This privacy notice is provided in compliance with Art. 13 of Regulation 2016/679 (GDPR), pursuant to Art. 13 of Legislative Decree No. 196/2003 (Personal Data Protection Code) and applies to all personal data processed in the manner described below.
Data Controller

The Data Controller of the collected Personal Data is: Herian – Sunglasses and Eyeglasses

Registered office: Via del Sole, 6/8r, 50123 – Florence – Tuscany – Italy

Controller’s email address: info@herian.it
Types of Data collected
Full details on each type of data collected are provided in the dedicated sections of this privacy policy. Personal Data may be freely provided by the User or, in the case of Usage Data, collected automatically during use of the site. Unless otherwise specified, all requested Data is mandatory. If the User refuses to provide it, it may be impossible to deliver the service. In cases where some data is optional, Users are free to refrain from providing such Data without any consequences for the availability or operation of the Service. Users who have doubts about which Data is mandatory are encouraged to contact the Controller. The use of Cookies, or other tracking tools, by the site or by the owners of third-party services used, unless otherwise specified, is intended to provide the Service requested by the User. The User assumes responsibility for any Personal Data of third parties obtained, published, or shared through the site and warrants having the right to communicate or disclose it, releasing the Controller from any liability toward third parties.
METHODS AND PLACE OF PROCESSING OF COLLECTED DATA
Purposes of Processing the collected Data
The user’s data is collected to allow the Controller to provide its Services, as well as for the following purposes: Statistics, Newsletter, Personalized Advertising, Accounting, Content and Feature Performance Testing, Interaction with Social Networks and External Platforms, Display of Content from External Platforms, and Interaction with Data Collection Platforms and Other Third Parties. For more detailed information on the purposes of processing and the Personal Data concretely relevant to each purpose, the User may refer to the relevant sections of this document.
Processing methods
The Controller adopts appropriate security measures to prevent unauthorized access, disclosure, modification, or destruction of Personal Data. Processing is carried out using IT and/or telematic tools, with organizational methods and logic strictly related to the stated purposes. In addition to the Controller, other parties external to the company may have access to the data (administrative, commercial, marketing, legal staff, system administrators) or external parties (such as third-party technical service providers, postal couriers, hosting providers, IT companies, communication agencies), also appointed, where necessary, as Data Processors by the Controller. The updated list of Data Processors may always be requested from the Data Controller.
Legal basis of processing
The Controller processes Personal Data relating to the User when one of the following conditions applies:

• the user has given consent for one or more specific purposes;
• processing is necessary for the performance of a contract with the user and/or for the execution of pre-contractual measures;
• processing is necessary to fulfill a legal obligation to which the Controller is subject;
• processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the Controller;
• processing is necessary for the pursuit of the legitimate interests of the Controller or third parties.

It is always possible to request the Controller to clarify the specific legal basis for each processing activity, and in particular to specify whether processing is based on law, provided for by a contract, or necessary to enter into a contract.
Place
Data is processed at the Controller’s operational premises and at any other location where the parties involved in the processing are based. For further information, please contact the Controller. The User’s Personal Data may be transferred to a country other than the one in which the User is located. To obtain further information on the place of processing, the User may refer to the section concerning the details of Personal Data processing. The User has the right to obtain information regarding the legal basis for the transfer of Data outside the European Union or to an international organization under public international law or established by two or more countries, such as the UN, as well as regarding the security measures adopted by the Controller to protect the Data. Should any of the aforementioned transfers take place, the User may refer to the relevant sections of this document or request information from the Controller by contacting them at the details provided at the beginning.
Retention period
Data is processed and stored for as long as required by the purposes for which it was collected:

• Personal Data collected for purposes related to the performance of a contract between the Controller and the User will be retained until the execution of that contract is complete.
• Personal Data collected for purposes attributable to the legitimate interest of the Controller will be retained until that interest is satisfied. The User may obtain further information regarding the legitimate interest pursued by the Controller in the relevant sections of this document or by contacting the Controller.

