PRIVACY POLICY in accordance with EU Regulation 2016/679 ("GDPR")

1.INTRODUCTION

The company Cantiere Nautico Cranchi S.p.A. - Via Nazionale, 1319 - 23010 Piantedo (Italy) hereinafter referred to as the "data controller"), has always considered of primary importance the protection of the personal data of its customers and users, to whom it ensures the processing of personal data in full compliance with the protections and rights recognized by the EU Regulation 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (hereinafter also referred to only as the "Regulations") and in general by the entire legislation on the protection of personal data.

In Art. 4 point 1) of the Regulations we find the definition of "personal data" as "any information relating to an identified or identifiable natural person; an identifiable person is considered to be any natural person who can be identified, directly or indirectly, by reference in particular to an identifier such as a name, an identification number, location data, an online identifier, or to one or more characteristic elements of his or her physical, physiological, genetic, mental, economic, cultural or social identity" (hereinafter referred to as "Personal Data"). And therefore, the data controller, in pursuit of its business purposes, may become aware of or request Personal Data from you, such as your first and last name, your e-mail address, your telephone and postal contact information, your Tax Identification Number or VAT number, your date of birth, and other identifying information about you.

The Regulations provide for the issuance, prior to the processing of Personal Data - by which term is to be understood, according to the relevant definition in Art. 4 under 2) of the Regulation, "any operation or set of operations, performed with or without the help of automated processes and applied to personal data or sets of personal data, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, communication by transmission dissemination or any other form of making available, comparison or interconnection, restriction, deletion or destruction" (hereinafter the "Processing") - adequate information to the person to whom such Personal Data belong about the purposes of the Processing, the manner in which the Processing will be conducted as well as in relation to as much other information as is required by law.

In this regard, the contents of this notice are intended to provide you, in a simple and intuitive manner, as much information as possible to supplement the information contained in the specific privacy notices rendered in accordance with Article 13 of the Regulations at the time of the provision and collection of your Personal Data.

This Information Notice, therefore, has been prepared, on the basis of the principle of transparency, precisely to provide all the elements required by Articles 13 and 14 of the Regulations, and, in deference to a principle of absolute ease of consultation, is divided into individual sections (hereinafter "Sections" and individually "Section"), each of which deals with a specific topic so as to make it quicker, easier and more intuitive for you to read (hereafter, the contents of this Internet page will be referred to jointly and briefly as "Information Notice").

The purpose of this privacy policy (hereinafter "Privacy Policy") is to describe the management methods - as regards the processing of personal data of users/visitors under the Regulations (hereinafter only "Users") - of the websites and Apps of the data controller, which are listed below:

https://www.cranchi.com/

The data controller, in compliance with privacy regulations and according to the guidelines described in the Privacy Policy, intends to ensure the protection and security in the processing of personal data of each User of the Internet Sites, which include Cookies, usage data, e-mail addresses, first and last name, telephone number, and home/residence addresses.

In any case, even in the absence of a specific Privacy Policy pursuant to art. 13 of the Regulations, the Privacy Policy will be valid as a document capable of providing the proper indications referred to in articles 13 and 14 of the Regulations, for all Users of the Internet Sites who find themselves interacting with the Data Controller in order to take advantage of the services offered by the same Internet Sites.

 

1.2. OBJECT OF PROCESSING

With regard to the data processed by this website, the owner processes:

• personal, identifying data hereinafter, "personal data."
• navigation data: this category of data includes IP addresses or domain names of the computers and terminals used by users, addresses in URI/URL (Uniform Resource Identifier/Locator) notation, the time of the request, the method used in submitting the request to the server, the size of the file obtained in response, the numerical code indicating the status of the response given by the server (successful, error, etc.) and other parameters relating to the user's operating system and computer environment. These data, necessary for the use of web services, are also processed for the purpose of:
• obtain statistical information on the use of services (most visited pages, number of visitors by time slot or daily, geographical areas of origin, etc.);
• check the proper functioning of the services offered.
• data communicated by the user: such as, for example, personal data provided by you through the "contact" form or data provided in the "Contact" section.
• cookies and other tracking systems: for details of the cookies used by this site, see the section on cookies in the following data protection notice.

In particular, it is specified that the data processed by means of the website are:

Derived data
Information that our servers automatically collect when you access the Site, such as your IP address, browser type, operating system, access times, and the pages you viewed directly before and after accessing the Site.

Facebook Permissions
The Site can, by default, access basic Facebook account information, including name, email, gender, birthday, current city, and profile picture URL, as well as other public information.

Data from social networks
User information from social networking sites, Facebook, Google+, Linkedin, X, Instagram, Meta, Pinterest, YouTube, Tik Tok, including name, social network user name, location, gender, date of birth, e-mail address, profile photo, and public contact information, if the user links their account to such social networks.

Third-party data
In terms of the company's main activity, the owner deals with:
personal, identifying data hereinafter, "personal data" provided by the user by means of interaction with this site aimed at using the services of the Company.

With regard to applications pertaining to personnel selection, the data processed and the related processing methods are as follows:
Contact information (such as, address, e-mail address, phone number, etc.);

1. Data on education, professional experience and previous activities;
2. Special categories of personal data (such as, for example, health status, union membership, etc.) only to the extent that such information is contained in the cv
3. Photo as it is on the cv

Processing is carried out in both manual and computerized ways and with the support of paper, computer (management software, accounting, etc.) or otherwise automated and telematic means.

In any case, the processing of data is carried out with the adoption of all appropriate measures to ensure the security and confidentiality of personal data, in particular in compliance with the security measures referred to in Article 32 of European Regulation No. 2016/679 and in accordance with the principles of lawfulness, necessity and proportionality.

 

2.THE PURPOSE AND LEGAL BASIS OF PROCESSING

Each Data Controller, except for specific cases of co-ownership, may require the provision of your Personal Data for the Processing purposes below:

2.1.Regarding the processing purposes of the site of Cantiere Nautico Cranchi S.p.A.

Pursuant to Article 6 EU Regulation No.679/2016 (and subsequent legislative adaptation provisions Legislative Decree 101/2018) (GDPR) for the following Service Purposes:

(a) interaction and navigation on the site:

1. To enable the enjoyment and use of this website, as well as to carry out maintenance and technical support necessary for its proper functioning;
2. To allow the Owner to respond to requests made by you through this website.

Legal basis and lawfulness of the processing: The legal basis underlying the processing referred to in paragraph (a) of this point is provided by 'art. 6 par.1 lett. f) GDPR, which states that "the processing is necessary for the pursuit of the legitimate interest of the data controller or a third party".

The Processing of your Personal Data will be legally based on the contractual relationship that will be created between you and the Data Controller as a result of your interaction with the company's specific website;

2.2.With regard to the processing purposes of the 'activities of Cantiere Nautico Cranchi S.p.A.:

b) purchase of products and/or services: the Data Controller, in order to enable the purchase of its products and/or services, needs to collect some of your Personal Data, as requested within the subscription or purchase form,.

Thus, processing operations include all operations and activities pertaining to the sale, maintenance, hauling, launching, and garaging of naval units or vessels, installation of on-board equipment and systems, sandblasting, sanding, painting, and varnishing of surfaces, and all related inrential and propaedeutic activities as well as the servicing and maintenance of propulsion engines, electrical and hydraulic systems, propulsion lines, propellers, electrical and hydraulic systems and equipment, and on-board instrumentation, and all related inrential and propedeutical operations, including customer service.

Legal basis and lawfulness of the processing: contractual purpose/legal obligations ex art. 6 letters b) and c) of the Regulations - the Processing of your Personal Data will be conducted by the Data Controller to enable you to receive what you have requested and purchased and will therefore be legally based on the contractual relationship that will be created between you and the latter;

c) participation in events: the Data Controller, in order to allow you to participate in one of the events organized by the same, needs to collect some of your Personal Data, as requested within the event registration form/form. In particular, it is mentioned that data may be collected for the following specific purposes:

• The fast pass service, which offers the possibility for the user to be able to veloccize the data registration procedures by means of QR code for access to the booths arranged by the owner.
• Mode of participation in the boat show through the reference dealer.
• Ways to participate in private boat shows.

Legal basis and lawfulness of processing: contractual purpose/legal obligations ex art. 6 letters b) and c) of the Regulations - the Processing of your Personal Data will be conducted by the Data Controller to register you for the event and ensure your participation and therefore will be legally based on the contractual relationship that will be created between you and the latter;

d)request for information and assistance: the Data Controller, in order to follow up on your request for information received by the same through one of the modalities present on its websites, needs to process some of your Personal Data as requested within the collection form and/or as spontaneously conferred by you, including those related to the section:

e)Request for customized or preowned products and services 

Legal basis and lawfulness of processing: pre-contractual purpose ex art. 6 letter b) of the Regulation - the Processing of your Personal Data will be conducted by the Data Controller to provide feedback to your request for information and will be legally based on the pre-contractual relationship that will be created between you and the latter;

f) Personnel selection activities: the Data Controller, in order to initiate personnel selection processes and properly evaluate your candidacy whether aimed at a specific search activity or voluntary, needs to process your Personal Data contained within the Curriculum Vitae and/or requested in the collection form prepared by the Data Controller.

