Privacy Policy | Riflessi

PRIVACY POLICY

Information on the processing of personal data

This Privacy Policy explains how www.stileinterno.live processes the personal data of its users.

“Processing” includes any operation or set of operations performed on personal data, whether or not by automated means, as defined in Article 4 of Regulation (EU) 2016/679 (the “GDPR”).

This notice is provided under Article 13 of the GDPR and Italian Legislative Decree No. 196/2003, as amended. It applies to everyone who visits the website or interacts with the services provided through it by Riflessi S.r.l., Via Nino Pace 58, Z.I., 66026 Ortona (CH), Italy, VAT No. 01536130691 (the “Controller” or “Riflessi”).

This notice describes why and how Riflessi collects and processes personal data, the categories of data involved, your rights and how to exercise them.

The notice applies to this website only. Riflessi accepts no responsibility for other websites you may visit through links on this website. Data is processed using both electronic and manual means. This notice also covers data obtained through social media pages managed by Riflessi, including Facebook, Instagram, LinkedIn, Messenger, WhatsApp and YouTube.

By using this website, users accept this notice. Please read it before providing any personal information.

1. What types of personal data do we process?

Browsing data

During their normal operation, the IT systems and software used to run this website collect certain personal data whose transmission is inherent in the use of internet communication protocols.

This information is not collected for the purpose of identifying individual users. However, by its nature, it could be combined with data held by third parties to identify users.

This category includes IP addresses or domain names of the devices used to access the website; the Uniform Resource Identifier (URI) addresses of requested resources; the time of each request; the method used to submit the request to the server; the size of the file returned; the numerical code indicating the server’s response status (successful, error, etc.); and other parameters relating to the user’s operating system and IT environment.

This data is used solely to produce anonymous statistics on website use, such as the most visited pages, visitor numbers by time of day or day, and visitors’ geographical areas, and to check that the website works properly. It is deleted within the periods stated in the Cookie Policy. The data may also be used to establish liability in the event of suspected cybercrime against the website.

Data provided voluntarily by users

In addition to browsing data, Riflessi collects any personal data you submit through the website’s forms, the Controller’s contact details or its official social media profiles or pages. This data is used to respond to your requests or register you for the “News” service. Riflessi also collects identification and contact details, as well as any information contained in a CV you submit.

The Controller does not collect sensitive data, other special categories of data under Article 9 of the GDPR, or data relating to criminal convictions or offences through the website.

Personal data processed through social media platforms

For information about processing carried out by the operators of the social media platforms used by Riflessi, please refer to their respective privacy policies. Riflessi processes personal data you provide through its social media pages to manage interactions with users, including comments, public posts and private messages, in accordance with applicable law.

2. Purposes and legal bases for processing

a) Responding to your requests

The Controller processes data you provide voluntarily solely to respond to your requests. Providing this data is therefore necessary to receive the requested service. The legal basis for processing is Article 6(1)(b) of the GDPR (performance of a contract).

Data provided when registering for the “News” service may be used to inform you about promotions, news and initiatives organised by Riflessi in its areas of business.

Information contained in your CV is processed for recruitment purposes.

Your data is also processed to ensure that the website and its content function properly. The legal basis for this processing is the Controller’s legitimate interest under Article 6(1)(f) of the GDPR.

b) Complying with legal obligations

Where data is processed to comply with legal obligations, the legal basis is Article 6(1)(c) of the GDPR.

c) Sending commercial communications

Your personal and contact details, including your first and last name, postal address, email address, landline number and mobile number, may be used to contact you by telephone or to send commercial information to your postal address, by email or by SMS, including through automated means.

Consent to this processing, based on Article 6(1)(a) of the GDPR, is optional. If you do not consent, you will not receive commercial communications.

3. Who may receive your personal data?

Personal data you provide will not be made public. It may be disclosed, for the purposes described above, to parties who:

- are authorised by the Controller to process data for those purposes. Riflessi S.r.l. ensures that its staff are appropriately trained in the importance of personal data protection and use secure tools as required;

- act as independent data controllers where disclosure is required by law, such as public authorities performing their official duties, lawyers providing assistance in disputes, banks and insurance companies;

- act as external data processors: parties contractually authorised to act on behalf of Riflessi S.r.l. in carrying out the purposes described above, such as providers of accounting and administrative services and companies that assist Riflessi S.r.l. in managing its activities.

These companies, bodies and organisations receive only the personal data needed to provide the agreed services or comply with legal obligations. They are not authorised to use it for any other purpose.