Where processing is based on the User’s consent, the Controller may retain Personal Data for a longer period until such consent is withdrawn. Furthermore, the Controller may be required to retain Personal Data for a longer period in compliance with a legal obligation or by order of an authority. Upon expiry of the retention period, Personal Data will be deleted. Therefore, once that period has elapsed, the right of access, erasure, rectification, and the right to data portability may no longer be exercised.
Details on the processing of Personal Data
Personal Data is collected for the following purposes and using the following services:

• Mailing List or NewsletterUpon registration to the mailing list or newsletter, the User’s email address is automatically added to a contact list to which email messages containing information, including commercial and promotional content, may be sent. The User’s email address may also be added to this list as a result of registration on the site or after requesting a quote. Personal Data collected: email, first and last name.
• Contact formThe User, by filling in the contact form with their Data, consents to its use to respond to requests for information, quotes, or any other type of request indicated in the form’s heading.
  Personal Data collected: first and last name, email (mandatory), phone number, and various types of Data.
• Registration for access to a reserved areaThe User, by filling in the registration form with their Data, consents to its use to create a unique account for various site functions (responding to information requests, quotes, or e-commerce).
  Personal Data collected: first and last name, email (mandatory), phone number, and various types of Data.
• Interaction with social networks and external platformsThis type of service allows interactions with social networks, or other external platforms, directly from this site. Interactions and information acquired are in any case subject to the User’s privacy settings for each social network. Where a social network interaction service is installed, it is possible that, even if Users do not use the service, it may still collect traffic data relating to the pages on which it is installed.
  • Facebook Social Widgets (Facebook Inc.)Facebook social widgets are interaction services with the Facebook social network, provided by Facebook, Inc.
    Personal Data collected: Cookies and Usage Data.
    Place of processing: USA – Privacy Policy.
  • YouTube Social Widgets (Google Inc.)YouTube social widgets are interaction services with the YouTube platform, provided by Google Inc.
    Personal Data collected: Cookies and Usage Data.
    Place of processing: USA – Privacy Policy.
• Remarketing and Behavioral TargetingThis type of service allows the Controller to communicate, optimize, and serve advertising based on the User’s past use of this site. This activity is carried out through the tracking of Usage Data and the use of Cookies, information which is transferred to partners linked to the remarketing and behavioral targeting activity.
  • Remarketing with Google Analytics for Display Advertising (Google Inc.)Google Analytics for Display Advertising is a remarketing and behavioral targeting service provided by Google Inc. that connects the tracking activity performed by Google Analytics and its Cookies.
    Personal Data collected: Cookies and Usage Data.
    Place of processing: USA – Privacy Policy.
• StatisticsThe services contained in this section allow the Data Controller to monitor and analyze traffic data and are used to track User behavior.
  • Google Analytics (Google Inc.)Google Analytics is a web analytics service provided by Google Inc. (“Google”). Google uses the collected Personal Data to track and examine the use of the site, compile reports, and share them with other services developed by Google. Google may use Personal Data to contextualize and personalize the ads of its advertising network.
    Personal Data collected: Cookies and Usage Data.
    Place of processing: USA – Privacy Policy – Opt Out.

Additional information on Personal Data
Privacy Policy
The User, by filling in the contact form with their Data, consents to its use to respond to requests for information, quotes, or any other type of request indicated in the form’s heading.
User Rights
Pursuant to Arts. 15–21 of EU Regulation 2016/679, each data subject is granted a series of rights.

• Right of Access: the data subject, pursuant to Art. 15, has the right to obtain confirmation as to whether or not personal data concerning them is being processed and, if so, to obtain a copy. They also have the right to access the personal data concerning them and to additional information such as the purpose of processing, the categories of recipients, the data retention period, and the rights exercisable.
• Right to Rectification: the data subject, pursuant to Art. 16, has the right to obtain the rectification of inaccurate personal data concerning them or the completion thereof.
• Right to Erasure: the data subject has the right to obtain the erasure of personal data concerning them, without undue delay, where one of the grounds provided for in Art. 17 applies.
• Right to Restriction of Processing: the data subject has the right, in the cases provided for in Art. 18 of Regulation 2016/679, to obtain restriction of processing.
• Right to Data Portability: the data subject has the right to receive personal data concerning them in a structured, commonly used and machine-readable format, and has the right to transmit such data to another controller without hindrance, pursuant to Art. 20 of Regulation 2016/679;
• Right to Object to Processing: the data subject has the right to object to the processing of personal data concerning them pursuant to Art. 21 of Regulation 2016/679.

The data subject also has the right to lodge a complaint with the competent supervisory authority, the Italian Data Protection Authority (Garante della Privacy). The requests referred to in the preceding points must be addressed in writing to the Data Controller. The Data Controller will, within the time limits established by current legislation, provide a timely response to requests for the exercise of data subjects’ rights.