Privacy Policy

Velier S.p.A. (hereinafter, for brevity, the “Company” or the “Controller”), as Data Controller, wishes to inform you, pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 on the protection of personal data (the “Regulation” or “GDPR”) and the applicable national legislation, that the personal data automatically collected or provided by you while navigating or interacting with the website www.velier.it (the “Website”) will be processed in compliance with the applicable legal provisions for the purposes and using the methods described below.

1. Data Controller and DPO – Identity and contact details

The Data controller is Velier S.p.A., with its registered office at Via V Maggio, 85 - 16147, Genoa, Italy, tax code and VAT number 00264080102, represented by its pro tempore legal representative.
The Company can be contacted at the following email address: privacy@velier.it.
The Company has appointed a Data Protection Officer (“DPO”), who can be contacted at the following address: dpo@velier.it.

2. Types of personal data processed

The Company mainly processes the following categories of personal data:

  1. identification and contact data (e.g., contact person’s first and last name, trade name, company name, VAT number, tax code, mobile phone number, address, postal code, city, province, email address);
  2. billing data (e.g., SDI code/PEC email);
  3. geolocation data (including “IP” address);
  4. internet browsing data collected through cookies installed on your computer or mobile device (for more information, please refer to the Cookie Policy);
  5. banking data necessary for managing the commercial relationship;
  6. data related to your interactions with our Website.

The Website does not contain information, functionalities or services directly offered to underage users; therefore, underage users are not permitted to provide any personal data, as the use of this site is not allowed for minors. In the event that the Company is informed that personal data has been provided by a minor, in the context of purchasing a product through the Website, the Company will promptly delete such data, reserving the right to prevent access to the services offered on the Website by any user who has concealed their minor status.
The voluntary sending of emails to the Company's contact addresses will result in the collection and processing of the sender’s email address as well as any additional personal data provided in the communication.

3. Purposes, legal basis for processing and nature of providing data

The following outlines the purposes of the processing of personal data as mentioned in the previous paragraph and their corresponding legal bases:

  • Account Registration via Website: the registration procedure, through the creation of an account, aims to allow navigation on the Velier Website as a "Registered User" and to access a range of services. In the event that you have requested a visit from the local agent, your personal data may be shared and processed by the Company’s commercial agents.
    The legal basis for this processing is the performance of pre-contractual measures to which the data subject is a party, pursuant to Art. 6.1, letter b) of the GDPR. The provision of data is optional.
  • Product Purchase: through our Website, you may purchase products as a registered user. Your personal data will be processed for the purpose of managing orders and payments, fulfilling the related administrative and accounting obligations and contacting you for any communications related to your purchases (e.g., information on the status of your orders).
    The legal bases for such processing are the performance of the contract to which the data subject is a party and the compliance with legal obligations to which the Data Controller is subject, pursuant to Arts. 6.1, letter b) and letter c) of the GDPR. The provision of data is necessary for the completion of the purchase.
  • Marketing: with your explicit consent, your personal data may be processed to send commercial communications, including via automated or electronic means, such as email, and to invite you to participate in our promotional initiatives or subscribe to our newsletter. The legal basis for such processing is the consent of the data subject, pursuant to Art. 6.1, letter a) of the GDPR, which can be withdrawn at any time.
  • Profiling: with your explicit consent, we may process your personal data for profiling purposes, i.e., to analyze or predict your preferences, potential habits, and consumption choices, in order to offer you personalized products, services, promotions, and commercial communications. The legal basis for such processing is the consent of the data subject, pursuant to Art. 6.1, letter a) of the GDPR, which can be withdrawn at any time. Profiling may also be carried out using first-party and third-party cookies. We therefore encourage you to read our Cookie Policy. This processing will be carried out provided that you give a specific and optional further consent.
  • Statistical analysis: personal data you provide during your navigation on the Velier Website may be stored in our databases in an anonymized form to analyze and improve the services offered, assess the effectiveness of activities and initiatives promoted by Velier. The legal basis for this processing is the legitimate interest of the Data Controller, pursuant to Art. 6.1, letter f) of the GDPR.

