Informativa Privacy Grovestreetart

PRIVACY POLICY

Your privacy and the security of your personal data are very important.

The following Privacy Policy, based on Regulation (Eu) 2016/679 of the European Parliament and of the Council Of 27 April 2016 (Gdpr), together with theCookie Policy [LINK], describes how we collect, use, share, and protect customers’ personal information when they use this websitegrovestreetart.com (hereinafter: Website).
​​This document contains a section dedicated to Californian consumers and their privacy rights.

Who is the Data Controller

The Data Controller is CREATICOM S.r.l.,with registered office at Via Terraglio 14, 42048 Rubiera (Re), Italy  - P.IVA: 02960410351 - REA: RE-328211 - Capitale sociale: 20.000 euro interamente versato, (hereinafter: Data Controller or Company), email: info@grovestreetart.com, where you may address requests relating to the processing of your personal data.

Pursuant to the GDPR, the Data Controller shall process the personal data provided by you as indicated in this privacy policy.

  1. WHAT DATA DO WE PROCESS

As concerns the purposes of the processing indicated in article 2 below, the Company processes various types of personal data concerning you, including:

  • your identification information (such as first and last name), your contact details (such as email address and telephone number), billing address, payment information (such as the method of payment used, cardholder, card number used), and photographs you provide to be transformed in digital portraits.
    This data is processed in reference to the online sale of the Company products and the corresponding activities related thereto (such as the signing and performance of the contract; payment; invoice issuance; product shipping).
  • If you register on the Website, this includes your identification information, your email address, and your password, as well as the data needed to provide you with services that are reserved for registered users.
  • When you navigate through the Website, we also collect data relating to your navigation, in particular to verify the proper functioning of the Site, to provide you with the best navigation, and to increase the quality of our services. For more information about the technologies used (cookies and similar tools) please consult our ‎‎Cookie Policy [link].
  1. WHY DO WE PROCESS YOUR DATA AND ON WHAT LEGAL BASIS

The Company as an independent controller, processes your personal data for the online sale of the digital products and the relative activities connected thereto. In particular:

  1. a) to enable you to register with the Website and make use of the services restricted to registered users and for administrative/accounting purposes. The legal basis for the processing is Company’s commitment to be compliance with a legal obligation or to take steps at the request of the data subject prior to entering into a contract, as the case may be;
    b) in the case of the execution of an online purchase order, to allow the conclusion of the purchase contract and the proper execution of transactions related to the same (and, where necessary, to fulfill tax obligations). The legal basis for the processing is Company’s commitment to be compliance with a legal obligation or to perform a contract to which the data subject is party;
    c) limited to the email address provided by you when purchasing products offered on the Website, to enable the direct sale of similar products (soft spamming), without requiring your express and prior consent and provided that you do not exercise your right to object. The legal basis for the processing is the Company's legitimate interest to perform these activities. This legitimate interest is equal to the user's interest to receive "soft-spam" communications;
    d) if you provide your explicit consent, for the Company to send you newsletter and for market research purposes also aimed at evaluating the level of customer satisfaction and to send you promotional communications in relation to the products of the Company and / or third-parties, by email (marketing purposes); if you provide your explicit consent, for the analysis of your consumer choices and purchasing habits (known as “profiling”), by the Company, through a study of the type and frequency of your online purchases, in order to send informative and/or advertising material about products of the Company and / or third-parties, that may be of particular interest to the user, by email (profiling purposes). The legal basis for the processing is your consent;
    e) to respond to your requests through the customer care service. The provision of data is purely optional. However, as the said processing is necessary in order to respond to your request, your refusal to provide the relevant data will prevent you from obtaining an answer from the customer care of the Company. The legal basis for the processing is the Company's legitimate interest to perform these activities. This legitimate interest is equal to the user's interest to use the customer care service of the Website;
    f) in order to answer your requests by mail. The provision of data is purely optional. However, as the said processing is necessary in order to respond to your request, your refusal to provide the relevant data will prevent you from obtaining an answer from the customer care of the Company. The legal basis for the processing is the Company's legitimate interest to perform these activities. This legitimate interest is equal to the user's interest to receive an answer by the Company.
    g) to manage requests to exercise personal data protection rights (further information, see art. 7). This processing is necessary to fulfil a legal obligation to which the data controller is subject;
    h) other personal data protection requirements. Under certain circumstances, the personal data protection legislation requires the data controller to use your contact details to provide you with specific information about the processing of your data such as, for example, to inform you of any security violations concerning your information and the measures adopted to address them (so-called data breach), and well as to inform you of any significant updates to this privacy policy. This processing is therefore necessary to perform a legal obligation to which the data controller is subject.

