GDPR Compliance

Last updated: August 2024

Our Commitment to GDPR

Casa Legno is committed to compliance with the General Data Protection Regulation (EU) 2016/679 (GDPR). This page provides detailed information about how we handle personal data in accordance with this regulation.

Data Controller Information

As the data controller, Casa Legno is responsible for decisions about how your personal data is processed.

Casa Legno
Via delle Industrie 47
31033 Castelfranco Veneto (TV)
Italy
Email: [email protected]

Lawful Bases for Processing

We rely on the following lawful bases when processing personal data:

Contractual Necessity (Article 6(1)(b))

When you request a consultation or commission furniture, we process your data to fulfil our contractual obligations. This includes contact information, project specifications, and payment details.

Legitimate Interests (Article 6(1)(f))

We may process data based on legitimate business interests, such as:

• Improving our website functionality and user experience
• Analysing website traffic patterns
• Protecting against fraud and security threats

Consent (Article 6(1)(a))

For marketing communications and non-essential cookies, we obtain your explicit consent before processing. You may withdraw consent at any time.

Legal Obligation (Article 6(1)(c))

We process certain data to comply with legal requirements, including tax and accounting regulations.

Your Rights Under GDPR

Right of Access (Article 15)

You may request confirmation of whether we process your personal data and, if so, access to that data along with information about how it is processed.

Right to Rectification (Article 16)

You may request correction of inaccurate personal data or completion of incomplete data.

Right to Erasure (Article 17)

You may request deletion of your personal data in certain circumstances, including when data is no longer necessary for its original purpose or when you withdraw consent.

Right to Restriction (Article 18)

You may request restriction of processing in certain circumstances, such as when you contest data accuracy.

Right to Data Portability (Article 20)

You may request your personal data in a structured, commonly used, machine-readable format and have it transmitted to another controller.

Right to Object (Article 21)

You may object to processing based on legitimate interests or for direct marketing purposes.

Rights Related to Automated Decision-Making (Article 22)

We do not use automated decision-making or profiling that produces legal or similarly significant effects.

Exercising Your Rights

To exercise any of these rights, please contact us at [email protected]. We will respond to your request within one month. In complex cases, this period may be extended by two additional months.

We may request proof of identity before processing your request to ensure data security.

Data Protection Authority

If you believe your data protection rights have been violated, you have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali):

Garante per la protezione dei dati personali
Piazza Venezia 11
00187 Roma
Italy

International Transfers

Your personal data is primarily processed within the European Economic Area. If data is transferred outside the EEA, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses approved by the European Commission.

Data Retention

We retain personal data only for as long as necessary:

• Consultation requests: 2 years if no project proceeds
• Project records: 10 years (legal requirement for commercial records)
• Marketing consent records: Until consent is withdrawn plus 1 year
• Website analytics: 26 months

Updates to This Information

We may update this GDPR compliance information periodically. Significant changes will be communicated through our website.