Information on the processing of personal data
DR Automobiles S.r.l. wishes to inform the Data Subject about the processing of personal data transmitted to the Company, as defined below, by filling in the following forms on the Company’s website www.sportequipe.it (hereinafter, the “Website”): “contact us”, “request a test drive”, “appointment at the dealership”.
The data collected through these forms may also be processed for sending promotional and commercial communications and for profiling the Interested Party, subject to the acquisition of his/her specific consent.
Personal data are processed, in compliance with the principles of protection of personal data established by the GDPR and national legislation, by means of paper, computer and telematic tools, with logics strictly related to the purposes indicated herein, so as to ensure the security and confidentiality of the data, in accordance with the principles established by the GDPR.
- Identity and Contact Details of the Data Controller
The Data Controller for the processing of personal data is DR Automobiles S.r.l. (the “Company” or the “Data Controller”), with registered office in Macchia di Isernia (IS), Zona Industriale di Macchia d’Isernia s.n.c., VAT and C.F. 00879050946.
The Data Subject may contact the Controller by registered mail with return receipt to be sent to the aforementioned registered office or by email at the following email address: privacy@drautomobiles.it.
- Categories of Interested. Categories of personal data processed.
Data Subjects are those who fill out the aforementioned forms on the Web Site.
The personal data being processed are: first name, last name, e-mail address, telephone number, ZIP code, as well as, where optionally given by the Data Subject, the license plate of the vehicle. With regard to the “request a test drive” form, data on the city of interest and the province are also processed.
Personal data are collected through direct provision by the Data Subject.
- Purpose and lawfulness of processing. Legal basis. Nature of the provision
Personal data collected are processed by the Owner for the following purposes:
a) to respond to requests made by the Data Subject through the aforementioned forms on the Company’s website, as well as to manage the related pre-contractual and/or contractual fulfilments; the legal basis for the processing is the execution of pre-contractual measures taken at the request of the Data Subject and, where applicable, the execution of a contract pursuant to Art. 6(1)(b) GDPR;
b) where the Interested Party has voluntarily indicated the license plate of his or her vehicle in the “contact” form, process this data to enable the identification of the vehicle for the purpose of handling the request for assistance or information submitted therein. The legal basis for processing is the performance of a contract to which the Data Subject is a party. The provision of the license plate is optional: its omission does not affect in any way the management of the request;
c) subject to the specific, free and optional consent of the Interested Party, send promotional and commercial communications by automated means (e-mail, SMS, instant messages and other electronic communication tools), or by traditional means (telephone calls with operator and paper mail); the legal basis is consent in accordance with Art. 6, par. 1, lett. a), GDPR.
d) subject to the specific, free and optional consent of the Data Subject, carry out profiling activities in order to personalize the Company’s commercial communications and offers; the legal basis is consent pursuant to Art. 6(1)(a) GDPR.
The provision of personal data for the purposes referred to in point a) is necessary in order to follow up on the requests made by the Interested Party through the forms on the website: failure to provide such data will make it impossible for the Data Controller to process the request.
The provision of the vehicle license plate for the purposes of (b) is optional: failure to provide it will only preclude activities that require vehicle identification, including the handling of service requests referring to a specific vehicle, without affecting the handling of other requests.
On the other hand, the provision of personal data for the purposes referred to in letter c) is optional and does not condition in any way the management of the requests referred to in letter a); failure to provide consent or its subsequent revocation does not affect the enjoyment of the services offered by the Owner.
The provision of personal data for the purposes of (d) is optional. Failure to provide consent to profiling does not affect the possibility of receiving general commercial communications under letter c), nor the handling of requests under letter a). Consent to profiling may be revoked at any time in the manner indicated in Section 8.
- Categories of Recipients of Personal Data
Personal data may be disclosed, to the extent strictly necessary to achieve the purposes stated in Section 3, to the following categories of recipients:
(i) authorized dealers and workshops operating in the Controller’s network, as autonomous data controllers;
(ii) DR Automobiles Group companies, to the extent that their involvement is necessary for the pursuit of the purposes set forth in Section 3, in their capacity as data controllers appointed pursuant to Article 28 GDPR;
(iii) provider of the hosting service for the Company’s website, as the data controller appointed under Article 28 GDPR.
Where processing for direct marketing purposes is carried out with the support of the aforementioned parties, it will be carried out exclusively within the limits of any consent given by the Data Subject.
Personal data are also processed by subjects authorized for processing by the Controller.
The personal data processed are not subject to dissemination.