Legal basis and lawfulness of processing: pre-contractual purpose ex art. 6 letter b) of the Regulation - the Processing of your Personal Data will be conducted by the Data Controller evaluating your application and will be legally based on the pre-contractual relationship that will be created between you and the latter.
For this specific purpose, candidates are reminded that they can consult the appropriate data protection notice;

g) Establishment and management of employment or collaboration relationship: the Data Controller, in order to establish and manage an employment or collaboration relationship, needs to collect some of your Personal Data, as required within the employment or collaboration contract. The Processing of your Personal Data will be conducted by the Data Controller and will be legally based on the contractual relationship of employment or collaboration that will be created between you and the latter;

Specifically, the purposes inherent in the employment relationship are as follows:

Pursuant to Art 6(b), (e) GDPR), EU Regulation No.679/2016 (and subsequent legislative adaptation provisions Legislative Decree 101/2018) (GDPR) for the following Service Purposes:

1. for eventual recruitment where this has not already occurred;
2. for the processing and payment of salary;
3. for the completion of all paperwork required by current occupational safety, privacy and environmental regulations;
4. for the fulfillment of legal and contractual obligations, including collective obligations, related to the employment relationship;
5. for collection and for entry into master records in computer databases;
6. for the issuance of invoices and credit notes;
7. for the issuance of quotes and quotations to active and/or potential customers;
8. for the maintenance of ordinary accounting and VAT;
9. for the management of receipts and payments; In connection with the employment relationship, the company may process data belonging to particular categories, so-called "special", as they are suitable for detecting for example:

(a1) the general state of health (absences due to illness, maternity, accident, or compulsory start-up), or fitness for certain duties, as the outcome expressed by medical personnel following preventive/periodic medical examinations or upon request;

(b1) membership in a labor union, membership in a political party or holding elected public office (leave or leave of absence), religious beliefs (religious holidays usable by law).

Data of a sensitive nature, concerning the state of health, which is processed by the competent doctor in the performance of the duties provided for by Legislative Decree 81/2008 and other provisions on hygiene and safety in the workplace, for the performance of preventive and periodic medical examinations, will be processed exclusively by the same doctor as the person responsible for processing. Only judgments on unfitness will be communicated by the doctor to the same employer.

Legal basis and lawfulness of the processing: contractual purpose/legal obligations ex art. 6 letters b) and c) of the Regulations - The Processing of your Personal Data will be conducted by the Data Controller to follow up on the establishment and management of your employment or collaboration relationship with the same and will be legally based on the contractual employment or collaboration relationship that will be created between you and the Data Controller;

(h) execution of contractual documents: the Data Controller, in order to give effect to the contractual relationship between you and the latter as well as the related fulfillments, needs to collect and process some of your Personal Data as requested within the individual contractual document;

Legal basis and lawfulness of processing: contractual purpose/legal obligations ex art. 6 letters b) and c) of the Regulations - The Processing of your Personal Data will be conducted by the Data Controller to follow up on the signing of the individual contractual document and will be legally based on the contractual relationship that will be created between you and the latter;

(i) Compliance with legal obligations: the Data Controller, in order to comply with legal obligations, needs to collect and process certain of your Personal Data as, from time to time, required by specific legal regulations;

Legal basis and lawfulness of processing: legal obligations under Art. 6 letter c) of the Regulations - The Processing of your Personal Data will be conducted by the Data Controller to comply with legal obligations and will be legally based on the applicable legal regulations;

(j) in order to exercise the right of defense in court: the Data Controller, in order to be able to exercise the right of defense in court, needs to collect and process certain of your Personal Data as, from time to time, required by specific legal regulations;

Legal basis and lawfulness of processing: exercise of the defense in court ex art. 6 letter c) of the Regulation - The Processing of your Personal Data will be conducted by the Data Controller in order to exercise a right and will be legally based on the applicable rules of law;

(k) Marketing activities: the performance by the Data Controller of its own promotional and/or marketing activities towards You. This category includes all activities performed to promote products, services, sold and/or provided by the Data Controller; subject to your specific consent.

Legal basis and lawfulness of processing: legitimate interest under Article 6 letter f) of the Regulation - The Processing of your Personal Data will be conducted by the Data Controller and will be legally based on its legitimate interest in promoting its products and services;

Legal basis and lawfulness of processing: consent of the data subject ex art. 6 letter a) of the Regulation - The Processing of your Personal Data will be conducted by the Data Controller and will be legally based on your free, express and unequivocal consent.

 

3. PROCESSING METHODS AND HOW DATA ARE COLLECTED

The processing of your personal data is carried out by means of the following operations: collection, recording, organization, storage, consultation, processing, modification, selection, extraction, comparison, use, interconnection, blocking, communication, deletion and destruction of data.

The processing will be carried out either by manual and/or computerized and telematic means with logics of organization and processing strictly related to the purposes themselves and in any case in such a way as to guarantee the security, integrity and confidentiality of the data themselves in compliance with the organizational, physical and logical measures provided for in Articles 24 and 25 and 32 of the GDPR.

The personal data subject to processing are collected directly by the Data Controller or by third parties expressly authorized by the Data Controller, or communicated by the Data Controller to such third parties for the pursuit of the purposes set forth in this policy.

The Data Controller carries out periodic checks so that no personal data are processed, collected, stored or retained that are not necessary in relation to the processing and related purposes as outlined in this policy.

 

4. NATURE OF DATA PROVISION AND CONSEQUENCES OF REFUSAL TO RESPOND

We inform you that, taking into account the purposes of the processing referred to in points a)-j) as explained above in point 2., the provision of the data necessary for the purposes related to the contractual services of the data controller is free but their failure, partial or inaccurate provision may have, as a consequence, the impossibility of carrying out the activity and pre-contractual and contractual fulfillments as provided for in the contract of sale and / or supply of products.

In contrast, for the purposes of k) above, the express consent of the data subject is required.

 

5. ACCESS TO DATA BY PROCESSING EMPLOYEES

Your data may be made accessible for the exclusive purposes set forth in this notice:

• to employees and collaborators of the Controller, the auxiliaries and third persons employed companies and companies in supply and outsourcing relationship with the Controller in their capacity as authorized persons for processing and/or internal data controllers and/or system administrators;
• to third-party companies or other entities performing outsourced activities on behalf of the Controller, in their capacity as external data controllers.

 

6. COMMUNICATION OF PERSONAL DATA

Personal Data may be disclosed to specific entities considered to be recipients of such Personal Data, which should be understood to mean natural or legal persons, public authority, service or other body receiving communication of Personal Data, whether or not they are third parties.

With this in mind, in order to properly carry out all Processing activities necessary to pursue the purposes set forth in this Notice, the following Recipients may be in a position to process your Personal Data:

Third parties who carry out part of the Processing activities and/or activities related and instrumental to the same on behalf of the Data Controller . Such individuals have been appointed as data controllers, i.e., natural or legal persons, the public authority, service or other body that processes Personal Data on behalf of the Data Controller; individuals, employees and/or collaborators of the Data Controller, who have been entrusted with specific and/or more Processing activities on your Personal Data. Such individuals have been given specific instructions regarding the security and proper use of Personal Data and are defined as the "persons authorized to process Personal Data under the direct authority of the Data Controller or Data Processor."

Where it is required by law or to prevent or suppress the commission of a crime, your Personal Data may be disclosed to public bodies or judicial authorities without, however, being defined as Recipients. In fact, the regulation states that public authorities that receive disclosure of Personal Data as part of a specific investigation conducted in accordance with Union or Member State law are not considered Recipients.

Without the need for express consent, the Data Controller may communicate your data for the above purposes to Supervisory Bodies, Judicial Authorities, insurance companies for the provision of insurance services, as well as to those subjects to whom the communication is compulsory by law for the fulfillment of the said purposes.

Specifically, data recipients can be:

• Information and computer support companies;
• Companies, or professional firms offering professional and/or consulting services with respect to accounting, legal, tax, administrative, financial, and debt collection matters;
• Providers of IT infrastructure and solutions;
• Web service providers;
• Banks and payment service providers, acting as Processors, to whom your personal data may be disclosed for the purpose of processing your payments;
• Consultants, to the extent necessary for the performance of their professional duties.

The communication concerns the categories of personal data whose transmission to the above-mentioned third parties is necessary for the performance of the activities and for the purposes referred to in this notice.
An up-to-date list of Data Processors and Authorized Persons is kept at the Data Controller's office and is available upon request to be made by e-mail at sales@cranchi.com
Some of these parties may process data in their capacity as autonomous data controllers.
Your data will not be disseminated.

Data communications may also relate to:

Law or exercise of rights
If the release of information is deemed necessary to respond to legal process, to investigate or remedy potential violations of our policies, or to protect the rights, property, and safety of others, we may share information as permitted or required by any applicable law, rule, or regulation. This includes sharing information with other entities for fraud protection and credit risk reduction.

Third-party service providers
The site shares information with third parties who perform services for the site or on our behalf, including data analysis, emailing, hosting services, customer service, and marketing support.

