Information

Information relating to users who access the services through the website www.cascospa.com is provided in accordance with Regulation (EU) 2016/679 ("GDPR") and Italian Legislative Decree No. 196/2003, as amended by Italian Legislative Decree No. 101/2018.

While browsing the website, information relating to users may be collected that constitutes personal data under applicable legislation. This privacy notice is provided exclusively for the website indicated above and does not apply to other third-party websites that the user may access through hyperlinks contained therein.

Data Controller

The Data Controller is CASCO S.P.A., with registered office at Via Alcide De Gasperi, 45 – 80133 – Napoli, Italian Tax Code and VAT No.: 05556401213.

The Data Controller can be contacted by email at: [email protected].

Purposes and Legal Bases of Processing

The personal data provided by users who access the services of the website www.cascospa.com is collected and processed by CASCO S.P.A. for the following purposes.

1. Contractual Purposes and Provision of Services

Legal basis: performance of a contract or steps taken prior to entering into a contract, pursuant to Article 6(1)(b) of the GDPR.

  • Management of registration for the website's services and the user's account.
  • Entering into, managing and performing contractual and commercial relationships relating to the products and services offered.

2. Compliance with Legal Obligations

Legal basis: compliance with a legal obligation, pursuant to Article 6(1)(c) of the GDPR.

  • Compliance with obligations imposed by laws, regulations or European Union legislation, particularly with regard to accounting, administrative and tax matters.

3. Communications Relating to Similar Products or Services (Soft Spam)

Legal basis: legitimate interest of the Data Controller, pursuant to Article 6(1)(f) of the GDPR and Article 130(4) of Italian Legislative Decree No. 196/2003.

  • Sending, by email, commercial and promotional communications relating exclusively to products or services similar to those already purchased or used by the user. The data subject has the right to object to such processing easily and at any time through the dedicated link included in each email.

4. Marketing and Newsletter

Legal basis: optional consent of the data subject, pursuant to Article 6(1)(a) of the GDPR.

  • Subject to the user's specific and freely given consent, subscription to the newsletter service and the sending of informational, advertising or promotional material or commercial communications relating to the products, offers and events of CASCO S.P.A., through automated means, such as email and SMS, or traditional means, such as postal mail and telephone contact.

Place of Processing and Contact Details

Processing operations related to the web services of www.cascospa.com take place at the registered or operational offices of CASCO S.P.A. and are managed exclusively by authorized and specifically instructed technical personnel.

Where necessary for the provision of services, for example web hosting services and cloud infrastructure management, data may be processed by third parties appointed as Data Processors pursuant to Article 28 of the GDPR. The servers used to provide the website are located within the territory of the European Union.

To request information about the processing of personal data or to exercise the rights provided for under Articles 15-22 of the GDPR, the Company may be contacted at the dedicated email address: [email protected].

Disclosure and Recipients of Personal Data

Personal data provided by users will under no circumstances be disseminated, meaning made available to unspecified parties.

Data may be disclosed to appropriately selected third parties acting as Data Processors pursuant to Article 28 of the GDPR, or as Independent Data Controllers, or may be processed by authorized persons operating under the direct authority of CASCO S.P.A., solely for the purpose of carrying out the activities necessary to provide the requested services.

In particular, data may be disclosed to the following categories of recipients:

  • Technical and IT service providers: web hosting companies, cloud infrastructure managers, software maintenance providers and IT support providers.
  • Operational and logistics service providers: carriers, postal couriers, packaging companies, labelling companies and companies involved in the shipment of promotional materials or products.
  • Consultants and independent professionals: law firms, accountants and administrative, accounting and tax consultants.
  • Platforms and communication service providers: providers of services for sending newsletters and marketing communications, such as direct email marketing (DEM) and SMS platforms.

This is without prejudice to the obligation of CASCO S.P.A. to disclose data to Judicial Authorities, Police Bodies or Law Enforcement Authorities in the cases provided for by law or following formal and explicit requests.

