Privacy Policy

Privacy notice pursuant to Article 13 of EU Regulation 2016/679

Pursuant to Regulation (EU) 2016/679 (hereinafter the "Regulation"), this page describes how the personal data of users who visit the website www.mussini.com are processed.
This notice does not apply to other websites, pages or online services that may be reached through hypertext links published on the site but referring to resources outside the mussini.com domain.

1. DATA CONTROLLER

The data controller is Mussini sas di Alessandro Mussini & C., hereinafter referred to as MUSSINI SAS, represented by its Legal Representative, with registered office at Frazione Filia 92/1, 10081 Castellamonte (TO), Italy — P.IVA (VAT no.) 06628220011.
Contact details for data processing matters: info@mussinisas.it, certified email (PEC) certificata@pec.mussinisas.it.
The Company is not required to appoint a Data Protection Officer (DPO) under art. 37 of the Regulation and has not made such an appointment.

2. TYPES OF DATA PROCESSED

As a result of visiting the site, data relating to identified or identifiable natural persons may be processed.

2.1 Data provided by users

Within the website operated by the Company there are different options and ways for the user to contact it.

While the sending of data by the user is voluntary and optional, the user has various opportunities for interaction which cannot be established without the collection of personal data.

Below is an up-to-date list of the various means of contact provided by the site:

Contact by telephone: the user may contact the Company at the telephone numbers shown on the site; establishing contact may involve providing the personal data needed to handle the request;
Contact by email: the site allows the user to submit requests on a wide range of items through the email contacts, reachable via direct links, within the web page. In this way the Company collects the user’s email address and, where they are contained in the text of the correspondence, further personal data;

Purchase on the site: in order to fulfil an order the Company processes identification, contact, billing and shipping data. Payment data are processed directly by the payment service providers and are not stored by the Company;
Newsletter subscription: the user may voluntarily provide their email address in order to receive commercial communications, which may be withdrawn at any time;
Reviews: after a purchase the user may be invited to leave a review; the data provided on that occasion are processed in order to publish the review;

Contact through social networks: the website contains direct links to the social media pages managed by the Company (Instagram and Facebook); by using the social pages the user may contact the Company for various purposes, including the possibility of posting comments or reactions on them.
Social interaction involves the collection of personal data voluntarily provided by users;

2.2 Browsing data

The computer systems and software procedures used to operate this site acquire, in the course of their normal operation, certain personal data whose transmission is implicit in the use of internet communication protocols.

This category of data includes the IP addresses or domain names of the computers and terminals used by users, the URI/URL addresses of the resources requested, the time of the request, the method used to submit the request to the server, the size of the file obtained in response, the numerical code indicating the status of the response given by the server (successful, error, etc.) and other parameters relating to the user’s operating system and computer environment.

Such data, which are necessary in order to use the web services, are processed for the purpose of:

obtaining statistical information on the use of the services (most visited pages, number of visitors by time slot or by day, geographical areas of origin, etc.);
checking that they work correctly and improving Users’ browsing experience.
This information could also be used to establish liability in the event of hypothetical computer crimes against the Site.

Browsing data are deleted immediately after processing (save for any need for crimes to be investigated by the Judicial Authority).

2.3 Information collected through cookies

The site uses web tracking systems such as cookies. These are computer records of information transmitted by a web server to the user’s computer so that the computer can be identified on future visits to the same website. These tools help to facilitate the analysis of web traffic, allow the site to operate correctly and enable web applications to send information to individual users.

On first access to the site a banner is shown that makes it possible to accept or refuse non-necessary cookies, broken down by purpose (statistics and marketing). Technical cookies, which are essential for the operation of the site and of the cart, are always active. The user may change their choices at any time by recalling the preferences banner from the same page.

3. PURPOSES OF THE PROCESSING

MUSSINI SAS processes users’ personal data solely for the following purposes:

a) management of orders and of the customer relationship: conclusion and performance of sales contracts, shipping, invoicing, customer service, handling of returns and warranty claims, replies to requests for information;
b) marketing communications: sending the newsletter and information about new products, promotions and initiatives of MUSSINI SAS, by email;
c) publication of photos of customer-painted models: publication on the website and on the social media pages of MUSSINI SAS of photographs of Mussini models painted by customers, possibly accompanied by the painter’s name or nickname;
d) compliance with legal obligations, in particular accounting and tax obligations, and, where necessary, the establishment, exercise or defence of legal claims.

MUSSINI SAS does not transfer or sell personal data to third parties for their own marketing purposes and does not carry out profiling.

4. METHODS OF PROCESSING

Personal data will be processed in full compliance with the principles of confidentiality, fairness, necessity, relevance, lawfulness and transparency required by the GDPR.

Personal data will be processed by automated means (e.g. using electronic procedures and media) and/or manually (e.g. on paper), in accordance with the legal provisions in force. Appropriate security measures will be observed to prevent the loss of personal data, unlawful or incorrect use of the data or unauthorised access.