Cookies and web beacons
We may use cookies, web beacons, tracking pixels and other tracking technologies on the Site to help personalize the Site and improve your experience. When you access the Site, personal information is not collected through the use of tracking technologies. Most browsers are set to accept cookies by default. You can remove or reject cookies, but be aware that such action may affect the availability and functionality of the Site. Users cannot reject web beacons. However, they can be made ineffective by rejecting all cookies or by changing your web browser settings to notify you each time a cookie is offered, allowing you to accept or reject cookies on an individual basis. We may use cookies, web beacons, tracking pixels and other tracking technologies on the Site to help personalize the Site to improve your experience.

The cookies used by this site are listed in the Cookie Declaration.

 

7.THIRD-PARTY WEBSITES

The site does not contain links to third-party websites and applications of interest, including external services, that are not affiliated with us.

 

8. PERIOD OF RETENTION OF PERSONAL DATA (SO-CALLED DATA RETENTION)

Personal data are stored mainly with both paper and digital procedures in Italy, within the European Union and precisely also outside the Holder's Head Office and in full compliance with the provisions and fulfillments necessary for the purposes of security and proper location of data storage units. Digital storage modes are limited only to the sending of documentation and are carried out in full compliance with the provisions and fulfillments necessary for the purposes of security and proper location of data storage units( pc and secure back up tools) as well as for the purposes of security of paper archives.

The Controller will process personal data for the time necessary to fulfill the above purposes and in any case for no longer than the termination of the relationship carried out for the Service Purposes.  It is considered that The Controller will process personal data for as long as necessary to fulfill the above purposes and in any case for no longer than 10 years from the termination of the relationship for the Service Purposes of billing and accounting; For the purposes related to direct and indirect marketing, please note that the retention period does not exceed 24 months from the date of re-collection.

Retention time related to data processing carried out by this website:

Personal data will be processed and stored for as long as necessary for the purposes for which it was collected.

Therefore:

Personal Data collected for purposes related to the performance of a contract between the Data Controller and the User will be retained until the full performance of that contract.

Personal Data collected for purposes of legitimate interest of the Data Controller will be retained for as long as necessary to fulfill those purposes. Users can find specific information about the legitimate interests pursued by the Controller in the relevant sections of this document or by contacting the Controller.

The Controller may be authorized to retain Personal Data for a longer period if the User has given consent to such processing, provided that such consent is not withdrawn. In addition, the Controller may be obliged to retain Personal Data for a longer period if this is required for the fulfillment of a legal obligation or by order of an authority.

Once the retention period has expired, the Personal Data will be deleted. Therefore, the right of access, the right to erasure, the right to rectification, and the right to data portability cannot be exercised after the retention period has expired.

 

9.EXTRA EU/SEAS TRANSFER

In the management of the relationship with customers, there is no transfer of data to third countries nor to international organizations.

Should it become necessary to make transfers of personal data outside the territory of the European Union to countries not considered adequate by the European Commission, the Controller will ensure that appropriate or adequate safeguards are in place to protect personal data and that the transfer of such data complies with applicable data protection laws.

Any transfer of data subjects' data to countries located outside the European Union will, in any case, take place in compliance with the appropriate and adequate safeguards for the purposes of the transfer itself, in accordance with the applicable legislation and in particular Articles 45 and 46 of the Regulations.

Accordingly, where required by applicable data protection laws, the Owner will ensure that service providers sign Standard Contractual Clauses approved by the European Commission.

 

10.RIGHTS OF THE DATA SUBJECT

In your capacity as a user you are entitled to the following rights:

• Right to access your data, obtain confirmation of the existence or otherwise of personal data concerning you, even if not yet registered, and their communication in intelligible form; -obtain indication of: (a) the origin of the personal data; (b) the purposes and methods of processing; (c) the logic applied in the case of processing carried out with the aid of electronic instruments; (d) the identification details of the data controller, data processors and the data controller's representative and the persons authorized to process the data; and (e) the subjects or categories of subjects to whom the personal data may be communicated or who may become aware of the data in their capacity as designated representative in the territory of the State, data processors or persons authorized to process the data; (Art. 15 GDPR).
• Right to update, rectify or, when interested, supplement data; (Art. 16 GDPR).
• Right to erasure, transformation into anonymous form or blocking of data processed in violation of the law, including data whose retention is not necessary in relation to the purposes for which the data were collected or subsequently processed ; (art. 17 GDPR).
• Right to request the restriction of use of data for the sole reasons of public interest and for the establishment or defense of a right, in cases where the data subject disputes the accuracy of the data and processing, in the case of exercising the right to object to processing under Article 21 GDPR, and in the other cases provided for in Article 18 GDPR; (Article 18 GDPR).
• Right to receive the personal data provided to the data controller in a structural format or on a commonly used, intelligible and accessible computer medium for any operating system (USB or duly encrypted ZIP file), and to move without constraints, the complexes of information and data concerning you from the present controller or another controller chosen by you in accordance with your purposes and in full compliance with the principles of transparency, lawfulness and proportionality of processing.  This right to data portability is without prejudice to other rights; (Art. 20 GDPR).
• Right to object, in whole or in part:
  a) on legitimate grounds to the processing of personal data concerning you, even if relevant to the purpose of collection; b) to the processing of personal data concerning you for any other purpose not relevant to the processing; (Art. 21 GDPR).

 

11. OBJECTION TO PROCESSING AND WITHDRAWAL OF CONSENT

As provided for in the Regulations, if you have given your consent to the Processing of your Personal Data for one or more of the purposes for which you have been requested, you may, at any time, withdraw it in whole and/or in part without affecting the lawfulness of the Processing based on the consent given before the withdrawal.

The ways to revoke consent are very simple and intuitive, you just need to contact the Data Controller using the contact channels reported to you within this Policy.

In addition to the above and for the sake of simplicity, should you find yourself in the condition of receiving advertising e-mail messages from the Data Controller that are no longer of interest to you, simply click on the text "UNSUBSCRIBE".

placed at the bottom of them to stop receiving any further communication or, if not present, using the additional contact channels made available by the Data Controller.

• Right to withdraw consent, where provided and at any time. Revocation of consent does not affect the lawfulness of the processing based on the consent given before revocation;
• Right to file a complaint with the supervisory authority.
• Right to withdraw consent: consent to data processing may be withdrawn at any time by the data subject.

 

12. WAYS OF EXERCISING RIGHTS

You may exercise your rights at any time by sending a request by email to the email address: sales@cranchi.it, writing to the Privacy Office of Cantiere Nautico Cranchi S.p.A., or asking for the Privacy Office or the data controller.

You may also exercise your rights by contacting the Privacy Guarantor, with Headquarters in Piazza Venezia n. 11 - 00187 Rome, Telephone switchboard: (+39) 06.696771,Fax: (+39) 06.69677.3785. For general information you can send an e-mail to: protocollo@gpdp.it, protocollo@pec.gpdp.it

 

13. AMENDMENTS TO THIS POLICY

The Data Controller reserves the right to make changes to this Privacy Policy at any time by giving notice to users on this site. Therefore, please consult this page often, taking as reference the date of last modification indicated at the end of the document. In case of non-acceptance of the changes made to this Privacy Policy you may request the Data Controller to delete the personal data concerning you.

 

14. MATERIALS

All content on the Internet Sites (not uploaded by users) is part of the Cranchi S.p.a archive, including images. Part of the photographic materials are taken from online archives. The user when registering and entering content, whether photographic or textual, for the purpose of publication on the Internet Sites, declares that he owns the rights (including for commercial purposes) to the uploaded images. The user therefore assumes full responsibility for the provenance and legality of the images uploaded to the Internet Sites.

 

15. PROCEDURE FOR REVOCATION OF CONSENTS ON DATA PROCESSING BY THE ENTITY:

 Cantiere Nautico Cranchi S.p.A. - Via Nazionale, 1319 - 23010 Piantedo (Italy).

Dear User, You may request revocation of one or more of the privacy consents below by sending an email to the following address: sales@cranchi.it and mentioning one or more of the options you wish to revoke.

• Revocation of Email Communications
• Revocation of third-party marketing communications by email

Once the request is received, it will generally be processed within 48 hours.

HOW TO DISABLE COOKIES OF ANY BROWSERS USED BY THE USER FOR BROWSING BY BROWSER CONFIGURATION?

Chrome

1. Running the Chrome Browser
2. Click on the menu in the browser toolbar next to the url entry window for lanavigation
3. Select Settings
4. Click Show Advanced Settings
5. In the "Privacy" section, click "Content Settings" button.
6. In the "Cookies" section, you can change the following cookie-related settings: - Allow local data to be saved locally - Change local data only until the browser is closed -Prevent sites from setting cookies - Block third-party cookies and site data - Manage exceptions for certain websites - Delete one or all cookies

For more information visit the dedicated page.

Mozilla Firefox

1. Run the Mozilla Firefox Browser
2. Click on the menu in the browser toolbar next to the url entry window for lanavigation
3. Select Options
4. Select the Privacy panel
5. Click ShowAdvanced Settings.
6. In the "Privacy" section, click "Content Settings" button.
7. Under "Tracking "you can change the following settings related to cookies: - Require sites not to do any tracking - Notify sites of your willingness to be tracked - Notify no preference regarding tracking of personal data
8. From the "History "section you can: - Enable "Use custom settings" to select to accept third-party cookies (always, from the most visited sites or never) and to store them for a specified period (until they expire, when Firefox closes or to ask each time) - Remove individual stored cookies.

