Privacy policy

We are committed to protecting and respecting the personal information shared with us, in compliance with Regulation (EU) 2016/679 (GDPR) and applicable data protection law.

This statement describes what kinds of information we collect, how it is used, how we protect it, how we share it with other organisations, how long we keep it, how rights over the information we hold can be exercised, and how you can contact us.

As regards direct marketing communications, it will always be possible to ask us to stop. We do not send unsolicited email or communications and we do not share data with parties other than those set out in this policy. We do not resell information to third parties, but we do work with selected partners who help us provide the information, products and services requested.

The content of this policy may change from time to time; we recommend checking this page periodically. Where possible we will inform data subjects directly of any material change.

What information we collect

We collect personal information through the website, our applications or direct contact. We only collect information that is necessary, relevant and adequate for the purpose for which it is provided. The information we collect includes some or all of the following:

• Identity data: first name, surname, username or similar identifier, and title.
• Contact information: billing address, delivery address, email address and telephone numbers.
• Financial data: bank account and payment card details, collected solely for the purpose of completing a purchase.
• Transaction data: details of payments to and from the customer or supplier, and other details of the products and services bought or sold.
• Profile data: purchases or orders placed, social profiles where applicable, preferences, feedback, communications, responses to internal surveys and, where applicable, customer portal username and password.
• Usage data: information about how the website, products and services are used.
• Marketing and communication data: preferences on receiving marketing communications from us and from third parties, and communication preferences.
• Technical data: IP address, login data, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform, and other technologies on the devices used to access the site.

How we use the information we collect

We process only the information necessary for the purpose for which it was collected. It is always possible to opt out of marketing communications, and consent may be withdrawn at any time. We use personal data solely for the following purposes and legal bases:

• Performance of a contract (processing is necessary to perform a contract or to enter into one): registering a new customer, creating and managing their account and providing the services; providing product technical support; providing customer training and certification; managing the relationship, including order processing and delivery of the product or service, or the equivalent with suppliers.
• Consent (withdrawable at any time): providing information about our organisation, products and services and sending newsletters or updates by email; informing you about special offers and products or services of potential interest; understanding traffic flow on the site in order to improve the experience.
• Legitimate interest (in running our business; you may object at any time): measuring the interest of customers and suppliers and improving products, services and the site; meeting contractual obligations; providing a high level of customer support; managing and keeping the site up to date and informing our commercial and marketing strategy; presenting content in the most effective way.
• Legal obligation: prevention and detection of fraud, money laundering or other offences, or responding to a binding request from a public authority or a court.
• Vital interest (rare cases): contacting the data subject in the event of an urgent safety notice.

You have the right to object at any time to processing of personal data carried out on the basis of legitimate interest.

How we protect the information

We adopt appropriate technical and organisational measures to protect personal data against unauthorised access, loss, destruction or disclosure. In particular:

• data transmission protected by the HTTPS/TLS protocol and encrypted connections;
• encryption of data at rest on the systems where it is stored;
• access control based on the principle of least privilege, with user identification and authentication;
• monitoring and logging of access and relevant events, with handling of anomalies;
• protection measures for devices and media, and security incident management procedures.

How we share this information

We do not sell information to third parties. We may disclose it to the following categories of parties to whom we entrust the management of services on our behalf, strictly limited to what is necessary: support service providers, customer contact centres, marketing agencies and consultants, market research and analysis providers, legal advisers and other professionals, and — for order fulfilment and delivery — logistics operators and couriers. We take steps to ensure that all third parties processing the information comply with data protection law and protect it as we do. We disclose only the information strictly necessary for the service performed on our behalf and, where possible, we anonymise or aggregate the data.

How long we keep the information

We do not keep personal information in an identifiable form for longer than necessary.

In the case of an ongoing relationship (for example a customer), we keep personal information for 10 years from the date on which the relationship ends, in order to establish, exercise or defend legal claims and to meet legal obligations.

Where we obtain information following a request for information, brochures or quotations, we keep it for a maximum of 1 year and 6 months from collection, unless an actual relationship arises in the meantime (for example a purchase).

Exceptions to these periods apply where: the law requires us to keep the data longer or to delete it sooner; a complaint has been raised about a product or service (in which case we keep the data for 10 years from the date of the complaint); the data subject exercises the right to erasure and there are no overriding legitimate grounds or legal obligations to retain it.

The processing of Amazon information follows the specific retention and deletion terms set out in the Amazon Data Protection Policy (secure deletion within 30 days of the processing no longer being necessary).

How the information can be managed

Every data subject has the right to access their personal information and to request its correction. They also have the right to withdraw consent previously given, to request erasure of the data and to object to processing based on legitimate interest. Data protection law provides a set of rights; for most of them we will request information to confirm identity and, where applicable, to locate the data. Save in exceptional cases, we will respond within 30 days of receiving the request.

Users have the following rights:

• to request a copy of the information we hold;
• to correct and update their information;
• to withdraw consent (see "How we use the information we collect");
• to object to our use of the information based on legitimate interest, save for overriding legitimate grounds; for direct marketing we will always respect the right to object;
• to erase the information or restrict its use, save for legitimate grounds or legal obligations;
• to obtain portability of the information in a structured, commonly used and machine-readable format, where processing is based on consent or on contract.

If a request is manifestly unfounded or excessive, we may charge a contribution towards costs or refuse to act on it. Please note that once data has been removed from our systems (on expiry of the stated periods or on request), removal is permanent and may affect any subsequent access requests.

You may exercise the rights set out above and manage your information by contacting us:

Post: Aurobica SRL — Contrada Fontanelle, 3 — 81014 Capriati a Volturno (CE), Italy — VAT 04508530617
Email: info@aurobica.com

For specific data protection concerns or complaints, you may write to the same email address. You may also lodge a complaint with the competent supervisory authority (in Italy, the Garante per la protezione dei dati personali).

Where we store personal data

The personal data we collect is stored on servers located in Italy, within the European Economic Area (EEA). We do not transfer personal data outside the EEA. Should a transfer outside the EEA become necessary for specific future needs, we will first put in place the appropriate safeguards provided for by Articles 44 and following of the GDPR (for example adequacy decisions or standard contractual clauses approved by the European Commission) and will state this in this policy.

Cookies

Cookies are text files that make it possible to recognise the device used to access the site. For the purposes of their use, please refer to the section "How we use the information we collect". You can configure your browser to accept all cookies, to be notified when a cookie is set, or to refuse them; the relevant function is in the browser settings, usually in the privacy section. More detailed information about cookies and how to manage them is available at allaboutcookies.org. Refusing cookies may prevent the site from working correctly or prevent access to certain areas.

Note on aurobica.com. This site is made of static pages: it sets no profiling cookies, uses no third-party analytics tools and loads no resources from external domains. The references to cookies above concern the applications and portals reserved for customers.