European Regulation 679/2016 (hereinafter, for the sake of simplicity, also referred to as the ‘Regulation’) on the protection of personal data provides for the protection of natural persons with regard to the processing of personal data.
In compliance with the aforementioned legislation, the processing of personal data covered by this privacy notice carried out by Cesari S.r.l. (hereinafter the ‘Data Controller’ or the ‘Company’) will be based on the principles of fairness, lawfulness, transparency, relevance, data minimization in relation to the purposes for which the data are collected, and the protection of your privacy and rights.
With regard to data processing, the Company hereby informs you of the following.
- PERSONAL DATA PROCESSED
The Data Controller processes personal data relating to Customers, Suppliers, and Users of the websites (www.umbertocesari.com, www.shop.umbertocesari.com, umbertocesariartcontest.com).
The Data Controller will not process special categories of personal data (as referred to in Articles 9 and 10 of the Regulation).
The data processed are listed below by category:
- common personal data such as first name, last name, place and date of birth, tax code (codice fiscale) or VAT number, residential address or registered office, email address, telephone number, bank details, and any data necessary for the fulfillment of tax, accounting, and contractual obligations;
- should the User wish to register for the restricted e-commerce area, the following additional personal data will be required: a password created by the Users themselves upon registration, or the password and username of Facebook, Twitter, or another social network, imported directly from said sites if registration takes place via social network, and any additional information that may be provided on an optional basis;
- should the User wish to join the Wine Club to benefit from specific services and promotions for purchasing products, their gender and further optional data necessary to participate in certain promotional initiatives will be required, as well as any additional information that may be provided on an optional basis;
- data collected through necessary, statistical, preference, and marketing cookies (which are collected and processed in accordance with the methods, purposes, and legal bases specified in more detail in the dedicated policy available on this website);
- browsing behavior and service usage data: information regarding email opens, pages visited, time spent on the website, links clicked, products viewed or added to the shopping cart, type of device used, and IP address (collected via tracking pixels contained within our email communications).
The Data Controller processes personal data through its delegates, internal or external data processors, and by employing its own personnel, who will operate in compliance with the instructions provided by the same pursuant to the Regulation.
Processing operations related to web services are handled exclusively by technical personnel in charge of processing, or by any persons entrusted with the maintenance of the websites.
- PLACE OF DATA PROCESSING
Processing operations are carried out at the registered office of the Company, or at the appointed external data processors.
3. PURPOSES – LEGAL BASES OF PROCESSING – CONSEQUENCES OF FAILURE TO PROVIDE DATA
Personal data are processed for the following purposes:
a) to provide the products and services covered by the contractual and pre-contractual relationships between Cesari S.r.l. and the Customer/Supplier, and to fulfill the accounting, tax, and legal obligations relating to the pre-contractual and contractual relationship with the Customer/Supplier.
The legal basis for the processing of personal data in relation to the aforementioned purpose is the performance of a contract, and the fulfillment of accounting, tax, and legal obligations relating to the pre-contractual and contractual relationship with the Customer/Supplier. For this activity, the data subject is free to provide the data necessary for the performance of the service or contract; failure to provide such data will make it impossible to proceed with the performance of the contractual relationship.
b) to manage the user’s registration on the e-commerce platform, manage the account and grant access to it, utilize the purchasing service, and manage the exercise of the right of withdrawal through the specific feature available on the website.
The legal basis for the processing of personal data in relation to the aforementioned purpose is the performance of a contract, and the fulfillment of accounting, tax, and legal obligations relating to the pre-contractual and contractual relationship with the Customer/Supplier. For this activity, the data subject is free to provide the data necessary for the performance of the service or contract; failure to provide such data will make it impossible to proceed with the purchase through the e-commerce website.
c) to issue and use the Wine Club card, provide access to promotions, and manage loyalty points programs in accordance with the procedures described in the relevant regulations, both with reference to physical points of sale and the e-commerce platform;
The legal basis for the processing of personal data in relation to the aforementioned purpose is the performance of the contract related to the issuance of the card. For this activity, the data subject is free to provide the data necessary for the performance of the service or contract; failure to provide such data will make it impossible to proceed with the issuance/renewal of the card and to benefit from the advantages connected to its use.
d) to make the website usable by enabling basic features such as page navigation and access to secure areas of the website. The website cannot function properly without these cookies (personal data automatically acquired during browsing).