For more information visit the dedicated page.

Internet Explorer/Edge

1. Run the Internet Explorer/Edge Browser.
2. Click on the Tools button and choose OptionsInternet.
3. Click on the Privacy tab and in the Settings section change the slider to the desired action for cookies

• Block all cookies
  Allow all cookies
• Selection of sites from which to obtain cookies: move the cursor to an intermediate position so as not to block or allow
  all cookies,then press on Sites, in the Web Site Address box enter a siteinternet and then press on Block or Allow

For more information visit the dedicated page.

Safari 6

1. Running the Safari Browser
2. Click on Safari,select Preferences and press on Privacy
3. In the Block Cookies section, specify how Safari should accept cookies from Internet sites.
4. To view which sites have stored icookie click on Details

For more information visit the dedicated page.

Safari iOS(mobile devices)

1. Running the Safari iOS Browser
2. Tap on Settingsand then Safari
3. Tap on BlockCookie and choose from the options, "Never," "Third-Party and Insiders," or "Always"
4. To clear all cookies stored bySafari, tap on Settings, then on Safari and finally on ClearCookies and Data

For more information visit the dedicated page.

Opera

1. Running the Opera Browser
2. Click on Preferencesthen on Advanced and finally on Cookies
3. Select one of the following options: -Accept all cookies - Accept cookies only from the site you are visiting: third-party cookies and that are sent from a domain other than the one you are visiting will be rejected - Never accept cookies: all cookies will never be saved

For more information visit the dedicated page.

 

16. DEFINITIONS AND LEGAL REFERENCES

Personal Data (or Data)

Personal data is any information that, directly or indirectly, including in connection with any other information, including a personal identification number, makes a natural person identified or identifiable.

Usage Data

This is the information collected automatically through this Application (including by third party applications integrated into this Application), including: the IP addresses or domain names of the computers used by the User who connects with this Application, the addresses in URI (Uniform Resource Identifier) notation, the time of the request, the method used in forwarding the request to the server, the size of the file obtained in response, the numerical code indicating the status of the response from the server (successful, error, etc..) the country of origin, the characteristics of the browser and operating system used by the visitor, the various temporal connotations of the visit (e.g. the length of time spent on each page) and the details of the itinerary followed within the Application, with particular reference to the sequence of pages consulted, the parameters relating to the User's operating system and computer environment.

User

The individual using this Application who, except where otherwise specified, coincides with the Data Subject.

Interested

The natural person to whom the Personal Data refers.

Data Processor (or Manager)

The natural person, legal entity, public administration and any other entity that processes personal data on behalf of the Controller, as set forth in this privacy policy.

Data Controller (or Owner)

The natural or legal person, public authority, service or other body which, individually or jointly with others, determines the purposes and means of the processing of personal data and the means adopted, including the security measures relating to the operation and use of this Application. The Data Controller, unless otherwise specified, is the owner of this Application.

This Application

The hardware or software tool by which Users' Personal Data are collected and processed.

Service

The Service provided by this Application as defined in the relevant terms (if any) on this site/application.

European Union (or EU)

Unless otherwise specified, any reference to the European Union in this document shall be deemed to extend to all atSual member states of the European Union and the European Economic Area.

Cookie

Cookies are Tracking Tools that consist of small portions of data stored within the User's browser.

Tracking Tool

Tracking Tool means any technology - e.g., cookies, unique identifiers, web beacons, embedded scripts, e-tags, and fingerprinting - that allows tracking Users, for example, by collecting or storing information on the User's device.

Legal references

This privacy policy is prepared based on multiple legislative orders, including Articles 13 and 14 of Regulation (EU) 2016/679.
Unless otherwise specified, this privacy policy covers this Application only.

 

17. ACCEPTABLE USE POLICY FOR WEBSITE USERS

Prohibited use
You may not use the Services to post content or engage in activities that are illegal under applicable law, harmful to others, or that could expose us to liability, including but not limited to the following activities, each of which is prohibited by this AUP:

• Phishing or identity theft
• Distribution of computer viruses, worms, Trojan horses (TROJAN) or other malicious codes (MALWARE, RANSOMWARE, etc.).
• Distributing pornography or adult content or offering escort services.
• Promoting or facilitating violence or terrorist activities.
• Infringement of intellectual property or other property rights of others.

Application
Your services may be suspended or terminated with or without notice if you violate this policy. Any violation may result in immediate suspension or termination of your account.

Reporting violations
To report a violation of this policy, contact us as per Section 12 of this policy
We reserve the right to change this policy at any time, and you will be promptly updated of this. To make sure you are up-to-date on the latest changes, we recommend that you visit this page often.

Information on the processing and protection of personal data

Pursuant to the combined provisions of European Regulation 2016/679 (General Data Protection Regulation, hereinafter "GDPR") and Legislative Decree 196/2003 as amended (Legislative Decree 101/2018)

Art. 1. Data controller (the person or company that decides how and why to process data)

The data controller (hereinafter referred to as "Data Controller") is. Cantiere Nautico Cranchi S.p.A. - Via Nazionale, 1319 - 23010 Piantedo (Italy) - REFERENCE: Mrs. Carlotta Lucini, Mobile: +39 331 6662385, e-mail: carlotta.l@cranchi.it - website: www.cranchi.com .

2. Purpose, legal basis for processing and data processed

	Puropses	Legal basis and nature of contribution	Type of data
a	Activities of sending newsletters, commercial communications and marketing: the performance by the Data Controller of its own promotional and/or marketing activities towards you. This category includes all activities performed to promote products, services, sold and/or provided by the Data Controller; subject to your specific consent.	Legal basis and lawfulness of processing: legitimate interest ex art. 6 letter f) of the Regulation - The Processing of your Personal Data will be conducted by the Data Controller and will be legally based on its legitimate interest in promoting its products and services; Legal basis and lawfulness of processing: consent of the data subject ex art. 6 letter a) of the Regulation - The Processing of your Personal Data will be conducted by the Data Controller and will be legally based on your free, express and unequivocal consent.	identification and contact data:  First name, last name, e-mail address, telephone number, Tax ID number, City, Country of residence, Country of mooring, sailing area, other data as may be fonished by the customer due to requests
b	Exercise the rights of the Owner, such as any right of defense in court.	Legitimate interest of the data controller (Art. 6(1)(f) GDPR): right of defense fairly balanced with the same right of data subjects	identifying and contact data:  First name, last name, e-mail address, telephone number, Tax code, City, Country of residence, and data necessary for legal defense

3. Modalities of processing

The processing is carried out with both manual and computerized methods and with the support of paper, computer or otherwise automated means.

In any case, the data processing is carried out with the adoption of all appropriate measures to ensure the security and confidentiality of personal data, in particular in compliance with the security measures referred to in Article 32 of the European Regulation No. 2016/679 and in accordance with the principles of lawfulness, necessity and proportionality.

4. Data storage

Data are processed and stored on the tools used (e.g., computers) by the owner. The personal and special data of the data subjects are stored separately from the works and drawings made during the course of therapy.

The Holder will keep personal data for as long as necessary to fulfill the above purposes.

Specifically : 24 months for marketing purposes.

5. Communication and transmission of data

Data are not subject to communication and dissemination to third parties, except for obligations arising from the law.

Personal data may be transmitted to:

• Third parties who carry out activities on behalf of the Data Controller as Data Processors appointed pursuant to Article 28 of the European Regulation 2016/679, (by way of example hosting services and IT services)
• Credit Institutions
• Insurance companies
• Law firms for the management of any litigation and the exercise of the Holder's right of defense
• Reference dealers

 More information regarding the entities listed above is available from the Holder's office.

6. Transfer of data outside the EU

In the management of the relationship with customers, no transfer of data to Third Countries nor to international organizations is envisaged.

Should it become necessary to transfer personal data outside the territory of the European Union to countries not considered adequate by the European Commission, the Data Controller will ensure that appropriate or adequate safeguards are in place to protect personal data and that the transfer of such data complies with applicable data protection laws.

Any transfer of data subjects' data to countries outside the European Union will, in any event, take place in compliance with the safeguards that are appropriate and adequate for the purposes of such transfer, pursuant to applicable law and in particular Articles 45 and 46 of the Regulations.

Accordingly, where required by applicable data protection laws, the Controller will ensure that service providers sign Standard Contractual Clauses approved by the European Commission.

