PRIVACY POLICY
pursuant to Article 13 of EU Regulation 2016/679

1. Data controller

The Data Controller of the data collected through this site is Vetreria Nuova Romagnola S.R.L. Unipersonale, with registered office in Cerasolo (RN) - Vat no. / Tax code 00873270409 (hereinafter also referred to as “Controller”).

2. Purpose and legal basis of processing

By using or consulting the site, visitors and users approve this privacy policy and consent to the processing of their personal data in the manner and for the purposes described below, including possible disclosure to third parties if this is necessary for the provision of a service.

Providing data and thus consenting to its collection and processing is optional. The User may withhold consent and may revoke consent already given at any time (via the banner on the site or via the browser settings for cookies). However, denying consent may result in the inability to provide certain services and the site navigation experience would be impaired.

3. Methods of processing personal data

Your data is processed using instruments and procedures that guarantee its security and confidentiality, and may be processed both through our website and through other electronic means, and sometimes even on paper.

4. Data retention period

The data collected by the site during its operation are kept for the time strictly necessary to carry out the specified activities.

On expiry, the data will be deleted or anonymised, unless there is no further purpose for retaining the data. Data (IP address) used for site security purposes (blocking attempts to damage the site) are stored for 7 days.

Personal data collected via the “contact us” and “work with us” forms will be kept for the time strictly necessary to carry out the activities for which they were and/or until the consent given is revoked.

5. Transfer of data to non-EU countries/organisations

This site may share some of the data collected with services located outside the European Union (e.g. through the Google Analytics service). The transfer is authorised on the basis of specific decisions of the European Union and the Data Protection Supervisor, in particular Decision 1250/2016 (Privacy Shield).

6. Transfer of collected data to third parties

The data collected by the site are generally not provided to third parties, except in specific cases: legitimate request by the Judicial Authority and only in the cases provided for by law; when it is necessary for the provision of a specific service requested by the User; for the performance of security checks or site optimisation.

7. Security measures

We process visitors'/users' data lawfully and fairly, taking appropriate security measures to prevent unauthorised access, disclosure, modification or destruction of data.

We are committed to protecting the security of your personal data when sending them, using Secure Sockets Layer (SSL) software, which encrypts information in transit. Processing is carried out by means of computer and/or telematic tools, with organisational methods and logic strictly related to the purposes indicated.

In addition to the Data Controller, in some cases, categories of employees involved in the organisation of the site or external parties (such as third-party technical service providers, hosting providers) may have access to the data.

8. User rights

Pursuant to Art. 7 of the Privacy Code and Art. 13 GDPR, each user has the right to obtain confirmation of the existence or non-existence of his or her personal data, even if not yet registered, and their communication in intelligible form. In particular, the data subject has the right to obtain from the data controller the following information:

·       the origin of personal data;

·       the purpose and method of processing;

·       the logic applied in the event of processing carried out with the aid of electronic/informatic instruments;

·       the identification details of the owner, the managers and the designated representative;

·       of the subjects and categories of subjects to whom the data may be communicated or who may become aware of the data in their capacity as designated representative in the territory of the State, as managers or appointees;

Furthermore, pursuant to Art. 15 et seq. of the GDPR, the data subject has the right to:

·       Obtain from the Controller confirmation as to whether or not personal data relating to him/her are being processed and, if so, to obtain access to the personal data and to the following information the purposes of the processing; the categories of personal data concerned; the recipients or categories of recipients to whom the personal data have been or will be disclosed, in particular if recipients in third countries or international organisations; where possible, the period for which the personal data are to be retained or, if this is not possible, the criteria used to determine that period where the data are not collected from the data subject, all available information as to their source; the existence of an automated decision-making process, including profiling, and, at least in such cases, meaningful information on the logic used, as well as the importance and the envisaged consequences of such processing for the data subject.

·       Obtain from the data controller the rectification of inaccurate personal data concerning him/her without undue delay. Taking into account the purposes of the processing, the data subject has the right to obtain the integration of incomplete personal data, also by providing a supplementary declaration.

·       Obtain from the data controller the erasure of personal data concerning him/her without undue delay if one of the following grounds applies: a) the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;

(b) the data subject withdraws the consent on which the processing is based in accordance with Article 6(1)(b)

(a), or Article 9(2)(a), and if there is no other legal basis for the processing;

(c) the data subject objects to the processing pursuant to Article 21(1) and there is no overriding legitimate ground for processing, or objects to the processing pursuant to Article 21(2); (d) the personal data have been processed unlawfully;

(e) the personal data must be erased in order to comply with a legal obligation laid down by Union or Member State law to which the controller is subject;

(f) the personal data were collected in connection with the offering of information society services as referred to in Article 8(1).

·       obtain from the data controller the restriction of processing when one of the following cases occurs:

(a) the data subject contests the accuracy of the personal data, for the period necessary for the controller to verify the accuracy of such personal data;

b) the processing is unlawful and the data subject objects to the deletion of the personal data and requests instead that their use be restricted;

(c) although the data controller no longer needs them for the purposes of processing, the personal data are necessary for the establishment, exercise or defence of legal claims by the data subject;

(d) the data subject has objected to the processing pursuant to Article 21(1), pending verification as to whether the legitimate reasons of the controller prevail over those of the data subject.

To receive in a structured, commonly used and machine-readable format the personal data concerning him/her that he/she has provided to a data controller and to transmit that data to another data controller without hindrance by the data controller to whom he/she has provided them if:

(a) the processing is based on or on a contract

(b) the processing is carried out by automated means. When exercising his or her data portability rights, the data subject has the right to obtain the direct transmission of personal data from one data controller to another, if technically feasible.

·       Object at any time, on grounds relating to his or her particular situation, to the processing of personal data concerning him or her pursuant to Article 6(1)(e) or (f), including profiling on the basis of those provisions. Where personal data are processed for direct marketing purposes, the data subject has the right to object at any time to the processing of personal data concerning him/her carried out for such purposes, including profiling insofar as it is related to such direct marketing.

·       The right not to be subjected to a decision based solely on automated processing, including reprocessing, which produces legal effects concerning him/her or significantly affects him/her in a similar way.

·       Right to lodge a complaint with a supervisory authority.

Requests under the above points should be sent by e-mail to the address of the data controller: info@vetreriaromagnola.com

9. Updates

This privacy policy is updated as of 23 May 2024.