Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation)


This document (“Policy”) aims at providing indications about the treatment of pieces of information You will make available to the Company, as specified below. This pieces of information shall be treated from the Company and/or third parties for the objectives specified below. The Policy is provided pursuant to the Regulation (EU) 2016/679 (“GDPR”) and subsequent adaptive national regulations (“Applicable Law”)

  1. Identity and contact information of the Data Controller

The Data Controller,  pursuant to art. 4 and 24 of the GDPR, is CUSCIANO SRLS, legal address VIALE DUCA DEGLI ABRUZZI 145, MONTORIO AL VOMANO (TE), ITALY. P.IVA: 02050880679, Tel. +39324 541 3221, EMAIL regaltruffle@pec.it,  in the person of its temporary legal representative (“Data Collector”).

  1. Contact information of the Data Protection Manager (“RPD-DPO”)

The Data Collector doesn’t perform activities which imply the appointment of a Data Protector manager.

  1. Purpose and legal basis fordata processing

Personal data collected shall be treated for the following purpose and legal basis for data processing:

 

Purpose Legal basis for data processing
3, a) management of customer contractual and pre-contractual relationships (for instance, administration elaboration, invoicing or shipment). In this case, You are free to provide your persona data, although failure to provide the data shall make it impossible the build a relationship and supply the service. The processing is necessary for entering into a contract, which you are part of, and it is necessary to comply with a legal obligation to which the Data Controller is subject.
3, b) after your explicit consent, which can be withdrew at any moment, to send promotional communication regarding the Data Controller and communication about the trade of products promoted by the Data controller (hereinafter “marketing purpose”) Your consent

 

 

  1. Nature of personal data collected

Within the limits of the purpose and methods described in this Report, pieces of information considered to be “Personal Data” shall be treated, namely, personal information, contacts (for instance, phone numbers, address, e-mail address, etc…).

 

  1. Recipients and categories of recipients

Personal Data shall not be disclosed, meaning that the information shall not be disseminated in any way to unspecified individuals. They  could be object of communication to well defined individuals, in total compliance with the regulation, for the above mentioned purpose. Any access to your Personal Data is limited to the individuals authorized by the Data Controller. Any communication to the individuals, only when involved in and functional to achieve the purposes referred to in paragraph 3 herein, thus data collected and processed could be:

  1. used anonymously for statistical purpose;
  2. made available to the Data Controller’s Collaborators, such as Data Protection Officers or persons authorized to process personal data;
  3. communicated to third parties, individuals or companies, public administrations, professionals, law enforcement agencies, government agencies, regulatory bodies, courts or other public authorities authorized by the law;
  4. Individuals that provide services for the management of information and communication system, included: e-mail, newsletter and websites;
  5. Studies and societies in the ambit of assistance andconsultancy;
  6. if necessary,transferred to another Data Controller in accordance with the provisions of the GDPR, including with regard to the right to data portability

 

Informations may also be transmitted any time there is a requests made by legal authorities or those responsible for public safety have to be fulfilled. Data collected shall not be disclosed in any case.

 

The list of those responsible for processing of personal data is available at the legal address of the Data Controller.

 

  1. Transfer of data abroad.

Data shall not be transferred outside the European Union.

 

  1. Retention period of data (criteria for determining)

Below you will find a table containing the retention period of Personal Data (criteria for determining).

Purpose Retention Period
3, a) contact management Data shall be treated for the entire duration of the contract and afterwards for commercial purposes, in strict respect of legal obligations, for 10 (ten) years.
3, b) marketing purpose 10 (ten) years from the data collections, with the possibility to modify and/or cancel your shall any time

 

 

  1. Methods of Data Processing

The processing shall be carried out by means of manual and/or IT and electronic instruments, according to the rules of security and confidentiality prescribed by law. There is no automated decision-making process.

 

Where it is necessary to contact you for various needs of the management of your situation, in case you do agree to the treatment of your personal data for the purpose referred to in point 3, lett. b), you could be contacted by e-mail, newsletter, sms, IMS or any other similar electronic tool or by traditional mail, telephone operator at all the contacts given.

 

  1. Rights granted

You shall be able to exercise his/her rights under the Applicable Law, for instance the right to:

  1. Access your Personal Data and acknowledge the origin, purpose, and aims of the treatment, data of the individuals to which data are transmitted, retention period and criteria for determining (art.15).
  2. Request the correction (art. 16)
  3. Cancel them in case they are not necessary anymore, incomplete, wrong or collected in violation of the law(art. 17)
  4. Request that the treatment is limited to a part of the information collected
  5. When technically possible, to receive or transmit to you or third parties, from you designated, your personal data (“Portability”) or those you voluntarily provided (art. 20)
  6. make an opposition to their processing for legitimate reasons (art. 21)
  7. Withdraw his or her consent at any time, in the event it is the basis for data processing.

 

The above mentioned rights shall be exercised by means of a written request addressed to the Data Collector to the contacts referred to in point 1.

 

The Data Collector shall proceed in this way without any delay within one month of the receipt of the request. The deadline shall be extended by 2 months, if necessary, considering the complexity and amount of requests received from the Data Collector. In this event, the Data Collector shall inform you of the reasons of the extension, within a month of receipt of your request.

 

We all remember you that, in case the feedback to your requests was not satisfying, you have the right to lodge a complaint with the Italian Data Protection Authority (http://www.garanteprivacy.it/) in accordance with the procedure prescribed by the Applicable Law.