INFORMATION NOTICE ON THE PROCESSING OF PERSONAL DATA (PRIVACY POLICY)

pursuant to Articles 12, 13 and 14 of Regulation (EU) 2016/679 (“GDPR”)

This Privacy Notice describes the methods of collection, use, storage and protection of the personal data of users who visit the websites www.reda1865.com and store.reda1865.com (hereinafter, the “Sites”), purchase products through the e-commerce platform or subscribe to the newsletter and promotional communication services.

Successori Reda S.B.p.A. is committed to ensuring that personal data are processed in full respect of the rights, fundamental freedoms and dignity of the data subject, with particular regard to the principles of lawfulness, fairness, transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity, confidentiality and accountability laid down in Article 5 of Regulation (EU) 2016/679.

Data Controller

The controller of the personal data collected through the Sites is:

Successori Reda S.B.p.A.
Registered office: Via Robiolio 25 – 13825 Valdilana (BI), Italy
Tax Code, VAT No. and Biella Companies Register No.: 01676570029
Contact e-mail address for privacy matters: privacy@reda1865.com

Persons authorised and instructed to process personal data act under the direct authority of the Controller, in compliance with precise operating instructions to ensure the security and confidentiality of information.

Types of Personal Data Processed

Depending on the services used, the Controller may process the following categories of data:

Browsing and technical data: The IT systems and software procedures responsible for the operation of the Sites acquire, in the course of their normal operation, certain personal data whose transmission is implicit in the use of Internet communication protocols (by way of example: IP addresses, type of browser used, operating system, domain name and addresses of the websites from which access was made, pages visited, time of access, time spent on each page). The acquisition and use of such data for statistical or advanced tracking purposes take place by means of cookies or other similar tools.
Identification, contact and shipping data for e-commerce: First name, surname, shipping address, billing address, tax code or VAT number (where required for tax obligations), telephone number, e-mail address.
Payment and transaction data: Data relating to the chosen payment method, history of orders placed, payment status. Financial information and credit/debit card numbers are handled directly by certified payment gateways that comply with industry security standards; the Controller only processes the data confirming that the transaction has been completed.

Data for subscribing to the Newsletter and Marketing communications: E-mail address and, where provided, first name, surname and contact preferences.
Profiling data and consumer habits (subject to specific consent): Information relating to purchases made (frequency, amounts, categories of products purchased), interaction with the communications sent, browsing preferences collected through profiling cookies.
Data voluntarily provided by the user: Personal data included in messages sent to Customer Service channels or through the information request forms available on the Sites.
Third-party data provided by the user: Where the user provides personal data of third parties (for example, for the shipment of a product to a recipient other than the purchaser), the user assumes responsibility for informing such third parties and for ensuring that the provision of such data is lawful under applicable law.

Purposes of Processing, Legal Bases and Retention Periods

The individual purposes of processing, the related legal bases identified pursuant to Article 6 of the GDPR and the respective data retention periods are set out below:

Purpose of Processing	Legal Basis for Processing	Retention Period
A) Management of e-commerce purchase orders and performance of the contract (Account creation, order fulfilment, delivery of products, management of returns and of Customer Service).	Performance of the contract or of pre-contractual measures to which the data subject is party (Art. 6(1)(b) GDPR).	For the entire duration of the contractual relationship and for the 10 years following its termination, in compliance with civil-law obligations and ordinary limitation periods.
B) Administrative, tax and accounting obligations (Issuing of invoices, keeping of accounting records, fulfilment of legal obligations).	Compliance with a legal obligation to which the Controller is subject (Art. 6(1)(c) GDPR).	10 years from the date of issue of the accounting document, or in accordance with the specific time limits laid down by the applicable tax legislation.
C) Management of disputes and fraud prevention (Protection of the Controller’s rights in out-of-court and judicial proceedings, verification of the regularity of transactions).	Legitimate interest of the Controller in protecting its rights and in the security of transactions (Art. 6(1)(f) GDPR).	For the time strictly necessary for the establishment or defence of the right in legal proceedings, or until the enforceable right becomes time-barred.
D) Direct marketing and sending of promotional newsletters (Sending of commercial communications, news, promotions and events through automated channels such as e-mail and SMS, or traditional channels such as paper mail and telephone).	Express, separate and specific consent of the data subject (Art. 6(1)(a) GDPR).	Until consent is withdrawn by the data subject or the right to object is exercised, and in any case no longer than 24 months from collection or from the last positive interaction.
E) Profiling and personalisation of offers (Analysis of preferences, purchasing habits and consumer choices for the purpose of formulating personalised communications and improving services).	Express, separate and specific consent of the data subject (Art. 6(1)(a) GDPR).	Until consent is withdrawn by the data subject, and in any case no longer than 12 months from the recording of preferences and purchasing behaviour.

