Privacy Policy

Rule Components S.r.l. processes the personal data of users of the www.rulecomponents.com website in accordance with Regulation (EU) 2016/679 (GDPR) and Italian Legislative Decree 196/2003 as amended by Legislative Decree 101/2018. This notice, provided pursuant to articles 13 and 14 of the GDPR, describes what data we collect, for what purposes and by what means we process it, and what rights you may exercise.

1. Data controller

Rule Components S.r.l.
Via San Vincenzo, 1 – 10024 Moncalieri (TO), Italy
VAT number / Tax code: IT04105690046
E-mail: info@rulecomponents.com
Tel. +39 349 3055561

The Controller has not appointed a Data Protection Officer, as the conditions set out in article 37 of the GDPR do not apply. For any request concerning the processing of your data, please write to the e-mail address above.

2. Categories of data processed

a) Identification and contact data: first name, surname, e-mail address, telephone number, billing and shipping address, tax code or VAT number, recipient code for electronic invoicing.

b) Order data: products purchased, amounts, order history, returns and warranty claims, correspondence with customer service.

c) Payment data: card details neither pass through nor are stored on our systems, but are processed directly by the payment provider; we receive only the outcome of the transaction and the data required for invoicing. In the case of a bank transfer, we receive the payer’s bank details.

d) Browsing data: IP address, browser and device type, operating system, pages visited, date and time of access, server logs. Some of this data is collected through cookies and similar technologies, as set out in the Cookie Policy.

e) Account data: credentials for accessing the reserved area (the password is stored in encrypted form and cannot be read by the Controller).

The website is not directed at children under 16 and we do not knowingly collect their data. We do not process special categories of data within the meaning of article 9 of the GDPR.

3. Purposes, legal bases and retention periods

a) Management of orders, payments, shipments, returns and warranty claims. Legal basis: performance of a contract or pre-contractual measures (art. 6(1)(b) GDPR). Retention: for the duration of the relationship and thereafter for 10 years, being the ordinary limitation period and the statutory retention period for accounting records.

b) Tax, accounting and statutory obligations, including electronic invoicing and substitutive archiving. Legal basis: legal obligation (art. 6(1)(c) GDPR). Retention: 10 years, or any longer period required by tax legislation.

c) Responding to enquiries sent through the contact forms. Legal basis: pre-contractual measures or legitimate interest in replying (arts. 6(1)(b) and 6(1)(f) GDPR). Retention: 24 months from the last contact.

d) Registration and management of the account in the reserved area. Legal basis: performance of the service contract (art. 6(1)(b) GDPR). Retention: until the account is deleted, or after 24 months of inactivity.

e) Sending newsletters and promotional communications. Legal basis: consent (art. 6(1)(a) GDPR), which may be withdrawn at any time via the link at the foot of each message or by writing to the Controller. Retention: until consent is withdrawn, and in any case no longer than 24 months from the last interaction.

f) Sending communications about products similar to those purchased (soft spam). Legal basis: legitimate interest pursuant to article 130(4) of Legislative Decree 196/2003; you may object at any time, without formality. Retention: 24 months from the last purchase.

g) Website usage statistics and service improvement, through analytics tools activated only after express consent given in the cookie banner. Legal basis: consent (art. 6(1)(a) GDPR). Retention: as set out in the Cookie Policy.

h) Website security, prevention of fraud and abuse, management of technical logs. Legal basis: the Controller’s legitimate interest in ensuring the integrity of its systems (art. 6(1)(f) GDPR). Retention: 12 months.

i) Establishment, exercise or defence of legal claims. Legal basis: legitimate interest (art. 6(1)(f) GDPR). Retention: for the duration of the proceedings and until the expiry of the time limits for appeal.

Providing the data marked as mandatory in the forms is necessary in order to complete an order or to receive a reply: refusal makes it impossible for us to provide the service. Providing data for marketing purposes is optional and refusal has no effect on your purchase. Once the periods indicated have elapsed, data is deleted or irreversibly anonymised.

4. Recipients of the data

Data may be disclosed to parties carrying out activities necessary for the management of the relationship, appointed as Data Processors pursuant to article 28 of the GDPR where they process data on our behalf:

• providers of hosting, maintenance and website development;

• couriers and logistics operators, for the delivery of products;

• payment service providers and banks, acting as independent controllers in respect of transaction data;

• accountants, tax advisers and invoicing software providers;

• providers of analytics and newsletter distribution services;

• lawyers, insurers and loss adjusters, in the event of a dispute;

• judicial and administrative authorities, in the cases provided for by law.

An up-to-date list of Data Processors is available on request by writing to info@rulecomponents.com. Data is not disseminated nor transferred to third parties for their own marketing purposes.

5. Transfers outside the European Economic Area

Some providers may process data outside the European Economic Area. In such cases the transfer takes place solely on the basis of an adequacy decision of the European Commission or of the standard contractual clauses adopted by the Commission pursuant to article 46 of the GDPR, supplemented where necessary by additional measures. You may request a copy of the safeguards in place by writing to the Controller.

6. Processing methods and security

Processing is carried out by electronic means and, residually, on paper, using logic strictly related to the purposes stated. We adopt technical and organisational measures appropriate under article 32 of the GDPR, including encryption of traffic via HTTPS, access controls, storage of passwords using hash functions, regular backups and system updates. Staff authorised to process data act under the Controller’s instructions and are bound by confidentiality.

7. Automated decision-making

We do not carry out automated decision-making or profiling producing legal effects concerning the user or similarly significantly affecting them within the meaning of article 22 of the GDPR.

8. Your rights

You may exercise the rights set out in articles 15 to 22 of the GDPR at any time, and in particular the right to:

• access your data and obtain a copy of it;

• request its rectification or completion;

• request its erasure, in the cases provided for by article 17;

• request restriction of processing;

• object to processing based on legitimate interest and, in any case and without needing to give reasons, to processing for direct marketing purposes;

• receive your data in a structured, commonly used and machine-readable format and transmit it to another controller (data portability);

• withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal.

Requests should be sent to info@rulecomponents.com. The Controller will reply without undue delay and in any case within one month of receipt, extendable by two months in particularly complex cases. Exercising these rights is free of charge, save for manifestly unfounded or excessive requests.

You also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, Piazza Venezia 11, 00187 Rome – www.garanteprivacy.it) or with the supervisory authority of your country of residence, or to bring proceedings before the courts.

9. Cookies

The website uses cookies and similar technologies. Information on their types, purposes, duration and on how to manage consent is set out in the Cookie Policy, available at www.rulecomponents.com/cookie-policy.

10. Amendments

The Controller may update this notice to reflect changes in legislation or in the services offered. The version in force is always published on this page, together with the date it was last updated. In the event of substantial changes, registered users will be informed with reasonable notice.