Privacy Policy

We take privacy and security very seriously, and all our actions are aimed at ensuring and guaranteeing the highest standards of security and confidentiality. We take pride in being able to ensure these high standards, which we consider a distinguishing feature in our relationship with our users, and we are committed to continuing to evolve and improve, always in the spirit of transparency and fairness. We therefore invite you to carefully read the information provided in our privacy policies: they contain useful details regarding the processing of your personal data in connection with the provision by our company, DRORYS SUD S.p.A., of the services you have requested through our website.

DATA CONTROLLER AND GENERAL INFORMATION

DRORYS SUD S.p.A., with headquarters at Viale San Nicola, 12, 84020 Palomonte, Salerno, Italy, is the data controller for the personal data provided by users.
DRORYS SUD S.p.A. is committed to safeguarding users’ right to the protection of their personal data.

This Privacy Policy is provided to users in accordance with and for the purposes of national and European legislation on the protection of personal data, which refers to Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016, on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (GDPR), as well as any other personal data protection legislation applicable in Italy, including the provisions issued by the Data Protection Authority.

We recommend that you read the following carefully to understand our policies and practices regarding Personal Data and how it will be processed.

DATA CONTROLLERS

The Data Controller engages data processors to achieve the purposes set forth below and has appointed a Data Protection Officer (DPO) to oversee the protection of personal data.

Please note that you may contact the Data Protection Officer at any time to submit any questions or requests regarding your personal data and the protection of your privacy by writing to info@drorys.it

TYPES OF DATA COLLECTED

The Personal Data collected by this Application, either directly or through third parties, may include: email address, first name, last name, date of birth, gender, shipping address, ZIP code, city of delivery, cell phone number, tax ID or VAT number, cookies, and Application Usage Data. If the User signs up using social media authentication methods, DRORYS SUD S.p.A. will access certain personal data (e.g., first name, last name, email, etc.) in the User’s social media account in accordance with the applicable terms of use of the specific social media platform.

Personal Data may be provided directly by the User or, in the case of Usage Data, collected automatically during the use of this Application.

Unless otherwise specified, all Data requested by this Application is required. If the User refuses to provide it, this Application may be unable to provide the Service. In cases where this Application indicates that certain Data is optional, Users are free to choose not to provide such Data, without this having any impact on the availability of the Service or its functionality.
Users who have questions about which Data is required are encouraged to contact the Data Controller.

Any use of cookies (or other tracking tools) by this Application or by the providers of third-party services used by this Application, unless otherwise specified, is intended to provide the Service requested by the User, in addition to the other purposes described in this document and in the Cookie Policy, if available.

The User assumes responsibility for the Personal Data of third parties obtained, published, or shared through this Application and warrants that they have the right to communicate or disclose such data, thereby releasing the Data Controller from any liability toward third parties.

METHODS AND LOCATION OF PROCESSING OF COLLECTED DATA

Methods of Processing

The Data Controller implements appropriate security measures to prevent unauthorized access, disclosure, alteration, or destruction of Personal Data.

Processing is carried out using IT and/or telecommunications tools, with organizational procedures and logic strictly related to the stated purposes.

In addition to the Data Controller, in some cases, other parties involved in the operation of this Application (administrative, sales, marketing, and legal staff, as well as system administrators) or external parties (such as administrative and accounting service providers, couriers and logistics operators, hosting providers and systems engineering service providers, payment collection service providers, IT companies, and online marketing firms) who may also be appointed, if necessary, as Data Processors by the Data Controller. An updated list of Data Processors may always be requested from the Data Controller. These service providers have access only to the personal data necessary to perform their tasks. We guarantee that they may not use such Data for any other purposes and are further required to process Personal Data in accordance with this Privacy Policy and in compliance with applicable data protection laws.

Legal Basis for Processing

The Data Controller processes Personal Data relating to the User if one of the following conditions applies:

  • the User has given consent for one or more specific purposes;
  • the processing is necessary for the performance of a contract with the User and/or for the implementation of precontractual measures;
  • the processing is necessary to comply with a legal obligation to which the Data Controller is subject;
  • the processing is necessary for the performance of a task carried out in the public interest or for the exercise of official authority vested in the Data Controller;
  • the processing is necessary for the purposes of the legitimate interests pursued by the Data Controller or by a third party.