The provision of data for the purposes set out in point a) and b) is purely optional. However, as the said processing is necessary in order to: a) provide the services restricted to registered users; b) perform a contract to which you are party. Your refusal to provide the relevant data will prevent you from: a) make use of the services restricted to registered users; b) completing an online purchase.
Consent to marketing and profiling purposes is purely optional. Failure to consent will have the following consequences. Failure to consent to the processing of personal data for marketing purposes will prevent you from receiving promotional communication and newsletter regarding products of the Company and/or third-parties and will prevent the Company from carrying out market research purposes aimed at evaluating the level of customer satisfaction. Failure to consent to the processing of personal data for profiling purposes will prevent the Company from studying the type and frequency of your online purchases, in order to send to you newsletter and/or advertising material that may be of particular interest to you regarding products of the Company and/or third-parties. You may revoke your consent using the relevant link indicated in any promotional email sent by the Company.

Payment Card Data

In order to make a payment through one of the payment cards offered on the Website, you shall enter the data of the payment card directly on a page that will communicate through secure encryption protocol with the payment service provider (which will act as an independent data controller). These data will not pass through the server of the Company which, therefore, will not process such data in any way. In execution of the legal obligations provided for by Directive 2015/2366/(EU) on payment services in the internal market (PSD2), You are informed that, with reference to purchases made on the Web Site by credit card, data necessary for the conclusion of the purchase process may include the phone number communicated by You, or a different personal data necessary to complete the purchase process. In order to allow you to complete the purchase, the payment institution in charge of managing the transaction will send you an authentication code, which must be reported by You during the purchase process to meet the authentication criteria provided by PSD2 (Strong Customer Authentication). The processing of your personal data for these purposes has as its legal basis the fulfillment of legal obligations and does not require your consent. To provide the above-indicated data is necessary to make purchases on the Website.

PayPal

You may make purchases using PayPal. In this event, you will be directed to a page outside the Website, where you must indicate the personal data requested by PayPal to complete the purchase process (PayPal will act as a data controller). These data will not pass through the server of the Company which, therefore, will not process such data in any way. To provide the above-indicated data is necessary to make purchases on the Website.

Data Transfer

As better specified below, if you provide your consent, your personal data may be transferred to third parties (providers and/or business partners) such as companies that perform marketing activities.

  1. METHODS OF PROCESSING PERSONAL DATA AND SECURITY

The processing of your personal data will be carried out by electronic or automated means, in the manner and with the appropriate tools to ensure the security and confidentiality in accordance with the GDPR. The information and methods of processing will be relevant and not excessive in relation to the type of services provided. Data will be managed and protected in environments where access is under constant control. Data Controller adopts specific technical and organisational security measures to safeguard the confidentiality of Website users’ personal data, which are aimed at preventing the unlawful or fraudulent use of their personal data. The Data Controller is CREATICOM S.r.l. ,with registered office at Via Terraglio 14, 42048 Rubiera (Re), Italy - P.IVA: 02960410351 - REA: RE-328211 - Capitale sociale: 20.000 euro interamente versato, (hereinafter: Data Controller or Company), email: info@grovestreetart.com, where you may address requests relating to the processing of your personal data.

  1. DATA DISCLOSURE

For the purposes described in this privacy policy, the personal data provided by you may be disclosed or communicated to the following parties: a) to all those parties (including Public Authorities) that have access to the data by virtue of regulatory or administrative measure; b) to third parties in charge of printing, enveloping, shipping (e.g., suppliers, even with reference to drop shipping activity) and/or delivery and/or collection of products purchased through the Website; c) to forwarding agents and to parties responsible for the delivery and/or collection of the products purchased; d) to parties who process online payment transactions; e) to companies, consultants or professionals in charge of the installation, maintenance, updating and the management of the Company's hardware and software or which the Company uses for the provision of its services; f) to the companies that send the newsletters and/or other informative communications transmitted on behalf of the Company; g) to the employees and/or collaborators of the Company; h) to the company in charge of the customer care service; i) companies managing online payment transactions; l) to all those public and/or private parties, natural and/or legal persons (legal, administrative and tax consultancy firms), where the communication is necessary or of practical use for the correct fulfillment of contractual obligations undertaken in relation to the services provided through the Website, and of legal obligations. Your data may be disclosed only in anonymous and aggregated form for statistical or research purposes.