- Extra-EEA transfers
Personal data are not transferred to third countries outside the European Economic Area (EEA).
- Personal Data Retention Period
Personal data processed are stored at the registered office of the Holder.
Personal data are retained for the period of time strictly necessary to fulfill the purposes for which they were collected, in accordance with the principle of storage limitation set forth in Article 5(1)(e) GDPR.
In particular, the data processed to follow up on the request of the Interested Party will be kept for the time necessary to process the request and, in any case, for a period not exceeding twelve (12) months from the date of closure of the file or from the last contact made with the Interested Party, unless their further retention is necessary to comply with legal obligations or to ascertain, exercise or defend a right in court. Any vehicle license plate conferred will be retained for the same period and deleted when the processing of the request to which it relates is completed.
If the Data Subject has consented to the processing for direct marketing purposes, the personal data will be retained for that purpose for a maximum period of twenty-four (24) months after the consent has been given, or until its revocation, whichever is earlier. At the end of this period, personal data will be deleted or anonymized, unless further retention is necessary to comply with legal obligations or to establish, exercise or defend a right in court.
If the Data Subject has given consent to profiling, the personal data processed for this purpose, including the profiles processed, will be retained for a maximum period of twenty-four (24) months from the provision of consent, or until its revocation, whichever is earlier. At the end of this period, personal data will be deleted or anonymized, unless their further retention is necessary to comply with legal obligations or to establish, exercise or defend a right in court.
- Automated Decision-Making
The Data Controller performs profiling activities for the purposes of Section 3(d) only with the consent of the Data Subject.
The Data Controller does not make decisions based solely on automated processing that produce legal effects concerning the Data Subject or similarly significantly affect the person of the Data Subject within the meaning of Article 22 GDPR. The profiling activity carried out by the Data Controller is therefore aimed exclusively at the personalization of commercial communications and does not produce legal effects or significantly affect the person of the Data Subject within the meaning of the aforementioned provision.
- Rights of the data subject
Pursuant to the GDPR, the Data Subject may, in the manner and terms provided therein, exercise the following rights:
- The right to obtain from the Data Controller confirmation as to whether or not personal data concerning the Data Subject are being processed and, if so, to obtain access to the personal data and information provided for in Article 15 GDPR and in particular those relating to the purposes of the processing, the categories of personal data concerned, the recipients or categories of recipients to whom the personal data have been or will be communicated, the period of storage, etc;
- Right to obtain, where inaccurate, the rectification of personal data concerning the Data Subject, as well as the integration of the same where deemed incomplete always in relation to the purposes of processing (Art. 16 GDPR);
- Right to erasure of data (“right to be forgotten”), where one of the cases referred to in Article 17 GDPR applies;
- Right to limitation of processing, in the cases provided for in Article 18 GDPR;
- Right to data portability under Article 20 GDPR;
- right to object to processing pursuant to Article 21. 21 of the GDPR and, in particular, the right to object at any time to the processing of personal data carried out for direct marketing purposes; in this case, personal data will no longer be processed for such purposes;
- The right to revoke at any time any consent given for direct marketing and/or profiling purposes, without affecting the lawfulness of the processing based on the consent before revocation. Revocation may be exercised by clicking on the appropriate unsubscribe link present in any marketing communication received, as well as through the contact methods indicated at the end of this Section, and will not entail additional charges for the Data Subject;
- right not to be subjected to a decision based solely on automated processing, including profiling, that produces legal effects affecting the Data Subject or similarly significantly affects the person of the Data Subject (Article 22 GDPR). As indicated in Section 7, the profiling activity carried out by the Data Controller is aimed exclusively at the personalization of commercial communications and does not produce legal effects or significantly affect the person of the Data Subject; therefore, the Data Controller does not make decisions attributable to Article 22 GDPR.
These rights may be exercised by request sent by registered mail with return receipt to the Controller at the registered office or by email to the email address: privacy@drautomobiles.it
The Data Subject also has the right to file a complaint with the Data Protection Authority or other Supervisory Authority pursuant to Article 77 of the GDPR.
- Data Protection Officer
The Data Protection Officer (DPO) is Eng. Carmine De Donato, who can be contacted through the following channels:
phone: 0865 4793,
e-mail address: dpo@drautomobiles.it,
Mail: DR Automobiles S.r.l., Zona Industriale di Macchia d’Isernia s.n.c., 86070 Macchia d’Isernia (IS).
- Changes to This Privacy Policy
The Controller reserves the right to modify and update this information over time.
