Privacy Policy under Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (GDPR). Effective from 18 October 2022.
INTRODUCTION
This privacy policy takes into account the provisions of the GDPR and the Privacy Code (Legislative Decree 30 June 2003, No. 196). The document has also been drafted in accordance with the Guidelines of the Data Protection Authority (especially the Guidelines on combating spam issued by the Data Protection Authority on 4 July 2013).
Data Controller: Almi Food S.r.l. - Craftsmanship Zone Via Romatizza - Lotto 19 - 72022 Latiano (BR) - VAT/CF 01791750746 - tel. 080 8888888 - cell. 349 9999999 - info@export_puglia.com
Website to which this privacy policy refers:https://b2b.exportpuglia.it/
GENERAL INFORMATION
Below are described the main processing activities of your personal data provided on the website. It explains the legal basis for the processing, whether the provision is mandatory, and the consequences of not providing personal data.
Registration on the Website
The information and data requested during registration will be used to allow you to access the reserved area of the website and to benefit from the online services offered by the Data Controller to registered users. The legal basis for the processing is the necessity of the Data Controller to perform pre-contractual measures at the request of the data subject. Providing the data is optional. However, your refusal to provide the data will make it impossible to register on the website.
Purchases on the Website
Your personal data will be processed to enable you to make purchases on the website. In the case of placing an online purchase order, this is necessary to conclude the purchase contract and properly execute the related operations (and, if required by sector-specific regulations, to fulfill tax obligations). The legal basis for the processing is the Data Controller's obligation to perform the contract with the data subject or to comply with legal obligations. Regardless of the above (and therefore without your consent), the Data Controller may process your data for the purpose of so-called "soft-spam" as regulated by Article 130 of the Privacy Code. This means that, limited to the email address provided by you in the context of a purchase through the website, the Data Controller will process the email address to enable direct offers of similar products/services unless you object to such processing in accordance with this privacy policy. The legal basis for the processing is the Data Controller's legitimate interest in sending this type of communication. This legitimate interest may be considered equivalent to the data subject's interest in receiving "soft-spam" communications. The Data Controller may send emails to remind the user to complete a purchase. The legal basis for this processing is the Data Controller's legitimate interest in sending this type of communication.
Responding to Your Requests
Your data will be processed to respond to your information requests. Providing the data is optional, but your refusal will make it impossible for the Data Controller to respond to your inquiries. The legal basis for the processing is the Data Controller's legitimate interest in following up on user requests. This legitimate interest is equivalent to the user's interest in receiving a response to the communications sent to the Data Controller.
Generic Marketing
With your consent, the Data Controller may process the personal data provided by you in order to send you advertising material and/or newsletters related to its own products or those of third parties. The legal basis for this processing is your consent. Providing personal data for this purpose is purely optional. Failure to give consent to the processing of data for marketing purposes will make it impossible for you to receive advertising material related to products/services of the Data Controller and/or third parties, as well as preventing the Data Controller from conducting market research, including assessing user satisfaction, and sending newsletters. These communications will be sent to the email address provided by you on the website.
Profiling
With your consent, the Data Controller may process your personal data for profiling purposes, which involves analyzing your consumer choices by revealing the type and frequency of purchases you have made, in order to send you advertising material and/or newsletters related to its own products or those of third parties that are specifically of interest to you. The legal basis for this processing is your consent. Providing data for this purpose is purely optional. Failure to give consent to the processing of your personal data for profiling purposes will make it impossible for the Data Controller to create your commercial profile by detecting your choices and purchasing habits, as well as sending you advertising material related to products of the Data Controller and/or third parties that are specifically of interest to you. These communications will be sent to the email address provided by you on the website.
Data Transfer
The Data Controller does not transfer your personal data to third parties.
Communication of Personal Data
In the course of its normal activities, the Data Controller may communicate your personal data to certain categories of entities. In Article 2, you can find the list of entities to which the Data Controller communicates your personal data. To facilitate the protection of your rights, Article 2 may specify in certain cases when your data is not communicated to third parties. "Communication" of personal data to third parties is different from "transfer" (addressed in the preceding paragraph). In fact, in communication, the third party to whom the data is transmitted can only use it for the specific purposes described in the relationship with the Data Controller. In transfer, however, the third party becomes an independent Data Controller of the personal data. Furthermore, your consent is always required to transfer your personal data to third parties. Notwithstanding the above, the Data Controller may still use your personal data to comply with the obligations required by applicable laws.
