Unigrà S.r.l. (hereinafter “Unigrà”) hereby would like to inform visitors to the website that it provides for the protection of personal data in compliance with Italian national legislation and in accordance with the EU General Data Protection Regulation No. 2016/679.
1. Modalities of acquisition and types of data processedThe website offers information and sometimes interactive content. During navigation of the site, we may acquire information about the visitor in the following ways:
1.2. Website traffic data - The IT systems and software procedures provided to operate this web site acquire, during their normal operation, certain personal data which are implicitly transmitted when using the Internet communication protocols. The IP addresses or the domain names of the computers used by the users who connect to the site, the URI (Uniform Resource Identifier) notation addresses of the resources requested, the time of the request, the method used for submitting the request to the server, the size of the file received in response, the numeric code indicating the status of the response given by the server (successful, error, etc.) and other parameters relative to the operating system and the IT environment of the user come under this category. Those data will solely be used to obtain anonymous statistical information on the use of the website and to check it is functioning properly, and will be stored for periods in accordance with the relevant legislation. This information may be used to determine liability in case of cyber-crimes against Unigrà or any perpetrated through the use of the website.
1.3. Data provided voluntarily by the visitor - These are all personal data, additional to registration data, which the visitor freely releases, for example, in order to complete registration to a reserved area, to request information about a particular product or service via a form, to write to an email address or to call a toll-free number for direct contact with customer service. Where applicable, this information may be used for the purposes of profiling the user. Where this happens, we will send the appropriate communication and obtain your freely-given and specific consent for marketing and/or profiling purposes in accordance with the techniques provided for in current privacy legislation (initially in the process of collecting consent based on opt-in and then, in the case of any refusal of consent, based on opt-out).
2. Purposes of processingPersonal data provided by users are processed for the following purposes:
- enable the carrying out of transactions relating to the services requested by the users and to relationship management with them, and also to facilitate access to password protected areas of the website;
- facilitate the performance of contractual duties and the proper management of pre-contractual relationships;
- to acquire anonymous statistical information on the use of the website and to check its correct operation;
- fulfill the duties imposed by law, including accounting and tax;
- by prior consent, engage in activities of providing information on Unigrà's products and/or services, initiatives and promotions, market research, surveys and in general marketing activities — such as updates on the website, recipes, dietary and nutritional features, events and competitions, etc. — also by means of the use of automated systems without the intervention of the operator (e.g. postal service, e-mail or SMS);
- on the basis of the legitimate interest of the Data Controller, if and in so far as different interests, rights or freedoms of the data subject do not override them, engage in activities of promotional information by means of e-mail concerning categories of products and/or services and/or events similar or in any case belonging to the same type as those previously purchased by our company;
- by prior consent, engage in personalized information activities (profiling) by processing of data provided by users, creating groups divided by categories of interest, with the aim of originating commercial communications of the greatest interest and as little invasive as possible.
5. Legal basis of processing and obligatory/optional provision of dataThe provision of data is mandatory for contractual and service-provision purposes, and for the discharge of legal duties, since the processing concerned is directly instrumental to the management of the contractual relationship between the parties, the provision of the requested service, and compliance with the law. In their absence, there may be no commercial relationship with the data subject and Unigrà cannot guarantee the registration to the website or the services provided by it. The provision of data for marketing purposes is entirely optional, since this processing is based on the consent of users, who may therefore decide not to provide any data or to withdraw consent thereafter. In this case, they will not be able to receive any communications about our events, products and services, but they will continue to be entitled to registration on the website and the services offered by it. No prior consent is required for the activities of providing sales information based on the legitimate interest of Unigrà to send users/customers communications via e-mail regarding types of services and/or products similar to those previously purchased by them, with the intent to maintain and develop their business activities; however, the receipt of these communications may be terminated easily and at any time by using the link at the bottom of each of the emails received for this purpose. Every provision and processing of data for purposes related to personalized sales information (profiling) is based on a specific prior consent of the user, who may, therefore, decide not to confer any data or subsequently withdraw his consent to such processing.