  1. DATA STORAGE

We retain your personal data for a limited period of time, which is strictly related to the purpose for which it was collected, and in conformity with the applicable legal or regulatory obligations.

The retention period differs according to the purpose of the processing, in particular:

  • for the online sale of products and the relative activities connected thereto (point 2.b), your personal data will be retained for the entire duration of the contractual relationship and for 10 (ten) years after the termination thereof, except for registration on the Site and the use of confidential services for registered users, in relation to which your personal data will be retained until you request the deletion of your account. If you close your account, your personal data will be stored for administrative purposes for a period not exceeding 90 (ninety) days, without prejudice to any legal obligations regarding the storage of accounting documents or for public security purposes.
  • for personalised marketing or profiling purposes, your data is retained for a period of 4 (four) years from the time you provide your consent for the aforementioned purposes;
  • for general marketing activities, your data is retained until deletion is requested, consent revoked, or processing opposed; the Company furthermore wishes to protect your data and ensure that you wish to continue to receive its communications. Therefore, it deletes your data when 4 (four) years have elapsed since your last interaction with the Company or the Website. At the end of this period, the Company may ask you to renew your consent to the processing of your data or to make them anonymous and keep them only for statistical or historical purposes.
  • to comply with legal obligations relating to personal data processing matters (point 2.g), your personal data will be processed by each controller, as concerns their specific area of authority, for the period needed to manage your request to exercise the rights recognised under the GDPR or to meet the legal obligation to which the data controller is subject. The data necessary to demonstrate compliance with the legal obligations to which the controller is subject shall be retained for 10 (ten) years;
  • in case of a legal or administrative dispute, your data shall be retained for the time needed for the Company or a third party to seek legal protection of a right, or within the limits imposed by the legal or administrative authority.

For all other purposes, personal data will be stored only as long as necessary to ensure the provision of the services offered.

  1. WHERE WE PROCESS YOUR PERSONAL DATA

The processing of your personal data is made in the Company’s head office. Sometimes, your personal data may also be transferred to third parties, such us artists responsible for the artworks to the products purchased. Some of the parties indicated above may also be established outside the European Union (EU) or the European Economic Area (EEA), in countries that do not guarantee an adequate level of protection of personal data according to the standards established by the GDPR. Therefore, you acknowledge that the transfer of personal data is risky due to the lack of an adequacy decision by the European Commission and appropriate safeguards. You agree that a transfer of your personal data shall take place pursuant to Article 49 of the GDPR if the transfer is necessary for (i) the performance of a contract between you and the Company or the implementation of pre-contractual measures taken at your request; (ii) the conclusion or performance of a contract concluded in the interest of you between the Company and another natural or legal person. The Company has adopted the necessary precautions to ensure a lawful transfer of data (in particular, through the use of the Standard Contractual Clauses approved by the European Commission in accordance with the examination procedure referred to in Article 93(2) of the GDPR). You may request information about the transfer of your personal data abroad at any time by contacting us using the contact details indicated.

  1. WHAT ARE YOUR RIGHTS 

Pursuant to GDPR, you have the right to:
- request access to and rectification or erasure of personal data or restriction of processing or object to their processing, in addition to the right to data portability
- revoke consent at any time without prejudice to the lawfulness of processing based on consent given prior to the withdrawal
- lodge a complaint before a supervisory authority. In Italy, a claim may be filed with the Personal Data Protection Authority [Garante per la Protezione dei Dati Personali] (http://www.garanteprivacy.it/).
The above-mentioned rights may be exercised by making a request to the contacts indicated above.

  1. CHANGES TO PRIVACY POLICY

The features, functionalities, and services offered by the Website may change in the future. Consequently, this Privacy Policy may be changed and supplemented over time. Therefore, we ask that you please periodically check the contents thereof. We will arrange to inform you in a timely manner of any significant changes that are made to this Privacy Policy.

  1. INFORMATION FOR CALIFORNIA RESIDENTS – CALIFORNIA PRIVACY RIGHTS

California law requires us to disclose the following information with respect to our privacy practices. If you are a California resident, this section applies to you in addition to the rest of the privacy policy.

Personal information we collect: You can find a list of the categories of personal information that we collect in the “WHAT DATA DO WE PROCESS” section above.