7. Rights of data subjects (Art. 15 et seq. of the GDPR)

Art. 15 Right of access, the right to know whether any processing of one's personal data is taking place and - if confirmed - to obtain a copy of such data and to be informed about: the origin of the data; the categories of personal data processed; the recipients of the data; the purposes of the processing; the existence of automated decision-making, including profiling; the data retention period; and the rights provided by the Regulation. The Right to lodge a complaint at any time with the Supervisory Authority (Garante Privacy: Piazza Venezia nr. 11, 00187 ROMA, Tel. +39 06 696771 - PEC: protocollo@pec.gpdp.it); Art. 16 Right of the data subject to obtain the updating, rectification or integration of personal data; Art. 17 Right to erasure and the right to be forgotten; Art. 18 Right to restriction of processing, when provided for; Art. 19 Obligation of the data controller to notify rectification, erasure and/or restriction; Art. 20 Right to data portability: the right to request that the data provided to the data controller be transferred to another data controller, where the processing is based on your consent or on a contract with you and is carried out by automated means; Art. 21 Right to object, at any time on grounds relating to your particular situation, where the processing is carried out in the exercise of public authority or in the performance of a task carried out in the public interest, or without the need to give reasons for the objection, when the data are processed for direct marketing purposes; Art. 22 Right not to be subjected to a decision based solely on an automated process, including profiling.

8. automated processing

No automated data processing is carried out.

9. Instances of the Interested Parties

The requests referred to in Art. 7 above may be submitted by the Data Subjects to the Data Controller by registered letter or electronic mail to the addresses listed in Art. 1 above.

Information on the processing and protection of personal data

Pursuant to the combined provisions of European Regulation 2016/679 (General Data Protection Regulation, hereinafter "GDPR") and Legislative Decree 196/2003 as amended (Legislative Decree 101/2018)

Art. 1. Data controller (the person or company that decides how and why to process data)

The data controller (hereinafter referred to as "Data Controller") is. Cantiere Nautico Cranchi S.p.A. - Via Nazionale, 1319 - 23010 Piantedo (Italy) - REFERENCE: sales@cranchi.it - Mrs. Desiree Fischietti - Phone : +39 0342 683359 - website: www.cranchi.com.

2. Purpose, legal basis of processing and data processed

	Puropse	Legal basis and nature of contribution	Type of data
a	Follow up on your request for information received by the owner through one of the methods on its websites Administrative management and operations necessary to ensure access to the holder's booths.	Execution of pre-contractual measures taken at the request of the data subject and/or execution of a contract to which the data subject is a party (Art. 6(1)(b) GDPR).	identification and contact data: First name, last name, e-mail address, telephone number, tax code, City, Country of residence, Country of mooring, sailing area, other data that may be fonished by the customer because of his requests
b	Recording invoices, receiving payments; Fulfilling pre-contractual, contractual and tax obligations arising from the customer relationship; Fulfilling obligations under the law, a regulation, EU legislation or an order of the Authority	Legal obligation to which the owner is bound (Art. 6(1)(c) GDPR). The provision of data is mandatory, and in case of refusal to provide personal data, it will not be possible for the Holder to provide the service.	identification and contact data: First name, last name, place and date of birth, e-mail address, phone number
c	Exercise the rights of the Owner, such as any right of defense in court.	Legitimate interest of the data controller (Art. 6(1)(f) GDPR): right of defense fairly balanced with the same right of data subjects	identifying and contact data: First name, last name, e-mail address, telephone number, Tax code, City, Country of residence, and data necessary for legal defense

3. Method of treatment

Processing is carried out using both manual and computerized methods and with the support of paper, computer or otherwise automated means.

In any case, the processing of data is carried out with the adoption of all appropriate measures to ensure the security and confidentiality of personal data, in particular in compliance with the security measures referred to in Article 32 of European Regulation No. 2016/679 and in accordance with the principles of lawfulness, necessity and proportionality.

4. Data Retention

Data are processed and stored on the tools used (e.g., computers) by the owner. Personal and special data of data subjects are stored separately from the works and drawings made during the course of therapy.

The Holder will retain personal data for as long as necessary to fulfill the above purposes.

Specifically : 24 months for application records.

5. Reporting and transmission of data

Data are not subject to communication and dissemination to third parties, except for obligations arising from the law.

Personal data may be transmitted to:

• Third parties carrying out activities on behalf of the Controller as Data Processors appointed pursuant to Article 28 of the European Regulation 2016/679, (by way of example hosting services and IT services)
• Credit Institutions
• Insurance companies
• Law firms for the management of any litigation and the exercise of the Holder's right of defense
• Dealer Reference

More information regarding the subjects listed above is available from the Holder's office.

6. Transfer of data outside the EU

In the management of the relationship with customers, there is no transfer of data to third countries nor to international organizations.

Should it become necessary to make transfers of personal data outside the territory of the European Union to countries not considered adequate by the European Commission, the Controller will ensure that appropriate or adequate safeguards are in place to protect personal data and that the transfer of such data complies with applicable data protection laws.

Any transfer of data subjects' data to countries located outside the European Union will, in any case, take place in accordance with the appropriate and adequate safeguards for the purposes of the transfer itself, pursuant to the applicable legislation and in particular Articles 45 and 46 of the Regulations.

Accordingly, where required by applicable data protection laws, the Owner will ensure that service providers sign Standard Contractual Clauses approved by the European Commission.

7. Rights of data subjects (Art. 15 et seq. of the GDPR)

Art. 15 Right of access, the right to know whether any processing of one's personal data is taking place and - if confirmed - to obtain a copy of such data and to be informed about: the origin of the data; the categories of personal data processed; the recipients of the data; the purposes of the processing; the existence of automated decision making, including profiling; the period of data retention; the rights provided by the Regulation. The Right to lodge a complaint at any time with the Supervisory Authority (Garante Privacy: Piazza Venezia nr. 11, 00187 ROMA, Tel. +39 06 696771 - PEC: protocollo@pec.gpdp.it); Art. 16 Right of the data subject to obtain the updating, rectification or integration of personal data; Art. 17 Right to erasure and the right to be forgotten; Art. 18 Right to restriction of processing, when provided for; Art. 19 Obligation of the data controller to notify rectification, erasure and/or restriction; Art. 20 Right to data portability: the right to request that the data provided to the data controller be transferred to another data controller, where the processing is based on your consent or on a contract with you and is carried out by automated means; Art. 21 Right to object, at any time on grounds relating to your particular situation, where the processing is carried out in the exercise of public authority or in the performance of a task carried out in the public interest, or without the need to give reasons for the objection, when the data are processed for direct marketing purposes; Art. 22 Right not to be subjected to a decision based solely on an automated process, including profiling.

8. automated processing

No automated data processing is carried out.

9. Instances of interested parties

The requests referred to in Article 7 above may be submitted by the Data Subjects to the Data Controller by registered letter or electronic mail to the addresses listed in Article 1 above.

Information on the processing and protection of personal data

Pursuant to the combined provisions of European Regulation 2016/679 (General Data Protection Regulation, hereinafter "GDPR") and Legislative Decree 196/2003 as amended (Legislative Decree 101/2018)

Art. 1. Data controller (the person or company that decides how and why to process data)

The data controller (hereinafter referred to as "Data Controller") is: Cantiere Nautico Cranchi S.p.A. - Via Nazionale, 1319 - 23010 Piantedo (Italy) - Reference: Mrs. Carlotta Lucini - Mobile: +39 331 66 62 385 - E-MAIL: carlotta.l@cranchi.it - website: www.cranchi.com.

2. Purpose, legal basis of processing and data processed

	Puropse	Legal basis and nature of contribution	Type of data
a	Mode of participation in events using the fast pass service, which offers the possibility for the user to be able to veloccize data registration procedures by means of QR code for access to booths arranged by the owner. (https://www.cranchi.com/it/events/fast-pass) Administrative management and operations necessary to ensure access to the holder's booths.	Execution of pre-contractual measures taken at the request of the data subject and/or execution of a contract to which the data subject is a party (Art. 6(1)(b) GDPR). The provision of data is mandatory, and in case of refusal to provide personal data, it will not be possible for the Holder to provide the service.	Identification and contact information: First name, last name, e-mail address, telephone number, Tax code, City, Country of residence, Country of mooring, sailing area, other data that may be fonished by the customer because of his requests
b	Recording invoices, receiving payments; Fulfilling pre-contractual, contractual and tax obligations arising from the customer relationship; Fulfilling obligations under the law, a regulation, EU legislation or an order of the Authority	Legal obligation to which the owner is bound (Art. 6(1)(c) GDPR). The provision of data is mandatory, and in case of refusal to provide personal data, it will not be possible for the Holder to provide the service.	Identification and contact information: First name, last name, place and date of birth, e-mail address, phone number
c	Exercise the rights of the Owner, such as any right of defense in court.	Legitimate interest of the data controller (Art. 6(1)(f) GDPR): right of defense fairly balanced with the same right of data subjects	identifying and contact data: First name, last name, e-mail address, telephone number, Tax code, City, Country of residence, and data necessary for legal defense

3. Methods of processing

Processing is carried out using both manual and computerized methods and with the support of paper, computer or otherwise automated means.

In any case, the processing of data is carried out with the adoption of all appropriate measures to ensure the security and confidentiality of personal data, in particular in compliance with the security measures referred to in Article 32 of European Regulation No. 2016/679 and in accordance with the principles of lawfulness, necessity and proportionality.

4. Data Retention

Data are processed and stored on the tools used (e.g., computers) by the owner. Personal and special data of data subjects are stored separately from the works and drawings made during the course of therapy.

The Holder will retain personal data for as long as necessary to fulfill the above purposes.

Specifically : 24 months for records of the holder's organization and booth access operations.