In any case, you may always ask the Data Controller to clarify the specific legal basis for each processing activity and, in particular, to specify whether the processing is based on law, provided for by a contract, or necessary to enter into a contract.

Location

The Data is processed at the Data Controller’s headquarters and at any other location where the parties involved in the processing are located.

The User’s Personal Data may be transferred to a country other than the one in which the User is located, including outside the European Union. When such a transfer occurs, we ensure that it is carried out in accordance with this Privacy Policy and that adequate protection is guaranteed.

Should any of the transfers described above take place, the User may refer to the relevant sections of this document or request information from the Data Controller by contacting the Data Controller using the contact details provided at the beginning of this document.

Retention Period

Data is processed and retained for as long as necessary to fulfill the purposes for which it was collected. Generally speaking, data will be retained until:

  • for Users with addresses in geographic areas served by , the later of:
  • the fifth anniversary following the User’s last use of our Platform or their last active interaction with DRORYS SUD S.p.A.;
  • the fifth anniversary following the closure of the account if the User has taken advantage of a “member-get-member” promotion or has been identified as involved in a transaction suspected of fraud.
  • For Users with addresses in geographic areas not served by DRORYS SUD S.p.A., the tenth anniversary following registration on the Platform.

The following categories of data may be retained for additional periods:

  • Financial and accounting data (e.g., invoices, payments, refunds, etc.) are retained for the duration required by applicable tax and accounting laws;
  • All user-generated content (e.g., purchased products, behavior patterns) is anonymized but remains available for our analysis in aggregated form.

At the end of the retention period, Personal Data will be deleted. Therefore, upon expiration of this period, the rights of access, erasure, rectification, and data portability can no longer be exercised.

PURPOSES OF PROCESSING THE COLLECTED DATA

User Data is collected to enable the Data Controller to provide and optimize its Services and, in particular, to:

  1. identify the User, which is necessary to access the Application and related products and services, as well as to enable the proper provision of user support;
  2. to complete the order and manage payment collection, with the necessary controls and security measures in place for the transaction;
  3. preparing and delivering orders;
  4. manage order invoicing and complete related administrative and tax processes;
  5. providing after-sales support and managing support and contact requests;
  6. the development of marketing activities related to our Services, as well as to analyze and understand our customers in order to improve our service (including the user interface experience) and optimize the selection of products offered.

To obtain further information regarding the Personal Data specifically relevant to each purpose, the User may request information from the Data Controller by contacting them using the contact details provided at the beginning of this document.

USER RIGHTS

Users may exercise certain rights with respect to the Data processed by the Data Controller. In particular, the User has the right to:

  • withdraw consent at any time. The User may withdraw previously given consent to the processing of their Personal Data.
  • object to the processing of their Data. The User may object to the processing of their Data when it is based on a legal basis other than consent. Further details on the right to object are provided in the section below.
  • access their Data. The User has the right to obtain information about the Data processed by the Data Controller, about certain aspects of the processing, and to receive a copy of the processed Data.
  • Verify and Request Rectification. The User may verify the accuracy of their Data and request that it be updated or corrected.
  • To obtain restriction of processing. Under certain conditions, the User may request that the processing of their Data be restricted. In such cases, the Data Controller will not process the Data for any purpose other than storage.
  • To obtain the erasure or removal of their Personal Data. When certain conditions apply, the User may request that the Data Controller erase their Data.
  • Receive their Data or have it transferred to another data controller. The User has the right to receive their Data in a structured, commonly used, and machine-readable format and, where technically feasible, to have it transferred without hindrance to another data controller. This provision applies when the Data is processed by automated means and the processing is based on the User’s consent, on a contract to which the User is a party, or on contractual measures related thereto.
  • File a complaint. The User may file a complaint with the competent data protection supervisory authority or seek legal redress.

Details on the Right to Object

When Personal Data is processed in the public interest, in the exercise of official authority vested in the Data Controller, or to pursue a legitimate interest of the Data Controller, Users have the right to object to the processing for reasons related to their particular situation.

