PRIVACY POLICY FINALIZED TO THE AUTHORIZATION TO TREATMENT OF PERSONAL DATA

Pursuant to the combined provisions of Legislative Decree 30 June 2003, n. 196 on the "Code regarding the protection of personal data" (Consolidated Law on Privacy) and Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the treatment of personal data as well as the free circulation of such data from here on also only "GDPR".

 

WHEREAS

 

1. that the GDPR, published in the Official Journal of the European Union (GUUE) L. 119 of 4 May 2016 and, pursuant to art. 99 of the GDPR, entered into force on 25 May 2016 and will be compulsorily applied in each Member State with effect from 25 May 2018;

2. that until the issuing of measures aimed at adapting the national regulatory framework to the provisions of EU Regulation no. 679/2016 (GDPR), the application of the Privacy Code (D.lgs.n.196/2003) is also necessary, even if, in so far as this will not be incompatible with the provisions contained in the GDPR itself;

3. that, therefore, without prejudice to what already provided for and governed by Legislative Decree n.196/2003, the GDPR, with the exceptions provided for in Article 2, is applied to the processing of all or part of personal data and to the processing of personal data. non-automated personal data contained in an archive or intended to be included;

4. which, according to the provisions of art. 5 GDPR ("Principles applicable to the processing of personal data"), the personal data of the data subject are processed according to the principles of

 

• • lawfulness or compliance with the rules; of correctness or respect for ethical and non-codified ethical standards; and transparency or guarantee of awareness of the data subject, traceability of data and disclosure at any time at the request of the interested party (letter a);
•  • "limitation of purpose" or collected for specific, explicit and legitimate purposes as well as subsequently processed in ways that are not incompatible with those purposes (letter b);
• • "data minimization" or collected in an appropriate, relevant and limited to what is necessary with respect to the purposes for which the same data are processed (letter c);
• • "Accuracy" or collected in an exact manner and, if necessary, updated as well as deleted or rectified in the event of their proven inaccuracy (letter d);
• • "limitation of conservation" or stored in a form that allows identification of data subjects for a period of time not exceeding that functional to achieve the purposes for which the same data are processed (letter e);
• • "integrity and confidentiality" or treated in such a way as to ensure adequate security of personal data, including their protection through appropriate technical and organizational measures, unauthorized or unlawful processing or loss, destruction or accidental damage (letter f) ;

 

5. that, in particular, the processing is "lawful" if, and to the extent that, see art. 6 GDPR ("Lawfulness of processing") has at least one of the following conditions:

 

• • the interested party has given his consent to the processing of his personal data for one or more specific purposes (letter a);
• • the processing is necessary for the execution of a contract of which the interested party is a party or for the execution of pre-contractual measures adopted at the request of the same (letter b);
• • the processing is necessary to fulfill a legal obligation to which the data controller is subject (letter c);
• • the processing is necessary to safeguard the vital interests of the data subject or of another physical person (letter d);
• • the processing is necessary for the performance of a task carried out in the public interest or in connection with the exercise of official authority vested in the data controller (letter e);
• • the processing is necessary for the pursuit of the legitimate interest of the data controller or third parties, provided that the interests or the fundamental rights and freedoms of the data subject who require the protection of personal data do not prevail, in particular if the data subject is a minor (letter f). all of the above, in compliance with the regulatory provisions of art. 13 ("Information to be provided if personal data are collected from the data subject") - Section 2 ("Information and access to personal data") of the GDPR, and pursuant to art. 13 ("Information") of Legislative Decree n.196/2003

 

I declare to have received the following information

 

 

Identification of the "Data Controller"

 

(see definition "Data controller" item 7 - Article 4 "Definitions" GDPR: "natural or legal person, public authority, service or other body which, individually or together with others, determines the purposes and means of the processing of personal data" and definition "Controller" letter f) - art. 4 "Definitions" D.lgs.n.196/2003: "the natural person, the legal person, the public administration and any other association or body, to which they also compete together with another owner, the decisions regarding the purposes, the methods of processing personal data and the tools used, including the security profile"): The data controller is Albatros s.n.c., Loc. Castellare 44 - 52048 Monte San Savino (AR). VAT number 01232620516, Phone 0575849697, Fax 0575844955, www.albatrosristorazione.it, albatros@ntc.it