Nature of the Provision of Data and Consequences of Refusal

Processing for Contractual and Legal Purposes (Items A and B): The provision of data for these purposes is necessary for the conclusion and performance of the purchase contract, for the provision of the services requested and for compliance with the related tax and legal requirements. Failure to provide such data, or the provision of partial or inaccurate data, will make it impossible for the Controller to process the order, provide the sales services or duly fulfil its regulatory obligations.
Processing for Marketing and Profiling Purposes (Items D and E): The provision of data and the granting of consent for these purposes are entirely optional and voluntary. Any refusal will in no way affect browsing on the Sites, account registration or the completion of purchase orders.

Processing Methods and Security Measures

Personal data are processed both by manual and paper-based means and by computerised and electronic procedures, using logic strictly related to the purposes indicated above.

Pursuant to Article 32 of the GDPR, the Controller adopts appropriate technical and organisational measures to ensure a level of security commensurate with the risks of destruction, loss, alteration, unauthorised disclosure of, or accidental or unlawful access to, the personal data processed. Transactions and the transmission of confidential data on the Sites take place using secure cryptographic protocols (such as SSL/TLS certificates).

Recipients and Categories of Recipients of Personal Data

In pursuit of the purposes described above, personal data may be disclosed to the following categories of recipients:

Technical and IT service providers: companies providing web hosting, system maintenance and e-mail platform management services, and providers for sending newsletters and commercial communications.
Logistics operators and carriers: couriers and freight forwarders for the delivery of purchased products.
Banks and payment intermediaries: platforms for the management and processing of digital payments.
Professional and legal advisers: accounting, tax or law firms for compliance with legal obligations or the defence of the Controller’s rights.
Public authorities and police forces: where required by specific legal obligations or by binding orders of the judicial or administrative authorities.

Where such parties do not act as independent Data Controllers, they are formally appointed by the Controller as Data Processors pursuant to Article 28 of the GDPR and are bound by specific contractual obligations of confidentiality and security. The detailed and up-to-date list of Data Processors is available on request by sending an e-mail to privacy@reda1865.com.

Transfer of Data outside the European Economic Area (EEA)

Personal data are processed mainly within the European Economic Area (EEA). Should it become necessary, for technical, operational or contractual reasons, to transfer data to third countries, such transfer will take place exclusively in compliance with the conditions laid down in Chapter V of the GDPR, namely:

to third countries ensuring an adequate level of protection on the basis of an Adequacy Decision of the European Commission (Art. 45 GDPR);
subject to Appropriate Safeguards, such as the Standard Contractual Clauses (SCCs) adopted by the European Commission (Art. 46 GDPR), following verification of the effective protection of data subjects’ rights in the country of destination;
in accordance with binding corporate rules or specific derogations permitted by law (Art. 49 GDPR).

RIGHT TO OBJECT TO DIRECT MARKETING (Art. 21 GDPR)

Pursuant to Article 21(2) and (3) of Regulation (EU) 2016/679 and Recital 70:

The data subject has the right to object at any time, free of charge and without having to give any reason, to the processing of his or her personal data for direct marketing purposes (including the sending of newsletters, commercial offers, promotions and advertising material), including profiling to the extent that it is related to such direct marketing.

