NOTICE FOR CUSTOMERS AND PROSPECTS

under articles 13 and 14 of the GDPR (Regulation (EU) 2016/679)

About us

Ferretti SpA, with registered office at Via Irma Bandiera 62, 47841 Cattolica (RN), Italy (Data Controller), is responsible in its capacity as data controller for keeping your personal data confidential and protecting it from any potential data breach.

The Data Controller has appointed a Data Protection Officer (DPO), whom you can contact if you have any queries about our data protection policies and practices.

You can contact the DPO via email at: dpo@ferrettigroup.com.

Which personal data does the Data Controller collect and where is it collected?

The Data Controller collects and/or receives certain information about you, such as your forename, surname, contact details (telephone number and email address), date of birth, payment details and purchase data (Personal Data).

Personal Data is also collected from third parties, such as dealers and brokers that work with the Data Controller.

For what purposes does the Data Controller collect and process your Personal Data?

1. To establish and manage the contractual relationship

Your Personal Data will be processed to enact pre-contractual measures to which you are party or to manage the contractual relationship at your request.

We shall process Personal Data for this purpose to enact pre-contractual measures adopted at your request or to execute the contract to which you are party, in accordance with GDPR Article 6.1(b).

The Personal Data will be kept for the duration of the contract and for up to 10 years after it ends, unless the data needs to be retained for other purposes or unless other retention periods mandated by law or sector-specific regulations apply.

2. To fulfil legal obligations

Your Personal Data will be processed to meet the obligations set out in domestic and supranational regulations, as well as tax and accounting obligations, under GDPR Article 6.1(c).

The Personal Data will be kept for as long as required by law.

3. To prevent and combat fraud and abuse

Your Personal Data will be processed to prevent and combat fraud and abuse. The lawful basis for this processing is the Data Controller’s legitimate interest under GDPR Article 6.1(f).

The Personal Data will be kept for up to 5 years.

4. To establish, defend and/or exercise rights in case of complaints and/or judicial and/or out-of-court settlements

Your Personal Data may be processed, when necessary, to establish, defend and/or exercise the Data Controller’s rights in case of complaints and/or judicial and/or out-of-court settlements.

The lawful basis for this processing is the Data Controller’s legitimate interest under GDPR Article 6.1(f).

The Personal Data will be kept throughout the complaint process and/or the judicial and/or out-of-court procedures until the legal safeguards and/or remedies have been exhausted.

5. To assure safe access to the Data Controller’s offices, shipyards, stands, yachts and/or premises by monitoring physical entry (excluding video surveillance)

Your Personal Data will be processed to monitor physical entry to the Data Controller’s offices, shipyards, stands, yachts and/or premises in order to assure the safety of people and protect company assets.

The lawful basis for this processing is the Data Controller’s legitimate interest under GDPR Article 6.1(f).

The Personal Data will be kept for up to 7 days.

6. To send invitations to events, carry out market research and statistical analyses, and send commercial and/or promotional messages about the Data Controller’s and Ferretti Group’s products and services

Your Personal Data may be processed to perform market research and statistical analyses, send promotional newsletters, invite you to events, trade fairs and/or boat shows, and send commercial and/or promotional messages and information about products and services from the Data Controller, Ferretti Group companies or commercial partners, or on behalf of third parties (without disclosure of data).

With your consent, the Data Controller may send these communications by automated means (e.g. email, SMS and instant messaging) or by traditional means (e.g. post or telephone calls).

The lawful basis is your consent under GDPR Article 6.1(a), which is optional, freely given and may be withdrawn at any time.

Personal Data relating to campaigns will be kept for up to 10 years and/or until you withdraw your consent.

7. To send messages about products and services similar to those sold under a purchase order

Unless you object, your Personal Data may be processed to send direct-sales emails relating to products or services similar to those already purchased.

The lawful basis is the Data Controller’s legitimate interest under GDPR Article 6.1(f) and Article 130.4 of Italian Legislative Decree No. 196 of 30 June 2003 (Privacy Code).

You may object at any time by writing to: dpo@ferrettigroup.com.

8. To send marketing messages from the Data Controller, Ferretti Group companies or commercial partners, with disclosure of data

With your consent, your Personal Data may be processed to send promotional newsletters, invitations to events, trade fairs and boat shows, and commercial or promotional communications regarding products and services from the Data Controller, Ferretti Group companies inside or outside the EU (e.g. Allied Marine), commercial partners or third parties (with disclosure of data).

Communications may be sent by automated means (email, SMS or instant messaging) or by traditional means (post or telephone).

The lawful basis is your consent under GDPR Article 6.1(a), which is optional, freely given and may be withdrawn at any time.

Personal Data relating to campaigns will be kept for up to 10 years and/or until you withdraw your consent.

9. To create a personalised profile in order to send personalised commercial messages

Your Personal Data may be processed to create a profile based on your preferences, habits, interests, behaviour and purchase history, in order to send personalised commercial communications.

The lawful basis is your consent under GDPR Article 6.1(a), which is optional, freely given and may be withdrawn at any time.

Purchase-related Personal Data will be kept for up to 10 years and/or until you withdraw your consent.

Where will your Personal Data be sent?

Your Personal Data may be transferred to the following non-EU countries, subject to the safeguards required by EU legislation.

In particular, your Personal Data may be shared with Ferretti Group companies located in:

• USA, based on standard contractual clauses and additional safeguards in compliance with personal data protection legislation.
• Hong Kong, based on standard contractual clauses in compliance with personal data protection legislation.

If you have purchased a boat and require assistance, support or after-sales services, the Data Controller may transfer your identification data to suppliers located in the country where your boat is moored in order to fulfil your request.

These transfers comply with the applicable legislation governing transfers of personal data outside the European Economic Area (EEA).

For more information about the safeguards adopted, please write to: privacy@ferrettigroup.com.

Who may receive your Personal Data?

Your Personal Data may be disclosed to parties acting as independent Data Controllers, such as public authorities legitimately entitled to receive the data, including judicial authorities and public security bodies.

The Data Controller may also disclose your data to third parties appointed as Data Processors pursuant to GDPR Article 28, including Ferretti Group companies providing intra-group services and suppliers of IT services such as maintenance, hosting and mailing.

For the list of appointed Data Processors, please write to: privacy@ferrettigroup.com.

Whom do we authorise to process your Personal Data?

Your Personal Data will be processed exclusively by employees belonging to the company departments responsible for the purposes described above, who have been expressly authorised and appropriately trained.

What are your rights?

You may request access to your Personal Data, ask for its correction, deletion or completion if incomplete, and request restriction of processing in the cases provided for by GDPR Article 18¹.

Where processing is carried out by automated means and based on consent or a contract, you may exercise your right to data portability by receiving your Personal Data in a structured, commonly used and machine-readable format and, where technically feasible, transmitting it to another Data Controller.

You may withdraw your consent at any time.

You also have the right to lodge a complaint with the competent data protection authority and to seek any other legal remedy available.

To exercise your rights, please write to: dpo@ferrettigroup.com.

¹ Note

The right to restrict processing means temporarily limiting the processing of Personal Data to storage only in the following cases provided for by GDPR Article 18:

a) if the data subject contests the accuracy of the Personal Data, for the period necessary for the Data Controller to verify its accuracy;

b) if the processing is unlawful and the data subject opposes erasure, requesting instead the restriction of its use;

c) if the Data Controller no longer needs the Personal Data for processing purposes, but the data subject requires it for the establishment, exercise or defence of legal claims;

d) if the data subject has objected to processing under GDPR Article 21(1), pending verification of whether the Data Controller’s legitimate grounds override those of the data subject.