5. LEGAL BASIS AND NATURE OF PROVIDING THE DATA

Purpose a) – The legal basis is the performance of a contract and of pre-contractual steps taken at the data subject’s request (Art. 6(1)(b) of the Regulation). Providing the data is necessary: without it the order cannot be fulfilled or the request answered.

Purpose b) – The legal basis is the data subject’s consent (Art. 6(1)(a)). Providing the data is optional and refusing consent does not prevent purchases. Consent may be withdrawn at any time, including via the unsubscribe link in every communication.

Purpose c) – The legal basis is the data subject’s consent (Art. 6(1)(a)), requested each time for each photo and always obtained in writing, by email. Where the request is made in person, at fairs and events, consent is confirmed in writing before publication. Providing the data is optional. Consent may be withdrawn at any time by writing to info@mussinisas.it: the photo will be removed from the website and from the social media pages managed by MUSSINI SAS, although withdrawal has no effect on copies that third parties may already have shared on social networks.

Purpose d) – The legal basis is compliance with a legal obligation to which MUSSINI SAS is subject (Art. 6(1)(c)) and its legitimate interest in protecting its rights (Art. 6(1)(f)).

6. RECIPIENTS OF THE DATA

Personal data may be accessed by MUSSINI SAS staff authorised to process it, within the limits of their duties.

It may also be processed, solely on behalf of MUSSINI SAS and to the extent necessary, by the providers of the services used to run the shop, acting as data processors: the e-commerce platform, email and review-collection services, and the accounting and tax adviser. Payment service providers and the couriers entrusted with shipments process the data they need as independent controllers.

Data is not transferred to third parties for marketing purposes. The only information made public is the photos of models painted by customers, with the painter’s name or nickname where given, and only with their consent (purpose c).

An up-to-date list of data processors can be requested by writing to info@mussinisas.it.

6-bis. TRANSFER OF DATA OUTSIDE THE EUROPEAN UNION

The site is built on the Shopify platform and some of the suppliers used by the Company to manage the shop, commercial communications and reviews are based outside the European Economic Area. Where this involves a transfer of personal data to third countries, the transfer takes place on the basis of an adequacy decision of the European Commission or of the standard contractual clauses approved by it. An up-to-date list of the suppliers and of the safeguards adopted may be requested by writing to info@mussinisas.it.

7. DATA RETENTION

The data you provide will be processed for the entire duration of the contractual relationship in place and thereafter retained solely for the period required to fulfil legal obligations, unless it proves necessary to retain them further in order to defend or assert a right or to comply with any further legal obligations or orders of the Authorities.

In particular: data relating to orders and invoicing are retained for ten years from the conclusion of the contract, in accordance with civil law and tax obligations; data processed for marketing purposes are retained until consent is withdrawn and in any case for no longer than twenty-four months from the last contact; browsing data are deleted immediately after processing, save where crimes need to be investigated by the Judicial Authority.

Photos of models painted by customers remain published until the painter withdraws their consent.

8. THE RIGHTS OF DATA SUBJECTS

In relation to the processing of your personal data, you have the right to ask MUSSINI SAS for:

access: you may ask for confirmation as to whether or not data concerning you are being processed, as well as for further clarification about the information set out in this Privacy Notice, and to receive the data themselves, within the limits of reasonableness;
rectification: you may ask to have the data you have provided to us, or that are otherwise in our possession, corrected or supplemented, if they are inaccurate;
erasure: you may ask for your data to be erased, where they are no longer necessary for our purposes or where there are no pending claims or disputes, in the event of withdrawal of consent or of your objection to the processing, in the event of unlawful processing, or where there is a legal obligation to erase them;
restriction: you may ask for the processing of your personal data to be restricted, where one of the conditions set out in art. 18 of the GDPR applies; in that case, your data will not be processed, except for storage, without your consent, save as set out in paragraph 2 of that same article.
objection: you may object at any time to the processing of your data based on a legitimate interest of ours, unless we have legitimate grounds for the processing which override yours, for example for the exercise or defence of legal claims; your objection will always and in any case prevail over our legitimate interest in processing your data for marketing purposes;
portability: you may ask to receive your data, or to have them transmitted to another controller indicated by you, in a structured, commonly used and machine-readable format.
Furthermore, pursuant to art. 7(3) of the GDPR, we inform you that you may exercise your right to withdraw consent at any time, without affecting the lawfulness of the processing based on the consent given previously.

We also inform you that you have the right to lodge a complaint with the Supervisory Authority, which in Italy is the Garante per la Protezione dei Dati Personali (the Italian Data Protection Authority).

To exercise your rights, or for questions or information about the processing of your data and the security measures adopted, you may in any case contact our Company by making a request in the following ways:

registered letter with return receipt to the address: MUSSINI SAS - Frazione Filia 92/1 10081 Castellamonte TO
communication by certified email (PEC) to the address: certificata@pec.mussinisas.it