Transfer of Data Outside the European Economic Area (EEA)

Personal data is mainly processed within the European Economic Area. Where, for organizational or technical reasons, it is necessary to use providers located in third countries outside the EU, the transfer will take place exclusively in compliance with the conditions set out in Articles 44 et seq. of the GDPR, for example on the basis of Adequacy Decisions adopted by the European Commission or through the execution of Standard Contractual Clauses approved by the European Commission.

Browsing Data

The IT systems and software procedures used to operate the website www.cascospa.com acquire, during their normal operation, certain personal data whose transmission is implicit in the use of Internet communication protocols.

This category of data includes:

  • IP addresses or domain names of computers and devices used by users;
  • URI/URL addresses (Uniform Resource Identifier/Locator) of the requested resources;
  • time of the request, method used to submit the request to the server and size of the file received in response;
  • numerical code indicating the status of the response provided by the server, such as successful completion or error;
  • other parameters relating to the user's operating system and IT environment.

Purposes and Legal Basis of Processing

This data is processed solely for the purpose of:

  • obtaining aggregated and anonymous statistical information about the use of the website;
  • monitoring the proper operation of the infrastructure and web services;
  • ensuring network security and preventing or establishing possible liability in the event of cybercrime affecting the website or its users.

The legal basis for processing is the legitimate interest of the Data Controller, pursuant to Article 6(1)(f) of the GDPR, in ensuring the proper operation and security of the website.

Data Retention

Browsing data is retained for the period strictly necessary for the purposes indicated above, normally for no longer than 7-14 days, and is deleted immediately after aggregation, without prejudice to any need for investigation of criminal offences by the Judicial Authorities.

Use of Cookies

The website www.cascospa.com uses cookies and similar technologies to ensure the proper functioning of its procedures and to improve the user experience of online applications.

1. Technical Cookies (Strictly Necessary)

These cookies are essential for the proper functioning of the website and for managing browsing sessions, such as session identifiers. They are not permanently stored on the user's computer and disappear when the browser is closed. Their installation does not require the user's prior consent.

2. Analytics and Third-Party Cookies

The website may use analytics cookies, such as Google Analytics, to collect aggregated information about the number of users and how they use the website.

Where such cookies are not fully anonymized or where profiling or third-party cookies are used, for example embedded content such as maps or videos, they are installed exclusively after the user has given their free and explicit consent, provided through the information banner displayed upon first accessing the website.

Consent Management

Users can manage or modify their cookie preferences at any time through the dedicated link or button “Manage Cookie Consent” in the footer of the website, or by configuring their browser settings directly.

For further information, users can consult the extended Cookie Policy available in the dedicated section of the website or write to: [email protected].

Provision of Personal Data

With the exception of browsing data, which is automatically acquired by IT systems to enable the use of the website, users are free to decide whether or not to provide their personal data through the contact, registration or service request forms available on www.cascospa.com .

1. Nature of the Provision of Data

  • Required data (mandatory): data marked with a specific symbol or an asterisk (*) in the forms is strictly necessary to process the request or provide the service. Failure to provide such data will make it impossible for CASCO S.P.A. to process the user's requests or enter into the contract.
  • Optional data: the provision of data not marked as mandatory is entirely optional. Refusal to provide such data will not in any way affect access to the main services requested.
  • Consent for additional purposes, marketing and newsletters: the provision of data and consent for the sending of promotional or marketing communications is optional. Failure to provide consent does not prevent the provision of the requested services.

2. Voluntary Sending of Communications

The optional, explicit and voluntary sending of emails to the addresses indicated on the website, the completion of contact forms or the sending of messages via WhatsApp results in the subsequent acquisition of the sender's address or telephone number, which is necessary in order to reply to the requests, as well as any other personal data included in the communication.

Processing of Data Through Instant Messaging Systems

WhatsApp Business

In addition to traditional contact channels, such as email and web forms, CASCO S.P.A. provides users with a customer support service through the WhatsApp instant messaging platform, provided by Meta Platforms Ireland Limited.

