Privacy Policy

Privacy notice pursuant to Article 13 of EU GDPR 2016/679 on the protection of personal data We Do Spaces S.r.l. (hereinafter also the “Company” or the “Controller”), owner of the “Dvo” and “Sitland” brands, in its capacity as Data Controller, informs users that the personal data provided through the forms available on the Company landing page www.wedospaces.it and on the related brand websites (www.sitland.com; www.dvo.it) will be processed in accordance with the principles of fairness, lawfulness, transparency and confidentiality set out in Regulation (EU) 2016/679.

1. Data Controller

The Data Controller is: We Do Spaces S.r.l. Via XX Settembre, 272, Tel. +39 0434386111 E-mail: privacy@wedospaces.it

2. Categories of data processed

Depending on the service requested, the Controller may process the following categories of personal data:

• first name and surname;
• e-mail address;
• telephone number;
• company or organisation;
• profession or job role;
• city, province and country;
• content of requests and communications submitted;
• any additional data voluntarily provided by the user in descriptive fields or in submitted attachments.

The provision of special categories of personal data (for example, health data or other particularly sensitive information) is not required, and users are requested not to include such data in their communications.

3. Purposes of processing
4. A) Management of information requests

Personal data will be processed to:

• respond to requests for information about We Do Spaces products and services and/or those of its brands;
• provide commercial or technical clarifications;
• contact the user again in relation to the request submitted.

Legal basis: Article 6(1)(b) GDPR (performance of pre-contractual measures taken at the request of the data subject).

1. B) After-sales support

Personal data will be processed to:

• manage technical support requests;
• manage complaints and reports;
• verify the purchase and the related documentation;
• organise support and assistance activities.

Legal basis: Article 6(1)(b) GDPR (performance of a contract or pre-contractual measures).

1. C) Newsletters and promotional communications

Where the user requests subscription to the newsletter or gives the relevant consent, the data may be used for:

• sending newsletters;
• commercial communications;
• promotional initiatives;
• invitations to events;
• information on products, collections and news concerning We Do Spaces brands.

Legal basis: Article 6(1)(a) GDPR (consent of the data subject). Consent may be withdrawn at any time, without affecting the lawfulness of processing carried out before its withdrawal.

1. D) Protection of the Controller’s rights

Data may be processed for the establishment, exercise or defence of the Company’s rights in judicial or out-of-court proceedings, or to prevent fraudulent use of the website services, manage IT security and protect information systems. Legal basis: Article 6(1)(f) GDPR.

1. E) Profiling

Subject to the data subject’s specific consent, personal data may be processed to analyse preferences, interests, browsing habits, interactions with communications sent and purchasing behaviour, in order to personalise commercial communications and offer content and promotions more closely aligned with the data subject’s interests. Legal basis: Article 6(1)(a) GDPR (consent of the data subject).

4. Nature of data provision

Providing data marked as mandatory is necessary to manage the user’s request. Refusal to provide such data may prevent the Controller from responding to the request submitted. Providing data for marketing and newsletter purposes is optional.

5. Processing methods

Personal data will be processed using paper-based and electronic means in compliance with the security measures required by the GDPR and applicable national legislation.

6. Recipients of the data

Data may be disclosed to:

• personnel authorised by the Controller;
• companies belonging to the We Do Holding group, where necessary;
• providers of IT, hosting, website maintenance and management services;
• newsletter and marketing service providers;
• consultants and professionals assisting the Controller;
• authorities and public administrations in the cases provided for by law.

Depending on the circumstances, these parties act as external processors or independent data controllers.

7. Transfer of data to third countries

Where the provision of services used by the Controller requires the transfer of personal data to countries outside the European Economic Area, such transfer will take place in compliance with the conditions laid down in Articles 44 et seq. of the GDPR. A list of the third countries concerned and the safeguards adopted may be requested from the Controller.

8. Retention period

Data will be retained as follows:

• information requests: up to 24 months after the request has been handled;
• after-sales support: for the time necessary to handle the case and subsequently for the period required by legal obligations;
• newsletters and marketing: until consent is withdrawn and, in any event, no longer than 24 months after the user’s last significant interaction, unless consent is renewed.

Data may be retained for a longer period where necessary to comply with legal obligations or to protect the Controller’s rights.

9. Rights of the data subject

The data subject has the right to request access to their data from the Data Controller (Article 15 GDPR), rectification of such data (Articles 16 and 19 GDPR) and data portability (Article 20 GDPR). Where the relevant conditions are met, the data subject also has the right to erasure, restriction of processing and objection to the processing of personal data concerning them (Articles 17, 18 and 19 GDPR), including the right to withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal. The data subject also has the right to lodge a complaint regarding any infringement with the Italian Data Protection Authority, following the guidance and procedures set out on the Authority’s website: https://www.garanteprivacy.it/diritti/come-agire-per-tutelare-i-tuoi-dati-personali/reclamo. The data subject may exercise their rights by writing to privacy@wedospaces.it and may use the relevant forms made available by the Controller. The full text of the Regulation is available at: https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32016R0679&from=EN