The legal basis on which this processing is grounded is the performance of contractual and pre-contractual measures and the legitimate interest of the Data Controller to maintain a presence on the web.
e) to allow the website owner to understand how visitors interact with the website by collecting and transmitting information in an anonymous form (data relating to website access, time spent, pages read, referral methods…) in order to compile statistical reports and perform internal website analysis (statistical cookies). The legal basis for the processing of personal data in relation to the aforementioned purpose is the express consent of the data subject. Failure to provide consent or its subsequent withdrawal (to be carried out by clicking on the ‘cookie settings’ link in the footer at the bottom of the website page) will make it impossible for the Company to collect data for the purposes indicated above.
f) to send advertising information and/or commercial offers regarding the Company’s products, services, or promotional initiatives.The legal basis for the processing of personal data in relation to the aforementioned purpose is the express consent of the data subject provided upon subscribing to the newsletter. Failure to provide consent or a subsequent request to unsubscribe from the newsletter will make it impossible to receive future advertising and promotional material regarding our products, promotions, initiatives, and services;
g) To analyze your purchase data and consumption preferences in order to deliver targeted offers and personalize future content. This activity is also carried out through marketing cookies, tracking pixels, or small graphic elements embedded within our email communications, which allow us to detect message opening, reading time, and the device used.The legal basis for this purpose is the data subject’s consent (Art. 6, para. 1, lett. a) of the GDPR and Art. 122 of the Italian Privacy Code), freely expressed upon receiving the email, signing the hard copy registration form for the Wine Club, or selecting preferences via the cookie banner on the website (also accessible via the “Cookie Settings” link in the website footer).Failure to provide consent or its subsequent withdrawal (which may be carried out by clicking the preference management link at the bottom of each email, via the “Cookie Settings” link in the website footer, or by sending a communication to the address specified in section 8 of this privacy notice) will result in the impossibility of receiving future personalized communications based on the specific interests or needs of the Customer/User.
4. METHODS OF PROCESSING – RETENTION PERIOD
Data processing shall be carried out manually or, predominantly, with the aid of electronic means, and shall include—in compliance with the limits and conditions set forth in Articles 2, 3, and 4 of EU Regulation 2016/679—all operations, or sets of operations, defined under the term “processing” by the Regulation itself, with the exclusion of dissemination.The methods of processing personal data are described in the procedural documentation established by CESARI S.r.l. These methods entail the adoption of appropriate security measures to protect the confidentiality, integrity, and availability of data stored on IT systems or in hard copy format. Such measures have been assessed as adequate following an analysis of all risks—evaluated by taking into account the respective severity of consequences and likelihood of occurrence—affecting the processed personal data and the data subjects.
Personal data will be retained for the period necessary to fulfill the purposes indicated above, and specifically:
– to comply with all legal, tax, and administrative obligations, as well as to fulfill contractual commitments, for a period of ten years following the termination of any contractual relationship;
– for Wine Club Card holders, data will be retained until the end of the promotion as specified in the relevant Regulations, and for an additional 12 months starting from the last purchase, unless the user provides consent otherwise. If a user registered with the Wine Club does not make a purchase within 12 months, they will be automatically deleted;
– for the management of events and prize contests, the personal data collected will be retained for a maximum of 5 years from the conclusion of the initiative;
– data acquired through cookies will be retained for the periods specifically indicated in the relevant cookie policy.
Without prejudice to the foregoing, personal data shall be retained for any further period required to fulfill tax and accounting obligations and for the protection of the Company’s rights, including in connection with legal claims
5. PROCESSING METHODS – RETENTION PERIOD
The personal data collected may be disclosed to parties outside the Company for the purposes listed above, and specifically:
– in the event of an existing contractual relationship with a Customer or Supplier, the data necessary to fulfill legal obligations may be disclosed to tax and/or legal advisors, banks and insurance companies, IT support service providers, law firms, the Judicial Authority, and couriers responsible for deliveries, solely for purposes related to the management of the contractual relationship, compliance with a legal obligation, and the protection of corporate assets;
– to carry out activities related to data processing for marketing purposes, including user profiling, data may be transmitted to marketing and communication service providers, website management service providers, and third-party web service providers.
The entities to which personal data are disclosed will operate as Data Processors, autonomous Data Controllers, or persons authorized to process data. Under no circumstances will personal data be subject to dissemination.
In the event of a transfer to non-EU countries, the Company ensures that the Data Processor is contractually bound by the “Standard Contractual Clauses” (SCCs) approved by the European Union.
6. CONTACT DETAILS OF THE DATA CONTROLLER
The Data Controller is:
CESARI S.r.l.
Via Stanzano 1120, 40024 Castel San Pietro Terme (BO)
Tel. +39 051 6947811
Fax. +39 051 944387
e-mail: [email protected]
7. RIGHTS OF THE DATA SUBJECTS
Pursuant to Articles 15 to 22 of the GDPR, you are entitled, among others, to the following rights, which you may exercise by sending a communication to the address specified in section 8 of this privacy notice: a) right of access (Art. 15 GDPR); b) right to rectification (Art. 16 GDPR); c) right to erasure / right to be forgotten (Art. 17 GDPR); d) right to restriction of processing (Art. 18 GDPR); e) right to data portability (Art. 20 GDPR); f) right to object (Art. 21 GDPR); g) right not to be subject to automated decision-making (Art. 22 GDPR).
You may withdraw any consent previously provided for the processing of your data in the same manner.
Furthermore, it is possible to lodge a complaint regarding the processing of personal data with the National Supervisory Authority, namely the Italian Data Protection Authority (Garante per la Protezione dei Dati Personali – www.garanteprivacy.it).