Information pursuant to art. 13 of the European Regulation 679/2016 and consent
Pursuant to art. 13 of European Regulation (EU) 2016/679 (hereafter GDPR), and in relation to personal data of which BISCOTTIFICIO GRONDONA S.p.A., in person of its Legal Representative, with registered office in Via Campomorone, 48 16164 GENOVA (Italy)- VAT: 02258670104 will enter in the availability of personal data supplied by you, in the execution of a contract of which you are part or in carrying out pre-contractual activities on your request, we inform you as follows:
- Data controller and responsible for the protection of personal data
The data controller is BISCOTTIFICIO GRONDONA S.p.A (hereinafter referred to as the “OWNER” or “HOLDER of the TREATMENT” in person of the Legal Representative in person of its Legal Representative, with registered office in Via Campomorone, 48 16164 GENOVA (Italy)- VAT: 02258670104. Contact for any communication concerning privacy at the following e-mail address: firstname.lastname@example.org.
- Purposes of data processing and legal basis of processing
The Data Controller processes personal data of natural persons, legal entities, sole proprietorships and / or freelancers (“Interested parties”) for the following purposes:
- the need to execute a contract for which the interested party is a party or to perform pre-contractual activities upon his request. This need represents the legal basis that legitimizes the resulting treatments. The provision of data necessary for these purposes represents, depending on the case, a contractual obligation or a necessary requirement for the conclusion of the contract; in the absence of these, the owner would be unable to establish the relationship or to implement it;
- the need to comply with legal obligations (eg obligations under the anti-money laundering legislation, instructions given by the Supervisory Authority, the Magistrates, etc.). This need represents the legal basis that legitimizes the resulting treatments. Providing the data necessary for these purposes is a legal obligation; in the absence of them the owner would be unable to establish relationships and could have the obligation to make reports;
- handling of and response to your requests. You may decide to give your consent to the processing of your Personal Data for the purpose of handling and replying to your requests by the owner in relation its products and initiatives, advertising. In relation to this purpose, your consent is required at the time of sending your request. If you decide not to consent to the processing of your Personal Data for the above purposes, we will not be able to continue to send your request.
- sending dedicated commercial communications, also by sending news letters, sms, e-mails and phone calls, carrying out promotional activities, marketing and selling “dedicated” products and services of the owner or of third-party companies, specifically identified through the elaboration and the analysis, also through the use of techniques or automated systems, of information related to preferences, habits, consumption choices, aimed at dividing the interested parties into homogeneous groups for behaviors or specific characteristics (customer profiling) implemented also through the enrichment of data with information acquired from third parties (enrichment). The legal basis that legitimizes the resulting processing is the consent of the interested party who is free to give or not and who can, however, revoke at any time. The provision of data necessary for these purposes is not mandatory and the refusal to provide them does not determine any negative consequences, except for the impossibility of receiving dedicated commercial communications.
Personal data may be processed by means of both paper and electronic files (including portable devices) and processed in ways strictly necessary to meet the aforementioned purposes.
- Consequences of failure to communicate personal data
With regard to personal data relating to the execution of the points a, b, c above which you are party, or related to the fulfillment of a regulatory obligation (for example the obligations related to the keeping of accounting records and tax), the failure to communicate personal data prevents the improvement of the contractual relationship itself and / or in any case the possibility of carrying out and carrying out the commercial and contractual collaboration activities in progress and of fulfilling the contractual obligations deriving from points a, b and b. With regard to personal data relating to commercial and promotional activities the provision of data necessary for these purposes is not mandatory and the refusal to provide them does not determine any negative consequences, unless it is impossible to receive dedicated commercial communications.
- Data retention
Your personal data, object of treatment for the above mentioned purposes, will be stored conserved for a period that is necessary, depending on the purposes of the processing and depending on the contractual relationship between the Owner and You.
- Data communication
Your personal data may be disclosed to:
- a) banking and insurance institutions that provide functional services for the purposes indicated above;
b) banking and insurance institutions that provide functional services for the purposes indicated above;
c) subjects that process data in execution of specific legal obligations;
d) Judicial or administrative authorities, for the fulfillment of legal obligations;
- Profiling and dissemination of data
Your personal data are not subject to disclosure or to any fully automated decision making process, including profiling.
- Rights of the interested party
Among the rights recognized by the GDPR are those of:
- ask the Owner to access your personal data and information relating to them; the correction of inaccurate data or the integration of incomplete data; the cancellation of personal data concerning you (upon the occurrence of one of the conditions indicated in article 17, paragraph 1 of the GDPR and in compliance with the exceptions provided for in paragraph 3 of the same article); the limitation of the processing of your personal data (upon the use of one of the hypotheses indicated in Article 18, paragraph 1 of the GDPR);
- request and obtain from the Data Controller – in the cases in which the legal basis of the treatment is the contract or consent, and the same is done by automated means – your personal data in a structured and readable format by automatic device, also in order to communicate such data to another data controller (so-called right to the portability of personal data);
- oppose at any time the processing of your personal data to the occurrence of particular situations that affect you;
- withdraw consent at any time, limited to the cases in which the processing is based on your consent for one or more specific purposes and concerns common personal data (for example date and place of birth or place of residence), or particular categories of data (eg data revealing your racial origin, your political opinions, your religious beliefs, your health status or your sex life). The treatment based on consent and carried out prior to the revocation of the same preserves, however, its lawfulness;
- propose a complaint to a supervisory authority (Authority for the protection of personal data- garanteprivacy.it).