Welcome to the ClayToSay website.

Please read the Privacy Policy carefully, which applies to every access to the website, every browsing within it and every use of the services, regardless of the purchase of products. Please also read the section’s General Terms of Use, as they contain important information about privacy and the security systems adopted.

This policy is made in accordance with EU Regulation no. 679/2016 (“GDPR”) for the protection of personal data of natural persons, d. lgs. no. 196/03 as amended (Legislative Decree 101/2018) and to the Measures of the Italian Data Protection Authority. Your data will be processed in compliance with the regulations in force, in the manner and for the purposes indicated below.

Data controller

The ClayToSay website , is managed by ClayToSay, with registered office in Via Barone Nicola Nisco 146/ 82018 San Giorgio del Sannio, Benevento, VAT number 01835610625

The data controller is the one (natural or legal person, public authority, the service or other body) who individually or together with others, independently determines the purposes and means of the processing of personal data; implements appropriate technical and organizational measures to ensure, and be able to demonstrate that the processing is carried out in accordance with the Regulation. These measures shall be reviewed and updated as necessary.

Purposes of processing

to process data exclusively for the purposes and in the manner outlined in the notice presented at the time of its collection;

use the data for purposes other than those for which the data were specifically released only where the user’s express consent is present;

make the data available to third party companies only for purposes instrumental to the provision of the requested service and within the scope of an appointment as a data processor; not disclose the data, assign or transfer them to third parties for their own processing without the users having been informed in advance and having granted their consent;

respond to requests for cancellation, modification, integration of data provided, opposition to the processing of data for the purpose of sending commercial information and advertising;

ensure proper and lawful data management, safeguarding the privacy of users, as well as apply appropriate security measures to protect the confidentiality, integrity and availability of the data provided.

Optional or mandatory nature of providing data

The provision of personal data that may be requested within ClayToSay is either necessary for the pursuit of the purposes identified in the appropriate statement, or optional.

In the sessions in which the data request occurs, fields that are mandatory upon release are marked with the symbol (*)

Any refusal to disclose certain of your data marked as mandatory makes it impossible to pursue the main purpose of the specific collection: such a refusal could, for example, result in the impossibility for ClayToSay to execute the contract for the purchase of products on ClayToSay or to provide the other services available on ClayToSay.

On the other hand, the provision to ClayToSay of further data, other than those marked as essential, is optional and does not entail any consequences with regard to the pursuit of the main purpose of the collection (e.g., as the case may be, the use of the website and its services or the purchase of products).

Purposes of processing

The ClayToSay site serves an informational and commercial function, as it offers information and price lists and allows users to place orders directly online. In addition, this site is a digital communication tool.

The processing on personal data is carried out with mainly electronic and telematic modalities by ClayToSay and other subjects who, appropriately selected as to reliability and competence, carry out operations instrumental to the pursuit of the purposes strictly related to the use of the ClayToSay website , its services and the purchase of products through the website (see below, paragraph “Subjects who may process your personal data”).

In general, data are processed for the provision of the following services:

To enable navigation (see Cookies Policy);

site registration, to take advantage of related services;

joining specific and additional services, such as our newsletter and other similar information services about our activity, creating your mailbox and sharing its contents, inviting your friends to join the ClayToSay world , making yourself known to other users by sending us your photo and comments;

order fulfillment and related activities;

management of payments, including anti-fraud control in the case of payment by credit card; in this case, the data released during the purchase process (first name, last name, address, credit card number, delivery address if different from the billing address) will be sent to the person in charge of anti-fraud control and processed by him/her solely for this purpose;

Handling of inquiries: technical, commercial, about the progress of orders and inquiries in a broad sense;

making contact with the contact persons of our services (Press Office, Business Development, Web Marketing, Purchasing Department, Customer Service);

When processing data that may, directly or indirectly, identify you, we try to adhere to a principle of strict necessity. In general, your data will be collected either by a specific procedure upon registration and access of the Restricted Area, or by automatic mode during the use of the Site, unless you access the non-restricted area anonymously.

For this reason, we have configured the site in such a way that the use of your personal data is kept to a minimum: therefore, the processing of your data is excluded when the purposes pursued in individual cases can be achieved by the use of anonymous data (as, for example, in market research aimed at improving services) or by other means that allow the data subject to be identified only when necessary or at the request of the authorities and police (as, for example, for data on traffic and your stay on the website or your IP address).