The provision of your personal data, depending on the purpose pursued, may be either optional or mandatory. When the provision is mandatory, failure to provide personal data may affect your ability to use certain services (e.g., to make a purchase, providing an address is necessary; failure to provide this information will prevent the completion of the purchase). When the provision is optional, you will still be able to use basic services, but not additional ones (for example, not giving consent to receive promotional communications will not affect the completion of a purchase, but will prevent you from being updated on our promotions and initiatives).
The mandatory or optional nature of the provision will be indicated from time to time using symbols (e.g., the asterisk "*") placed next to the information whose provision is mandatory to pursue the respective purpose.

4. Processing methods

Personal data will be processed by the Company and authorized parties using both electronic and manual systems, in accordance with the principles of fairness, lawfulness and transparency as set forth by the applicable data protection legislation. The confidentiality of the data subject and their rights will be safeguarded through the implementation of appropriate technical and organizational measures to ensure a level of security appropriate to the risk.

5. Recipients and transfer of Personal data

Your personal data may be communicated to authorized parties or third parties whom the Company engages for the provision of specific services. These parties act under the Company's instructions as Data Processors pursuant to Article 28 of the Regulation. A complete list of Data Processors pursuant to Article 28 of the Regulation is available from the Data Controller, who can be contacted at the details provided above.

By way of example, your personal data may be communicated to the following categories of recipients:

  • Third-party companies providing hosting services and infrastructure for the Website, maintenance of platforms and IT systems;
  • subjects, entities or authorities to whom it is mandatory to disclose your personal data, pursuant to legal provisions or orders from authorities.

Your personal data may also be communicated to other companies within the Velier Group, as necessary, for organizational purposes or for the legitimate interest of the Company.

Your personal data are not generally transferred to countries outside the European Union. However, where specific needs arise that require the transfer of data to countries outside the EU, including countries that do not provide adequate protection, the Company is committed to ensuring appropriate levels of protection and safeguards, including contractual safeguards in accordance with applicable laws, such as the use of standard contractual clauses. Further information is available from the Data Controller or the DPO by writing to the addresses provided above.

6. Duration of processing and retention of Personal Data

In order to ensure compliance with the principles of necessity and proportionality of processing, different retention periods for personal data have been identified, based on the specific purposes pursued:

  • Registration on the Website: personal data provided by you to register on the Website will be retained for the duration of your registration on the portal. In the event of inactivity for 36 months, your account will be deleted.
  • Purchase of Products: personal data provided by you for purchasing products on the Website will be retained for a period of time sufficient to ensure the correct execution of the contract and in any case for an additional 10 years to fulfill related administrative and tax obligations.
  • Marketing and Profiling: data collected for marketing purposes and for profiling purposes, for which you have given consent to processing, will be retained for a period not exceeding 24 months (marketing) and 12 months (profiling) or for such different period as may be indicated by the relevant supervisory authorities. Where you have not provided such consents, your personal data will be anonymized and used for statistical analysis purposes.

Once the retention periods mentioned above have expired, the provided data will be deleted or anonymized and, in any case, will be rendered unusable with respect to the purposes for which the corresponding retention periods have expired.

7. Rights of the Data Subject

The data subject may exercise at any time, with regard to the processing of personal data described herein, the rights provided by the Regulation (Articles 15-21 and 77), including:

  • the right to receive confirmation of the existence of his/her personal data and to access their content (right of access);
  • the right to update, modify, and/or correct his/her personal data (right of rectification);
  • the right to request the deletion or restriction of the processing of personal data processed in violation of the law, including data that is no longer necessary for the purposes for which it was collected or otherwise processed (right to be forgotten and right to restriction);
  • the right to object to the processing (right of objection);
  • the right to withdraw consent, where given, without prejudice to the lawfulness of processing based on consent before the withdrawal;
  • the right to receive a copy of his/her personal data in a structured, commonly used, and machine-readable format, and to request that such data be transmitted to another data controller (right to data portability).

To exercise these rights, the data subject may contact the Data Controller or the DPO at the above-mentioned contact details.

The data subject also has the right to file a complaint with the Italian Data Protection Authority in the event of a violation of data protection laws.