Unigrà S.r.l. (hereinafter "Unigrà") would like to inform visitors to its website that it protects personal data in accordance with national legislation and in accordance with the European Union General Data Protection Regulation no. 2016/679.
1. Methods of acquisition and types of data processedThe website offers informative and occasionally interactive content. Whilst browsing the site, it is thus possible for information about the visitor to be obtained in the following ways:
1.1. Registration Data - The information requested during registration will be used to provide access to online services and areas. To ensure that all activities connected or instrumental to the provision of its services are properly conducted, Unigrà may, if necessary, share the personal data of users with some of its other Group companies. Moreover, as registration is required to access online services, the personal data of users, once they have chosen a service and, if necessary, after providing further information, will be processed for the purposes related and/or functional to the delivery of the selected service. The data will not be disclosed under any circumstances to third parties outside the Unigrà Group.
1.2. Browsing data - During their normal operation, the computer systems and software procedures used to operate this website acquire some personal data, the transmission of which is implicit in the use of internet communication protocols. This category of data includes the IP addresses or domain names of computers used by users connecting to the website, the URI (Uniform Resource Identifier) of the resources requested, the time of the request, the method used to submit the request to the server, the size of the file obtained in reply, the numerical code indicating the status of the response from the server (successful, failed, etc.) and other parameters about the operating system and the computer environment. This data is only used to obtain anonymous statistical information on site usage and to check its correct functioning and is kept for the time defined by the relevant legal regulations. This information could be used to ascertain responsibility in case of computer crimes against Unigrà or otherwise perpetrated through the use of the website.
1.3. Data provided voluntarily by the visitor - This is all the personal information provided beyond the registration data that is given freely by the visitor on the site, for example to complete registration to a reserved area, to request information about a particular product or service through a form, write to an e-mail address or call a toll free number to have direct contact with customer service. Where provided, this information will be used for the purposes of user profiling. Where this is carried out, suitable communication will be provided and the user's free and specific consent will be acquired for marketing and/or profiling purposes, according to the methods provided by the privacy law (initially in the process of gathering consent for an opt-in and subsequently, for the eventual refusal of consent for an opt-out).
1.5. Specific types of data processed - The user who wishes to access the services and content provided through this website will be asked, during registration and depending on the type of service, to indicate personal data such as name, residence or domicile address, e-mail, date and place of birth, telephone number, etc. Additional personal information may be provided if the user wishes to participate in promotions and any kind of other initiative. Furthermore, certain sections of this website provide open text fields which users can use to voluntarily provide Unigrà with information containing personal data, possibly related to a third party. In such a circumstance, considering these are indeed open fields, the user may enter, even inadvertently, sensitive personal information (further information), such as, for example, data revealing political opinions, religious or philosophical beliefs, trade union membership, state of health, etc. Unigrà asks its users to not reveal these types of data unless this is absolutely necessary. Users who decide to share such information will have to give their consent to its processing. If the user happens to communicate any kind of personal data belonging to a third-party data subject, the same will be considered an independent data controller and will be responsible for all the obligations and responsibilities of law. In any case, Unigrà asks its users to communicate data relating to third parties only if such transmission is based on the prior consent of such subjects or some other legitimate legal basis. Users who submit their applications for job positions can refer to the website section "Work with us" and the disclosure statements published therein. Minor-aged users can freely browse this website. However, minors under 14 years of age cannot register on the website or use the services made available through it unless they have previously obtained the consent of their parent or guardian.
2. Purposes of processingUsers’ data is processed for the following purposes:
- to allow the carrying out of operations related to the services requested by users and the management of relations with them, as well as enable access to restricted sections of the site;
- to allow the execution of contractual obligations and the proper management of pre-contractual relationships;
- to obtain anonymous statistical information about the site and check its proper functioning;
- to fulfil the obligations imposed by law, including accounting and tax law;
- with consent, to carry out activities related to providing information about Unigrà products and/or services, events and promotions, market research, surveys and general marketing activities, for example updates on site news, recipes, dietary and nutritional information, events and competitions, etc., including the use of automated systems not requiring operator intervention (e.g. postal service, e-mail or SMS);
- based on the legitimate interest of the Data Controller, if and to the extent that different interests, rights or freedoms of the data subject shall not prevail, to provide commercial information by e-mail concerning categories of products and/or services and/or events which are similar or otherwise belonging to the same type as those previously purchased from our company;
- with consent, to offer personalised information (profiling), through the processing of data provided by users, creating groups divided according to interest, with the purpose of sending commercial communications aligned with the users’ interests and which are as non-invasive as possible.