5. Reporting and transmission of data

Data are not subject to communication and dissemination to third parties, except for obligations arising from the law.

Personal data may be transmitted to:

• Third parties carrying out activities on behalf of the Controller as Data Processors appointed pursuant to Article 28 of the European Regulation 2016/679, (by way of example hosting services and IT services)
• Credit Institutions
• Insurance companies
• Law firms for the management of any litigation and the exercise of the Holder's right of defense
• Dealer Reference

More information regarding the subjects listed above is available from the Holder's office.

6. Transfer of data outside the EU

In the management of the relationship with customers, there is no transfer of data to third countries nor to international organizations.

Should it become necessary to make transfers of personal data outside the territory of the European Union to countries not considered adequate by the European Commission, the Controller will ensure that appropriate or adequate safeguards are in place to protect personal data and that the transfer of such data complies with applicable data protection laws.

Any transfer of data subjects' data to countries located outside the European Union will, in any case, take place in accordance with the appropriate and adequate safeguards for the purposes of the transfer itself, pursuant to the applicable legislation and in particular Articles 45 and 46 of the Regulations.

Accordingly, where required by applicable data protection laws, the Owner will ensure that service providers sign Standard Contractual Clauses approved by the European Commission.

7. Rights of data subjects (Art. 15 et seq. of the GDPR).

Art. 15 Right of access, the right to know whether any processing of one's personal data is taking place and - if confirmed - to obtain a copy of such data and to be informed about: the origin of the data; the categories of personal data processed; the recipients of the data; the purposes of the processing; the existence of automated decision making, including profiling; the period of data retention; the rights provided by the Regulation. The Right to lodge a complaint at any time with the Supervisory Authority (Garante Privacy: Piazza Venezia nr. 11, 00187 ROMA, Tel. +39 06 696771 - PEC: protocollo@pec.gpdp.it); Art. 16 Right of the data subject to obtain the updating, rectification or integration of personal data; Art. 17 Right to erasure and the right to be forgotten; Art. 18 Right to restriction of processing, when provided for; Art. 19 Obligation of the data controller to notify rectification, erasure and/or restriction; Art. 20 Right to data portability: the right to request that the data provided to the data controller be transferred to another data controller, where the processing is based on your consent or on a contract with you and is carried out by automated means; Art. 21 Right to object, at any time on grounds relating to your particular situation, where the processing is carried out in the exercise of public authority or in the performance of a task carried out in the public interest, or without the need to give reasons for the objection, when the data are processed for direct marketing purposes; Art. 22 Right not to be subjected to a decision based solely on an automated process, including profiling.

8. automated processing

No automated data processing is carried out.

9. Instances of interested parties

The requests referred to in Article 7 above may be submitted by the Data Subjects to the Data Controller by registered letter or electronic mail to the addresses listed in Article 1 above.

Information on the processing and protection of personal data

Pursuant to the combined provisions of European Regulation 2016/679 (General Data Protection Regulation, hereinafter "GDPR") and Legislative Decree 196/2003 as amended (Legislative Decree 101/2018)

Art. 1. Data controller (the person or company that decides how and why to process data).

The data controller (hereinafter referred to as "Data Controller") is Cantiere Nautico Cranchi S.p.A. - Via Nazionale, 1319 - 23010 Piantedo (Italy), Reference: sales@cranchi.it - Mrs. Desiree Fischietti - Phone : +39 0342 683359 - website: www.cranchi.com.

2.Purpose, legal basis of processing and data processed

	Purpose	Legal basis and nature of contribution	Type of data
a	Ways to participate in private boat shows. (https://www.cranchi.com/it/contacts/cranchi-private-show) Administrative management and operations necessary to ensure access to the holder's booths.	Execution of pre-contractual measures taken at the request of the data subject and/or execution of a contract to which the data subject is a party (Art. 6(1)(b) GDPR). The provision of data is mandatory in nature, and in case of refusal to provide personal data, it will not be possible for the Holder to provide the service of access to the booths predeployed for the private show.	Identification and contact information: First name, last name, e-mail address, telephone number, Tax code, City, Country of residence, Country of mooring, sailing area, other data that may be provided by the customer because of his requests
b	Recording invoices, receiving payments; Fulfilling pre-contractual, contractual and tax obligations arising from the customer relationship; Fulfill obligations under the law, a regulation, EU legislation or an order of the Authority	Legal obligation to which the owner is bound (Art. 6(1)(c) GDPR). The provision of data is mandatory in nature, and in case of refusal to provide personal data, it will not be possible for the Holder to provide the service of access to the booths predeployed for the private show.	Identification and contact information: First name, last name, place and date of birth, e-mail address, phone number
c	Exercise the rights of the Owner, such as any right of defense in court.	Legitimate interest of the data controller (Art. 6(1)(f) GDPR): right of defense fairly balanced with the same right of data subjects	identifying and contact data: First name, last name, e-mail address, telephone number, Tax code, City, Country of residence, and data necessary for legal defense

3. Method of treatment

Processing is carried out using both manual and computerized methods and with the support of paper, computer or otherwise automated means.

In any case, the processing of data is carried out with the adoption of all appropriate measures to ensure the security and confidentiality of personal data, in particular in compliance with the security measures referred to in Article 32 of European Regulation No. 2016/679 and in accordance with the principles of lawfulness, necessity and proportionality.

4. Data Retention

Data are processed and stored on the tools used (e.g., computers) by the owner. Personal and special data of data subjects are stored separately from the works and drawings made during the course of therapy.

The Holder will retain personal data for as long as necessary to fulfill the above purposes.

Specifically : 24 months for records of the holder's organization and booth access operations.

5. Reporting and transmission of data

Data are not subject to communication and dissemination to third parties, except for obligations arising from the law.

Personal data may be transmitted to:

• Third parties carrying out activities on behalf of the Controller as Data Processors appointed pursuant to Article 28 of the European Regulation 2016/679, (by way of example hosting services and IT services)
• Credit Institutions
• Insurance companies
• Law firms for the management of any litigation and the exercise of the Holder's right of defense
• Dealer Reference

More information regarding the subjects listed above is available from the Holder's office.

6. Transfer of data outside the EU

In the management of the relationship with customers, there is no transfer of data to third countries nor to international organizations.

Should it become necessary to make transfers of personal data outside the territory of the European Union to countries not considered adequate by the European Commission, the Controller will ensure that appropriate or adequate safeguards are in place to protect personal data and that the transfer of such data complies with applicable data protection laws.

Any transfer of data subjects' data to countries located outside the European Union will, in any case, take place in accordance with the appropriate and adequate safeguards for the purposes of the transfer itself, pursuant to the applicable legislation and in particular Articles 45 and 46 of the Regulations.

Accordingly, where required by applicable data protection laws, the Owner will ensure that service providers sign Standard Contractual Clauses approved by the European Commission.

7. Rights of data subjects (Art. 15 et seq. of the GDPR).

Art. 15 Right of access, the right to know whether any processing of one's personal data is taking place and - if confirmed - to obtain a copy of such data and to be informed about: the origin of the data; the categories of personal data processed; the recipients of the data; the purposes of the processing; the existence of automated decision making, including profiling; the period of data retention; the rights provided by the Regulation. The Right to lodge a complaint at any time with the Supervisory Authority (Garante Privacy: Piazza Venezia nr. 11, 00187 ROMA, Tel. +39 06 696771 - PEC: protocollo@pec.gpdp.it); Art. 16 Right of the data subject to obtain the updating, rectification or integration of personal data; Art. 17 Right to erasure and the right to be forgotten; Art. 18 Right to restriction of processing, when provided for; Art. 19 Obligation of the data controller to notify rectification, erasure and/or restriction; Art. 20 Right to data portability: the right to request that the data provided to the data controller be transferred to another data controller, where the processing is based on your consent or on a contract with you and is carried out by automated means; Art. 21 Right to object, at any time on grounds relating to your particular situation, where the processing is carried out in the exercise of public authority or in the performance of a task carried out in the public interest, or without the need to give reasons for the objection, when the data are processed for direct marketing purposes; Art. 22 Right not to be subjected to a decision based solely on an automated process, including profiling.

8. automated processing

No automated data processing is carried out.

9. Instances of interested parties

The requests referred to in Article 7 above may be submitted by the Data Subjects to the Data Controller by registered letter or electronic mail to the addresses listed in Article 1 above.

Information on the processing and protection of personal data

Pursuant to the combined provisions of European Regulation 2016/679 (General Data Protection Regulation, hereinafter "GDPR") and Legislative Decree 196/2003 as amended (Legislative Decree 101/2018)

Art. 1. Data controller (the person or company that decides how and why to process data).

The data controller (hereinafter referred to as "Data Controller") is: Cantiere Nautico Cranchi S.p.A. - Via Nazionale, 1319 - 23010 Piantedo (Italy) - Reference: Mrs. Carlotta Lucini - Mobile: +39 331 66 62 385 - E-MAIL: carlotta.l@cranchi.it - website: www.cranchi.com.

