Privacy Policy

INFORMATION ON THE PROCESSING OF PERSONAL DATA

pursuant to Article 13 of the GDPR (General Data Protection Regulation) – EU Regulation 679/2016

Pursuant to Article 13 of EU Regulation 679/16, Musye S.r.l. wishes to provide you with the following information regarding the processing of your personal data.

Musye S.r.l. guarantees compliance with the legislation on personal data protection and individual protection, and informs you that the personal data provided by data subjects through the various collection channels, directly or indirectly managed by the Data Controller, or acquired from third parties in compliance with the law, will be processed lawfully, appropriately, and fairly, in accordance with the principles established by EU Regulation 679/16.

Please note that this policy applies to the website www.musye.com (hereinafter also referred to as the “Site”), but does not extend to other websites that the user may access via links and/or buttons on the site. Users are encouraged to read the respective privacy policies of these websites. For information on the processing of browsing data, including through cookies, please refer to the specific policy on the site.

1 – Data Controller and DPO

The Data Controller is Musye S.r.l. with registered office in Florence, Via Bolognese, 165, Fiscal Code, VAT number 06613430484. The Data Protection Officer can be contacted at the email address privacy@giunti.it.

2 – Data categories, purposes, legal basis, nature of the provision and duration of the processing

Please note that personal data may also be processed for a longer period if an act interrupting and/or suspending the statute of limitations occurs, justifying the extension of data retention (compensation requests by data subjects, initiation of legal proceedings, requests from the public administration, etc.). For consent-based processing, the withdrawal of consent does not affect the lawfulness of the processing based on consent before its withdrawal.

3 – Treatment methods

Personal data is processed by the Data Controller in both paper and electronic format, applying technical and organizational security measures (Article 32 of the GDPR) to ensure a level of security appropriate to the risk, taking into account the state of the art and the costs of implementation or, where applicable, security measures prescribed by specific legislation, including but not limited to provisions issued by the Data Protection Authority, regulations, provisions, and laws.

4 – Categories of subjects to whom your data may be communicated

Your personal data may be disclosed if necessary or otherwise functional to the management and execution of the purposes for which it was collected and within the limits established by law. In the case of suppliers of goods or services external to the Data Controller’s organization (e.g., freight forwarders, assistance, etc.), they will be formally appointed as Data Processors, pursuant to Art. 28 of EU Regulation 2016/679, selected from entities providing sufficient guarantees to protect the data subject’s rights (the list of entities may be requested from the Data Controller by the data subject). The data subject’s data may also be processed by the appointed entities subject to authorization pursuant to Art. 2 quaterdecies of the Privacy Code (amended by Legislative Decree 101/18) and/or a suitable commitment to confidentiality. Any other communications to external parties who do not participate in achieving the Data Controller’s primary purposes may only occur with your explicit consent, where applicable, except where required by judicial authorities or as otherwise required by law.

5 – Data Transfer to Third Countries

The Data Controller, for the purposes described above, transfers your data to third countries (outside the EU). The relevant data transfers will be subject to appropriate safeguards corresponding to the adequacy decisions issued by the European Commission and/or the Italian Data Protection Authority, as appropriate. Further information regarding any data transfers to countries outside the European Union, the related safeguards adopted, and information regarding the companies appointed as data processors will be provided to data subjects.

6 – Data Subject Rights

In relation to the processing of personal data, the Data Subject may exercise, at any time, the rights provided for by the GDPR, where applicable: Articles 15 – “Right of access by the data subject”, 16 – “Right to rectification”, 17 – “Right to erasure”, 18 – “Right to restriction of processing”, 19 – “Obligation to notify regarding rectification or erasure of personal data or restriction of processing”, 20 – “Right to data portability”, 21 – “Right to object”, 22 – “Automated individual decision-making, including profiling” of the GDPR, within the limits and under the conditions set forth in Article 12 of the GDPR. Where appropriate, the Data Subject may lodge a complaint with the supervisory authority (Article 77 of the GDPR). Please note that if processing is based on consent, the Data Subject may freely withdraw this consent by submitting a request to the Data Controller. Withdrawing consent does not affect the lawfulness of processing based on consent before its withdrawal. The data subject may exercise the above-mentioned rights at any time by submitting a written request to the contact details indicated in section 1 of this policy.

7 – Changes

The features, functions, and services offered, as well as the methods of data processing by the Data Controller, may be subject to future changes. Consequently, this policy may be subject to changes, updates, and/or additions. Users are therefore encouraged to periodically review its content by consulting the Site and/or dedicated web pages.

Last updated: October 2025