Privacy notice pursuant to Article 13 of Regulation (EU) 2016/679 and applicable legislation concerning the Website

DATA CONTROLLER

The Controller of your Personal Data is:

K-WAY S.p.A., registered office at Via dell'Aprica 12 - 20158 Milano ITALY, tax code/VAT no. 11606200969; email: customer@k-way.com.

A list of external processors is available at the Company’s registered office and may be requested using the contact details above. The Company has also appointed a Data Protection Officer (DPO), contactable at dpo@seefree.it.

CATEGORIES OF DATA COLLECTED

Personal Data collected by www.k-way.com (the “Website”), independently or through third parties, concerning users of the Website (“Users”), include:

• Identification and contact details (e.g. first name, surname, telephone number, postal address and email address);
• Purchase history;
• Payment information;
• Usage Data (e.g. session statistics, store-related data, device information, session duration, clicks, interaction events, browsing history and page views);
• Other ordinary data necessary to establish and perform the contractual relationship with the Controller.

Further details of the processing of collected Personal Data are provided in the relevant sections of this privacy policy or in specific notices displayed before collection. Personal Data may be provided freely by the User or, in the case of Usage Data, collected automatically when using the Website.

Unless otherwise indicated, data requested by the Website are necessary to use the Website and/or receive services or purchase products offered by the Controller (the “Services”). Failure to provide them may make it impossible to provide the Services. Where data are marked as optional, Users may withhold them without affecting the availability or operation of the Services. Users unsure which data are necessary should contact the Controller.

Cookies or other tracking technologies used by the Website or third-party service providers serve to provide the Services requested by the User and for the further purposes described in this document and the Cookie Policy. Users are responsible for third-party Personal Data obtained, published or shared by them through the Website.

PROCESSING METHODS, RECIPIENTS, LOCATION AND RETENTION PERIOD

Processing methods and recipients

The Controller adopts appropriate security measures to prevent unauthorised access, disclosure, alteration or destruction of Personal Data. Processing is carried out using IT and/or telematic tools, with organisational methods and logic closely related to the purposes indicated.

Personal Data will not be publicly disclosed. In addition to the Controller, they may be accessed by persons authorised by law or orders of authorities; personnel involved in operating the Website (administration, sales, marketing, legal and system administrators); and external parties such as technical service providers, postal couriers, hosting providers, IT companies and communications agencies.

Depending on the circumstances, these recipients act as processors under the Controller’s instructions or as independent controllers. Processing is performed exclusively by the Controller’s employees and/or duly designated authorised persons instructed as to the methods and purposes. An up-to-date list of external processors may be requested at the email address above.

Location

Personal Data are processed at the Controller’s operating offices and wherever the parties involved are located, within the purposes set out below. The Controller does not intend to transfer Personal Data outside the European Union. If transfers outside the European Economic Area become necessary, they will take place only after the safeguards required by the Regulation have been adopted and suitable information provided to the data subject. For details, contact the Controller at the email address above.

Users’ Personal Data may be transferred to a country other than their country of residence. Further information on the location of processing is available under “Details on the processing of Personal Data”.

Retention period

In accordance with the principles of proportionality and necessity, Personal Data are processed and retained only for as long as strictly necessary for the purposes for which they were collected; they may be retained longer solely to comply with legal obligations or following renewed User consent. At the end of the retention period, Personal Data will be erased; thereafter the rights of access, erasure, rectification and portability can no longer be exercised.

PURPOSES OF PROCESSING THE DATA COLLECTED

Users’ Personal Data are collected and processed for the following purposes:

a) Compliance with legal obligations, including tax, accounting and administrative obligations. Providing the data is legally mandatory; failure to provide them prevents the Company from carrying out the requested activity requiring compliance with those obligations.

b) Performance of obligations arising from or connected with use of the Website, provision of the Services and the contractual relationship, including shipping and after-sales assistance. Providing the data is contractually necessary; failure to provide them prevents the Company from entering into the contract.

c) Direct marketing and profiling: (i) sending advertising and promotional communications by email and SMS/WhatsApp (subject to the User’s right to opt out), concerning products or services offered or promoted by the Controller or its commercial partners, including gifts; and (ii) processing Personal Data to assign Users to relevant groups (profiling) and send personalised commercial and promotional information by email, fax or telephone. Providing data for these purposes is optional; without consent, the Company cannot perform these activities.

