PRIVACY NOTICE PURSUANT TO ARTICLE 13 OF EU REGULATION NO. 2016/679
MRR Bullets srl (VAT No.: 04140440985) (hereinafter “MRR”), with registered office at Via Alessandro Volta 92, 25063 Gardone Val Trompia (BS) — Italy, in its capacity as Data Controller pursuant to Articles 4(7) and 24 of EU Regulation No. 2016/679 (GDPR), hereby informs you that, in accordance with Article 13 of the GDPR, your personal data described in Article 1 below will be processed for the purposes of processing described in Article 2 below.
1. Categories of personal data subject to processing.
1.1. MRR collects and processes, for the purpose of pursuing the processing purpose described in Article 2, your personal data pursuant to Article 4(1) of the GDPR, namely so-called identifying data (e.g. first name; surname; email address; telephone number; town), through one or more features available on the MRR website (hereinafter the “Website”).
2. Purposes of processing and legal basis
2.1. Your personal data is processed by MRR for the following purpose: to fulfil your request for contact and/or further information, made via one or more features on the Site. In accordance with Article 13(2)(e) of the GDPR, MRR hereby states that any failure to provide (even partially) your personal data via one or more features you have selected on the Site may make it impossible for MRR to fulfil the processing purpose in question.
3. Retention period
3.1. In accordance with Article 13(2)(a) of the GDPR, MRR hereby informs you of the following retention period, at the end of which your personal data will be deleted, destroyed or anonymised: (i) for the purposes of processing referred to in Article 2.1. point (a): 5 years, commencing upon the full and complete fulfilment of your request for contact and/or further information; this period may be extended in order to comply with regulatory obligations (including those arising subsequently) or to assert or defend a right, including in court proceedings.
4. Recipients
4.1. In accordance with Article 13(1)(e) of the GDPR, MRR informs you that your personal data may be disclosed, where appropriate and necessary, to one or more recipients pursuant to Article 4(9) of the GDPR, generally identified by category as follows: (i) for the purposes of processing referred to in Article 2.1. point (a): persons authorised under Articles 4(10), 29 and 32(4) of the GDPR to process data on behalf of MRR; subsidiaries or otherwise affiliated companies, including indirectly, of MRR; consultants or firms of various kinds that provide services and/or perform tasks (including professional services) connected, even indirectly, to the fulfilment of the purpose in question. Finally, MRR specifies that your personal data will not be disclosed to any third parties.
5. Transfer.
5.1. MRR wishes to inform you that your personal data is stored in automated, partially automated or non-automated files belonging to, or otherwise attributable to, MRR – even indirectly – and located within the European Economic Area (EEA).
6. Rights of the data subject.
6.1. In relation to your personal data, MRR informs you of your right to exercise the following rights, which may be subject to the restrictions set out in Articles 2-undecies and 2-duodecies of the Privacy Code: right of access pursuant to Article 15 of the GDPR:
- the right to obtain confirmation as to whether or not personal data is being processed, as well as the information referred to in Article 15 of the GDPR (e.g. purposes of processing, retention period);
- right to rectification pursuant to Article 16 of the GDPR: the right to correct, update or supplement personal data; right to erasure pursuant to Article 17 of the GDPR: the right to obtain the erasure, destruction or anonymisation of personal data, provided that the conditions set out in that Article are met;
- right to restriction of processing pursuant to Article 18 of the GDPR: a right of a distinctly precautionary nature, aimed at obtaining the restriction of processing where the circumstances governed by Article 18 apply;
- the right to data portability pursuant to Article 20 of the GDPR: the right to receive personal data provided to the data controller in a structured, commonly used and machine-readable format (and, where requested, to have it transmitted directly to another data controller), provided that the specific conditions set out in that Article are met (e.g. legal basis of consent and/or performance of a contract; personal data provided by the data subject);
- right to object under Article 21 of the GDPR: the right to obtain the permanent cessation of a specific processing operation involving personal data; right to lodge a complaint with the Supervisory Authority (i.e. the Italian Data Protection Authority) under Article 77 of the GDPR: the right to lodge a complaint where it is considered that the processing under review infringes national and EU legislation on the protection of personal data.
6.2. In addition to the rights described in Article 6.1 above, the Data Controller wishes to inform you that, in relation to your personal data, you have the right, where possible and appropriate, to exercise, on the one hand, the (sub)right provided for in Article 19 of the GDPR (“ The Data Controller shall inform each recipient to whom the personal data have been disclosed of any rectification, erasure or restriction of processing carried out in accordance with Article 16, Article 17(1) and Article 18, unless this proves impossible or involves a disproportionate effort. The controller shall inform the data subject of such recipients if the data subject so requests”), to be considered connected and linked to the exercise of one or more rights regulated by Articles 16, 17 and 18 of the GDPR; on the other hand, the Data Controller informs you that, in relation to your personal data, you have the right, where possible and relevant, to exercise the right provided for in Article 22(1) of the GDPR (“ The data subject shall have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her”), subject to the exceptions provided for in paragraph 2 below.
6.3. In accordance with Article 12(1) of the GDPR, MRR undertakes to provide the information referred to in Articles 15 to 22 and 34 of the GDPR in a concise, transparent, intelligible and easily accessible form, using clear and plain language: such information shall be provided in writing or by other means, including electronic means, or, at the request of the data subject, orally, provided that the identity of the data subject is verified by other means.
6.4. In accordance with Article 12(3) of the GDPR, MRR informs you that it undertakes to provide information regarding the action taken in response to a request pursuant to Articles 15 to 22 of the GDPR without undue delay and, in any event, no later than one month from receipt of the request; this period may be extended by two months if necessary, taking into account the complexity and number of requests (in which case, MRR undertakes to inform you of such an extension and the reasons for the delay within one month of receiving the request).
6.5. The rights described above (with the exception of the right under Article 77 of the GDPR) may be exercised using the contact details set out in Article 7 below.
7. Contact details
7.1. MRR can be contacted at the following address: info@mrrbullets.com