Purposes for which we will use such personal information:You can find a list of the Purposes for which we will use such personal information in the “WHY DO WE PROCESS YOUR DATA AND ON WHAT LEGAL BASIS” section above.

Categories of Personal Information Disclosed and Categories of Recipients:We disclose the following categories of personal information for business or commercial purposes to the categories of recipients listed below:

  1. a) We share Basic Identifying Information with: Service Providers, Third Party Partners, advertising networks, and social media networks.
    b) We share Commercial Information with: Service Providers, Third Party Partners, advertising networks, and social media networks.
    c) We share Payment Information with: Service Providers who process payments.
    d) We share Photographs you share with us with: Service Providers who process artworks
    e) We may also need to share any of the above categories of information pursuant to Legal Process or as a result of a Business Transfer as described in the section number 2 above.

Sources of information collected: we collect your personal information from you directly (including from your device) and from our service providers.

Selling your information: we do not sell, and have not in the preceding 12 months sold, the personal information of California residents (including minors under 16 years of age) and any other resident.We may allow certain third parties (such as certain advertising partners) to collect your personal information via automated technologies on our platforms in an effort to serve you content and advertisements that may be of interest to you. You have the right to opt out of this disclosure of your information, as described in the ‎‎Cookie Policy [link].

Your rights: Subject to exceptions under applicable law, you may have certain choices regarding our use and disclosure of your personal information, as described below:

  1. Access: you have the right to request, twice in a 12-month period, that we disclose to you the personal information we have collected about you during the past 12 months and details regarding our collection, use, and disclosure of such information.
    2. Deletion: you have the right to request that we delete the personal information we have collected about you.
    3. Opt-Out: you have the right to opt out of the sale of your personal information.
    4. Non-Discrimination: you have the right to not receive discriminatory treatment by us for the exercise of any of your rights under the CCPA.
    The above-mentioned rights may be exercised by making a request to the contacts indicated aboveusing THIS FORM.

AUTHORIZED AGENT: as a California resident, you may designate an authorized agent to act on your behalf to make a request under the CCPA by using the same channels for exercising your rights described above. If you designate an authorized agent, we may require you to (a) provide your authorized agent with signed permission to do so, (b) verify your own identity with us directly and (c) confirm with us directly that you have provided your authorized agent permission to submit the request.

CALIFORNIA SHINE THE LIGHT: as a California resident, you  may request information concerning the categories of personal information (if any) we share with third parties or affiliates for their direct marketing purposes. If you would like more information, please submit a written request to the contacts indicated above.

  1. EXTERNAL SERVICES WE USE TO PROCESS PERSONAL DATA

As concerns the purposes of the processing indicated in article 2 below, the Company processes various types of personal data concerning you, using services provided by third parties.

Platform services andhosting

Shopify (Shopify Inc.)
Shopify is a platform provided by Shopify Inc. that allows the Owner to build, run and host an e-commerce website.
Personal Data processed: various types of Data as specified in the privacy policy of the service.
Place of processing: Canada –Privacy Policy.
Category of personal information collected according to CCPA: internet information.

User database management
Klaviyo (Klaviyo Inc.)

Klaviyo is an email address management and message sending service provided by Klaviyo Inc. To take advantage of the service provided by Klaviyo, the Owner typically shares information about (purchasing) Users, such as for example contact details and shopping histories. Check the indication at “Personal Data processed“ below for an explanation of the extent of the sharing.Personal Data processed: country; email address; first name; last name; phone number; physical address; various types of Data. Place of processing: United States –Privacy PolicyOpt out.
Category of personal information collected according to CCPA: identifiers; internet information.
This processing constitutes a sale based on the definition under the CCPA. In addition to the information in this clause, the User can find information regarding how to opt out of the sale in the section detailing the rights of Californian consumers.

Zapier (Zapier, Inc.)

Zapier is a workflow automation service provided by Zapier, Inc. that automates the movement of Data between (third-party) services. Personal Data processed: city; email address; first name; last name; phone number. Place of processing: United States –Privacy Policy Category of personal information collected according to CCPA: identifiers. This processing constitutes a sale based on the definition under the CCPA. In addition to the information in this clause, the User can find information regarding how to opt out of the sale in the section detailing the rights of Californian consumers.

Payments Gateways

 

PayPal (PayPal Inc.)

PayPal is a payment service provided by PayPal Inc., which allows Users to make online payments. Personal Data processed: various types of Data as specified in the privacy policy of the service. Place of processing: See the PayPal privacy policy –Privacy Policy. Category of personal information collected according to CCPA: internet information.