 

 

Object and Processing Modality:

 

(see definition "Treatment" - Article 4 "Definitions" GDPR: "any operation or set of operations, performed with or without the aid of automated processes and applied to personal data or sets of personal data, such as collection, registration, organization, structuring, preservation, adaptation or modification, extraction, consultation, use, communication meditating transmission, dissemination or any other form of provision, comparison or interconnection, limitation, cancellation or destruction" and definition "Treatment"- letter a) art. 4, D.lgs.n.196/2003: "any operation or complex of operations, carried out without the aid of electronic tools, concerning the collection, registration, organization, conservation, consultation, processing , modification, selection, extraction, comparison, use, interconnection, blocking, communication, dissemination, deletion and destruction of data, even if not registered in a database" and definition of "Personal Data" point 1 - art. 4 "Definitions"

 

GDPR: "any information concerning an identified or identifiable person (" concerned ") considering" identifiable "the natural person who can be identified, directly or indirectly, with particular reference to an identifier such as the name, a number of identification, location data, an online identifier or one or more characteristic elements of its physical, physiological, generic, psychic, economic, cultural or social identity "); and definition "Personal Data" - letter b), art. 4, D.lgs.n.196/2003: "any information concerning a natural person, legal person, body or association, identified or identifiable, even indirectly, by reference to any other information, including a personal identification number";

 

The owner processes the personal identification data provided by the person concerned.

 

The processing of personal data is carried out on the basis of the operations indicated in article 4, n.2), GDPR and art. 4, letter a), D.lgs.n.196/2003 and precisely: collection, also, through the use of electronic and automated tools; registration for specific, explicit and legitimate purposes and use in further processing operations, however, compatible with these purposes; organization, conservation, consultation, processing, modification, selection, extraction, comparison, use, interconnection, blocking, communication, cancellation and destruction of data. The data will be processed in compliance with the security and confidentiality required and will be processed both on paper and electronic and / or automated. The Data Controller will process the personal data for the time necessary to fulfill the aforementioned purposes, taking care to keep them, however, within the limits of what is specified below.

 

Purposes of the processing to which the personal data are intended:

 

The data are collected and processed here:

 

a) without express consent (see article 24, legislative decree n.196/2003 and see article 6 GDPR), for the following Service purposes:

 

• • conclude contracts for the services of the Owner
• • fulfill the pre-contractual, contractual and tax obligations deriving from existing relationships with the interested party;
• • fulfill the obligations established by law, by a regulation, by the community legislation or by an order of the Authority;
• • prevent or discover fraudulent activities or malicious activities harmful to the website;
• • exercise the rights of the owner, for example the right to defense in court. b) only subject to specific and distinct consent (see Article 7 of the GDPR), for the following marketing purposes:
• • send via e-mail, mail and / or sms and / or telephone contacts, newsletters, commercial communications and / or advertising material on products or services offered by the Owner and detection of the degree of satisfaction on the quality of services offered, indicating that, where the interested party was already our customer, we can send commercial communications related to services and products of the owner similar to those of which the interested party has already used, subject to opposition (see Article 21 GDPR);
• • send by e-mail, mail and/or sms and/or telephone contacts, commercial and/or promotional communications of third parties (for example: business partners, insurance companies, etc.);

 

Details regarding the treatment for "Marketing purposes" and "Profiling"

 

For the benefit of the interested party, the following is specified:

 

A. The personal data collected will also be processed to pursue the purposes of commercial promotion, advertising, solicitation to purchase behavior, market research, surveys (including telephone, online or through forms), statistical processing (identifying), other marketing surveys in a broad sense of products and / or services related to the Company (hereinafter, "Treatment for Marketing Purposes") and through "generic" or "profiled" marketing, ie, to "profiling" (see definition "Profiling" - Article 4 "Definitions": "any form of automated processing of personal data consisting of the use of such personal data to evaluate certain personal aspects relating to a natural person [...]") and consisting of collection of data relating, for example, to the customer's personal details, to their postal address and e-mail address, all to his profession, to the preferences with respect to the commercial information he wishes to receive, to the registration of his acquisitions and to the creation and offer of targeted marketing partners, personalized services and additional benefits for all those who will be registered in a special Custom Relation Management (CRM) ;

