Ver. 21/12/2023
Onebra SRL processes your data in compliance with EU Regulation 2016/679 on the protection of personal data (“GDPR”) and other applicable regulations. Please read the following information carefully. In the text below, the term “data subject” refers to you. The Data Controller is at your disposal for any clarification.
Origin of the data – Data subject
Data subjects – Individuals who purchase or intend to purchase the Controller’s products or services
Types of data processed – Personal and contact data, tax identification data, bank reference data (or other payment channels), data related to purchased products and their corresponding payments, data related to the data subject’s specific physical characteristics (non-biometric), health data (generic).
Purposes of processing – To sell the Controller’s products (or services) to the data subject, to produce and ship the goods purchased by the data subject, to manage payments and collections, to handle accounting and debt collection, to manage post-sales support, to comply with any legal obligation (in particular, of a tax and accounting nature).
Data Controller – Onebra SRL, Via del Brennero 97 – Trento, info@onebra.it
Joint Controller – Not present
Data Protection Officer (DPO) – Not appointed
Representative in the EU – Not appointed
Legal basis for processing – Art. 6(1)(b) GDPR (processing is necessary for the performance of a contract or pre-contractual measures), Art. 6(1)(c) GDPR (processing is necessary for compliance with a legal obligation), Art. 9(2)(a) GDPR (explicit consent of the data subject).
Legitimate interest – Not applied
Data retention period – 10 years (equal to the legal retention period for accounting records)
Potential recipients of the data – Accounting and tax consultants, technology service providers, manufacturing service providers (any recipients may only process the data in the interest of the Controller and for the purposes indicated above).
Transfer of data outside the EU – Data transfer to the following countries is foreseen: USA on the basis of an adequacy decision (Art. 45 GDPR).
Your rights – Your rights (available at the link below) can be exercised by contacting the Controller, the Representative, or the DPO by post or e-mail.
https://ec.europa.eu/info/law/law-topic/data-protection/reform/rights-citizens/my-rights/what-are-my-rights_en
Complaints – For any violation of your rights, you can file a complaint with the Garante per la Protezione dei Dati Personali in Rome (the Italian Data Protection Authority) or, alternatively, with the supervisory authority of the place where you are established within the EU.
Provision of data – Necessary: without the provision of the requested data, it will not be possible to sell the Controller’s products (or services).
Consent – Necessary: without consent to the processing of (generic) health data, it will not be possible for the Controller to sell the products (or services).
IMPORTANT NOTE: The Controller does not collect any specific data related to the customer’s health status. However, since the purchase of some of the Controller’s products may be indicative of the customer’s health status, the Controller, for the protection of the data subject, extends the protection required by law for special categories of data (“sensitive data”) to every order.