(pursuant to Art. 13 of the EU Regulation 2016/679 – GDPR)

Data Controller:

Wallnöfer KG des Wallnöfer Oswald & Co, with registered office in 39024 Mals (BZ), Laatsch 72 (hereinafter referred to as "Data Controller"), hereby informs you about the processing of your personal data pursuant to Art. 13 of the EU Regulation 2016/679 (GDPR):

1. Object of Data Processing

We process personal data provided by you within the framework of contractual relationships, such as:
First name, last name, company name, address, telephone number, mobile number, fax, e-mail, PEC e-mail address, SDI code, tax number, VAT number, bank details, and payment data.

2. Purposes of Data Processing

  1. A) Without consent pursuant to Art. 6 para. 1 lit. b) and c) GDPR:
  • Fulfillment of contractual or pre-contractual obligations
  • Fulfillment of legal and fiscal obligations
  • Compliance with statutory provisions (e.g., anti-money laundering legislation)
  • Establishment, exercise, or defense of legal claims

Note: If you are already an existing customer, we may send you information about similar products/services unless you object.

  1. B) Only with your explicit consent (Art. 7 GDPR):
  • Sending newsletters, advertising, and commercial communications via e-mail, postal mail, SMS, WhatsApp, Facebook Messenger, Instagram, LinkedIn, or telephone
  • Customer satisfaction surveys regarding our services and offers

3. Methods and Duration of Processing

Data processing is carried out in paper form as well as by electronic/automated means in compliance with Art. 4 No. 2 GDPR. The data will be stored for as long as necessary to fulfill the respective purposes:

  • Up to 10 years for statutory and contractual obligations
  • Max. 3 years for marketing purposes (provided you have consented)

4. Access to Data4. Datenzugriff

Access to your data is restricted to:

  • Employees of the Data Controller in their role as authorized persons or system administrators
  • External service providers (e.g., banks, tax advisors, insurance companies), provided they act on our behalf and have concluded a corresponding Data Processing Agreement (DPA)

5. Disclosure of Data

Your data will – without your explicit consent – only be disclosed to public authorities, courts, or other official bodies if required by law (Art. 6 lit. b and c GDPR).
Your data will not be shared with or sold to third parties for commercial purposes.

6. Data Processing and Storage Location

Your data is processed at the company's registered office and within the EU. Data received via e-mail or the contact form is stored on the servers of Aruba S.p.A. in Arezzo, Rome, and Milan (Italy). Certified e-mail (PEC) messages are also securely managed there.

7. Nature of Data Provision

  • Mandatory provision (Art. 2.A): necessary for contract performance – without this data, no services can be rendered.
  • Voluntary provision (Art. 2.B): for marketing purposes – refusal does not affect existing contracts, but means you will not receive promotional materials or newsletters.

8. Rights of the Data Subject

Pursuant to Art. 15–21 GDPR, you have the right to:

  • Access your stored personal data
  • Rectification of inaccurate or incomplete data
  • Erasure ("Right to be forgotten")
  • Restriction of processing
  • Data portability
  • Objection to processing, particularly for direct marketing purposes
  • Lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it)

9. Exercise of Rights

You may exercise your rights by sending:

10. Data Controller

Data Controller: Wallnöfer Oswald