 

E. By granting the consent to the "Treatment for Marketing Purposes" and "Profiling" the interested party specifically takes note of the promotional, commercial and marketing purposes in the broad sense of the processing (including the consequent management and administrative activities) and authorizes expressly said treatment either by telephone with operator or other non-electronic means, not telematic or not supported by automatic, electronic or telematic mechanisms and / or procedures, either by email, fax, SMS, MMS, automatic systems without operator intervention and similar, including electronic platforms and other electronic means, and - finally - pursuant to art. 6, paragraph 1, letter (a) of the GDPR. Therefore, by granting the optional consent, the interested party specifically takes note of and authorizes such treatments and / or treatments that pursue similar purposes.

 

F. In any case, even if the interested party has given his consent, he will remain free to revoke it at any time, modifying the consent settings in the "Communication and Privacy" area of the site. Following receipt of this opt-out request, the Data Controller will promptly remove and delete data from the databases used for the "Treatment for Marketing Purposes" and "Profiling" and will inform for the same purposes of cancellation as possible. third parties to whom the data have been communicated.

 

G. In case it is requested - for the purposes described above - the indication of the number of telephone number of the interested party and the latter has given the optional and specific consent (which also covers the processing of this personal data) for the purposes of commercial promotion , marketing and profiling described above, the Data Controller informs the data subject that it may legally treat the telephone use for marketing and profiling purposes even if it is registered in the Public Register of Oppositions, as it is taken from a source other than the directories public telephone calls and covered by specific consent, without prejudice to the right of opposition following the processing where the consent is formally revoked.

 

H. We inform you specifically and separately, as required by art. 21 of the GDPR that the interested party has the right to oppose at any time the processing of personal data concerning him for such purposes and that if the person opposes the treatment for purposes of direct marketing and profiling, personal data will not be able to more to be treated for these purposes.

 

I. The Data Controller informs the data subject that the data could also be communicated to third-party business partners. The consent to the "Treatment for Marketing Purposes" and "Profiling" - where provided by the interested party - does not also cover the different and further marketing treatment represented by the communication to third parties of the data for the same purposes. In order to proceed with such external communication it is obligatory to acquire from the interested party a further, separate, additional, documented, expressed and completely optional informed consent.

 

J. Personal data subject to "Treatment for Marketing Purposes" will not be disclosed. Personal data subject to "Profiling" will not be disclosed to third parties or disseminated.

 

 

Possible recipients and/or category of recipients of personal data

 

(see definition "Recipient" item 9 - Article 4 "Definitions": "the natural or legal person, public authority, with the exception of those who were to receive data for the purposes of a specific investigation, the service or other bodies that receives communication of personal data, whether it is a third party or not ")

 

Personal data may be communicated: to employees and/or collaborators of Tech Center srl who, in turn, will be able to handle them always and in full compliance with the principles governing the treatment itself and within the limits and for the purposes already indicated. They may also be communicated to professional companies/studios that provide assistance, advice or collaboration to the Data Controller, in accounting, administrative, tax, legal, tax and financial matters, to Public Administrations for the performance of institutional functions within the limits established by law or by regulations and to third party service providers to whom communication is necessary for the performance of the services covered by the contract. Personal data will not be disseminated. Furthermore, without the need for express consent, the Data Controller may communicate the data of the interested party for the purposes referred to in letter a) of the aforementioned paragraph entitled "Purpose of the processing for which personal data are intended", to Supervisory Bodies, Judicial Authorities, as well as to all other subjects to whom the communication is mandatory by law for the accomplishment of the aforementioned purposes.

 

Possible data transfer:

 

The management and storage of personal data will be carried out on servers located within the European Union of the Owner and/or third-party companies appointed and duly appointed as Data Processors. The data will not be transferred to outside the European Union. In any case, it is understood that the Data Controller, where necessary, will have the right to move the server location to Italy and/or the European Union and/or non-EU countries. The Data Controller hereby ensures that the transfer of non-EU data will take place in accordance with the applicable legal provisions, stipulating, if necessary, agreements that guarantee an adequate level of protection and / or adopting the standard contractual clauses provided by the European Commission.