Users are advised that they may opt out of receiving newsletters from the Data Controller at any time and without providing any reason. To do so, Users are invited to visit the “Preferences” subsection within the “Profile” section of the website www.drorys.it or the DRORYS SUD S.p.A. app.

How to Exercise Your Rights

To exercise their rights, Users may submit a request using the Data Controller’s contact information provided in this document. Requests are processed by the Data Controller as quickly as possible, and in any case within one month.

This App uses cookies. To learn more and to view the detailed policy, Users may consult the Cookie Policy.

ADDITIONAL INFORMATION ON DATA PROCESSING

Legal Defense

The User’s Personal Data may be used by the Data Controller in legal proceedings or during the preparatory stages leading up to such proceedings to defend against any misuse of this Application or related Services by the User.

The User acknowledges that the Data Controller may be required to disclose the Data pursuant to an order from public authorities.

Specific Notices

At the User’s request, in addition to the information contained in this privacy policy, this Application may provide the User with additional, context-specific notices regarding specific Services or the collection and processing of Personal Data.

System Logs and Maintenance

For operational and maintenance purposes, this Application and any third-party services it uses may collect system logs: files that record interactions and may also contain Personal Data, such as the User’s IP address.

Information Not Included in This Policy

Any further information regarding the processing of Personal Data may be requested at any time from the Data Controller using the contact details provided.

Response to “Do Not Track” Requests

This Application does not support “Do Not Track” requests.
To find out whether any third-party services used by this Application support them, the User is encouraged to consult their respective privacy policies.

Changes to this Privacy Policy

The Data Controller reserves the right to make changes to this privacy policy at any time by notifying Users on this page. Please check this page regularly, referring to the “Last Updated” date at the bottom. If the User does not accept the changes made to this privacy policy, the User must stop using this Application and may request that the Data Controller delete their Personal Data. Unless otherwise specified, the previous privacy policy will continue to apply to Personal Data collected up to that point.

LEGAL REFERENCES

This privacy policy is prepared in accordance with Regulation (EU) 2016/679 and Directive 2009/136/EC regarding cookies.

DEFINITIONS USED

Personal Data (or Data)

Personal Data means any information that, directly or indirectly (including in combination with any other information, such as a personal identification number), identifies or makes a natural person identifiable.

Usage Data

This refers to information collected automatically through this Application (including from third-party applications integrated into this Application), such as: the IP addresses or domain names of the computers used by the User connecting to this Application, the Uniform Resource Identifier (URI) addresses, the time of the request, the method used to submit the request to the server, the size of the file received in response, the numerical code indicating the status of the server’s response (successful, error, etc.), the country of origin, the characteristics of the browser and operating system used by the visitor, the various products added to the shopping cart and, if applicable, purchased, various time-related aspects of the visit (for example, the time spent on each page), and details regarding the path taken within the Application, with particular reference to the sequence of pages viewed and parameters related to the User’s operating system and computing environment.

User

The individual using this Application who, unless otherwise specified, is the Data Subject.

Data Subject

The natural person to whom the collected Personal Data pertains.

Data Processor (or Processor)

The natural person, legal entity, public administration, or any other entity that processes personal data on behalf of the Data Controller, as set forth in this privacy policy.

Data Controller (or Controller)

The natural or legal person, public authority, agency, or other body that, alone or jointly with others, determines the purposes and means of the processing of personal data and the measures adopted, including security measures related to the operation and use of this Application. Unless otherwise specified, the Data Controller is the owner of this Application.

This Application

The hardware or software tool through which Users’ Personal Data is collected and processed, either via the website www.drorys.it or the DRORYS SUD S.p.A. mobile applications.

Service

The Service provided by this Application as defined in the relevant terms (if any) on this website/application.

European Union (or EU)

Unless otherwise specified, any reference to the European Union in this document is intended to extend to all current member states of the European Union and the European Economic Area.

A small piece of data stored on the User’s device.

Unless otherwise specified, this privacy policy applies exclusively to this Application.

Last updated: July 9, 2022