5. Legal basis of the processing and compulsory/optional nature of providing dataThe provision of data is required for contractual or service purposes and for compliance with the law, as its processing is strictly related to managing the relationship between the parties, providing the requested service and observing the law. In its absence, business relationships between the data subject and Unigrà cannot subsist, nor can Unigrà guarantee registration to the website or the services provided by the same. The provision of data for marketing purposes is entirely optional, as this processing is based on users' consent, who can decide not to provide or to withdraw the consent at a later time. In such a case the user will not be able receive any communications concerning our events, products and services, but will continue to be entitled to registration on the website and the services offered by the same. No prior consent is required for Unigrà, based on its legitimate interest, to send users/customers e-mail communications regarding types of services and/or products which are similar to those previously purchased by them, with the intention of maintaining and developing its commercial activities; however, the receipt of these communications can be stopped easily and started again at any time using the link at the bottom of each e-mail received for this purpose. Each provision and processing of data for purposes related to sending personalised marketing information (profiling) is based on a specific user's prior consent, who may then decide not to provide any data or later withdraw consent to such processing.
6. Data processing and storage methodsThe personal data provided to Unigrà will be processed in accordance with national and European regulations, including any provisions issued by the Control Authority (Italian Data Protection Authority) where applicable. The data processing operations will be carried out both manually and electronically, protecting confidentiality by means of appropriate technical and organisational security measures. Personal data will be stored for the period of time strictly necessary to achieve the purposes for which it was collected. Unigrà will keep the authentication credentials to the website's services active until the user decides to cancel the account. The data required for the execution of contractual relationships will also be retained after the cessation of commercial relationships, particularly as may be required to protect the interests of the Company from possible contractual responsibilities. After this period, the data will be deleted. The data may be stored for longer periods in order to fulfil legal obligations, according to applicable legislation. The personal data processed for marketing purposes, commercial information and/or profiling will be retained by Unigrà until the withdrawal of consent or receipt of a notice of objection to such processing. Once consent is revoked, Unigrà will not use the personal data for such purposes, but will eventually store it where it is used for different processing.
7. Recipients, communication and dissemination of dataThe personal data will be handled by personnel trained by Unigrà, having been assigned a specific role as data supervisor or processor/processing clerk, who have been given appropriate instructions and are committed to confidentiality. To ensure that all activities connected or instrumental to the provision of its services are conducted properly, Unigrà may, if necessary, share the personal data of users with some of its other Group companies. The personal information may be disclosed to third parties with whom Unigrà has ongoing contractual relationships involving services which are functional to performing its activities (such as, for example, couriers for product delivery, accounting firms, insurers, certifiers and consultants in the legal, tax, customs, financial, environmental, security fields, etc.). Notwithstanding the foregoing and communications carried out in fulfilment of legal obligations, personal data will not be disclosed to third parties or otherwise distributed. The data will be processed by Unigrà within the territories of the European Union and the European Economic Area. If for technical, organisational and/or operational reasons it becomes necessary to resort to parties located outside the European Union or the European Economic Area, Unigrà will ensure that the processing of data by these parties is carried out in accordance with applicable regulations and as provided for in articles 13 and 45 et seq. of the European Union General Data Protection Regulation no. 2016/679
8. Rights of data subjectsPursuant to art. 15 et seq. of the European Union General Data Protection Regulation no. 2016/679, data subjects have the right, at any time, to request from Unigrà:
• Correction: users can request to correct or supplement the data they have provided, if incomplete, inaccurate or outdated;
• Erasure: users can request that their data be deleted if it is no longer necessary for the processing purposes of Unigrà, in case of withdrawal of consent or opposition to the processing, in case of illegal processing, or if the data refers to minors under 14 years of age;
• Restriction of processing: users can request that their data be used only for the purpose of storage, with the exclusion of other processing, for the period necessary for the correction of the data, in cases of unlawful processing which they oppose, if they wish to exercise their rights in court, and the data stored by Unigrà could be useful and, finally, in the case when its processing has been opposed and a verification is in progress regarding the existence of legitimate reasons for Unigrà to process such data;
• Objection to processing: users can object to the processing of their data at any time, unless legitimate grounds for Unigrà to proceed with the processing prevail, for example for the exercise or defence of the company in court;
• Portability: users can request to receive their data, or to have it sent to another Data Controller indicated by them, in a structured format, commonly used and readable by an automatic device;
• Revocation: users may revoke their consent for marketing and profiling purposes and object to processing for the purpose of marketing information on similar products. Data subjects may revoke and request cessation of the sending of commercial information at any time by writing to the e-mail address indicated below or, if they receive communications through IT tools, by following the procedure indicated at the bottom of the aforementioned communications.
Furthermore, the data subjects are informed that they have the right to lodge a complaint with the Guarantor Authority for the Protection of Personal Data if they feel their rights have been violated by the Data Controller and/or a third party. To enforce the above rights or for further information, you can send a written request, indicating in the subject line "Privacy - exercise of Privacy rights", to the following e-mail address: firstname.lastname@example.org.