PRIVACY POLICY – WEBSITE

Information document pursuant to and for the purposes of Article 13 of Regulation (EU) 2016/679 (GDPR)

WHY THIS INFORMATION?

Pursuant to Regulation (EU) 2016/679 (hereinafter "GDPR"), this page describes how personal data is processed. This is information provided pursuant to Article 13 GDPR. This information should not be considered valid for other third-party websites that may be accessed through links on this website, for which we assume no responsibility.

Personal data that can be processed

  • Personal data: any information relating to an identified or identifiable natural person («data subject»); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person (C26, C27, C30 GDPR).
  • Data of contractors/users.
  • Browsing data: the computer systems and software procedures used to operate this site acquire, during their normal operation, some personal data whose transmission is implicit in the use of Internet communication protocols. This category of data includes IP addresses or domain names of computers and terminals used by users, addresses in URI/URL (Uniform Resource Identifier/Locator) notation of requested resources, the time of the request, the method used to submit the request to the server, the size of the file obtained in response, the numerical code indicating the status of the response given by the server (successful, error, etc.) and other parameters relating to the user's operating system and computer environment.
  • Data communicated voluntarily: the optional, explicit and voluntary sending of messages to the contact addresses indicated on this site and/or the completion of data collection forms involves the subsequent acquisition of the sender's address, necessary to respond to requests, as well as any other personal data entered.

Information regarding the processing of personal data carried out through Social Media platforms

Regarding the processing of personal data carried out by the operators of Social Media platforms used by the Data Controller, reference is made to the information provided by them through their respective privacy policies. The Data Controller processes personal data provided by users through the dedicated Social Media platform pages, to manage interactions with users (comments, public posts, etc.) and in compliance with current regulations.

Specific information

Specific information may be present on the Site pages in relation to particular services or data processing provided.

COOKIES AND OTHER TRACKING SYSTEMS. WHAT ARE THEY? WHAT ARE THEY FOR?

For Cookies and other tracking systems, please see the cookies policy reported in the site footer and at the following link.

1. WHO IS THE DATA CONTROLLER? HOW TO CONTACT THEM?

The Data Controller is Krea Allestimenti srl, with registered office at Via XXIV Maggio, 9, 22063 Cantù (CO), in the person of its pro-tempore Legal Representative, who can be contacted for any information via:

2. PURPOSE OF PROCESSING, LEGAL BASIS, DATA RETENTION PERIOD, NATURE OF DATA PROVISION

PURPOSE OF PROCESSING LEGAL BASIS DATA RETENTION PERIOD NATURE OF DATA PROVISION
Browsing on this website.

The data necessary for the use of web services is also processed for the purpose of:
  • obtaining statistical information on the use of services (most visited pages, number of visitors by time slot or daily, geographical areas of origin, etc.);
  • checking the correct functioning of the services offered.
The data will be used to ascertain liability in case of hypothetical computer crimes against the site. 		Processing is necessary for the pursuit of the legitimate interest of the data controller or third parties, provided that the interests or fundamental rights and freedoms of the data subject requiring the protection of personal data do not prevail, taking into account the reasonable expectations of the data subject and the activities strictly necessary for the operation of the site and browsing itself.

(Art. 6, par. 1 lett. f and C47 of GDPR)

Data subjects are guaranteed the possibility of obtaining, upon request, information on the balancing test carried out. 		Browsing data will be retained for the duration of the browsing session. In any case, they will not persist for more than seven days (except for any need to ascertain crimes by the Judicial Authority). Data provision is necessary for browsing the website.
Use of cookies and equivalent technologies.

See the cookies policy in the site footer. 		For non-technical necessary cookies and equivalent technologies, processing is based on consent to the processing of personal data (art. 6 par. 1 lett. a and C42, C43 of GDPR).

Consent is given through the banner and the site's cookie policy. 		See the cookies policy in the site footer. See the cookies policy in the site footer.

In addition to browsing, personal data will be processed for:

PURPOSE OF PROCESSING LEGAL BASIS DATA RETENTION PERIOD NATURE OF DATA PROVISION
A) CONTACTS, sending contact requests, information, quotations. Processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract (C44).

Art. 6 par. 1 lett. b) of GDPR. 		Maximum 12 months. Data provision is necessary.

Failure to provide the necessary data will result in the impossibility of being contacted and receiving information.
B) DIRECT MARKETING, for sending advertising or direct sales material or for carrying out market research, commercial and promotional communications, newsletters, through automated means (electronic mail).

