Cookie Policy

This information (hereinafter, “Privacy Notice” or “Cookie Policy”) governs the processing of your personal data when you browse the store.vaporart.it, and in particular through the use of cookies, carried out by VaporArt S.r.l, with registered office in Via Uberto Visconti di Modrone, 7 - 20122 Milano (MI) – Italia, VAT n. 08153300960, email info@vaporart.it (hereinafter, the “Controller”), in accordance with the rules on protection of personal data, in particular, the EU Regulation 2016/679 (hereinafter, “GDPR”), through the site you are browsing (hereinafter, the “Site”).

1. Identity and contact details of the Controller

The Data Controller is VaporArt S.r.l. VaporArt S.r.l. is a company incorporated in the Italian territory, therefore no representative has been appointed.

2. Contact details of the data protection officer

The Data Controller has not appointed a Data Protection Officer (“DPO”), pursuant to Article 37 GDPR.

3. Processing methods

Cookies are small text strings that the Site you visit sends to your browser, which stores them in order to transmit them to the Site when you visit it again.
Cookies allow us to collect information about your browsing experience.
Cookies may be permanently stored on your computer and have a variable duration (persistent cookies), or they may not be permanently stored on your device and be automatically deleted when you close your browser (session cookies).
Cookies may be installed by the site you are visiting or may be installed by other websites that provide various services to that site (third party cookies). 3.1. Technical cookies

Cookies in this category allow the Site to function properly.

3.2. Statistical cookies

The Site also uses statistical cookies created directly by the Controller, or provided by third parties.

With the statistical cookies created directly by the Controller, the latter will carry out statistical analyses on various domains, websites or apps that can be traced back to the Controller itself, and will carry out its own statistical processing, without such analyses being aimed at making commercial decisions.

With third-party statistical cookies, means have been taken to reduce their identifying power, for example by masking significant portions of the IP addresses processed. In case of use of third-party statistical cookies, the third party has contractually committed to the Controller to use them exclusively for the provision of the service, to store them separately and not to “enrich” or “cross-reference” them with other information they have.

Navigation data and environmental variables
The Site automatically acquires some personal data relating to your navigation. This category of data includes, for example:

• the IP addresses of the computer you are using;
• the number of accesses;
• the pages used;
the date and time of access;
• the URL where the browser was before viewing the Site;
• the type of browsing browser;
• the operating system used.

3.3. Marketing cookies

Marketing cookies are non-technical cookies that allow the Controller to carry out marketing activities. The Controller uses the listed marketing cookies.

3.4. Profiling cookies

Profiling cookies are non-technical cookies that allow the Controller to provide you with services tailored to your needs. The Controller uses the listed profiling cookies.

3.5. Cookie list 4. Delete and disable cookies

You can configure your browser to prevent the processing of cookies, or delete them immediately after browsing. Below, we list how to disable and delete cookies with the main browsers:

• Delete/deactivate cookies with Firefox: http://support.mozilla.com/it/kb/Eliminare%20i%20cookie
• Delete/deactivate cookies with EDGE: https://support.microsoft.com/it-it/microsoft-edge/eliminare-i-cookie-in-microsoft-edge-63947406-40ac-c3b8-57b9-2a946a29ae09
• Delete/deactivate cookies with Chrome: http://support.google.com/chrome/bin/answer.py?hl=it&answer=95647

5. Data you voluntarily provide

You have the right and the freedom to provide data by sending electronic mail to the addresses indicated on the Site, which the Controller may acquire for the purposes indicated from time to time. In addition to the email address necessary to respond to you, any other personal data contained in the relevant communication will be processed. The data collected in this way will be stored and processed exclusively for the purpose of keeping correspondence, without using it for any other purpose

