Pursuant to and for the purposes of the legislation on the protection of personal data (GDPR – European Regulation No. 2016/679 and national legislation of reference, Lady Brett Ashley srl, as owner of the processing of your personal data wishes to inform you on their use and your rights, so that you can knowingly express your consent, if required, and exercise the rights provided by the Regulation.



Your personal data (name, surname, identification document and copy thereof, telephone, e-mail address, etc), provided by you, by third parties or coming, within the limits of the law, from public lists, will be treated for the following purposes:

  1. 1) fulfill the obligations provided for by the law, by a regulation, by the European Union legislation as well as by provisions of Authorities legitimated to do so or by competent supervisory or control bodies (for example obligations relating to tax regulations or anti-money laundering registers) . In this case your consent is not necessary as the processing of data is related to compliance with these obligations / provisions.
  2. 2) Fulfill the obligations deriving from the credit brokerage contract of which you are part or to fulfill, before the conclusion of the contract, your specific requests. In this case, your consent is not necessary, as the data processing is functional to the management of the relationship or the execution of the requests.
  3. 3) Direct commercial purposes and profiling, ie to provide you with information and commercial and advertising material (also by means of distance communication techniques) on products, services or initiatives of the company, to promote them, to carry out direct sales actions, to carry out research statistics and market, to verify the quality of products or services, to apply one or more profiles. In this case, your consent is optional and does not affect the maintenance of relations with the company.
  4. 4) Indirect commercial purposes, ie communicating your data to third parties so that they carry out their own commercial activities as indicated in the previous number 3. Even in this case, your consent is optional and does not prejudice the maintenance of relations with the company.
  5. 5) Post-commercial purposes, ie in order to investigate the reasons for the termination of the relationship, following the termination or revocation of relations with the Company. In this case, your consent is optional and does not affect the maintenance of relations with the company.

The legal basis for the purposes of sub 1) is art. 6.1.ce and 9.2.b of the Regulations, for the purposes sub. 2) is the art. 6.1.b of the Regulation and for the purposes under 3) 4) 5) is art. 6.1.a of the Regulations.

Providing your personal data for the purposes of sub. 1) and sub. 2) it is optional, but failing that it will not be possible for the company to fulfill the obligations assumed towards it.

The consent to the processing of your data may be binding for the purpose of concluding contracts with the Data Controller or with third parties. Only data whose processing is essential for the purpose of concluding the contract can be binding in order to conclude a contract, while you can freely release or deny consent for non-essential data, and in particular for profiling, commercial communications , marketing.

It is possible that the Data Controller changes the purposes for which your data was collected; in this case, your explicit consent to the new purposes must be collected if it is necessary according to the regulations in force.

For technical or organizational reasons or due to the specific nature of the subject matter, legal obligations or other possible causes, the Company may find itself having to immutably manage your data.



The processing of your data takes place by manual means and by electronic and automated means, in a manner strictly related to the aforementioned purposes and in any case suitable to guarantee the security, protection and confidentiality of the data and to prevent and limit the risk of loss, deterioration, theft of your data, and to assure a reasonable recovery in the event of a ‘data breach’.

Within the company, your personal data, such as managers or processors, may become aware of employees, managers and directors or business partners, collaborators or commercials subject to independent work contracts that operate within the structure company. Adequate training was provided to these personnel. The consent to the processing by such personnel is not required as it is inherent in the necessary procedures provided for by law.

Outside the company, your data may be processed by consultants of any kind (lawyers, accountants, labor consultants or other registered professionals or non-registered professionals) who carry out technical, support and technical tasks on behalf of the company. company control, expressly appointed by the company as “responsible” for the processing It is your right to request and obtain the list of third parties to whom the data is transmitted Your consent is required for the transmission of the data to such third parties but, in In the event of a refusal, the Company may not be able to provide the services requested or fulfill the obligations for which it has committed itself to It is possible that the controller may delegate the processing of your data to other sub-managers, in turn instructed on how to correctly process the data.

Special categories of data

The Data you provide us with so-called ‘details’, also known as ‘sensitive’, ie data that reveal racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, genetic data, biometric data intended to uniquely identify a natural person, data relating to health or sex life or sexual orientation of the person or relating to criminal convictions and crimes or related safety measures, can be treated only with your explicit written consent and for the purposes indicated in this document. The consent is free and optional but the refusal to consent could jeopardize the performance of one or more activities requested by you to the company.

The data you provide to us called ‘biometrics’, such as fingerprints, hand, face or signature collected by technological means, will be treated in accordance with the provisions of the law in force, subject to your consent where necessary and for the purposes indicated in this form treatment.

Transfer to foreign countries.

Your data may be transferred to a foreign country within the European Union: in this case the data will be treated in the same way as treated in Italy. In case of transfer to countries outside the European Union, they will be treated by subjects that guarantee the respect of the rights provided by the Regulation through voluntary adhesion by the same with provisions of a general nature. the Transfer will take place in any case through instruments that guarantee the protection of the data from intrusions by third parties.


Your data will be kept by the Data Controller, with respect to the intended purposes, for the time necessary to carry out the existing relationship with you and to be able to guarantee the mutual protection in the judicial seat of the rights as well as to comply with legal obligations including those of tax nature. The data not necessary for the latter purposes will be removed within a variable time and in any case within the maximum period provided for by the right to be forgotten (Article 17 of the Regulation) or, at his request, even in a shorter time if not in contrast with the Rights of the Owner.

With regards to the profiling logics, the company declares to perform profiling.



You can, at any time, exercise the following rights:

  • right to lodge a complaint with the national authority (Guarantor for the protection of personal data) if it deems a right violated;
  • the right to have your data always accurate and up to date and therefore to report or request the rectification and updating of the same where it verifies that the data in our possession were not updated or incorrect;
  • right to withdraw consent to the processing of data where this is not prevented by the provision of the law or by the need to protect the rights of the holder also in court. In any case, the request for revocation gives rise to the right to limit the processing;
  • to access your data processed by the Owner through a written request, including an IT request. In this case you must necessarily provide us with proof of your identity, possibly also by accessing our data base through credentials uniquely referable to your person. You have the right to free access once, while a fee may be requested for requests subsequent to the first. You have the right to get a reply within thirty days of the request. You have the right to have your data in printable formats;
  • the right to cancel the data concerning you, as long as it is not data that the Data Controller must keep for specific legal obligations;
  • the right to have your data stored but not processed except within the limits of what is necessary for the resolution of the dispute over the data if you dispute the accuracy of your data, or the lawfulness of the processing, or the right of the Data Controller to cancel the data Your data, or you object to the processing of data and the owner disputes your opposition;
  • the right to be informed and to oppose the modification and cancellation if the Data Controller modifies or deletes your data in whole or in part;
  • right to data portability, ie to transfer your data – stored and processed electronically – to another Data Controller, in such a way as to allow easy reading and acquisition by third parties;
  • to object to the processing of your data, to profiling, to the use of data for direct marketing;
  • the right to request that, before the company makes binding decisions concerning it through automated procedures, your position is in any case examined by a human operator who carries out a merit assessment;
  • the right to revoke at any time the consent given for communication purposes regarding commercial or informational or educational initiatives (so-called newsletter);
  • the right to be consulted when assessing the security procedures for the processing and protection of your data.