Privacy notice

The data controller is GIMEC S.R.L., VAT number IT10832391212, REA NA-1135463, registered office at Via Madame de Stael 9, 80070 Bacoli (NA), which runs the CalosGroup platform.

For any request about your data: amministrazione@calosgroup.com, or by certified email to gimecsrl01@pec.it. Requests can also be made from the support form.

Data protection officer. GIMEC S.R.L. has not appointed a Data Protection Officer (DPO), as the conditions set out in art. 37 of Regulation (EU) 2016/679 do not apply: we are not a public authority, we do not carry out regular and systematic monitoring of data subjects on a large scale, and we do not process special categories of data on a large scale. The reference point for any matter relating to processing is the address amministrazione@calosgroup.com. If we appoint a DPO in future, we will publish their contact details here.

If you are not registered with an account we collect nothing that can be traced back to you, except the statistics and ad measurement you have agreed to in the cookie banner. You can browse the catalogue, search by vehicle and read the guides without being registered.

• Sign-up — first name, surname, email, telephone, password (kept only as an encrypted fingerprint: GIMEC S.R.L. does not know customers' account data, nor does it keep any digital trace of it).
• Delivery and billing addresses — entered by the consumer, who can delete them at any time from the account area.
• Business accounts — company name, VAT number, certified email, type of business, identity document of the legal representative, company registration extract and bank account details. The data requested serves solely to verify the requirements of commercial activity.
• Support requests — The data sent and any attached files serve solely and exclusively to identify the part requested. We therefore ask you to attach only the documents needed to resolve the request. Once the part has been identified, all data will be automatically deleted.
• Newsletter — News will be sent only to the email address given and only if the request was accepted.
• Garage and wish list — The vehicles saved and the parts added to the list.
• Statistics and ads — only with the consent given in the cookie banner: pages viewed and purchase actions (Google Analytics 4) and, with marketing consent, the identifier of the click on one of our ads and the order email address in encrypted form. Details are in the section “Statistics, ads and enhanced conversions” and on the cookie page.

Providing the data indicated as necessary for the performance of the contract and for compliance with legal obligations is optional only for private customers. For businesses it is instead an essential requirement. Providing data for the newsletter and for suggestions is free, and not signing up has no consequence whatsoever on the ability to purchase.

• Performance of the contract (art. 6(1)(b) GDPR) — account, addresses, orders, support: without this data the service requested cannot be provided.
• Legal obligation (art. 6(1)(c) GDPR) — tax documents and checks on business accounts.
• Consent (art. 6(1)(a) GDPR) — newsletter and purchase-based suggestions, visit statistics, ad measurement and enhanced conversions. They are optional, can be withdrawn at any time (newsletter and suggestions from the reserved area, statistics and ads from the “Cookie preferences” link at the bottom of every page), and withdrawing them does not stop you from buying. Withdrawal does not affect the lawfulness of processing carried out before it.
• Legitimate interest (art. 6(1)(f) GDPR) — the interest pursued is making navigation quicker for those returning to the site; the data processed is minimal and does not reveal special categories; it is not disclosed to third parties nor used for profiling; it does not accumulate, because the sixth search deletes the oldest; it can be deleted by the data subject independently and in a single step, from the same drop-down in which it appears; and it is not collected at all if you have not signed in. On this basis we consider that our interest does not override your fundamental rights and freedoms.

The balancing documentation is retained for the purposes of art. 5(2) GDPR and is available on request.

We do not take decisions based solely on automated processing which produce legal effects concerning the consumer or similarly significantly affect the consumer, within the meaning of art. 22 GDPR. Any part suggestions you receive are calculated internally on the purchases you have made with us, can be switched on and off with a revocable consent, and do not give rise to differences in price, contractual terms or access to the service.

Only if you accept it in the cookie banner. With statistics, Google Analytics 4 measures pages viewed and purchases in aggregate form. With marketing, Google Analytics reports to Google Ads the purchases that came from one of our ads, and Google may use the information about the visit to show you personalised ads.