6. Modalities of data processing and storagePersonal data provided to Unigrà will be processed in accordance with national and European regulations, including any measures issued by the Italian Supervisory Authority (Autorità Garante per la Protezione dei Dati Personali) where applicable. Data processing operations will be carried out both manually and electronically and will protect confidentiality through appropriate technical and organizational security measures. Personal data are stored only for as long as strictly necessary to achieve the purposes for which they have been collected. Unigrà will keep website services authentication credentials active until the user decides to delete their account. The data necessary to allow the performance of the contractual relationship may be retained even after the termination of the commercial relationship, specifically in so far as it may be necessary in order to protect the interests of the Company from possible contractual liability. At the end of this period the data will be deleted. In order to comply with legal requirements, the data may be stored for longer periods in accordance with applicable legislation. Personal data processed for marketing, sales information and/or profiling purposes will be kept by Unigrà until the withdrawal of the consent given or the communication of objection to such processing. Once your consent has been withdrawn, Unigrà will no longer use your personal data for these purposes, but may, if necessary, retain it when used in different processing.
7. Recipients, disclosure and dissemination of dataYour personal data will be processed by personnel who have been trained by Unigrà and to whom the specific role of data manager or processor has been assigned and appropriate instructions are given, and who have bound themselves to confidentiality. To ensure the proper performance of all activities connected or instrumental to the provision of its services, Unigrà may, where necessary, disclose the personal data of users to other companies of the own Group. Personal data may be disclosed to third parties with whom Unigrà has ongoing contractual relations concerning services instrumental to the performance of its activities (such as, for instance, carriers for the delivery of products, auditors, insurers, certification bodies and consultancies specialising in law, tax, customs, finance, environmental issues, security etc.). Without prejudice to the foregoing and without prejudice to disclosures made in compliance with legal duties, personal data will not be disclosed to third parties or otherwise disclosed. The data will be processed by Unigrà within the territory of the European Union and the European Economic Area. If for technical, organisational and/or operational reasons it is necessary to use entities located outside the European Union or the European Economic Area, Unigrà will ensure that the processing of data by these persons is carried out in compliance with applicable legislation, in accordance with the provisions of articles 13 and 45 et seq. of the UE General Data Protection Regulation No. 2016/679.
8. Rights of data subjectsThe persons to whom the personal data refer have the right at any time to ask Unigrà, pursuant to articles 15 et seq. of the UE General Data Protection Regulation No. 2016/679, for:
• Access: they may request confirmation whether or not processing of data concerning them is taking place, and also for further clarifications regarding the information referred to in this policy;
• Rectification: they may make a request to rectify or supplement the data they have provided, if incomplete, inaccurate or outdated;
• Erasure: they may request that their data be deleted, if they are no longer necessary for the purposes of the processing of Unigrà, in case of withdrawal of consent or objection to processing, in case of unlawful processing, or where there is a legal duty of erasure, or where the data refer to persons under the age of 14;
• Restriction: they may request that their data be processed only for the purposes of storage, with the exclusion of other processing, for the period necessary to rectify the data, in case of unlawful processing for which object, if they have to exercise their rights in court and the data stored by Unigrà may be useful to them and, finally, in the event of objection to the processing and is ongoing a verification whether Unigrà's legitimate reasons override theirs;
• Objection: they may object at any time to the processing of their data, unless there are legitimate reasons for Unigrà to proceed with the processing that override their own reasons, for example for legal action or the defence of the company in court;
• Portability: they may request that they receive their data or have them transmitted to another data controller indicated by them in a structured, commonly-used, and machine-readable format.
• Withdraw consent for marketing and profiling purposes and object to processing for the purpose of sales information on similar products: data subjects may withdraw from or have the sending of sales information terminated at any time by writing to the e-mail address below or, in the case of communications received by means of computer systems, by following the procedure set out at the bottom of the communication.
Furthermore, data subjects are informed that they have the right to lodge a complaint with the Italian Supervisory Authority (Autorità Garante per la Protezione dei Dati Personali) in the event they believe that their rights have been infringed by the Data Controller and/or a third party. To exercise the above rights or to obtain further information, you may send a written request, writing in the subject line “Privacy — Exercise of privacy rights”, to the following e-mail address: firstname.lastname@example.org.