PRIVACY POLICY


‍Dear Visitor, in accordance with Legislative Decree no. 196/2003 and the General Data Protection Regulation (EU) 2016/679 (hereinafter referred to as "Regulation"), this page describes the procedures for processing personal data of users who consult the website accessible electronically at the following address: https://www.cec.com/ for the services offered by C&C SpA.Please be informed that as a result of consulting this site, data related to identified or identifiable persons may be processed.This information does not concern other websites, pages or online services that can be reached through hyperlinks that may be published on the site.

‍Identity of the Data Controller

‍The Data Controller is C&C S.P.A., in person of its legal representative p.t., with its registered office at Viale Einaudi n. 10 - Bari (BA), (email: privacy@cec.com, Certified E-mail (PEC): info@pec.cecconsulting.it, Phone: +39 080 5622398)
(hereinafter also referred to as “the Data Controller”)C&C SpA has appointed a Data Protection Officer (DPO) who can be contacted at the following email address: dpo@cec.com

‍Data Source and Type of Data CollectedData Provided by the User
‍
‍The Data Controller collects personal data provided by users:at the time of purchasing a product offered. The data collected by the Data Controller may include, by way of example but not limited to: personal details, contact data, location data, financial information; information related to credit reliability, payment information, VAT number.at the time of creating an account/registration on the Site. The data collected by the Data Controller may include, by way of example but not limited to: personal details, contact data.at the time of subscribing to the newsletter service offered on the website. The data collected by the Data Controller may include, by way of example but not limited to: personal details (name and surname) and contact data (email address).at the time of enrolling in the C&C Loyalty Program and requesting the “C&C Fidelity Card” The data collected by the Data Controller may include: personal details and contact data (email address, phone number).when using the form in the “work with us” section and/or sending the Resume to the dedicated address. The personal data requested may include, in addition to personal and contact details, all the information contained within the Curriculum Vitae, should the user choose to send it to the Data Controller through the provided channels.when using the form present in the “Make an appointment” section to utilize the certified Apple Assistancewhen sending a message using the customer contact and support chat “Live Support”.when sending a message using the contact channels and/or contact forms present on the website.The optional and voluntary sending of messages to the contact addresses, as well as the completion and forwarding of forms on the website, involves the acquisition of the sender's contact data necessary to provide a response, as well as all personal data included in the communications.
‍
Navigation Data
‍
‍The Data Controller collects data relating to the user's use of the website.The computer systems and software procedures used for the operation of this site, during their normal operation, acquire some personal data whose transmission is implicit in the use of Internet communication protocols.This category of data includes the IP addresses or domain names of the computers and terminals used by users, the addresses in URI/URL (Uniform Resource Identifier/Locator) notation of the requested resources, the time of the request, the method used to submit the request to the server, the size of the file obtained in response, the numerical code indicating the status of the server's response and other parameters related to the user's operating system and computer environment.Such data, necessary for the use of web services, are also processed for the purpose of:obtaining statistical information on the use of the services (most visited pages, number of visitors per time or day slot, geographical areas of origin, etc.);checking the correct functioning of the services offered.Navigation data do not persist for more than seven days and are deleted immediately after their aggregation (except for any need to ascertain crimes by judicial authorities).

Cookies and Other Tracking Systems
‍
‍In order to make its services as efficient and simple to use as possible, this Site uses cookies.Therefore, when visiting the Site, a minimal amount of information is placed on the User's device, such as small text files called “cookies”, which are saved in the User's web browser directory. There are different types of cookies, but basically the main purpose of a cookie is to make the Site work more effectively and to enable certain features.For more information on cookies used by this website, you can view the cookie policy at the following link.

‍Purpose of Processing
‍
‍Depending on the type of processing to be carried out, the Data Controller uses the data collected and/or provided by the User for the following purposes:to process and fulfill orders, manage payments, communicate with the user regarding the order, manage any returns, provide customer assistance and allow product pickup. They will also be used to acquire precontractual data and information; exchange information aimed at the execution of the contractual relationship, including pre- and post-contractual activities; formulate requests or process received requests; manage accounting and fiscal obligations;send newsletters with informational or commercial promotion content (e.g., event invitations, communications about new services offered, promotional offers).Such processing may be done in an automated way via email and may be carried out provided the Data Subject has not revoked his/her consent for the use of the data; suggest features, products, and services that might interest you.
We ask for your consent to identify your preferences and personalize commercial offers and promotions based on your interests (so-called profiling); carry out the preliminary activities and subsequent to the request for registration/create User Account, as well as to fulfill any other obligation arising;provide feedback to any communications, requests for information and/or services from users by sending a message using the addresses and/or contact forms present on the site;register your appointment at one of our authorized Apple Assistance Centers; to provide feedback to any applications sent by Users, transmitted via the appropriate form present in the section “work with us” or using the contact addresses present on the site;manage and control risks, prevent possible fraud, insolvency or defaults; prevent and manage possible disputes, take legal action if necessary.

‍Legal Basis for Processing
‍
‍In reference to the purposes indicated in the previous paragraph, the legal basis for the same is, with respect to the point:the need to execute a contract to which the data subject is a party or to take pre-contractual measures at the request of the same;the expressed consent of the data subject;the expressed consent of the data subject;the need to execute a contract to which the data subject is a party or to take pre-contractual measures at the request of the same;the need to execute a contract to which the data subject is a party or to take pre-contractual measures at the request of the same;the need to execute a contract to which the data subject is a party or to take pre-contractual measures at the request of the same;the need to execute a contract to which the data subject is a party or to take pre-contractual measures at the request of the same. The processing of particular categories of personal data, if present within the Data Subject's Curriculum Vitae, is carried out if necessary to fulfill specific legal obligations, in particular for the purpose of establishing an employment relationship (Article 88 of the GDPR), as well as to ensure equal opportunities in the workplace (see.auth. gen no. 1/2016).the need to pursue the legitimate interest of the data controller (in particular with regard to the prevention of fraud and insolvency).

