Privacy Contact

Privacy Policy – Contact Us / Ticket

Preamble

Pursuant to Art. 13 of Regulation (EU) 2016/679 (hereinafter, also "GDPR"), Ridewill S.r.l., as the data controller (hereinafter also referred to as the "Controller" or "Ridewill"), informs the data subjects about the use of personal data in relation to requests sent by customers through the "Contact" section of the company website, concerning general/technical information, purchase requests, returns/right of withdrawal regarding products/services offered by Ridewill.

1. Data Controller and Data Protection Officer (DPO)

Pursuant to Art. 4(7) of the GDPR, the data controller is Ridewill, located at Via Socrate 6 – 22070 Casnate con Bernate (Co), Italy. Tel.: +39.031.5476941, E-mail: info@ridewill.it PEC: ridewill@pec.it

The Data Protection Officer (DPO) of Ridewill can be contacted at dpo@trustds.it PEC: dpotrustds@legalmail.it

2. Purpose of processing, personal data processed, legal basis, data retention period, and nature of data provision

Purpose A): Management of general information requests received from customers or potential customers ("Other/General Information" option in the contact form)

• Personal data processed: First and last name, e-mail, phone/mobile number (optional), message content, and any documents attached to the request;
• Legal basis: Processing is carried out based on the data subject’s freely given and explicit consent (Art. 6(1)(a) GDPR);
• Data retention period: The Controller may retain the data for the time necessary to send the requested information, without prejudice to any additional retention period arising from subsequent contractual relationships with Ridewill;
• Nature of provision: Providing the requested data is optional, but failure to do so prevents the Controller from responding to the data subject.

Purpose B): Management of account deletion requests sent by registered users of the Ridewill website ("Other/Account Deletion Request" option in the contact form)

• Personal data processed: First and last name, e-mail, phone/mobile number (optional), message content, and any documents attached to the request;
• Legal basis: Processing is carried out based on a legal obligation (Art. 6(1)(c) GDPR), given the data subject’s right to delete their account (Art. 17 GDPR). The phone number is processed based on the data subject’s consent, which may be withdrawn at any time;
• Data retention period: The Controller may retain the data for the time necessary to fulfil the request, without prejudice to any additional retention required by law;
• Nature of provision: Providing the requested data is mandatory in order to process the account deletion.

Purpose C): Management of technical information requests from customers/potential customers concerning Ridewill products and services ("Technical Info" option in the contact form)

• Personal data processed: First and last name, e-mail, phone/mobile number (optional), message content, and any documents attached to the request;
• Legal basis: Processing is carried out to take pre-contractual measures (Art. 6(1)(b) GDPR), where the request relates to a potential purchase of a Ridewill product/service. The phone/mobile number is processed based on consent, which may be withdrawn at any time;
• Data retention period: The Controller may retain the data for the time necessary to fulfil the request, without prejudice to any further retention resulting from subsequent contractual relationships with Ridewill;
• Nature of provision: Providing the requested data is mandatory to receive the requested technical information.

Purpose D): Management of customer requests regarding purchase orders placed on Ridewill’s website ("Orders" option in the contact form)

• Personal data processed: First and last name, e-mail, phone/mobile number (optional), message content, and any documents attached to the request;
• Legal basis: Processing is carried out for the performance of a contract (Art. 6(1)(b) GDPR) following a purchase order made by the customer. The phone/mobile number is processed based on consent, which may be withdrawn at any time;
• Data retention period: The Controller may retain the data for the time necessary to handle the request, without prejudice to additional retention periods required by law;
• Nature of provision: Providing the requested data is mandatory to handle the data subject’s request.

Purpose E): Management of product return requests from customers due to product defects ("Defective Product?" option)

• Personal data processed: First and last name, e-mail, phone/mobile number (optional), message content, and any documents attached to the request;
• Legal basis: Processing is carried out for the performance of a contract (Art. 6(1)(b) GDPR) resulting from the customer’s purchase order. The phone/mobile number is processed based on consent, which may be withdrawn at any time;
• Data retention period: The Controller retains the data for the time necessary to process the return request, without prejudice to additional retention periods required by law;
• Nature of provision: Providing the requested data is mandatory to execute the product return under the purchase contract.

Purpose F): Management of withdrawal requests ("Easy Return/Withdrawal" option) submitted by customers under the Consumer Code (Legislative Decree No. 206/2005)

• Personal data processed: First and last name, e-mail, phone/mobile number (optional), message content, and any documents attached to the request;
• Legal basis: Processing is carried out for the performance of a contract (Art. 6(1)(b) GDPR) and to comply with a legal obligation (Art. 6(1)(c) GDPR) under Art. 52 et seq. of Legislative Decree No. 206/2005 (consumer right of withdrawal). The phone/mobile number is processed based on consent, which may be withdrawn at any time;
• Data retention period: The Controller may retain the data for the time necessary to process the withdrawal request, without prejudice to additional retention periods required by law;
• Nature of provision: Providing the requested data is mandatory to carry out the withdrawal process.

3. Methods of processing and recipients of data

The personal data collected are processed for the purpose of responding to the above-mentioned requests and in compliance with the principles set out in Art. 5 of the GDPR.

Processing is carried out by individuals authorized by the Controller, for the purposes described above. Authorized persons are bound by professional confidentiality. Data processing may also be carried out with the collaboration of other entities appointed as data processors, who process data in accordance with the purposes and means defined by the Controller under Art. 28 of the GDPR. Further information may be requested from the Controller.

Processing is conducted in compliance with fundamental rights and freedoms and the principles of fairness, lawfulness, and transparency as set forth in Art. 5 of the GDPR. The Controller ensures the relevance and proportionality of processed information with respect to the pursued purposes.

4. Data transfer outside the European Economic Area (EEA)

The personal data processed for the above purposes are generally not transferred to third countries outside the European Union or the European Economic Area (EEA), nor to international organizations. If data must be transferred outside the EEA, the Controller undertakes to comply with Chapter V of the GDPR to ensure adequate data protection.

Further information may be requested from the Controller and/or the DPO.

5. Rights of data subjects

Data subjects – meaning natural persons whose data are processed – may exercise the rights provided for in Articles 15 et seq. of the GDPR, in particular: the right to access their personal data, to request rectification, restriction, or deletion where applicable, as well as the right to object to processing and the right to data portability. Where processing is based on consent, data subjects also have the right to withdraw consent at any time without affecting the lawfulness of processing carried out before such withdrawal.

To exercise their rights, data subjects may contact the Controller or the Data Protection Officer using the contact details provided in this notice.

If data subjects believe that the processing of personal data by the Controller violates the GDPR, they have the right to lodge a complaint with a supervisory authority in the Member State of their habitual residence or workplace, or where the alleged infringement occurred (Art. 77 GDPR). The Italian supervisory authority is the Garante per la protezione dei dati personali, whose contact details are available on its website (www.garanteprivacy.it).

Pursuant to Art. 79 of the GDPR, data subjects also have the right to seek judicial remedy if they believe their rights have been violated as a result of data processing.

6. Changes to this Privacy Policy

The Controller may modify, add, or remove any part of this Privacy Policy. To facilitate verification of any changes, the Policy includes the date of the last update.