Marketingservices

Facebook Ads conversion tracking (Facebook pixel) (Facebook Ireland Ltd)

Facebook Ads conversion tracking (Facebook pixel) is an analytics service provided by Facebook Ireland Ltd that connects data from the Facebook advertising network with actions performed on this Website. The Facebook pixel tracks conversions that can be attributed to ads on Facebook, Instagram and Audience Network. Personal Data processed: Tracker; Usage Data. Place of processing: Ireland –Privacy Policy. Category of personal information collected according to CCPA: internet information. This processing constitutes a sale based on the definition under the CCPA. In addition to the information in this clause, the User can find information regarding how to opt out of the sale in the section detailing the rights of Californian consumers.

Google Ads conversion tracking (Google LLC)
Google Ads conversion tracking is an analytics service provided by Google LLC that connects data from the Google Ads advertising network with actions performed on this Application. Personal Data processed: Cookies; Usage Data. Place of processing: United States –Privacy Policy Category of personal information collected according to CCPA: internet information. This processing constitutes a sale based on the definition under the CCPA. In addition to the information in this clause, the User can find information regarding how to opt out of the sale in the section detailing the rights of Californian consumers.

Pinterest Conversion Tag (Pinterest, Inc.)

Pinterest Conversion Tag is an analytics service provided by Pinterest, Inc. that connects data from the Pinterest advertising network with actions performed on this Application. Users may opt out of behavioral advertising features through their device settings, their Pinterestpersonalization settings or by visiting the AdChoices opt-out page. Personal Data processed: device information; Tracker; Usage Data. Place of processing: United States –Privacy PolicyOpt out. Category of personal information collected according to CCPA: internet information. This processing constitutes a sale based on the definition under the CCPA. In addition to the information in this clause, the User can find information regarding how to opt out of the sale in the section detailing the rights of Californian consumers.

Analytics

 

Google Analytics (Google LLC)
Google Analytics is a web analysis service provided by Google LLC (“Google”). Google utilizes the Data collected to track and examine the use of this Application, to prepare reports on its activities and share them with other Google services. Google may use the Data collected to contextualize and personalize the ads of its own advertising network. Personal Data processed: Cookies; Usage Data
Place of processing: United States –Privacy Policy Opt Out. Category of personal information collected according to CCPA: internet information. This processing constitutes a sale based on the definition under the CCPA. In addition to the information in this clause, the User can find information regarding how to opt out of the sale in the section detailing the rights of Californian consumers.

 

Google Analytics with anonymized IP (Google LLC)
Google Analytics is a web analysis service provided by Google LLC (“Google”). Google utilizes the Data collected to track and examine the use of this Application, to prepare reports on its activities and share them with other Google services. Google may use the Data collected to contextualize and personalize the ads of its own advertising network. This integration of Google Analytics anonymizes your IP address. It works by shortening Users' IP addresses within member states of the European Union or in other contracting states to the Agreement on the European Economic Area. Only in exceptional cases will the complete IP address be sent to a Google server and shortened within the US. Personal Data processed: Cookies; Usage Data. Place of processing: United States –Privacy PolicyOpt Out. Category of personal information collected according to CCPA: internet information. This processing constitutes a sale based on the definition under the CCPA. In addition to the information in this clause, the User can find information regarding how to opt out of the sale in the section detailing the rights of Californian consumers.

 

Customer support

Reamaze (Lantirn, Inc.)

Reamaze is a service provided by Lantirn Incorporated, to manage our customer service and support customers. To know more about personal data we collect, please see itsPrivacy Policy.

Social Networks

Facebook:http://www.facebook.com/about/privacy/
Instagram:https://help.instagram.com/519522125107875
Tik Tok:https://www.tiktok.com/legal/privacy-policy
Pinterest:https://policy.pinterest.com/it/privacy-policy
Etsy:https://www.etsy.com/legal/privacy/ 

  1. HOW TO CONTACT US

The Data Controller is CREATICOM S.r.l.with registered office at Via Terraglio 14, 42048 Rubiera (Re), Italy  - P.IVA: 02960410351 - REA: RE-328211 - Capitale sociale: 20.000 euro interamente versato, (hereinafter: Data Controller or Company), email: info@grovestreetart.com, where you may address requests relating to the processing of your personal data.

Last update: July 2022

Subscribe