6. Purpose, legal basis of the processing, optional consent and consequences of non-consent

• Personal data processed while browsing the website: The provision of personal data is a contractual obligation, without which the website could not be made available in full working order.
• Personal data processed with technical cookies: The provision of personal data is a contractual obligation, without which the website could not be made available in full working order.
• Personal data processed with statistical cookies: The communication of personal data is purely optional. If you do not communicate your data, it will be impossible for the Controller to carry out statistical analyses. The legal basis for processing is your consent, expressed in accordance with paragraph 3.2. of the Cookie Policy.
• Personal data processed with marketing cookies: The communication of personal data is purely optional. If you do not communicate your data, it will be impossible for the Controller to carry out marketing activities. The legal basis for processing is your consent, expressed in accordance with the current legislation and the Cookie Policy.
• Personal data processed with profiling cookies: The communication of personal data is purely optional. If you do not communicate your data, it will be impossible for the Controller to provide you with personalized services through profiling. The legal basis for processing is your consent, expressed in accordance with the current legislation and the Cookie Policy.
• Personal data provided voluntarily via email or form: The communication of personal data is purely optional. If you fail to provide the data, the Controller will not be able to respond to your requests. The legal basis for the processing is the legitimate interest of the Controller, as Data Controller, to respond to requests.

You can express your consent to the processing of personal data with non-technical cookies by clicking on a specific box presented within a banner.

7. Automated decision-making and profiling

If you consent to processing through profiling cookies to benefit from personalized services, your personal data may be subject to an automated decision-making process, with a specific algorithm that will decide which communications are best suited to your profile or which might be of interest to you. The expected consequences of this processing are the sending of highly profiled commercial communications, sending discounts, sending invitations to events deemed to be of interest.

In accordance with Article 22 GDPR, you have the right to:

• obtain human intervention in the decision-making process by the Data Controller;
• express your opinion;
• obtain an explanation of the decision reached by the Data Controller;
• challenge the decision itself.

8. Source of personal data and data categories

The Controller will only process personal data provided by you in accordance with the Cookie Policy, collected through the Site or by sending you an email. The Controller will not process data from publicly available sources. The Controller will not process special personal data as referred to in Article 9 of the GDPR.

9. Recipients and possible categories of recipients of personal data They may receive your personal data:

• communications companies that perform communications activities on behalf of the Controller;
• companies offering information society services;
• companies that offer hosting services;
• the service providers of the communication company.

10. Data Transfer

The Controller intends to transfer your personal data to entities established in a country outside of the European Union or to an international organization. Such entities could be represented, without limitation, by:

• Communications companies that perform communications activities on behalf of the Controller;
• companies offering information society services;
• companies that offer hosting services;
• the service providers of the communication company.

The transfer of personal data to such entities, if established in a third country, or to an international organization, is carried out in the presence of an adequacy decision by the European Commission, which has verified that the third country, the territory or one or more specific sectors within the third country, or the international organization in question ensure an adequate level of protection of your rights. In the absence of such decisions, if deemed appropriate, reserves the right to enter into specific and separate agreements obliging such entities to adopt adequate security measures, including organizational measures, aimed at providing appropriate safeguards with respect to your rights.
Google Inc., in particular, is contractually bound to ensure adequate protection of the rights of the data subject. The data may thus be transferred to the following countries: United States of America.
To obtain a copy of this data or the place where it has been made available, simply send your request to the Controller at the addresses shown above.

11. Data retention period

• The Controller will keep your personal data processed by means of technical cookies in order to allow you to use the Site correctly for a period not exceeding 12 (twelve) months from the date of individual collection, in accordance with the provisions of point 2.1 of the Cookie Policy;
• The Controller will keep your personal data processed to provide personalized services through statistical, marketing and profiling cookies for a period not exceeding 12 (twelve) months from the date of individual collection, in accordance with the provisions of points 3.2., 3.3. and 3.4 of the Cookie Policy;
• The Controller will keep your personal data provided voluntarily via e-mail or form and processed to respond to your requests for a period of time strictly necessary for achieving this purpose and, in any case, for no longer than 12 (twelve) months from the date of individual collection.

The Controller reserves the right, in any case, to ask you to renew your consent to the processing and / or to verify the consents you have already expressed.

