INFORMATION NOTICE PURSUANT TO ART. 13 OF EU REG. 2016/679,
CONCERNING THE PROCESSING OF PERSONAL DATA USERS OF THE SERVICES OFFERED BY THE SITE
Under art. 13 of EU Regulation 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation, “GDPR”), Gran Deposito Aceto Balsamico Giuseppe Giusti S.r.l. (hereinafter referred to as "Acetaia Giusti"), with registered office in Modena, Fraz. Lesignana, IT-41123, Street Quattro Ville 155, owner of the website: www.giusti.com, as Data Controller, informs you that the personal data acquired, voluntarily provided by the data subject also by filling in the data collection forms on the Website, shall be processed in compliance with the above-mentioned legislation.
In particular, the writer provides the following information.
CATEGORIES OF DATA
The information systems and software procedures used to operate the site acquire, during their normal operation, some personal data whose transmission is implicit in the use of Internet communication protocols. This information is not collected to be associated with identified subjects, but by its very nature could, through processing and association with data held by third parties, allow users to be identified. This category of data includes IP addresses or the domain names of the computers used by users who connect to the site, the URI (Uniform Resource Identifier) addresses of the resources requested, the time of the request, the method used to submit the request to the server, the size of the file obtained in response, the numerical code indicating the status of the response given by the server (successful, error, etc.) and other parameters relating to the user's operating system and computer environment. These data are used for the only purpose of obtaining anonymous statistical information on the use of the site and to check that it is functioning correctly. The data could also be used to ascertain responsibility in the event of hypothetical computer crimes to the detriment of the site: without prejudice to this possibility, the data on web contacts persist for a limited period and are deleted periodically.
Data provided voluntarily by the user
The data subject may voluntarily provide the information requested and functional to the provision of services, by filling the appropriate data collection forms on the platform. Therefore, common personal data, essentially identifying data (e.g. name; surname; physical and/or telephone and/or telematic contact details), login, e-mail address and passwords and data relating to payment settings (including credit card information and promotional codes, gift vouchers and account balance) may be collected. The data controller will not collect and/or process the "special categories of personal data" referred to in Article 9 of the GDPR (relating, for example, to health).
PURPOSE OF PROCESSING AND LEGAL BASIS.
The processing will also be carried out alsowith the help of computer and telematic means for the following purposes:
a) Purchase - also in e-commerce mode - and delivery of products and services. We use personal data to receive and process orders, to deliver products and services (e.g. guided tour), to process payments and to communicate with you about orders, products, services, and promotional offers.
The data collected for this purpose and, in particular, for the management of bookings for guided tours will be processed without the need for explicit consent from users, pursuant to Article 6, paragraph 1 letter b) GDPR, in order to fulfil contractual and/or pre-contractual obligations towards users.
b) Providing the newsletter service. We process, by computer and telematic means, the data you directly provide by filling in the appropriate form on our Site to provide a newsletter service (including promotional content) distributed by e-mail automatically and free of charge.
These data will be stored for the period during which the newsletter service is active. You may opt out of this service by sending an e-mail to email@example.com. The data collected for this purpose will be processed pursuant to your consent given in accordance with Article 6, paragraph 1 letter a) GDPR.
NATURE OF THE CONFERRAL
The provision by the user of the personal data required for the processing referred to in point 2, letter a) is mandatory and in the event of refusal to provide such data we will not be able to provide the requested service.
On the contrary, the provision of data for the processing referred to in point 2, letter b) is completely optional. Such treatment, in fact, will be carried out by virtue of your consent, which can be revoked at any time without affecting the lawfulness of the treatment based on the consent given before the revocation. If you wish us to carry out the processing referred to in points 2(c) and (d), you must instead provide us with your consent. However, you may withdraw your consent at any time without affecting the lawfulness of the processing based on the consent given before withdrawal.
PROCESSING METHODS AND STORAGE PERIOD
Data are collected, processed and stored mainly on magnetic, electronic and/or telematic media. In any case, the processing may be carried out on the basis of mandatories previously formalized by persons adequately informed and instructed by the Data Controller on the measures and procedures to be taken to ensure an adequate level of security. Personal data will be kept only for the time necessary to pursue the purposes for which they are collected, in compliance with the principle of minimisation as per article 5.1.c) GDPR.
In particular, for the purposes of the processing referred to in point 2 letter a), the data will be stored for the time necessary to fulfil the obligations provided by current legislation for administrative, tax and accounting purposes. In the light of the regulations concerning the epidemiological emergency from Covid-19, the booking data of the guided tour will be kept for a period of 14 days for a suitable implementation of the measures outlined at national and regional level for the prevention of Covid-19 infection.
For the purposes referred to in point 2, letter b), as it is a continuous periodic service, the data will be processed until the aforementioned service is active or interrupted by the user, without prejudice to further retention periods provided for by current legislation for specific tax/administrative and/or similar purposes.
Your data may be communicated to:
a. consultants (tax consultants, IT service providers, etc.) specifically appointed for this purpose;
b. any public authorities that may request it or to which it is necessary to communicate information in compliance with specific legal obligations.
c. companies that provide to the Data Controller functional services to the performance of the activity provided.
The list of persons appointed as Data Processors from time to time will be made available, on request, in the forms required by law, at the addresses of the Data Controller indicated in point 8 below of this information notice.
The data collected and processed will not be disseminated or made available or given in consultation in any form to subjects other than those indicated in this statement and/or provided for by the Privacy Law, nor to unspecified subjects.
TRANSFER OF DATA ABROAD
The data provided by users may be transferred outside the national territory in the pursuit of the purposes set out in art. 2, to companies belonging to the categories listed in the previous point, having their headquarters in countries belonging to the European Union or outside the European Union; in the latter case, a level of data protection appropriate to the European one will be guaranteed. This is without prejudice to the regulations on third party cookies described in this policy.
RIGHTS OF THE DATA SUBJECT
Under the conditions set out in EU Regulation 2016/679, you may exercise the following rights:
- Art. 7 Right of withdrawal of consent exercisable at any time without prejudice to the lawfulness of the processing based on the consent given before the withdrawal;
- Article 15 Right of access of the interested party;
- Article 16 Right of rectification;
- Article 17 Right to cancellation;
- Article 18 Right to restriction of processing;
- Article 20 Right to data portability;
- Art. 21 and Art. 22: Right to object and automated decision-making about natural persons.
To verifying the existence of the conditions and procedures for the exercise of the aforementioned rights, please refer to the full text of the aforementioned provisions, available at: www.garanteprivacy.it.
Please note that if you feel that your rights have been infringed, current legislation allows you to lodge a complaint with the National Supervisory Authority
IDENTITY AND CONTACT DETAILS OF THE DATA CONTROLLER.
The data controller is Gran Deposito Aceto Balsamico Giuseppe Giusti S.r.l., with registered office in Modena, Fraz. Lesignana, IT-41123, street Quattro Ville 155; e-mail: firstname.lastname@example.org; switchboard: 059.840135.