Where the data subject objects to processing for direct marketing purposes, the personal data will no longer be processed for such purposes.

Methods for Withdrawing Consent

Pursuant to Article 7(3) of the GDPR, the data subject has the right to withdraw at any time the consent previously given for marketing and/or profiling purposes.

The withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal. In accordance with the guidance of the European Data Protection Board (EDPB), the withdrawal procedure is made simple, immediate and free of charge through the following channels:

Unsubscribe link: provided at the bottom of each promotional e-mail or newsletter received, allowing immediate unsubscription with a single click.
Personal Account Settings: by accessing the user’s reserved area on the Sites, in the section dedicated to privacy and communication preferences.
Communication by E-mail: by sending a specific request to privacy@reda1865.com, indicating whether the withdrawal concerns all promotional communications or specific channels.

Rights of the Data Subject (Articles 15-22 GDPR)

The data subject may at any time exercise the rights granted by Articles 15 et seq. of the GDPR:

Right of Access (Art. 15 GDPR): to obtain confirmation as to whether or not personal data concerning him or her are being processed and, where that is the case, to obtain access to the data, the purposes of the processing, the categories of data, the recipients or categories of recipients (including the specific identity of the recipients, where applicable) and the retention period.
Right to Rectification (Art. 16 GDPR): to obtain the rectification of inaccurate personal data or the completion of incomplete data.
Right to Erasure (“Right to be Forgotten”, Art. 17 GDPR): to obtain the erasure of his or her personal data in the cases provided for by law (e.g. withdrawal of consent where there is no other legal basis, objection to marketing, data no longer necessary).
Right to Restriction of Processing (Art. 18 GDPR): to obtain restriction of processing in the cases provided for by the applicable legislation (e.g. contesting the accuracy of the data or unlawful processing).
Right to Data Portability (Art. 20 GDPR): to receive the personal data provided to the Controller in a structured, commonly used and machine-readable format, and to transmit them to another controller where the processing is based on consent or on a contract and is carried out by automated means.
Right to Object (Art. 21 GDPR): to object at any time, on grounds relating to his or her particular situation, to processing based on legitimate interest, and to object to direct marketing without charge and without having to give reasons.
Rights relating to Automated Decision-Making (Art. 22 GDPR): not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her.

Channel for Exercising Rights

Requests to exercise these rights may be submitted without formalities by writing to the e-mail address: privacy@reda1865.com. The Controller will respond to the request without undue delay and in any event no later than one month from its receipt, extendable by two months in cases of particular complexity, in accordance with Article 12(3) of the GDPR.

Right to Lodge a Complaint

A data subject who considers that the processing of his or her personal data infringes the GDPR has the right to lodge a complaint with the competent national supervisory authority (in Italy: Garante per la Protezione dei Dati Personali, Piazza Venezia 11, 00187 Rome, www.garanteprivacy.it) pursuant to Article 77 of the GDPR, or to bring proceedings before the competent courts pursuant to Article 79 of the GDPR.

Processing of Minors’ Data

The services of the Sites and the sale of products through the e-commerce platform are intended for persons who have reached the age of majority (18 years) or the age required by their respective legal system for entering into distance contracts. The Controller does not knowingly collect or process personal data of minors. Should it be ascertained that a minor has registered or inadvertently provided data without valid parental consent, the Controller will promptly delete such information.

Cookies and Tracking Tools

The Sites use technical cookies (necessary for the operation of the website and for the management of the shopping cart) and, subject to the user’s consent expressed through a dedicated interactive banner compliant with the applicable Guidelines, first-party and third-party analytics and profiling cookies.

For detailed information on the types of cookies installed, their duration, consent management and opt-out options, please refer to the specific Cookie Policy available in the relevant section of the Sites.

Changes and Updates to the Privacy Policy

The Controller reserves the right to amend or update this Privacy Notice, including as a result of regulatory developments or the introduction of new features on the Sites. Material changes will be notified to users by publication on the Sites, with an indication of the date of the last update, or, where technically and legally feasible, by direct communication to registered users.

Last updated: 23 September 2026