2.Purpose, legal basis of processing and data processed

	Purpose	Legal basis and nature of contribution	Type of data
a	Methods of participation in the boat show through the reference dealer. (https://www.cranchi.com/it/contacts/boat-show-registration) Administrative management and operations necessary to ensure access to the boat show	Execution of pre-contractual measures taken at the request of the data subject and/or execution of a contract to which the data subject is a party (Art. 6(1)(b) GDPR). The provision of data is mandatory, and in case of refusal to provide personal data, it will not be possible for the Holder to provide the service.	Identification and contact information: First name, last name, e-mail address, telephone number, Tax code, City, Country of residence, Country of mooring, sailing area, other data that may be fonished by the customer because of his requests
b	Recording invoices, receiving payments; Fulfilling pre-contractual, contractual and tax obligations arising from the customer relationship; Fulfilling obligations under the law, a regulation, EU legislation or an order of the Authority	Legal obligation to which the owner is bound (Art. 6(1)(c) GDPR). The provision of data is mandatory, and in case of refusal to provide personal data, it will not be possible for the Holder to provide the service.	Identification and contact information: First name, last name, place and date of birth, e-mail address, phone number
c	Exercise the rights of the Owner, such as any right of defense in court.	Legitimate interest of the data controller (Art. 6(1)(f) GDPR): right of defense fairly balanced with the same right of data subjects	identifying and contact data: First name, last name, e-mail address, telephone number, Tax code, City, Country of residence, and data necessary for legal defense

3. Methods of processing

Processing is carried out using both manual and computerized methods and with the support of paper, computer or otherwise automated means.

In any case, the processing of data is carried out with the adoption of all appropriate measures to ensure the security and confidentiality of personal data, in particular in compliance with the security measures referred to in Article 32 of European Regulation No. 2016/679 and in accordance with the principles of lawfulness, necessity and proportionality.

4. Data Retention

Data are processed and stored on the tools used (e.g., computers) by the owner. Personal and special data of data subjects are stored separately from the works and drawings made during the course of therapy.

The Holder will retain personal data for as long as necessary to fulfill the above purposes.

Specifically : 24 months for records of boat show access operations.

5. Reporting and transmission of data

Data are not subject to communication and dissemination to third parties, except for obligations arising from the law.

Personal data may be transmitted to:

• Third parties carrying out activities on behalf of the Controller as Data Processors appointed pursuant to Article 28 of the European Regulation 2016/679, (by way of example hosting services and IT services)
• Credit Institutions
• Insurance companies
• Law firms for the management of any litigation and the exercise of the Holder's right of defense
• Reference Dealer

More information regarding the subjects listed above is available from the Holder's office.

6. Transfer of data outside the EU

In the management of the relationship with customers, there is no transfer of data to third countries nor to international organizations.

Should it become necessary to make transfers of personal data outside the territory of the European Union to countries not considered adequate by the European Commission, the Controller will ensure that appropriate or adequate safeguards are in place to protect personal data and that the transfer of such data complies with applicable data protection laws.

Any transfer of data subjects' data to countries located outside the European Union will, in any case, take place in compliance with the appropriate and adequate safeguards for the purposes of the transfer itself, in accordance with the applicable legislation and in particular Articles 45 and 46 of the Regulations.

Accordingly, where required by applicable data protection laws, the Owner will ensure that service providers sign Standard Contractual Clauses approved by the European Commission.

7. Rights of data subjects (Art. 15 et seq. of the GDPR).

Art. 15 Right of access, the right to know whether any processing of one's personal data is taking place and - if confirmed - to obtain a copy of such data and to be informed about: the origin of the data; the categories of personal data processed; the recipients of the data; the purposes of the processing; the existence of automated decision making, including profiling; the period of data retention; the rights provided by the Regulation. The Right to lodge a complaint at any time with the Supervisory Authority (Garante Privacy: Piazza Venezia nr. 11, 00187 ROMA, Tel. +39 06 696771 - PEC: protocollo@pec.gpdp.it); Art. 16 Right of the data subject to obtain the updating, rectification or integration of personal data; Art. 17 Right to erasure and the right to be forgotten; Art. 18 Right to restriction of processing, when provided for; Art. 19 Obligation of the data controller to notify rectification, erasure and/or restriction; Art. 20 Right to data portability: the right to request that the data provided to the data controller be transferred to another data controller, where the processing is based on your consent or on a contract with you and is carried out by automated means; Art. 21 Right to object, at any time on grounds relating to your particular situation, where the processing is carried out in the exercise of public authority or in the performance of a task carried out in the public interest, or without the need to give reasons for the objection, when the data are processed for direct marketing purposes; Art. 22 Right not to be subjected to a decision based solely on an automated process, including profiling.

8. automated processing

No automated data processing is carried out.

9. Instances of interested parties

The requests referred to in Art. 7 above may be submitted by the Data Subjects to the Data Controller by registered letter or e-mail to the addresses listed in Art. 1 above.

Information on the processing and protection of personal data (doc. C7.1)

 

Pursuant to the combined provisions of European Regulation 2016/679 (General Data Protection Regulation, hereinafter "GDPR") and Legislative Decree 196/2003 as amended (Legislative Decree 101/2018)

 

ART. 1. DATA CONTROLLER (THE PERSON OR COMPANY THAT DECIDES HOW AND WHY TO PROCESS DATA).

The data controller (hereinafter referred to as "Data Controller") is: Cantiere Nautico Cranchi S.p.A. - Via Nazionale, 1319 - 23010 Piantedo (Italy), Reference: sales@cranchi.it - Mrs. Desiree Fischietti - Phone : +39 0342 683359- website: www.cranchi.com.

 

2. PURPOSE, LEGAL BASIS OF PROCESSING AND DATA PROCESSED.

 

	Purpose	Legal basis and nature of contribution	Type of data
a	The Data Controller, in order to enable the purchase of its products and/or services, as well as to follow up on your requests needs to collect some of your Personal Data, as requested within the subscription or purchase form	- Execution of pre-contractual measures taken at the request of the data subject and/or execution of a contract to which the data subject is a party (Art. 6(1)(b) GDPR).	Identification and contact information: First name, last name, e-mail address, telephone number, tax code, City, Country of residence, Country of berth, sailing area, other data that may be provided by the customer
b	Recording invoices, receiving payments; Fulfilling pre-contractual, contractual and tax obligations arising from the customer relationship; Fulfilling obligations under the law, a regulation, EU legislation or an order of the Authority	-Legal obligation to which the owner is bound (Art. 6(1)(c) GDPR). The provision of data is mandatory, and in case of refusal to provide personal data, it will not be possible for the Holder to provide the service.	Identification and contact information:  First name, last name, place and date of birth, e-mail address, phone number
c	Exercise the rights of the Owner, such as any right of defense in court.	Legitimate interest of the data controller (Art. 6(1)(f) GDPR): right of defense fairly balanced with the same right of data subjects	Identifying and contact data:  First name, last name, e-mail address, telephone number, Tax code, City, Country of residence, and data necessary for legal defense

 

 

3. METHOD OF TREATMENT 

Processing is carried out using both manual and computerized methods and with the support of paper, computer or otherwise automated means.

In any case, the processing of data is carried out with the adoption of all appropriate measures to ensure the security and confidentiality of personal data, in particular in compliance with the security measures referred to in Article 32 of European Regulation No. 2016/679 and in accordance with the principles of lawfulness, necessity and proportionality.

4. DATA RETENTION

Data are processed and stored on the tools used (e.g., computers) by the owner. Personal and special data of data subjects are stored separately from the works and drawings made during the course of therapy.

The Holder will retain personal data for as long as necessary to fulfill the above purposes.

Specifically : 5 years for accounting and law purposes.

 

 

5. REPORTING AND TRANSMISSION OF DATA

Data are not subject to communication and dissemination to third parties, except for obligations arising from the law.

Personal data may be transmitted to:

Third parties carrying out activities on behalf of the Controller as Data Processors appointed pursuant to Article 28 of the European Regulation 2016/679, (by way of example hosting services and IT services)

Credit Institutions

Insurance companies

Law firms for the management of any litigation and the exercise of the Holder's right of defense

More information regarding the subjects listed above is available from the Holder's office.

 

6. TRANSFER OF DATA OUTSIDE THE EU

In the management of the relationship with customers, there is no transfer of data to third countries nor to international organizations.

Should it become necessary to make transfers of personal data outside the territory of the European Union to countries not considered adequate by the European Commission, the Controller will ensure that appropriate or adequate safeguards are in place to protect personal data and that the transfer of such data complies with applicable data protection laws.

Any transfer of data subjects' data to countries located outside the European Union will, in any case, take place in accordance with the appropriate and adequate safeguards for the purposes of the transfer itself, pursuant to the applicable legislation and in particular Articles 45 and 46 of the Regulations.

Accordingly, where required by applicable data protection laws, the Owner will ensure that service providers sign Standard Contractual Clauses approved by the European Commission.