‍Recipients of Data
‍
‍The personal data processed by the Data Controller are not disseminated, i.e., they are not made known to indeterminate subjects, in any possible form, including that of their availability or simple consultation.
Rather, they may be communicated to workers who operate under the authority of the Data Controller.
Based on the roles and work tasks performed, these workers have been authorized to process personal data, considering their respective competences and in accordance with the instructions given to them by the Data Controller.
The Data Controller has tasked third-party service providers regarding the functioning of the website, such as hosting service providers, IT maintenance providers, and providers of services that allow the integration of other functions that the user may use at their discretion on the website.
To these service providers, designated as Data Processors, only the personal data necessary to provide the corresponding services are provided and they are not allowed to use or disclose the personal data of the data subjects for other purposes, without prior authorization from the data subject.
The data may also be communicated, as strictly necessary, to subjects who, for the purpose of processing orders or other requests or service performances related to the transaction or contractual relationship with the Data Controller, must provide goods and/or perform services or services on the Data Controller's behalf.
Finally, the data may be communicated to entities entitled to access it by virtue of legal provisions, regulations, community regulations.

‍Transfer of Data
‍
‍Any transfers of personal data to third countries or international organizations are carried out according to Chapter V of the GDPR to ensure that the level of protection of natural persons guaranteed by the Regulation is not compromised in any way.

‍Data Retention

‍The Data Controller retains and processes personal data for the time necessary to fulfill the indicated purposes. Subsequently, personal data will be stored and not further processed, for the period established by the current civil and tax provisions.
Data provided for commercial promotion purposes for services other than those already acquired by the Data Subject, for which he/she initially gave his/her consent, shall be retained for 24 months, except for the revocation of the consent granted.
Data provided to the Data Controller for profiling purposes will be retained for 12 months, except for the revocation of the consent granted.The data collected upon the creation of an account will be stored for the duration of your registration and in any case not beyond a maximum period of 12 (twelve) months of inactivity, or if within that term, no Services and/or products are associated through the same registration.The data collected when using the “Make an appointment” form section will be retained for the time necessary to fulfill the indicated purposes and, in any case, for a period not exceeding 12 months from the reception of the data. The data collected when using the “work with us” section form and/or sending the Resume to the indicated address will be retained for the time necessary to fulfill the indicated purposes and, in any case, for a period not exceeding 12 months from the reception of the data. In case of potential litigation, the data collected will be retained for the duration of the dispute, until the expiration of the appeal periods.
It should also be added that, in the case where a user provides the Data Controller with personal data not requested or not necessary for the performance of the service requested or the provision of a service strictly connected to it, C&C SpA cannot be considered the data controller for this data, and will proceed to its deletion as soon as possible.

‍Rights of the Data Subject
‍
‍In relation to the data subject to processing under this information, the data subject is recognized at any time the right to:request access to his/her personal data and information related thereto (Art. 15 of the GDPR); the correction of inaccurate data or the completion of incomplete ones (Art. 16 of the GDPR); the deletion of personal data concerning him/her (under one of the conditions indicated in Art. 17, para. 1 of the GDPR and in compliance with the exceptions provided for in paragraph 3 of the same article); the limitation of processing of his/her personal data (upon the occurrence of one of the hypotheses indicated in Art. 18, para. 1 of the GDPR);request and obtain from the Data Controller - in cases where the legal basis of the processing is the contract or consent, and the same is carried out by automated means - his/her personal data in a structured and machine-readable format, also in order to communicate such data to another data controller (so-called right to data portability - Art. 20 of the GDPR); oppose at any time the processing of his/her personal data upon the occurrence of particular situations concerning him/her (Art. 21 of the GDPR);revoke consent at any time, limited to the cases where the processing is based on his/her consent for one or more specific purposes. The processing based on consent and carried out before the revocation of the same retains, however, its legality (Art. 7, para. 3, of the GDPR);To facilitate the exercise of the rights of the Data Subjects under EU Regulation 2016/679, the Data Controller has adopted an appropriate form that, duly completed, should be addressed to the Data Controller of personal data. The appropriate application can be submitted by contacting the Data Controller via Certified E-mail (PEC) at the address info@pec.cecconsulting.it, through email at the address privacy@cec.com or registered letter with acknowledgment of receipt at the address Viale Einaudi n. 10 - Bari (BA).
‍
The form for exercising one’s rights is available by clicking HERE.

‍The data subject, if he/she believes that the processing of his/her data is in violation of the provisions of the Regulation, may file a complaint with a supervisory authority (Personal Data Protection Authority – www.garanteprivacy.it), as provided for by Art. 77 of the GDPR, or take the matter to the appropriate judicial authorities (Art. 79 of the GDPR).

‍Refusal to Provide Data
‍
‍In the event that the Data Subject does not provide his/her data identified as necessary for the execution of the service requested, the Data Controller will not be able to proceed with the processing related to the management of the said service, nor the obligations depending on it.If the Data Subject does not provide consent for the processing of personal data for the activities that require it, such processing will not occur for the same purposes without this affecting the provision of other services requested, nor for those for which he/she has already given his/her consent. If the Data Subject has given consent and should subsequently revoke it or oppose the processing, his/her data will no longer be processed for such activities, without this resulting in any adverse consequences or effects for the Data Subject and for any other services requested.

‍Automated Decision-Making Processes
‍The Data Controller does not carry out processing that consists of automated decision-making on the data of natural persons.

‍This document was updated on 06/04/2023