PRIVACY POLICY

This letter is to inform you that our company processes your personal data in full compliance with current national and EU legislation on the processing of personal data.
Pursuant to Article 13 of EU REGULATION 679/2016, we inform you that:
    1    Purpose of the processing: Personal data are processed as part of the company’s normal business activities for the following purposes:
a) exclusively aimed at fulfilling contractual obligations or acquiring pre-contractual information, as well as at providing information relating to the data subject’s requests for supplies and services;
b) related to obligations established by laws, regulations, and EU legislation, as well as by provisions issued by authorities legally empowered to do so and by supervisory and control bodies, as well as obligations related to tax and accounting matters.
    2    Category of data collected: The data collected fall within the category of personal identification data (personal details, tax code or VAT number, identification document details) strictly connected and instrumental to managing relationships with customers and suppliers (for example, acquiring preliminary information for the conclusion of a contract, performing operations based on the obligations arising from the contract, fulfilling tax and accounting obligations, etc.).
    3    Legal basis of the processing: The processing of your data for the purposes indicated in point 1 letters a) and b) of this notice is carried out lawfully, as it:
is performed in execution of a contract to which you are a party or of pre-contractual measures adopted at your request;
is necessary to comply with a legal obligation to which the Data Controller is subject (in relation to obligations established by laws, regulations, and EU legislation, as well as tax and accounting obligations);
Processing of your data for the purposes indicated in point 1) letter c) will be carried out only if you have given your specific consent for such purposes.
    4    Methods of data processing: Data processing is carried out using paper, electronic, and digital tools with logic strictly related to the purposes themselves and, in any case, in such a way as to guarantee the security and confidentiality of the data. In particular, we inform you that your data are:
- processed lawfully, fairly, and transparently;
- collected for the purposes set out above, explicit and legitimate, and subsequently processed in a manner not incompatible with these purposes;
- adequate, relevant, and limited to what is necessary in relation to the purposes for which they are processed (“data minimization”);
- accurate and, where necessary, updated, erased and/or rectified;
- stored in a form that permits your identification for no longer than is necessary to achieve the purposes for which they are processed;
- processed in a way that ensures adequate security of personal data, including protection—through appropriate technical and organizational measures—against unauthorized or unlawful processing and accidental loss, destruction, or damage.
    5    Data disclosure: For the purposes indicated, your data may be disclosed exclusively to the following subjects: credit institutions for the management of payments arising from contract execution; companies or third parties tasked with printing, envelope stuffing, dispatching and/or delivering documents; couriers and postal service providers; companies, consultants, or professionals responsible for installing, maintaining, updating, or generally managing the Data Controller’s information systems; credit recovery, transfer, and protection companies; professional firms and consultants in legal, tax, commercial, labor, and organizational matters; company collaborators and employees responsible for processing; as well as those subjects to whom communication is necessary or functional for the proper fulfilment of contractual obligations or legal requirements, or who have access to personal data by virtue of legal or administrative provisions.
These subjects act as external Data Processors or operate fully independently as separate Data Controllers.
The complete list of Data Processors is available at the company’s headquarters and may be requested from the Data Controller indicated above.
    6    Data dissemination and profiling: For the purposes indicated, your data will not be disseminated nor subjected to any fully automated decision-making process, including profiling.
    7    Transfer abroad: Your personal data are not transferred outside the national territory.
    8    Mandatory/optional nature of data provision: Without prejudice to the personal autonomy of the data subject, the provision of personal data may be:
- strictly necessary for managing and executing existing contractual relationships or relationships being established, or for performing pre-contractual measures adopted at your request;
- mandatory in relation to obligations established by laws, regulations, and EU legislation, as well as by provisions issued by authorities legally empowered and by supervisory and control bodies, and obligations related to tax and accounting matters.
    9    Refusal to provide data: Any refusal to provide personal data for the purposes indicated in point 1 of this notice will make it impossible to proceed with the correct and complete execution of the contract to which you are a party or with the execution of pre-contractual measures adopted at your request.
    10    Data retention period: Your personal data will be stored in a form that allows your identification for no longer than is necessary to achieve the purposes for which they are processed, and in any case in compliance with legal obligations regarding data retention (tax assessments and statutory limitation periods for exercising rights).
    11    Data subject rights: At any time, you may exercise, pursuant to Articles 15 to 22 of EU Regulation 2016/679, the right to:
request confirmation as to whether or not personal data concerning you exist;
- obtain information regarding the purposes of the processing, the categories of personal data, the recipients or categories of recipients to whom the personal data have been or will be disclosed, and, when possible, the retention period;
- obtain rectification and erasure of the data;
- obtain restriction of processing;
- obtain data portability, i.e., receive them from a data controller in a structured, commonly used, machine-readable format and transmit them to another data controller without hindrance;
- object to the processing at any time, including processing for direct marketing purposes;
- object to automated decision-making regarding natural persons, including profiling;
- request from the Data Controller access to personal data and the rectification or erasure of such data, or restriction of processing concerning you, or object to such processing, as well as the right to data portability;
- withdraw consent at any time without affecting the lawfulness of processing based on consent prior to withdrawal;
- lodge a complaint with a supervisory authority.
The Data Controller is GARESIO SOCIETÀ SEMPLICE AGRICOLA, represented by the legal representative pro tempore, with registered office at Località Sordo, 1 – 12050 Serralunga d’Alba (CN).
The above rights may be exercised by submitting a written request to the Data Controller via registered letter, or by email to: amministrazione@garesiovini.it