Purposes of Data Processing

The personal data processed may include identification data, administrative, accounting and tax information, as well as commercial information provided directly by the Customer.

We may also process identification data relating to other data subjects, such as employees, collaborators or contact persons, where such information is provided in connection with the relationship with the Data Controller.

CROSSHOP S.r.l. processes personal data in compliance with applicable data protection legislation for the following purposes:

• To provide the services requested by the Customer and to manage the operational, technical and administrative aspects of the relationship, including communications relating to the services provided.
• To enable browsing and use of the crosshop.eu website and other websites or domains owned by CROSSHOP S.r.l.
• To manage newsletter subscriptions.
• To provide personalised commercial offers based on products or services purchased or in which the Customer has shown an interest while browsing our website, where permitted by applicable law.
• For the protection of the legitimate interests of the Data Controller, including the use of automated systems designed to quantify and analyse rejected orders.
• To comply with accounting, tax, social security, banking and other applicable legal obligations.

Data processing activities may include collection, recording, organisation, storage on electronic and/or paper media, consultation, communication to the parties specified below and use of the data for the purposes described in this Privacy Policy.

In many cases, providing personal data is necessary in order to fulfil contractual, accounting or tax obligations. Failure to provide the required information may prevent CROSSHOP S.r.l. from providing some or all of the requested services.

Processing Methods and Data Retention

Personal data may be processed using manual, automated, computerised and electronic systems suitable for managing and storing information on electronic, paper or other appropriate media.

CROSSHOP S.r.l. adopts appropriate technical and organisational measures designed to protect personal data and ensure that processing is carried out in accordance with the principles of lawfulness, fairness, transparency and security.

Disclosure and Sharing of Personal Data

Your personal data may be shared, where necessary for the purposes described above, with:

• Parties acting as data processors, including individuals, companies or professional firms providing CROSSHOP S.r.l. with accounting, administrative, legal, tax or financial assistance and consultancy services.
• Public authorities, organisations or other parties to whom personal data must be disclosed pursuant to applicable laws, regulations or orders issued by competent authorities.
• Employees and collaborators of CROSSHOP S.r.l. who are authorised to process personal data as part of the company’s normal operational and administrative activities.
• Legal firms, insurance companies and debt collection companies, where necessary.

An updated list of data processors may be requested from the Data Controller.

Transfer of Personal Data Outside the European Union

Personal data will not normally be transferred to countries outside the European Union.

Should a transfer to a third country or international organisation become necessary in connection with the performance of a contract, the provision of a service or compliance with legal obligations, such transfer will be carried out in accordance with the requirements and safeguards established by the GDPR and other applicable data protection legislation.

Where required by law, the appropriate safeguards and/or the consent of the data subject will be obtained before the transfer takes place.

Rights of the Data Subject

The data subject has the right to obtain confirmation from the Data Controller as to whether or not personal data concerning them is being processed and, where applicable, to obtain access to such personal data in an intelligible form.

Subject to the conditions established by applicable legislation, the data subject may request information regarding the source of the data and the purposes and methods of processing.

The data subject may also exercise the rights provided for by the GDPR, including, where applicable, the right to:

• access their personal data;
• request correction or updating of inaccurate data;
• request deletion of personal data;
• request restriction of processing;
• object to processing;
• request data portability where applicable;
• withdraw consent where processing is based on consent.

The data subject may also request information regarding the security measures adopted to protect their personal data.

Any rectification, restriction or deletion of personal data will, where required by the GDPR and unless this proves impossible or involves disproportionate effort, be communicated by the Data Controller to recipients to whom the personal data has been disclosed.

Upon request, the Data Controller may provide the data subject with information about such recipients.