 

Retention period of personal data:

 

Personal data will be kept for the period strictly necessary for the pursuit of the purposes underlying their treatment and / or until the specific consent is revoked by the interested party. In any case, the data will be stored for no more than 10 (ten) years from the termination of the service provision and/or product supply.

 

Rights of the interested party:

 

In compliance with the provisions of art. 7, D.lgs.n.196 / 2003 and GDPR the interested party can exercise the following rights

 

• • ask the data controller to access personal data in order to be able to confirm that the processing of personal data concerning him or her is in progress and, in this case, obtain all the necessary information in accordance with the provisions of Article 15 "Right of access of the interested party" GDPR, and article 7, paragraph 1, D.lgs.n.196/2003;
• • ask the data controller to correct the inaccurate personal data concerning him / her as well as the integration of the incomplete personal data according to the provisions of Article 16 "Right of rectification" GDPR and article 7, paragraph 3, letter a), D.lgs.n.196/2003;
• • ask the data controller to delete their personal data in the event that the data are no longer necessary in relation to the purposes for which they were collected or otherwise processed (letter a); the interested party has revoked the consent or there is no legal basis for the processing (letter b); the interested party has opposed the treatment pursuant to art. 21, paragraphs 1 or 2, and there are no prevailing reasons to proceed, however, to the treatment (letter c); the treatment is illicit (letter d); the deletion of data constitutes fulfillment of legal obligation to which the data controller is subject (letter e); where there is the hypothesis foreseen by article 8, paragraph 1 (letter f), everything - in any case - according to the provisions of Article 17 "Right to cancellation ("right to be forgotten") GDPR and article 7, paragraph 3, letter b), D.lgs.n.196/2003;
• • obtain from the data controller the limitation of the treatment when: the interested party contests the accuracy of personal data (in this case within the time necessary to verify the accuracy of such data - letter a); in the hypothesis of unlawful processing, the interested party opposes - however - the cancellation of data, asking instead that its use is limited (letter b); regardless of the fact that the data controller no longer needs it for the purposes of the processing itself, the data subject needs to keep the data for purposes of assessment, exercise or defense in court (letter c); the interested party has opposed the treatment pursuant to art. 21, paragraph 1, pending verification on the possible prevalence of the legitimate reasons of the holder with respect to those of the interested party (letter d), all - in any case - according to the provisions of Article 18 "Right to limitation of treatment";
• • at any time, for reasons related to your particular situation, object to the processing of personal data concerning you, pursuant to Article 6, paragraph 1, letters e) of), including profiling on the basis of these provisions, as well as in the case of data processing for marketing purposes, including, in this case, profiling in so far as it is connected to such direct marketing. All this, in any case, according to the provisions of Article 21 "Opposition right" GDPR and article 7, paragraph 4, letters a) and b), D.lgs.n.196 / 2003;
• • obtain data portability according to the best provisions and regulated in Article 20 "Right to data portability";
• • at any time, withdraw your consent to the processing of data without prejudice to the lawfulness of the processing based on consent before revocation. All this, in any case, according to what is better provided for and governed by Article 7 "Conditions for consent";
• • propose a complaint to a Supervisory Authority with the task of monitoring the application of the GDPR in order to protect the rights and freedoms of natural persons with regard to the processing of personal data. All this, in any case, according to what is better provided for and regulated by articles 51 and the following. "Supervisory authority".

 

Optional communication of personal data

 

The user is free to provide his personal data aware of the fact that their failure to communicate will make it impossible to obtain the requested service.

 

Exercise of rights by the interested party:

 

The interested party can exercise his rights by writing to the e-mail address Albatros s.n.c., Loc. Castellare 44 - 52048 Monte San Savino (AR). VAT number 01232620516, Phone 0575849697, Fax 0575844955, www.albatrosristorazione.it, albatros@ntc.it Owner and responsible for the treatment: Cartocci Patrizio The identification data of the data controller company are as follows: Albatros s.n.c., Loc. Castellare 44 - 52048 Monte San Savino (AR). VAT number 01232620516, Phone 0575849697, Fax 0575844955, www.albatrosristorazione.it, albatros@ntc.it