This information notice (the “Notice”) is provided in relation to the processing of personal data of users of the App “MOTO.IT – Used motorcycles” and the websites Moto.it, Automoto.it, Vetrinamotori.it (the “Sites” or, individually, each of these, the “Site”).
1. Data Controller
The Data Controller is the company CRM Srl, with registered office in Via Melzo 9, 20129, Milan (MI), VAT number 11921100159 (hereinafter simply “CRM”, the “Company” or the “Data Controller”).
To resolve any doubts about how the Company processes personal data, you can always contact the Company at the following addresses:
• at the e-mail address [email protected] ; or
• by post, at the address via Melzo 9, 20129, Milan (MI).
2. Data collected
We collect personal data from users when they communicate it, for example by visiting the Sites, registering for an account on the Sites, sending requests through the forms on the Sites or by communicating via email, or by contacting us at the telephone numbers indicated on each Site (the “Data” or “Personal Data”).
We may also automatically collect certain personal data when you access, use or interact with us through our Sites.
2.1 Data you provide us through the Sites
We collect the Data you provide voluntarily, for example by registering for one of the Sites, communicating with us or sending requests by filling out the online forms on each Site.
The personal data you may communicate to us in these ways include:
• your name and surname;
• your userid;
• your residential and/or domicile address;
• the email address used when registering for an account on each Site;
• your gender;
• your telephone number;
as well as any additional personal data that you intend to communicate to us (relating, for example, in the case of car and motorcycle dealers, to your professional activity, to the relevant company and contact details, as well as to those of one or more sales representatives).
2.2 Data that we may collect automatically
On our Sites we use cookies and similar technological tools (collectively “Cookies”) to collect and store data relating to the use, access or interaction with us through each Site. We may, for example, collect data regarding the type of tool used to access each Site, the operating system, your IP address, your general geographic location indicated by your IP address, the type of browser used, the content that you view and access through the Sites, the ways in which you interact with the content available on the Sites and the keywords entered for the search on each Site. For further information regarding the use of Cookies, click here .
2.3 Data we may collect from other sources
We may receive Data relating to you from other sources, for example when you communicate with us by sending e-mails to the contact indicated on the Sites.
3. Purpose of Data Processing
The purposes for which your Data will be processed are the following:
a) for the purposes of registering a user on each Site and to use the services reserved for holders of a personal account (such as, for example, the possibility of publishing adverts);
b) to be able to use the services even as a guest of each Site, for example to report a suspicious advert;
c) for the management and technical administration of each Site;
d) to correctly receive and process requests for information and contact received and the services requested (such as, for example, the “Ask the dealer” messaging service);
e) marketing of the Data Controller: to send you communications about initiatives, commercial offers, questionnaires and market research of the Data Controller through digital channels (for example via e-mail);
f) marketing of third parties: to send you communications about initiatives, commercial offers, questionnaires and market research of third-party companies, partners of the Data Controller, through digital channels (for example via e-mail);
g) communication/transfer of Data to third parties: for the communication of Your Data to third-party companies, which will process Your Data as independent controllers such as, for example, motorcycle and car manufacturers or dealers, insurance companies, finance companies, and to verify the level of customer satisfaction with the products and services offered.
4. Legal basis for processing
The legal bases on which the Data Controller bases the processing of your Data are:
i. for the service purposes referred to in points a), b), c) and d) of paragraph 3, the execution of a contract to which the interested party is a party or of the pre-contractual measures adopted at the request of the same: the use of your Data is necessary for the execution of the measures requested by you, such as for example registration on each Site, the response to your requests for information and for the correct management and technical administration of the Sites.
ii. for the purposes referred to in points e), f) and g) of paragraph 3 consent: the Data Controller will base the processing of your Personal Data on your separate, explicit and prior consent for direct and third-party marketing activities and for the transfer of the Data to third-party companies.
The consent given may be revoked at any time using similar methods to those provided for its granting, by contacting us at the contact details indicated at the bottom of this Policy, without prejudice to the lawfulness of the processing based on consent prior to its revocation.
The provision of Personal Data for the purposes a), b), c) and d) of paragraph 3 on the legal basis referred to in the previous romanino i. is mandatory and necessary for the correct execution of the contractual and pre-contractual measures requested. Any refusal, partial or total, to provide the Data for these purposes will make it impossible for the Data Controller to execute them and to be able to use the requested services (such as, for example, the “Ask the dealer” messaging service), as well as benefit from the features reserved for users registered on the Sites (such as, for example, the possibility of publishing advertisements).