  • Purpose of processing: personal data voluntarily provided by the user, such as name, telephone number and message content, is collected and processed solely for the purpose of providing answers, support and information regarding products, services or contractual or commercial requests, as well as providing any necessary after-sales support.
  • Legal basis: performance of pre-contractual or contractual measures taken at the request of the data subject, pursuant to Article 6(1)(b) of the GDPR, and consent expressed by the user by initiating the conversation.
  • Nature of the provision of data: the provision of data through WhatsApp is entirely optional. If the user prefers not to use this channel or does not wish to share certain data via instant messaging, they may use traditional contact channels at any time, for example by writing to [email protected].
  • Data retention: messages and conversation history will be retained for the period strictly necessary to manage and process the support request and until the ticket is closed. After this period, the conversation will be deleted from company devices and systems, without prejudice to any retention requirements resulting from legal obligations or the protection of rights in legal proceedings. In such cases, the general retention periods provided for by law will apply, for example 10 years for contractual correspondence.

3. Specific Privacy Notices (Layered Privacy Notice)

Specific concise privacy notices providing further details, referred to as privacy notices, and any requests for explicit consent may be displayed on individual pages of the website dedicated to specific on-demand services, such as the Careers form, the commercial contact form or newsletter subscription.

Methods and Period of Data Retention

Personal, identification and contact data and, where applicable, payment data, is processed using automated and manual means, with appropriate technical and organizational security measures adopted pursuant to Article 32 of the GDPR in order to prevent data loss, unlawful or improper use and unauthorized access.

Data will be retained for the period strictly necessary to achieve the purposes for which it was collected and, in particular:

  • Contractual and accounting data: for the entire duration of the contract and for 10 years following its termination, in compliance with legal obligations relating to tax, administrative and civil matters, pursuant to Article 2220 of the Italian Civil Code.
  • Data for the provision of web services and user accounts: until a request is made to delete the account or until the service is terminated.
  • Data for marketing and newsletter purposes: until the user withdraws consent or exercises the right to object, also referred to as opt-out.

Security of Processing

Pursuant to Article 32 of Regulation (EU) 2016/679 (GDPR), CASCO S.P.A. adopts appropriate technical and organizational security measures to prevent and minimize the risks of destruction or loss of personal data, unauthorized access, or processing that is not permitted or does not comply with the purposes for which the data was collected.

In particular, data transmission on the website www.cascospa.com takes place using the HTTPS encryption protocol with an SSL/TLS certificate, ensuring a secure and confidential connection between the user's device and the company's servers.

Data is stored on secure servers located within the European Economic Area, protected by firewalls, antivirus systems and regular backup procedures. Access is permitted only to authorized and appropriately trained personnel.

Rights of the Data Subject (Articles 15-22 GDPR)

At any time, it is possible to obtain the deletion or anonymization of personal data, a copy of the data, its updating, rectification or completion, as well as the blocking of data processed unlawfully, in accordance with Regulation (EU) 2016/679 (GDPR).

As a data subject, the user has the right to request from CASCO S.P.A.:

  • Access to their personal data and information relating to its processing, pursuant to Article 15 of the GDPR.
  • Rectification or completion of inaccurate or incomplete data, pursuant to Article 16 of the GDPR.
  • Erasure, or the “right to be forgotten”, of personal data in the cases provided for by law, pursuant to Article 17 of the GDPR.
  • Restriction of processing under certain circumstances, pursuant to Article 18 of the GDPR.
  • Data portability, namely the right to receive the personal data provided by the user in a structured, commonly used and machine-readable format, or to have it transmitted directly to another controller, pursuant to Article 20 of the GDPR.
  • Objection, in whole or in part, to processing based on legitimate interest or carried out for direct marketing purposes, pursuant to Article 21 of the GDPR.

The data subject also has the right to withdraw consent at any time, without affecting the lawfulness of processing based on consent given before its withdrawal, and to lodge a complaint with the Italian Data Protection Authority.

Website of the Italian Data Protection Authority: www.garanteprivacy.it .

To exercise their rights or request any information, users may contact the Data Controller at the following email address: [email protected] .