Enhanced conversions. When you complete a purchase and have accepted marketing, our server turns the order email address into an encrypted fingerprint (SHA-256), which is sent to Google to attribute the purchase to the ad you came from. The address in clear is not sent. Without marketing consent it is not sent in any form.

For statistics Google Ireland Limited acts as data processor; for ad measurement and personalised ads it acts as an independent controller, under its own rules.

Authorised staff act under the controller's instructions and access only the data necessary for their duties. Technical suppliers are appointed as processors under a contract compliant with art. 28 GDPR, which forbids them any use of the data for their own purposes. The up-to-date list of processors, by name, is available on request by writing to amministrazione@calosgroup.com.

Transfers to third countries. Our technical suppliers operate within the European Economic Area. Where a transfer to a third country becomes necessary for an individual service, this will take place only in the presence of one of the safeguards provided by Chapter V GDPR: an adequacy decision of the European Commission under art. 45, or the standard contractual clauses adopted by the Commission under art. 46, together with any supplementary measures required. You can ask for a copy of the safeguards adopted by writing to amministrazione@calosgroup.com.

Google Analytics and ad measurement, active only with the consent given in the banner, are provided by Google Ireland Limited; data may be transferred to the United States to Google LLC, which participates in the EU-U.S. Data Privacy Framework (adequacy decision of the European Commission of 10 July 2023, under art. 45 GDPR).

After the account has been deleted we keep, for only as long as necessary, the data the law requires us to retain (tax documents) and the data needed to defend ourselves in court in relation to disputes over orders, returns or guarantee, for the corresponding limitation period. That data is no longer used for any other purpose.

In detail, Regulation (EU) 2016/679 gives you:

• the right of access to the data and to information about the processing (art. 15);
• the right to rectification of inaccurate or incomplete data (art. 16);
• the right to erasure (art. 17);
• the right to restriction of processing (art. 18);
• the right to portability of data processed on the basis of consent or of the contract (art. 20);
• the right to withdraw consent at any time (art. 7(3));
• the right to object (art. 21): you have the right to object at any time, on grounds relating to your particular situation, to the processing of your data based on our legitimate interest. In our case the only processing on this basis is the last five searches: you can exercise the objection directly from the search drop-down, by deleting them, or by writing to us. Once the objection is received we refrain from the processing, unless we demonstrate compelling legitimate grounds which override your interests, rights and freedoms.

Many functions can be switched off independently, (correcting data, changing consents, removing an address). In any event you can contact support; we reply without delay and in any case within one month of receiving the request, a period extendable by two months for particularly complex requests, giving reasoned notice. Exercising your rights is free of charge.

If you believe your data is being processed improperly you can turn to the Italian Data Protection Authority. You may lodge a complaint with the Garante per la protezione dei dati personali, Piazza Venezia 11, 00187 Rome, and in any case bring proceedings before the courts. A complaint to the Garante and an action before a court are alternatives for the same matter.

We adopt technical and organisational measures appropriate to the risk under art. 32 GDPR: encrypted connection, passwords stored only as a non-reversible encrypted fingerprint, access to uploaded documents subject to verification of the requester's identity, staff access rights profiled by role, logging of access to sensitive documents. In the event of a personal data breach presenting a risk to your rights and freedoms, we notify the Garante within 72 hours and inform the data subjects in cases of high risk, pursuant to artt. 33 and 34 GDPR.

We do not build advertising profiles ourselves. The only third-party tools on our pages are the Google ones described in “Statistics, ads and enhanced conversions”, and they start only with your consent. The full list of the cookies the site writes is on the cookie page.

Consent to “suggestions based on my purchases” concerns only advice about parts within the site, calculated on purchases made on our platform, and therefore does not feed advertising on other sites.

If we change this notice we update the date at the top of the page. Where the change concerns the purposes, the legal bases or the recipients of the data, we notify it by email before it takes effect, and if the change requires consent we ask for it again; new processing never comes into force on the basis of consent given for different processing.