You may request a list of data processors at any time by writing to Riflessi S.r.l., Via Nino Pace 58, 66026 Ortona (CH), Italy, or emailing privacy@stileinterno.live.

If personal data must be transferred abroad for the purposes described above, the transfer will take place in accordance with the safeguards required by law.

4. How long do we process and retain your data?

Data used to respond to your requests is retained only for as long as necessary and, in any event, for no longer than 12 months.

Data collected for the “News” and “Atelier” services is retained until you withdraw your consent, which you may do by emailing privacy@stileinterno.live.

Information in unsolicited CVs is used solely to assess candidates. If a candidate is not selected, it is deleted within 12 months. If the assessment is successful, the information is retained for the duration of the employment relationship.

5. What rights can you exercise?

Under Articles 15 et seq. of the GDPR, you have the right to:

1. ask whether the Controller holds your personal data, access that data and obtain information about its origin; check its accuracy; request its updating, rectification, completion or erasure; request restriction of processing; or object to its processing;

2. request the transfer of data processed by automated means to another controller (data portability);

3. request the correction of personal data you believe is inaccurate or incomplete;

4. request the blocking, anonymisation or erasure of your personal data, or restriction of its processing, where it has been processed unlawfully. This includes data whose retention is no longer necessary for the purposes for which it was collected or subsequently processed.

You can send these requests to the Controller at privacy@stileinterno.live.

You may also lodge a complaint about the processing of your personal data with the Italian Data Protection Authority (Garante per la protezione dei dati personali).

6. Data Controller and contact details

The Data Controller is Riflessi S.r.l., Via Nino Pace 58, 66026 Ortona (CH), Italy, VAT No. 01536130691. Email: privacy@stileinterno.live.

7. Changes to this notice

The Controller may amend or update this notice, in whole or in part, including in response to changes in applicable law. Changes and updates take effect when published on the website. Please check this section regularly for the latest version and for information about the data collected and how it is used.

If a change involves new or additional processing that requires your consent, or in any other case where consent is required by law, your personal data will not be processed for those additional purposes without your explicit consent.

Last updated: 8 June 2021

Privacy Notice on the Processing of Personal Data

Pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (“GDPR”)

The personal data you provide to us (including your identification and contact details, tax identification number and/or VAT number, bank details, where applicable, information concerning products purchased or in which you have expressed an interest, as well as data collected through the digital channels described in Section 4) are processed by RIFLESSI S.r.l. (hereinafter the “Data Controller” or the “Company”) in connection with the establishment and performance of a contractual relationship, your visit to one of our stores, your attendance at trade fairs and events, or your browsing of and submission of forms through the website and the related store-specific pages. Personal data are processed in accordance with the principles of fairness, lawfulness, transparency, data minimisation and storage limitation. Processing may be carried out in writing, in paper form and/or by electronic and telematic means, using procedures and systems designed to ensure the security, integrity and confidentiality of the data, through appropriate technical and organisational measures intended to prevent loss, unlawful or improper use and unauthorised access.

No automated decision-making process that produces legal effects concerning you or similarly significantly affects you within the meaning of Article 22 GDPR is carried out in connection with the processing of your personal data.

1. Data Controller

The Data Controller is RIFLESSI S.r.l., with registered office at Via Nino Pace No. 58 – Z.I., 66026 Ortona (CH), Italy, VAT No. 01536130691. For any information concerning the processing of your personal data, the Data Controller may be contacted at privacy@stileinterno.live. The Data Controller’s contact details are also available at www.stileinterno.live/it/privacy .

2. Purposes of the processing and legal basis

Your personal data are processed by the Data Controller for the following purposes:

2.1 Contractual, accounting and statutory purposes (mandatory processing)

To respond to your requests, manage store appointments, enter into and perform purchase agreements, and comply with obligations arising under applicable laws, regulations, and accounting and tax legislation.

The legal basis for such processing is Article 6(1)(b) and (c) GDPR. The provision of personal data for these purposes is necessary; failure to provide such data will make it impossible to fulfil your request or establish or continue the contractual relationship. This processing does not require the data subject’s consent.

2.2 Direct marketing purposes (optional processing)

Subject to your specific and express consent, the identification and contact details you provide—including through website forms, requests for appointments at stores, attendance at trade fairs and events, or subscription to the newsletter—may be used by the Data Controller for direct marketing purposes. This includes sending commercial communications, newsletters, information on new products, promotions, offers and initiatives of the Company and its network of authorised dealers, including by automated means, via email, SMS, post or telephone.