SPECIFIC PRIVACY INFORMATION
Art. 1 Processing Methods
1.1 The processing of your personal data will primarily be carried out using electronic or automated means, in accordance with the GDPR, and with suitable methods and tools to ensure their security and confidentiality. If the automatic chatbot service is operational, your personal data will also be processed to enable the activation of this service, through which the user can contact and be contacted by the Data Controller, with your consent. The legal basis is the Data Controller's legitimate interest in responding to user requests through the chatbot service. This legitimate interest may be considered equivalent to the data subject's interest in using the automatic chatbot service.
1.2 The acquired information and processing methods will be relevant and not excessive in relation to the type of services provided. Your data will also be managed and protected in secure and appropriate IT environments.
1.3 "Special categories of data" are not processed through the Website. Special categories of data are those that can reveal racial or ethnic origin, religious or philosophical beliefs, political opinions, membership of political parties, trade unions, religious, philosophical, political or trade union organizations, health, or sex life.
1.4 Judicial data is not processed through the Website.
Art. 2 Communication of Personal Data
The Data Controller may communicate your personal data to specific categories of entities. Below are the entities to which the Data Controller reserves the right to communicate your data:
The Data Controller may communicate your personal data to all those entities (including Public Authorities) who have access to personal data by virtue of regulatory or administrative measures.
Your personal data may also be communicated to all those public and/or private entities, individuals and/or legal entities (legal, administrative, and tax consulting firms, Judicial Offices, Chambers of Commerce, Labor Offices, etc.), if such communication is necessary or functional to the correct fulfillment of legal obligations.
The Data Controller employs employees and/or collaborators in any capacity. For the proper functioning of the Website, the Data Controller may communicate your personal data to these employees and/or collaborators.
In the ordinary management of the Website, the Data Controller relies on companies, consultants, or professionals responsible for the installation, maintenance, updating, and, in general, the management of the hardware and software of the Data Controller or used by the Data Controller for the provision of its services. Therefore, only for these purposes, your data may also be processed by these entities.
For the sending of its communications, the Data Controller uses external companies entrusted with the sending of this type of communications (CRM platforms). Your personal data (in particular, email) may therefore be communicated to these companies.
The Data Controller does not rely on external companies to provide customer care service.
The Data Controller reserves the right to modify the above list based on its ordinary operations. Therefore, you are invited to regularly access this information to check to which entities the Data Controller communicates your personal data.
Art. 3 Retention of Personal Data
3.1 This article describes how long the Data Controller reserves the right to retain your personal data.
Your personal data will be retained for the sole time necessary to ensure the proper provision of services offered through the Website.
For the purpose of executing the sales contract, data will be retained for 10 years from the date of receiving the purchase order. This is to allow the Data Controller to exercise its right to defense and to demonstrate the proper execution of the contract.
As provided for in Article 2220 of the Civil Code, invoices, as well as all accounting records in general, are kept for a minimum period of ten years from the date of registration, in order to be presented in case of inspection.
For marketing purposes, personal data will be retained until the possible withdrawal of consent. For inactive users, personal data will be deleted after one year from the last email viewed.
3.2 Notwithstanding Article 3.1, the Data Controller may retain your personal data for the time required by specific regulations, as may be amended from time to time.
Art. 4 Transfer of Personal Data
4.1 The Data Controller is located within the European Union. Therefore, the processing of your data is legally secure as regulated by the GDPR. If the transfer of your personal data takes place to a non-EU country for which the European Commission has expressed an adequacy decision, the transfer is considered legally secure in any case.
Art. 5 Rights of the Data Subject
Pursuant to Article 13 of the Privacy Regulation, the Data Controller informs you that you have the right to:
- Request access to your personal data from the Data Controller and request their rectification or erasure, or the restriction of their processing, as well as object to their processing, in addition to the right to data portability.
- Withdraw your consent at any time without affecting the lawfulness of the processing based on consent before its withdrawal.
- Lodge a complaint with a supervisory authority (e.g., the Garante per la protezione dei dati personali). These rights can be exercised by submitting a request without any formalities to the contact details indicated in the Introduction.