ONCO HAIR

INFORMATION FOR THE PROCESSING OF PERSONAL DATA (Article 13 of the EU Regulation no. 2016/679 on the protection of personal data)

ADVIHAIR S.R.L., VAT number 11495171008, with registered office in Via Benini n. 11 40069 Zola Predosa (BO), (hereinafter, "Owner"), as Data Controller, informs you pursuant to art. 13 EU Regulation no. 2016/679 (hereinafter,
"GDPR") that your personal data (communicated at the time of signing with which the relations deriving from the existing contract are maintained) will be processed in the manner and for the purposes indicated below.
According to the rules of the GDPR and Legislative Decree 196/2003 and subsequent amendments and additions (hereinafter "Privacy Code"), the treatments carried out by the Data Controller will be based on principles of correctness, lawfulness and
transparency and will be carried out
in compliance with the principles of relevance, completeness, non-excess and protection of confidentiality.

Object of the treatment

These data will be processed, also through the use of IT and telematic procedures, with the acquisition, even where necessary, of the image, in compliance with the aforementioned legislation and the confidentiality obligations therein.
expected. In particular, the personal data will be subject by the center to all individual processing operations - registration collection, organization, conservation, processing, modification, extraction, etc. and to any other operation.
useful for providing the requested services.

Purpose of processing and nature of the provision of data and consequences of refusing to respond

1. Personal data will be processed primarily exclusively for purposes strictly connected and instrumental to the fulfillment of the contractual obligations of which you are a part and constitute the legal basis of the processing pursuant to
of the art. 13, paragraph 1, letter c) of the GDPR. These purposes are in particular:

- conclude contracts for the services and products offered by the Data Controller;

- conclude contracts for the services and products offered by the Supplier;

- participate in the presentation / course / demonstration;

- fulfill the pre-contractual, contractual, administrative and fiscal obligations deriving from existing relationships with you (operational, organizational, managerial, fiscal, administrative, financial, insurance and accounting needs
relating to the contractual and / or pre-contractual relationship established);

- fulfill the obligations established by law, by a regulation, by community legislation or by an order of the Authority (such as in the field of anti-money laundering);

- exercise the rights of the owner, for example the right to defense in court.
The processing of such data will take place without the need for your express consent (Article 6 letter b), c) GDPR) and is mandatory. In the absence of this provision, we will not be able to guarantee the establishment and execution of
contractual relationships with the
Holder.

2. Personal data may be processed on a secondary basis, only with your specific and distinct consent (Article 7 of the GDPR) for the following purposes:

a) marketing: send you via e-mail, post and / or sms and / or telephone contacts, newsletters, commercial communications and / or advertising material on products or services offered by the Data Controller and detection of the degree of
satisfaction with the quality of
services.

b) Shooting and use of the portrait and the photographic and video image: use and publication of the portrait in photos and / or videos that will be shot, on the website of the Owner and on its social network pages. For this purpose the
Owner ensures the utmost respect for the rights relating to the honor and reputation of the data. The installation and use of the images are to be considered free of charge.
The provision of consent to the processing for marketing purposes and for the use of the portrait and the photographic and video image, for the purposes and with the methods illustrated above, are absolutely optional and optional (and in any case
revocable without formalities even after the performance) and failure to provide it will not cause any interference and / or consequence on the relationship. In any case, even where he has given his consent to authorize the Data Controller a
pursue all the aforementioned purposes, will remain free at any time to revoke it, by sending a registered letter with the request for "cancellation from the list" and / or "cancellation of images" to the address of the Owner
of data processing as identified below. Following receipt of this request, the Data Controller will promptly remove and delete the data from the databases used for the processing for the purposes of
Marketing and / or the use of portrait and photographic and video images. The simple receipt of the cancellation request will automatically be valid as confirmation of cancellation.

Processing methods

The processing will be carried out manually (eg collection of paper forms) and electronically or in any case with the aid of electronic, IT and telematic tools suitable for guaranteeing the security and confidentiality of the data.
compliance with the provisions of art. 32 of the GDPR and the Privacy Code. In carrying out the processing operations, all the technical, IT, organizational, logistical and procedural measures of
security, so that the minimum level of data protection required by law is guaranteed.

Duration of treatment

The Data Controller will process personal data for the time necessary to fulfill the aforementioned purposes and in any case for no more than 10 years from the termination of the relationship for the primary purposes and for no more than 2 years
from the end of the needs for
data processing for Marketing Purposes. The images will be kept without time limits and stored in the archives to have a historical memory of the events. however, a periodic check on the obsolescence of the data is guaranteed
stored in relation to the purposes for which they were collected.

Categories of subjects to whom the data may be communicated:

Your personal data may be disclosed to:

- employees of the Data Controller in their capacity as persons in charge and / or internal managers of the processing and / or system administrators;

- to freelancers (lawyers, consultants, etc.), administrative and tax consultants for the necessary legal obligations, companies that carry out outsourced activities on behalf of the Data Controller, in their capacity as external managers
of the treatment.

- to Supervisory Bodies, Judicial Authorities, to insurance companies for the provision of insurance services, as well as to those subjects to whom the communication is mandatory by law for the accomplishment of the aforementioned purposes.

- for defensive investigations or to assert or defend rights in court, provided that they are exclusively and strictly related to this purpose.

Data transfer

The Data Controller will not transfer your personal data to a third country or to an international organization.

Rights of the interested party

In your capacity as an interested party, you have the rights referred to in art. 15 GDPR and precisely the rights to obtain from the Data Controller confirmation that the processing of personal data concerning you is in progress and in this
case, of
obtain access to personal data and the following information: a) purpose of the processing; b) categories of personal data in question; c) the recipients or categories of recipients to whom the personal data have been or will be disclosed, in
particularly if they are recipients of third countries or international organizations; d) when possible, the retention period of the personal data envisaged or, if not possible, the criteria used to determine this period; e) right to
ask the Data Controller to rectify or delete personal data or limit the processing of personal data concerning you or to oppose their processing; f) the right to lodge a complaint with an authority of
check; g) if the data are not collected from the data subject, all available information on their origin; h) the existence of an automated decision-making process, including profiling and, at least in such cases, information
significant on the logic used, as well as the importance and expected consequences of this treatment for the data subject.
Where applicable, it also has the rights referred to in Articles. 16-21 GDPR (Right of rectification, right to be forgotten, right of limitation of treatment, right to data portability, right of opposition), as well as the right of complaint
to the Guarantor Authority following the procedures and indications published on the official website of the Authority on www.garanteprivacy.it or alternatively, the appeal before the judicial authority.

How to exercise rights

You can exercise your rights at any time by sending a registered letter to the Data Controller.

Holder of the treatment

The data controller of the personal data you provide is the company ADVIHAIR S.R.L., VAT number 11495171008, with registered office in Via Benini n. 11 40069 Zola Predosa (BO) in the person of its legal representative.

Articles 15 to 22 of the GDPR can be consulted at this link:
https://eur-lex.europa.eu/legal-content/IT/TXT/HTML/?uri=CELEX:32016R0679&from=IT

Consent for marketing purposes

I, the undersigned, consent to the processing and communication of my personal data to receive via e-mail, post and / or text message and / or telephone contacts, newsletters, commercial communications and / or advertising material on
products or
services offered by the Data Controller and detection of the degree of satisfaction with the quality of services.