In cases where it becomes necessary to collect personal information for other purposes, this will be clearly highlighted by means of a notice, placed before the data collection form requesting your consent

In some cases, as expressly stated in the notice, your data will be subjected – with your express consent – to processing aimed at profiling you based on your preferences and purchases. This is intended to send you information targeted to your needs and interests. Except in the case provided for in ‘art. 130, paragraph 4, d. lgs. 196/2003 (in which the Holder may use your data to send you advertising e-mails about its own products and services, similar to what you have already purchased, unless you refuse such use), the Holder may use your data to send you advertising about its own services and products only with your consent.

We would like to inform you that the legislation on the protection of personal data provides that – without the need to acquire your express consent – the data controller may use your e-mail address, for the purpose of direct sales of products similar to those you have already purchased, provided that you do not refuse such use (art. 130, paragraph 4, legislative decree 196/2003).

We also point out that the Garante by its own provision has allowed the data controller to use the postal address to send – together with administrative and accounting documents – advertising relating to products similar to those you have already purchased, provided that you do not refuse such use of the postal address issued (Provision of the Garante of June 19, 2008, concerning “Simplifications of certain fulfilments in the public and private sphere with respect to processing for administrative and accounting purposes”).

Your data will be disclosed to third parties only with your express consent, except in cases where disclosure is required by law or is necessary for purposes provided for by law for the pursuit of which the data subject’s consent is not required; in such cases, the data may be made available to third parties who will process them independently and solely for the aforementioned purposes.

Any processing purpose other than the specific one for which you have provided your personal data will be highlighted in the information notice and will be pursued by ClayToSay only after obtaining your express consent (, for example, customer profiling activities based on purchasing preferences and habits), in order to allow transparency and user awareness.

If you share some content through one or more social networks, the site may access some of your account or profile information if you have enabled sharing of your account or profile data with applications open to third parties.

ClayToSay reserves the right to delete accounts and all related data in the event that content that is illicit, harmful to the image of and/or its products or third parties, or otherwise offensive content or content that promotes illegal or defamatory activities, pornographic content, content that incites violence, or content that promotes discrimination related to race, sex, religion, and sexual orientation is detected.

Persons authorized to process

ClayToSay has decided to use third parties to process your personal data, for certain activities. The third parties carrying out these operations have been adequately selected and are found to be experienced, capable and reliable and offer suitable guarantees of full compliance with current processing provisions, including the data security profile.

These third parties (Press Office, Business Development, Web Marketing, Purchasing Office, Customer Service) have been appointed “data processors” for this purpose and carry out their activities according to the instructions given by ClayToSay  under its control (list). We periodically verify that the data processors have fulfilled their assigned tasks on time and continue to provide appropriate guarantees of full compliance with the provisions on the protection of personal data.

Your data are then processed by our employees in charge of individual services; the categories of employees who carry out these activities depend on the purposes for which the data were given and are always indicated in the information notice that we present to you when we release your personal data.

Recipients of processing

In summary, the data provided may be made accessible for the purposes specified in the above points: (i) to employees and collaborators, in their capacity as appointees; and (ii) to third-party companies or other entities that perform outsourcing activities on behalf of the Data Controller, in their capacity as data processors and/or data controllers. In addition, personal data may be disclosed, for the purposes mentioned in point 1, to, (iii) Companies or external professionals who carry out specific tasks on behalf of the Data Controller (by way of example but not limited to, data processing, assistance, consultancy in administrative, accounting, tax, legal, regulatory, management/maintenance/implementation of the company’s IT systems), only if the communication of the data is necessary and/or in any case functional for the pursuit of the above purposes; (iv) Law firms and lawyers, for the possible protection of contractual rights; (v) Credit institutions, and if necessary, to financial, leasing, debt collection, protection and assignment companies, for the management of economic transactions and (vi) Central and peripheral State Bodies, Public Bodies and other Institutions for the fulfillment of any legal obligations. It is understood in any case that the Holder, should it become necessary, will have the right to move the servers also outside the EU. In this case, the Data Controller assures as of now that the transfer of Data outside the EU will take place in accordance with the applicable legal provisions, subject to the conclusion of standard contractual agreements provided by the European Commission.