The legal basis for such processing is Article 6(1)(a) GDPR. Consent is optional and may be withdrawn at any time, without affecting the lawfulness of processing carried out prior to its withdrawal. Refusal or withdrawal of consent will result solely in your no longer receiving marketing communications.

Soft spam. Pursuant to Article 130(4) of Italian Legislative Decree No. 196/2003 (the Italian Data Protection Code), the email address you provide in connection with a purchase may be used by the Data Controller, without your consent, to offer products or services similar to those previously purchased, unless you object. You may object when your data are first collected or upon receipt of any subsequent communication by writing to privacy@stileinterno.live or using the unsubscribe link included in each communication.

3. Recipients and categories of recipients of personal data

Your personal data will not be made publicly available and may be disclosed, solely to the extent strictly necessary to pursue the purposes described above, to the following recipients:

personnel of the Data Controller authorised to process personal data for the purposes specified above, who have received appropriate instructions and training in data protection and use systems and tools designed to ensure data security;
parties acting as independent data controllers where disclosure is required by law or necessary for the establishment, exercise or defence of legal claims, such as public authorities, legal professionals, banks and insurance companies;
parties acting as data processors pursuant to Article 28 GDPR, namely contractually authorised suppliers processing personal data on behalf of the Data Controller, including, by way of example, the provider of the CRM system and related server infrastructure, the provider of the newsletter distribution platform, providers of IT systems and hosting services, and companies providing accounting and administrative services;
authorised dealers and agents within the Riflessi sales network, to whom your identification and contact details and the contents of your request may be transmitted, to the extent necessary to respond to your sales enquiry or manage your appointment at the relevant store. Authorised dealers act as independent data controllers in respect of the personal data they receive.

Transfers of personal data outside the EEA. Certain suppliers engaged by the Company to provide the services described above—including, by way of example, hosting and cloud infrastructure providers—may process personal data outside the European Economic Area. In such cases, personal data will be transferred in accordance with the safeguards set out in Chapter V GDPR, including European Commission adequacy decisions and Standard Contractual Clauses. Further information is available from the Data Controller upon request.

4. Methods and channels used to collect personal data

In accordance with the principle of transparency, the principal channels through which the Company collects your personal data are set out below:

at Riflessi-branded stores, in connection with a purchase, a request for an appointment or the completion and signing of this form;
through the website www.stileinterno.live and its pages dedicated to individual stores and appointment requests, as well as through newsletter subscriptions and any registration required to access restricted areas and download technical materials;
at trade fairs and events attended by the Company, through direct collection by Riflessi personnel or by means of a paper consent form;
through the Company’s CRM system, into which the data collected via the channels referred to above are entered and through which consent, the relevant retention period and any renewal of consent are managed.

Personal data collected through these channels are processed subject to the same safeguards and for the same purposes described in this Privacy Notice, irrespective of the channel through which they are obtained.

5. Retention period

Your personal data will be retained for no longer than is necessary to fulfil the purposes for which they were collected, taking into account applicable statutory obligations and the need to protect the Data Controller’s rights. In particular:

personal data processed for contractual, accounting and tax purposes will be retained for the period prescribed by the applicable legislation—generally ten years following termination of the relationship—without prejudice to any different retention periods required by law;
personal data processed for direct marketing purposes will be retained until consent is withdrawn and, where consent is not withdrawn, for no longer than 36 months from the date on which the data were collected or consent was last renewed. Upon expiry of this period, the Company will ask you to renew your consent; if consent is not renewed, the data will be anonymised or deleted.

Upon expiry of the periods specified above, personal data will be deleted or permanently anonymised, without prejudice to their retention in aggregated or anonymous form for statistical purposes.

6. Data subject rights

As a data subject, you have the right, pursuant to Articles 15–22 GDPR, to request from the Data Controller at any time:

access to your personal data;
rectification or completion of inaccurate or incomplete data;
erasure of your personal data, where the conditions prescribed by law are met;
restriction of processing;
objection to processing, particularly for marketing purposes;
portability of data processed by automated means on the basis of consent or a contract.

Requests for erasure remain subject to the Company’s statutory and document-retention obligations. To exercise your rights, you may contact the Data Controller at privacy@stileinterno.live.

You also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali) at www.garanteprivacy.it if you believe that your personal data are being processed in breach of applicable data protection legislation.

7. Amendments to this Privacy Notice

This Privacy Notice may be amended or updated, including as a result of changes in applicable legislation or the Company’s organisational arrangements. The latest version will always be available at Riflessi stores and at www.stileinterno.live/it/privacy .

Rev. 1 dated 10 September 2026 – Document prepared in accordance with Regulation (EU) 2016/679.