Treviso, 07/11/2024

PERSONAL DATA PROCESSING FOR AUCTION NOTICES GDPR

Whereas:

• reference is made to EU Regulation No. 679/2016 and subsequent amendments;
• World Yacht Store’s corporate purpose is to conduct auctions of goods;
• an auctioneer is the individual who publicly proclaims, announces, and notifies the sale of goods;
• a significant part of World Yacht Store’s activities involves notifying potential buyers about the existence of an auction for specific goods;
• the authorized auctioneer, due to the nature of their activity, strives to effectively notify those who have a legitimate interest.

1. The data processing controller (DPC) is Mr. Massimo De Marchi, who is also a managing partner of the company. The controller is responsible for the concrete implementation of this procedure.
2. The purpose of notifying third parties and managing personal data is inherent in the company’s corporate purpose. These third parties are selected based on their genuine interest in the matter.
3. The DPC verifies compliance with current regulations, checks for potential conflicts of interest, manages the data flow, and ensures data protection.
4. Recipients of the notifications are individuals or legal entities with a legitimate interest in the matter.

PROCEDURE – MAILING LIST

By “mailing list,” we mean a categorized list of email addresses or social media contacts. The purpose of this procedure is to provide a clear, operational list of activities to comply with current regulations, to effectively notify only those with a genuine and legitimate interest in auctions, and to provide each contacted entity with a convenient and definitive method to opt out of the relationship unilaterally initiated.

1. The operator only uses email addresses obtained from:
   
   • databases that have pre-processed information in accordance with current regulations – the company provides the operator with the appropriate databases;
   • internet search engines or social media platforms that publicly provide such addresses.
2. Individuals or companies and their respective email addresses must be individually verified by the operator through a review of websites or social media communications to establish a clear legitimate interest in the matter. Examples of those with genuine interests include: sellers of specific auctioned goods who invite sales on their websites or seek consulting services, companies in the specific sector, sales agents, technical experts or brokers in the specific sector promoting themselves through social media, sector-specific industry associations; in case of doubt, the name is unequivocally rejected.
3. The communication must have the following characteristics:
   
   • i) The communication/notice/auction notice must be in the subject line of the email with the wording “Auction Notice” in Italian or English;
   • ii) The sender must exclusively be a corporate email of World Yacht Store;
   • iii) The mailing list must be placed in Ccn and not in Cn or as a direct recipient: this way, no recipient can read other recipients’ addresses apart from their own;
   • iv) At the end of the email body (not as an attachment), there must always be an indication of the Data Controller, the purposes of the communication and processing, an indication of this procedure, and the methods by which the recipient can terminate the relationship or request the deletion of their data;
   • v) The operator must ensure email open tracking or deletion notification. In case of deletion notification, the operator immediately and definitively deletes all data of the contact;
   • vi) If the contacted individual does not reply to the email with a response email or in another way within 3 working days, the operator will contact them by phone. If the recipient, even if not a decision-maker in the company, verbally declares that they do not wish to be contacted anymore, the operator will immediately and definitively delete all of their data;
   • vii) The email body must always include the phrase “If disinterested in the content of this email, please reply with ‘NO’.” If the operator receives such an email, they will immediately and definitively delete all of the contact’s data;
   • viii) The email consists of:
     
     • a) a concise and essential text body that immediately conveys the content to the recipient, and
     • b) technical and commercial attachment for further information. This way, the recipient will access additional information only if genuinely interested.

RETENTION OF SENSITIVE DATA

The email and social media addresses of potentially interested parties, if not immediately deleted in accordance with this procedure, will be stored in specific folders on the company’s server, which is equipped with a professional firewall. VPN data will not be shared with indirect collaborators of the company. Such data will not be published on cloud archives (e.g., OneDrive, Dropbox, or others).

Data of a specific person or firm must be used to contact this specific person or firm only. The responsible party of this procedure, Mr. Massimo De Marchi, will take immediate corrective actions in case of non-compliance.

Sincerely,
Massimo De Marchi