INFORMATION PURSUANT TO ARTICLE 13 OF EU REGULATION 2016/679 (GDPR)

INFORMATION PURSUANT TO ARTICLE 13 OF EU REGULATION 2016/679 (GDPR)

In compliance with Article 13 of the EU Regulation no. 2016/679 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (GDPR), and more generally with the principles contained in the relevant legislation in force, the company Successo Società Agricola S.r.l, a company with registered office in Florence, via G. Carducci 16, VAT no. 06812520481 , local unit and operational office in Arezzo, Loc. Peneto 15, in its capacity as Data Controller (hereinafter the “Data Controller”), in the person of its legal representative pro tempore, Mr. ______________________, informs you that the personal data you provide through the website https://terrazza-toscana.com/en/ (hereinafter, the “Website”) as “Data Subject” will be processed in compliance with the principles of fairness, lawfulness, transparency and protection of your privacy and your rights. To this end, you are hereby provided with the following information

1. IDENTITY AND CONTACT DETAILS OF THE DATA CONTROLLER

The data controller is Successo Società Agricola S.r.l., a company based in Florence, via G. Carducci 16, p. Iva 06812520481, in the person of its legal representative pro tempore, Mr. ______________________, whose contact details are follows:

- tel: _______________;

- e-mail: ________________________;

- address: registered office via G. Carducci 16, 50121 Florence; local unit and operating office Loc. Peneto 15, 52100 Arezzo.

1. PERSONAL DATA BEING PROCESSED

Within the limits of the purposes and modalities defined in this information notice, personal data voluntarily provided to the data controller, i.e. contact data such as name, surname, address, e-mail, telephone number, tax code and VAT number, and any further information also sent when contacting the customer care contact details, shall be processed.

Also subject to processing are data acquired automatically for the purposes of the normal operation of the Site, such as IP addresses or the domain names of the computers used by users connecting to the Site, the URI (Uniform Resource Identifier) addresses of the resources requested, the request, the method used to submit the request to the server, the size of the file obtained in response, the numerical code indicating the status of the response given by the server (successful, error, etc.) and other parameters relating to the user’s operating system and computer environment. This is information that by its very nature could, through processing and association with data held by third parties, make it possible to identify the computers that connect to the site.

The Data Controller may receive information about the Data Subject from other sources, such as couriers, regarding up-to-date delivery and address information, which will possibly be used and/or processed to deliver future orders more smoothly.

1. COOKIES

The Site uses cookies and other similar technologies both in the form indispensable for its operation (“technical” cookies, information without which the website cannot function) and for the purposes of personalizing navigation, marketing, statistics (in this case in anonymous form). They are stored in order to be transmitted the next time the data subject visits. You can view the full Cookie Policy at the following link.

1. PURPOSE AND LEGAL BASIS OF DATA PROCESSING

The data provided by the Data Subject in the course of or in relation to purchases made by the latter on the Site will be processed by the Data Controller in order to receive and manage orders, provide the products and/or services purchased, for general accounting purposes, invoicing, tax obligations and to send the Data Subject communications relating to his/her orders and products. For these purposes, the processing is based on Article 6.1 letter (b) of the GDPR as it is necessary for the performance of a contract to which the Data Subject is a party. Failure to provide data for these purposes prevents the completion and execution of the contractual relationship.

The data provided by the data subject may also be processed:

- for communication, support and contact with the data subject, i.e. to respond to his/her requests;

- for marketing purposes, including through newsletters, in relation to products and/or services offered by the Controller;

- to carry out market research using automated and traditional methods.

In the cases listed above, the provision of data by the Data Subject is voluntary (therefore based on art. 6.1 let. (a) of the GDPR). The Data Subject may choose not to provide his or her data but, in this case, Successo Società Agricola S.r.l. may not be able to satisfy all or part of his or her requests (e.g. updating the customer on new products or commercial offers).

The Data Subject’s Personal Data may also be used by the Data Controller to protect itself in court before the competent judicial instances, as well as for the fulfilment of any obligation provided for by the applicable rules, laws and regulations, including those concerning tax and fiscal matters.

The use of the Data Subject's data for any other purposes will be subject to a specific request for consent.

1. PROCESSING METHODS AND RETENTION TIMES

Personal data may be processed by means of both hard copy and computerized archives (including portable devices) and handled in the manner strictly necessary to fulfil the above-mentioned purposes by persons, internal or external, specifically appointed for this purpose and committed to confidentiality. The data are stored in electronic and paper archives with full assurance of the security measures provided for by the legislator.

The data will be kept for a period of time not exceeding the achievement of the purposes for which they are processed, including those of archiving and protection of the rights of the Data Controller, in full compliance with the principle of retention limitation provided for by the GDPR and/or for the time necessary for legal obligations. The verification of the obsolescence of the retained data in relation to the purposes for which they were collected is carried out periodically.

1. COMMUNICATION AND TRANSFER OF DATA TO COUNTRIES OUTSIDE THE EU

The data subject's personal data may be disclosed to third parties solely and exclusively for the purposes indicated above and, specifically:

- to specially authorised internal subjects of Successo Società Agricola Srl who carry out activities connected and instrumental to the management of the services requested;

- to persons specifically appointed as Data Processors.

The data provided are stored at the Data Controller's premises and on servers located on the territory of the European Union and will not be transferred outside that territory.

The Data Controller may also communicate the data of the Data Subject referred to in point 2, for the purposes referred to in point 4 to the public entities to which it is addressed by law, to the judicial authorities, and to all those entities to which communication is mandatory for institutional purposes.

These parties will process the data in their capacity as autonomous data controllers.

1. RIGHTS OF THE DATA SUBJECT

Pursuant to Articles 13-21 of the GDPR, under the conditions laid down therein, the data subject may at any time exercise the following rights vis-à-vis the Data Controller:

• Right of access (the data subject has the right to have confirmation of the existence of the processing as well as information on the data processed and the right to receive a copy of the data);
• Right of rectification (the data subject has the right to request that his or her personal data be updated or corrected);
• right to data deletion, so-called 'right to be forgotten’ (the data subject may request the deletion of his or her personal data in the cases and under the conditions set out in Article 17 GDPR);
• Right to restriction of processing (the data subject may request the restriction of the processing of their data in the cases referred to in Article 18 GDPR. If the processing is restricted, personal data will only be processed, except for storage, with the consent of the data subject or for the establishment, exercise or defence of a legal claim or to protect the rights of another natural or legal person or for reasons of substantial public interest of the Union or a Member State);
• Right to portability (in the cases and under the conditions set out in Article 20 GDPR, the data subject has the right to receive his or her data in a structured, commonly used and machine-readable format and, where technically feasible, to obtain the unimpeded transfer to another data controller);
• Right to object (the data subject shall have the right to object at any time, on grounds relating to his or her particular situation, to the processing of personal data concerning him or her in accordance with Article 6(1)(e) or (f), including profiling on the basis of those provisions. The controller shall refrain from further processing personal data unless there are compelling legitimate grounds for processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defence of legal claims);
• Right to withdraw consent at any time if the processing is based on Article 6(1)(a) or Article 9(2)(a) of the GDPR. Withdrawal of consent shall not affect the lawfulness of the processing based on the consent before the withdrawal.

In any event, the data subject always has the right to lodge a complaint with the competent supervisory authority (Personal Data Protection Authority), pursuant to Article 77 of the Regulation, if he or she considers that the processing of his or her personal data is contrary to the legislation in force.

1. WAYS OF EXERCISING RIGHTS

In order to exercise the aforementioned rights, the data subject must address his request directly to the Data Controller at the addresses indicated in point 1.