With the data subject’s prior consent, the Controller may also use tracking tools, including tracking pixels embedded in newsletters and other promotional emails, to detect email opens and interactions, measure campaign effectiveness and analyse interest in the content. By consenting to promotional communications, the data subject also consents to these tracking pixels, having been informed in advance of their presence and function. Consent is free and optional, and withholding it has no adverse consequences.

Consent may be withdrawn at any time, free of charge and easily, following the instructions on the Website under “Manage Preferences” or the “Unsubscribe” section of every communication. Consent to tracking pixels alone may also be withdrawn while continuing to receive promotional communications without this tracking.

d) “Notify me” / “Back in stock”: emailing the User when a product they selected becomes available again on the Website. Providing data for this purpose is optional; without the relevant consent the Company cannot provide the notification.

e) Soft spam / basket recovery: emailing Users to enable them to complete purchases started but not completed on the Website. This processing relies on the specific exception under Article 130(4) of Italian Legislative Decree 196/2003 (Privacy Code). Users may deactivate the feature through the unsubscribe link in each message or the relevant section of their personal account on the Website, without prejudice to any opt-out option introduced by the Controller.

f) Establishment, exercise or defence of the Company’s rights in judicial or extrajudicial proceedings (legitimate interest; Articles 6(1)(f) and 9(2)(f) GDPR). This interest does not override Users’ rights and freedoms, since processing is necessary to exercise the constitutionally guaranteed right of defence.

The legal basis depends on the processing concerned: law, performance of a contract or pre-contractual measures requested by the data subject, legitimate interest or specific consent. Further details are provided in “Details on the processing of Personal Data”.

DETAILS ON THE PROCESSING OF PERSONAL DATA

How to opt out of interest-based advertising

In addition to the opt-out functions provided by the services listed in this document, Users can learn more about disabling interest-based advertising in the relevant section of the Cookie Policy.

Cookie Policy

This Website uses Tracking Technologies. Users can consult the Cookie Policy for further information.

LEGAL BASIS FOR PROCESSING

The Controller processes Users’ Personal Data where one of the following applies: the User has consented to one or more specific purposes; processing is necessary to perform a contract or take pre-contractual measures; processing is necessary to comply with a legal obligation; or processing is necessary for the legitimate interests of the Controller or a third party.

Users may always ask the Controller to clarify the specific legal basis for each processing activity, including whether it is based on law, contract, legitimate interest or consent.

USER RIGHTS

Data subjects have the following rights under the Regulation:

• Right of access (Article 15): confirmation of whether Personal Data are processed and, if so, access to those data and information including purposes, categories and recipients.
• Right to rectification (Article 16): prompt correction of inaccurate data and completion of incomplete data.
• Right to erasure / “right to be forgotten” (Article 17): erasure without undue delay in the cases provided by Article 17.
• Right to restriction of processing (Article 18): restriction in the cases provided by Article 18.
• Right to data portability (Article 20): receipt of data in a structured, commonly used, machine-readable format and transmission to another controller without hindrance in the cases provided by Article 20.
• Right to object (Article 21): objection, on grounds relating to the individual’s particular situation, to processing based on Article 6(1)(e) or (f), including profiling based on those provisions.
• Rights relating to automated decision-making (Article 22): the right not to be subject to decisions based solely on automated processing, including profiling, producing legal or similarly significant effects.

Users may withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal. Rights may be exercised by sending a formal request to customer@k-way.com. Users may also lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali) if they believe processing breaches Regulation (EU) 2016/679. For further information, contact the Controller at the address above.

Processing carried out by independent third-party controllers is not covered by this notice. The Company accepts no responsibility for such processing and invites Users to consult those third parties’ privacy notices.

OTHER USEFUL INFORMATION FOR USERS

Specific notices

At a User’s request, the Website may provide additional contextual privacy notices relating to specific Services or the collection and processing of Personal Data. For further information, contact the Controller.

Information not included in this policy

Further information on Personal Data processing may be requested from the Controller at any time using the contact details above.

Changes to this privacy policy

The Controller reserves the right to amend this privacy policy at any time, notifying Users on this page and, where possible, on the Website and, if technically and legally feasible, through the contact details held. Users are therefore invited to consult this page regularly and check the date of the latest amendment at the bottom.

Where amendments concern processing based on consent, the Controller will obtain renewed consent where necessary.