Modalities and duration of the storage of your data

Data are processed and stored with the adoption of specific security measures aimed at preventing any data breaches, such as data loss, possible illegal and/or incorrect use and unauthorized access. However, such measures, due to the nature of the online transmission medium, cannot absolutely limit and/or exclude any risk of unauthorized access or dispersion of data. To this end, it is advisable to periodically check that the medium used for browsing and accessing the Site is equipped with software devices suitable for the protection of network transmission of data, both incoming and outgoing (such as up-to-date antivirus systems) and that the Internet service provider has taken appropriate measures for the security of network transmission of data (such as, for example, firewalls and/or spam filters).

In any case, it should be noted that personal data:

are stored on servers located at ClayToSay for as long as necessary to fulfill the purposes for which they are collected, as well as for as long as necessary to fulfill them;

if voluntarily provided will be kept until consent is revoked or until the purposes for which it was provided are fulfilled or therefore as long as there is a legitimate business interest;

if collected while browsing the Site are kept for the duration of the session itself. After these terms, the data will be destroyed, deleted or anonymized (where not already collected anonymously). In addition, browsing data collected for the purpose of advertising personalization (marketing and profiling) are retained for a maximum time of 12 (twelve) months, and then automatically deleted.

Minor

It is expressly understood that only those over 14 (fourteen) years of age may express consent to the processing of their personal data in connection with the direct offer of services. With regard to such services, the processing of personal data of a minor under 14 (fourteen) years of age is lawful provided that consent is given by the person exercising parental responsibility.

Security Measures

We take appropriate security measures in order to minimize the risks of destruction or loss – even accidental – of data, unauthorized access or processing that is not permitted or not in accordance with the purposes of collection set out in our Privacy Policy.

However, ClayToSay  cannot guarantee its users that the measures taken for the security of the site and the transmission of data and information on the site limit or exclude any risk of unauthorized access or dispersal of data by devices pertaining to the user. We recommend that you ensure that your computer is equipped with appropriate software for the protection of network transmission of data, both incoming and outgoing (such as up-to-date antivirus systems) and that your Internet service provider has taken appropriate measures for the security of network data transmission (such as firewalls and spam filters).

Payments

The Data Controller and Data Processor do not hold Credit Card data entered by Customers.

In order to ensure greater security, Credit Card data entered by Customers is transmitted from the browser directly to Unicredit’s banking gateway without passing through internal systems. Authorization of payment, in the case of using a credit card, takes place at the time of order while the corresponding charge at the time of shipment.

In case of payment by Paypal or Stripe, the customer is redirected to a secure page managed by Paypal itself where the authentication required for payment is requested. The charge is made at the same time as the order is placed.

In the event that someone gets hold of your Credit Card information, it is important to know that you can always contact your Credit Card provider and refuse the charge, obtaining, once the actual conditions of use of the Card have been ascertained, a refund of the amounts charged.

Links to third-party sites

ClayToSay may, from time to time, contain links to third party websites (e.g. affiliates, partners etc.) that may offer useful information and services to our Customers and/or visitors. If you access these links and websites, please note that the owner and controller are not responsible for the actions of these third parties, which have their own Privacy Policies. Check these policies before sending personal information to these websites, especially if they are intended for countries outside the European Union.

Contacts

If you would like more information about how ClayToSay processes your personal information, please email info@claytosay.com.

To learn about your rights and to keep up to date with the legislation on the protection of individuals with respect to the processing of personal data, we recommend that you visit the website of the Garante per la protezione dei dati personali at http://www.garanteprivacy.it/.

Rights of the data subject

In relation to the aforementioned processing and related data existing in our archives, you may exercise your rights under Chapter III, Art. 15 to 22 of EU Regulation 2016/679, specifically:

right of access (art.15);

right of rectification (art.16);

right to erasure (so-called right to be forgotten, art.17);

right to restriction of processing (art.18);

right to data portability (art.20);

right to object (art.21);

In order to exercise your rights, you may contact the Text Editor by telephone, mail or e-mail using the contacts listed at the top of this policy.

Right to file a complaint with a supervisory authority

Pursuant to Art. 13(2)(d) you are informed that you have the right to lodge a complaint with the Data Protection Authority if you find that your rights as a data subject have been violated or for issues related to the processing of your personal data

Changes and updates to the Privacy Policy

ClayToSay may amend or simply update, in whole or in part, the Privacy Policy of the site, including in consideration of changes in the laws or regulations that govern this matter and protect your rights. Changes and updates to the Privacy Policy will be notified to users on the Home Page as soon as they are adopted and will be binding as soon as they are posted on the website. Therefore, please access this section regularly to check for the publication of the most recent and updated Privacy Policy.