 

7. RIGHTS OF DATA SUBJECTS (ART. 15 ET SEQ. OF THE GDPR).

Art. 15 Right of access, the right to know whether any processing of one's personal data is taking place and - if confirmed - to obtain a copy of such data and to be informed about: the origin of the data; the categories of personal data processed; the recipients of the data; the purposes of the processing; the existence of automated decision making, including profiling; the period of data retention; the rights provided by the Regulation. The Right to lodge a complaint at any time with the Supervisory Authority (Garante Privacy: Piazza Venezia nr. 11, 00187 ROMA, Tel. +39 06 696771 - PEC: protocollo@pec.gpdp.it); Art. 16 Right of the data subject to obtain the updating, rectification or integration of personal data; Art. 17 Right to erasure and the right to be forgotten; Art. 18 Right to restriction of processing, when provided for; Art. 19 Obligation of the data controller to notify rectification, erasure and/or restriction; Art. 20 Right to data portability: the right to request that the data provided to the data controller be transferred to another data controller where the processing is based on your consent or a contract entered into with you and is carried out by automated means; Art. 21 Right to object, at any time on grounds relating to your particular situation, where the processing is carried out in the exercise of public authority or in the performance of a task carried out in the public interest, or without the need to give reasons for the objection, when the data are processed for direct marketing purposes; Art. 22 Right not to be subjected to a decision based solely on an automated process, including profiling.

 

8. AUTOMATED PROCESSING

No automated data processing is carried out.

 

9. INSTANCES OF INTERESTED PARTIES.

The requests referred to in Article 7 above may be submitted by the Data Subjects to the Data Controller by registered letter or electronic mail to the addresses listed in Article 1 above.

Information on the protection of personal data

updated to the New EU Regulation No. 679/2016 (GDPR) (and subsequent provisions of legislative adaptation to the Italian Law 196/2003 as per Legislative Decree 101/2018). Doc C10:1)

 

CANDIDATES

Pursuant to and in accordance with Article 13 of the European Regulation 2016/679 (General Data Protection Regulation, hereinafter "GDPR") and Legislative Decree 196/2003 as amended (Legislative Decree 101/2018), the company in the person of its pro-tempore legal representative, as the Data Controller (hereinafter "Data Controller"), informs of the following.

1. DATA CONTROLLER

The data controller is the company Cantiere Nautico Cranchi S.p.A. - Via Nazionale, 1319 - 23010 Piantedo (Italy) - Reference: angelo.m@cranchi.it - Mr. Angelo Maroni - Direct +39 0342 015 023 website: www.cranchi.com

 

2. PURPOSE AND LEGAL BASIS FOR PROCESSING

The acquisition and processing of personal data voluntarily provided in connection with and as a result of the contract with clients or voluntarily provided to request information is necessary for the Owner to fulfill the requests of job applicants for job poiitions, to execute the contract itself, and to fulfill the related obligations under accounting and tax regulations.

Specifically, the purposes of processing are:

• purposes related to the execution of pre-contractual negotiations:
  a) Managing the process of selecting and evaluating candidates for inclusion in the corporate organization, including evaluating individuals to fill positions sought;

The legal basis legitimizing the processing of data for the purposes specified above is the performance of pre-contractual negotiations requested by the data subject is party (art. 6 no. 1 letter b) GDPR). In connection with the evaluation of the application, the Data Controller may also process special personal data pursuant to Article 9 GDPR, such as, but not limited to, those revealing state of health or religious beliefs or trade union membership.
The legal basis legitimizing the processing in this case is the specific and informed free consent of the data subjects (Art. 6 No. 1 letter a) of the GDPR).In case consent is not given, it will not be possible to evaluate the application.
Data subjects have the right to revoke their consent at any time, but processing carried out before revocation remains lawful. After revocation, the data controller will cease processing the data for which consent is required (Art. 7 No. 3 GDPR).

• Purposes related to the fulfillment of legal obligations:
  b) Fulfilling obligations under the law, with reference to possible subsequent employment.

The legal basis legitimizing the processing of data for the purposes specified above is the fulfillment of legal obligations (Art. 6 No. 1 letter c) of the GDPR).

• Purposes related to the legitimate interest of the Owner:
  c) Protection of the holder's rights and exercise of the right of defense in case of litigation.

The legal basis legitimizing the processing of data for the purposes specified above is the legitimate interest of the Data Controller (Art. 6 No. 1 letter f) of the GDPR), which in this case is fairly balanced with the rights and freedoms of the data subjects.

• Purposes requiring consent:

The Controller may process special data ex art. 9 GDPR such as but not limited to: health status, membership in protected categories, disability, or union membership, etc.
The legal basis legitimizing the processing of data for the purposes specified above is the consent freely given by the data subject (Art. 6 No. 1 letter a) of the GDPR).

 

3. DATA PROCESSED AND MODE OF PROCESSING

The Controller processes the personal data of the data subject, such as:

Personal and identification data: (such as, for example, name, date of birth, place of birth, nationality, social security number, marital status, occupation, etc.);

• • Contact information (such as, address, e-mail address, phone number, etc.);
• • Data on education, professional experience and previous activities;
• • Special categories of personal data (such as, for example, health status, union membership, etc.) only to the extent that such information is contained in the cv
• • Photo as it is on the cv

Processing is carried out in both manual and computerized ways and with the support of paper, computer (management software, accounting, etc.) or otherwise automated and telematic means.

In any case, the processing of data is carried out with the adoption of all appropriate measures to ensure the security and confidentiality of personal data, in particular in compliance with the security measures referred to in Article 32 of European Regulation No. 2016/679 and in accordance with the principles of lawfulness, necessity and proportionality.

 

4. Data Retention

The Data Controller will retain personal data for as long as necessary to fulfill the purposes set forth in Paragraph 2 above, specifically for the duration of the selection process and for 3 years from the collection of the information.

Personal data may be retained until the expiration of the period of prescription and/or forfeiture of legal claims arising from the relationship between the Holder and the interested parties, and in the case of any litigation in progress, for as long as the litigation lasts, in order to allow the exercise of the Holder's right of defense in and out of court.

 

5. REPORTING AND TRANSMISSION OF DATA

Data are not subject to communication and dissemination to third parties, except for obligations arising from the law.

Personal data may be transmitted to, but not limited to:

• Third parties carrying out activities on behalf of the Data Controller as Data Processors appointed pursuant to Article 28 of the European Regulation 2016/679, (by way of example, IT services), to the extent strictly necessary to achieve the purposes set out in paragraph 2 above
• Employees and contractors of the Owner, duly authorized for processing by the Owner as part of the performance of their work activities
• Credit Institutions
• Insurance companies
• Law firms for the management of any litigation and the exercise of the Holder's right of defense.

 

6. TRANSFER OF DATA OUTSIDE THE EU

The Holder informs that it has no intention to make any data transfers to Third Countries nor to international organizations.

Any transfer of data subjects' data to countries located outside the European Union will, in any case, take place in accordance with the appropriate and adequate safeguards for the purposes of such transfer, pursuant to the applicable legislation and in particular Articles 45 and 46 of the Regulations.

 

7. RIGHTS OF DATA SUBJECTS (ART. 15 ET SEQ. OF THE GDPR)

In your capacity as a user of our services and recipient of our products you have the following rights:

-Right to access your data, obtain confirmation of the existence or otherwise of personal data concerning you, even if not yet registered, and their communication in intelligible form; -obtain indication of: (a) the origin of the personal data; (b) the purposes and methods of processing; (c) the logic applied in the case of processing carried out with the aid of electronic instruments; (d) the identification details of the data controller, data processors and the data controller's representative and the persons authorized to process the data; and (e) the subjects or categories of subjects to whom the personal data may be communicated or who may become aware of the data in their capacity as designated representative in the territory of the State, data processors or persons authorized to process the data; (Art. 15 GDPR).

• Right to update, rectify or, when interested, supplement data; (Art. 16 GDPR).
• Right to erasure, transformation into anonymous form or blocking of data processed in violation of the law, including data whose retention is not necessary in relation to the purposes for which the data were collected or subsequently processed ; (art. 17 GDPR).
• Right to request the restriction of use of data for the sole reasons of public interest and for the establishment or defense of a right, in cases where the data subject disputes the accuracy of the data and processing, in the case of exercising the right to object to processing under Article 21 GDPR, and in the other cases provided for in Article 18 GDPR; (Article 18 GDPR).
• Right to receive the personal data provided to the Data Controller in a structural format or on a commonly used, intelligible and accessible computer medium for any operating system (USB or duly encrypted ZIP file), and to move without constraints, the complexes of information and data concerning you from the present controller to another controller chosen by you in accordance with your purposes and in full compliance with the principles of transparency, lawfulness and proportionality of processing.This right to data portability is without prejudice to other rights; (Art. 20 GDPR).
• Right to object, in whole or in part:
  a) on legitimate grounds to the processing of personal data concerning you, even if relevant to the purpose of collection;b) to the processing of personal data concerning you for any other purpose not relevant to the processing; (Art. 21 GDPR).
• Right to withdraw consent, where provided and at any time. Revocation of consent does not affect the lawfulness of the processing based on the consent given before revocation;
• Right to file a complaint with the supervisory authority

 

8.WAYS OF EXERCISING RIGHTS

You may at any time exercise your rights by sending a request by email to the email address in paragraph 1. and you may also exercise your rights by contacting the Privacy Guarantor, with Headquarters in Piazza Venezia n. 11 - 00187 Rome, Telephone switchboard: (+39) 06.696771,Fax: (+39) 06.69677.3785. For general information you can send an e-mail to: garante@gpdp.it @pec.it