The Data Controller, to compare and possibly improve the results of automated communications, uses systems with reports. Thanks to the reports, the Data Controller will be able to know, for example: the number of readers, opens, unique "clickers" and "clicks"; the devices and operating systems used to read the communication; the detail on the activity of individual users; the detail of sent emails, delivered and undelivered emails, forwarded emails. All this data is used for the purpose of comparing and possibly improving the results of communications. 		Processing is based on consent to the processing of personal data (C42, C43).

art. 6 par. 1 lett. a) of GDPR. 		Until consent is revoked (or opt-out). Data provision is optional.

Failure to provide the necessary data will result in the impossibility of receiving direct marketing communications.
C) MANAGEMENT OF YOUR REQUESTS and requests from other data subjects, pursuant to Articles 15 et seq. of GDPR (data subject rights). Processing is necessary for compliance with a legal obligation to which the data controller is subject (C45).

Art. 6 par. 1 lett. c) of GDPR. 		5 years from closure of the request, except for litigation. The provision of personal data is mandatory, as it is essential to be able to fulfill legal obligations.

3. TO WHOM WILL PERSONAL DATA BE COMMUNICATED? DATA RECIPIENTS

Personal data will be communicated to subjects who will process the data as independent Data Controllers, or Data Processors (art. 28 GDPR) and processed by natural persons (art. 29 GDPR) who act under the authority of the Data Controller and the Data Processors on the basis of specific instructions provided regarding the purposes and methods of processing. Data will be communicated to recipients belonging to the following categories:

  • Subjects providing services for the website and communication networks, including electronic mail, hosting and website management;
  • For direct marketing, subject to consent, to subjects for the management of direct marketing activities;
  • Competent authorities for compliance with legal obligations and/or provisions of public bodies, upon request.

The list of Data Processors art. 28 is available by writing to info@kreallestimenti.it or to the other contact details indicated above.

4. WILL DATA BE TRANSFERRED TO NON-EEA COUNTRIES?

Data will be transferred to Extra EEA Countries, in particular it is specified that they will be transferred on the basis of Article 45 GDPR (adequacy decision). In fact, the Data Controller uses suppliers that adhere to the EU-USA Data Privacy Framework, specifically Google LLC. Furthermore, the transfer of data outside EEA Countries through social platforms will be managed according to what is established in the general conditions and privacy policy of the relevant social networks. To receive further information regarding the transfer of data outside the EEA, it is possible to contact the Data Controller at the contact details indicated above.

5. IS THERE AN AUTOMATED PROCESS?

Personal data will be subject to traditional manual, electronic and automated processing. It is specified that fully automated decision-making processes are not carried out.

6. WHAT ARE YOUR RIGHTS? HOW CAN YOU EXERCISE THEM?

Data subjects can assert their rights as expressed in Articles 15 et seq. GDPR, by contacting the Data Controller at the email address: info@kreallestimenti.it, or by writing to the contact details indicated above.

The data controller guarantees data subjects the possibility to request, at any time, access to their personal data (art. 15), rectification (art. 16), erasure thereof (art. 17), restriction of processing (art. 18). The data controller communicates (art. 19), to each of the recipients to whom the personal data have been transmitted, any rectifications or erasures or restrictions on processing carried out. The data controller communicates to data subjects who request it such recipients. The data controller guarantees the right to portability (art. 20) and, in case of requests pursuant to art. 20, will provide data subjects with the data in a structured, commonly used and machine-readable format. Data subjects are recognized the right to object (art. 21), at any time, to the processing of data based on legitimate interest by writing to the contact details indicated above with the subject "objection". In case of exercising the right to object to processing based on legitimate interest, the data controller recognizes data subjects the possibility to obtain, upon request, information on the balancing test carried out. Data subjects are recognized the right to withdraw consent given, without prejudice to the lawfulness of processing based on consent given before withdrawal. To no longer receive automated direct marketing communications (electronic mail), data subjects are invited to write an email to the address info@kreallestimenti.it with the subject "unsubscribe from automated" or to use our automatic unsubscribe systems provided for emails only (opt-out). If data subjects believe that the processing of personal data carried out by the Data Controller occurs in violation of the provisions of Regulation (EU) 2016/679, they are free to lodge a complaint with the national supervisory authority, in particular in the Member State where they habitually reside or work, or in the place where the alleged infringement of the Regulation occurred (Privacy Authority https://www.garanteprivacy.it/), or to have recourse to the appropriate judicial authorities.

7. AMENDMENTS TO THE PRIVACY POLICY

The data controller may change, modify, add or remove any part of this Privacy Policy. In order to facilitate the verification of any changes, the information will contain an indication of the date of update of the information itself.

Last updated: 20/01/2026