12. Right of objection

As a “data subject”, you have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data relating to you pursuant to Article 6(1)(e) or (f) of the GDPR, including profiling on the basis of those provisions.
The Controller refrains from further processing your personal data, unless the Controller itself demonstrates the existence of compelling legitimate grounds for the processing which override your interests, rights and freedoms, or for the establishment, exercise or defence of legal claims.
If personal data is processed for direct marketing purposes, you have the right to object at any time to the processing of personal data about you carried out for such purposes, including profiling insofar as it is related to such direct marketing.
If you object to the processing for direct marketing purposes, your personal data shall no longer be processed for such purposes.
You may object to the processing of your personal data for direct marketing purposes even in part, for example by objecting only to the sending of promotional communications carried out by automated and/or digital means, or to the sending of paper communications and/or the receipt of telephone communications.
If your personal data is processed for scientific or historical research purposes or for statistical purposes pursuant to Article 89(1) of the GDPR, you have the right, on grounds relating to your particular situation, to object to the processing of personal data concerning you, unless the processing is necessary for the performance of a task carried out in the public interest.

13. Other rights The Controller would also like to inform you of the existence of the following rights:

• Right of access: you have the right to obtain confirmation from the Controller that personal data concerning you is or is not being processed. If so, you have the right to access your personal data and specific information, in accordance with Article 15 of the GDPR;
• Right of rectification: you have the right to obtain from the Controller the rectification of inaccurate personal data concerning you without undue delay. Taking into account the purposes of the processing, you have the right to obtain the integration of incomplete personal data, including by providing a supplementary declaration, in accordance with Article 16 of the GDPR;
• Right to erasure: you have the right to obtain from the Controller the erasure of personal data concerning you without undue delay. The Controller is obliged to delete your personal data without undue delay, if there are grounds listed in Article 17 of the GDPR;
• Right to restriction of processing: you have the right to obtain from the Controller the restriction of processing, if the grounds listed in Article 18 of the GDPR exist;
• Right to data portability: you have the right to receive in a structured, commonly used and machine-readable format, personal data concerning you provided to the Controller, as well as the right to transmit such data to another data controller without hindrance by the Controller , in the cases and under the conditions specified by Article 20 of the GDPR;
• Right to obtain human intervention, express your opinion, obtain an explanation of the decision reached by the Data Controller and challenge the decision reached by means of automated decision-making processing: you have the right to obtain human intervention in the decision-making process by the Data Controller, express your opinion, obtain an explanation of the decision reached by the Data Controller and challenge the decision itself in accordance with Article 22 GDPR;
• Right to object to commercial communications: you have the right to object at any time, free of charge, to receiving commercial communications from the Controller;
• Right to lodge a complaint with the Data Protection Authority: you have the right to lodge a complaint with the Data Protection Authority, to complain about a violation of the rules on the protection of personal data, in accordance with Article 77 of the GDPR.

14. How to exercise your rights

You may exercise the rights indicated in the Cookie Policy by addressing your requests directly to the Controller at the email address info@vaporart.it, or by sending the relative communication by registered mail with return receipt to the address Via Uberto Visconti di Modrone, 7 - 20122 Milano (MI) – Italia.
You may lodge a complaint with the Italian Personal Data Protection Authority in the manner provided for by the official website, addressing it to the contact details available at https://www.garanteprivacy.it/home/footer/contatti.

15. Accessibility

The Cookie Policy can be accessed at https://store.vaporart.it/en/cookie.html and at office of the Controller. If you specifically request it, the Controller may provide the information to you orally, subject to proof of identity, with a telephone request directed to +39 015 35096.

16. Changes

The Controller may modify the Cookie Policy, also in order to comply with national and/or European Union legislation or technological innovations. Any new versions of the Cookie Policy will be posted on the Site. We encourage you to periodically check the Cookie Policy. Any changes will be communicated to you through a pop-up on the Site or by other means and/or computer tools. If the Controller substantially modifies the Cookie Policy, providing for new processing purposes and / or categories of personal data processed or changing the third parties, the Controller itself will inform you, requesting the necessary consents, through a special banner. If it is impossible for the Controller to check the storage of cookies on your device on the occasion of your next visit to the Site, for example in case of deletion of cookies installed, the Controller will inform you and ask for your consent through a banner. If at least 6 (six) months have elapsed since the banner was previously displayed on the Site, the Controller will inform you by means of a banner asking for your consent.