The provision of Personal Data for the purposes e), f) and g) of paragraph 3 on the legal basis referred to in the previous romanino ii. is instead completely optional; any refusal, partial or total, to provide the Data for these purposes will make it impossible for the Data Controller to send you promotional communications from itself or from third parties.
In any case, your Personal Data may be processed, where necessary, also for the following purposes and legal bases:
h) For the need to fulfill legal obligations and, in particular, to fulfill obligations set forth by regulations and by applicable national and supranational legislation (tax, administrative obligations, etc.);
i) On the basis of a legitimate interest (legal protection), to ascertain, exercise or defend the rights of the Data Controller in court and/or out of court. This legitimate interest, given the constitutionally guaranteed interest in defense in court by the Data Controller and the negligible impact on the sphere of privacy of the interested parties, as well as their reasonable expectation, is to be considered prevalent.
5. Recipients of the Data
The Data may be known and processed by employees of the company functions responsible for pursuing the purposes indicated above, who have been expressly authorised to process them and who have received adequate operating instructions.
Furthermore, the Data may be communicated to third parties. In this case, the third party recipients of the Data – independent data controllers or duly designated as data processors – belong to the following categories:
A. external subjects operating as independent data controllers such as, for example, supervisory and control authorities and bodies and in general to subjects, including private individuals, authorised to request the data (such as accounting consultants, legal consultants), Public Authorities who make an express request for administrative or institutional purposes, in accordance with the provisions of the current national and European legislation and, where necessary, upon your explicit request, to motorcycle and car manufacturers or dealers;
B. subjects external to the Company who provide services to the Company and who are useful for its activities (for example: IT service providers for the management of databases including contacts and emails, digital service providers and IT consultants who provide technical assistance to the Data Controller, companies that offer support in carrying out market research); these subjects have received a specific assignment as data controllers and their names are available upon request to the Data Controller, using the contact details indicated in the following Paragraph 8.
6. Methods of processing, security and storage of Personal Data collected
The Data Controller and the parties it uses process the Data using electronic tools, according to logics strictly related to the purposes themselves and in any case in a way that guarantees the security and confidentiality of the Personal Data.
The Data Controller has adopted adequate administrative, technical and organizational measures to guarantee the security of the personal data collected. In any case, please note that the Data Controller is not responsible for the security of the information that you transmit using networks that are not under the control of the Data Controller, such as the Internet and wireless networks.
The Data Controller will retain the Personal Data collected for the period of time reasonably necessary to fulfill the purposes pursued and in any case:
• for the Data processed for the purposes referred to in points a), b), c) and d) of paragraph 3, for the entire duration of the contractual relationship and, upon termination of the same for any reason, for a period equal to the ordinary limitation period of 10 years;
• for the Data processed for the purposes referred to in points e), f) and g) of paragraph 3, for a maximum of 24 months from the date of collection of the Data for such purposes;
• for the Data processed for the purposes referred to in point h) of paragraph 3, for the entire duration provided by law for the processing for the fulfillment of legal obligations (10 years in the case of administrative-accounting obligations);
• for the Data processed for the purposes referred to in point i) of paragraph 3, in the case of legal disputes, for the entire duration of the same, until the terms for the exercise of appeal actions have expired, for the processing for the judicial protection of the Data Controller on the basis of his legitimate interest.
7. Transfer of Data outside the European Union
The processing of your Data will be carried out at the Data Controller’s offices and the Data will be stored on servers and/or archives both within the European Union.
In the event of any transfers of Data outside the European Union to countries for which no adequacy decision has been adopted by the European Commission, the Data Controller will adopt the appropriate guarantees referred to in Article 46 of the GDPR, and, specifically, the Standard Clauses prepared by the European Commission, integrated where necessary with additional security measures to ensure the effective security of the transfers carried out.
8. Your rights
Users, as interested parties (i.e., subjects to whom the Data refers), are holders of rights granted by the GDPR. In particular, pursuant to articles 15-22 of the GDPR, interested parties have the right to request and obtain, at any time, access to their Personal Data, information on the processing carried out, the rectification and/or updating of Personal Data, erasure and limitation of processing. Furthermore, they also have the right to object to processing and to request data portability (i.e. to receive Personal Data in a structured, commonly used, machine-readable format). Finally, interested parties always have the right to withdraw their consent at any time (this, in any case, will not affect the lawfulness of processing carried out on the basis of consent given before withdrawal) and to lodge a complaint with a supervisory authority (in Italy: the Guarantor for the Protection of Personal Data).
The above rights may be exercised at any time, by means of a simple request to the Data Controller to be sent:
– to the e-mail address [email protected] ; or
– by post, to the address via Melzo 9, 20129, Milan (MI).