PRIVACY POLICY
INFORMATION REGARDING THE PROCESSING OF PERSONAL DATA OF USERS AND IN THE CONTEXT OF CONTRACTS WITH CUSTOMERS IN ACCORDANCE WITH ART. 13 OF REGULATION (EU) 2016/679 (“GDPR”)
1) HOLDER OF THE TREATMENT
Caffitaly System S.p.A.
Via Panigali 38, Gaggio Montano (BO);
Telephone number: 053438911.
E-mail: privacy@caffitaly.com
ZIP code: 40041
Hereinafter referred to as: “Company”.
2) PERSONAL DATA PROCESSED and DATA SOURCE
“Data” means common data relating to natural persons (including, by way of example, name, surname, date of birth, gender, social security number, address, contact details and bank details.) Which are processed by the Company for the stipulation and execution of the contractual relationship with its customers (“Customers”) and for the other purposes indicated in this information. In addition to Customer data, data of other natural persons indicated by the Customers themselves as third parties unrelated to the contractual relationship but recipients of the delivery and shipping service may also be collected.
These data are in any case collected directly from the Customer.
3) TREATMENT
PURPOSE OF THE TREATMENT | LEGAL BASIS OF THE PROCESSING | DATA RETENTION PERIOD |
Purposes related to the provision of the services offered by the Company following registration on the website www.caffitaly.it, including, by way of example: the ability to make purchases in the online store, management of the user profile, use of the area dedicated to purchases already made and assistance in the purchase procedure. | The Company will process the Customer’s personal data to provide its pre-contractual services made available to the user following registration on the website. | Customer data will be kept for the entire duration of the service and up to 10 years from the closure of the online profile. |
Purposes related to the correct execution of the contractual relationship between the Customer and the Company, including by way of example: management of requests and / or purchase orders, home delivery of products purchased online, management of customer assistance , complaints and commercial offer. | The Company will process the personal data of the Client to the extent that this is necessary to execute the contract of which the Client is a party or to execute the pre-contractual measures adopted at the request of the same. | Contractual duration and, after termination, the ordinary limitation period of 10 years. In the event of a dispute, your data may be processed for the entire duration of the same, until the deadlines for appeals are exhausted. |
Purposes related to the fulfillment of administrative and accounting obligations – such as the management of accounting, treasury, planning and control as well as invoicing (for example, verification and registration of invoices), in accordance with the requirements of current legislation. | The Company will also process your personal data where this is necessary to fulfill the legal obligations to which the Company is subject in compliance with national and international regulations. | These data will be kept for 10 years following the fulfillment of the legal obligation. |
If necessary, to ascertain, exercise or defend the rights of the Data Controller in court, including credit recovery. | Legitimate interest | In the case of judicial litigation, for the entire duration of the same, until the terms of enforceability of appeals. |
Purposes related to the control of logical accesses to company information systems, in order to guarantee the safety of people and property (for example log management, management of system administrator logs); | Legitimate interest | 5 years from the moment the logical access was detected
|
Purposes related to marketing activities pursued through: – in the sending of promotional messages, through traditional forms of contact (such as telephone calls with an operator and traditional mail) and automated (such as e-mail, SMS, MMS, chat, instant messaging, social networks and other mass messaging tools) in relation to Caffitaly System Spa products and services; – invitation to press events and / or prize events through automated contact methods (e-mail, sms or mms) and traditional methods (such as telephone calls with operator and traditional mail); – detection of the degree of customer satisfaction through market surveys and statistical analyzes. | Client’s consent (optional and revocable at any time) | Until withdrawal of consent. |
Once the retention terms indicated above have elapsed, the Data will be destroyed or made anonymous, compatibly with the technical cancellation and backup procedures. | ||
4) PROVISION OF DATA
The provision of data highlighted with an asterisk (*) in the registration form is necessary for the conclusion of the contract and / or for its execution. The refusal to provide the Data may therefore not allow the contractual relationship to be correctly established and / or to fulfill the consequent obligations.
5) RECIPIENTS OF THE DATA
The Data may be disclosed to external parties operating as data controllers including, by way of example:
– administrative authorities and supervisory and control institutions;
– certification institutions;
– banks and credit institutions;
– auditing and analysis company;
– Payback;
– Paypal;
– legal studies;
– auditing firm;
– in general, subjects, public or private, entitled to request the Data.
The Data may be processed, on behalf of the owner, by external subjects designated as data processors, who carry out specific activities on behalf of the owner, including, by way of example:
– companies that offer e-mail marketing services;
– assistance and customer service centers;
– companies that offer management and maintenance services for the information systems and software used;
– companies or professional firms that offer legal, tax, commercial, insurance and technical assistance consultancy services;
– logistics and transport company;
– events organization company
5) SUBJECTS AUTHORIZED FOR PROCESSING AND PROCESSING METHODS
Your data will be processed in an automated manner and may be processed by employees of the corporate functions responsible for pursuing the aforementioned purposes, who have been expressly authorized to process them and who have received adequate operating instructions.
6) TRANSFER OF PERSONAL DATA TO COUNTRIES NOT BELONGING TO THE EUROPEAN UNION
It is not the Company’s intention to transfer Personal Data abroad, however, in order to execute the specific requests made by the interested parties themselves, in execution of the stipulated contractual relationship, the data could be transferred to countries outside the EU, and in particular:
– In Canada and Australia, whose data protection level was deemed adequate by the European Commission pursuant to art. 45 of the GDPR “
-In Indonesia and Brazil, in the presence of the derogation pursuant to art. 49 par. 1 letter B) of the GDPR., As the transfer is necessary for the execution of a contract concluded between the interested party and the data controller or for the execution of pre-contractual measures adopted at the request of the interested party;
7) RIGHTS OF THE INTERESTED PARTY – COMPLAINT TO THE SUPERVISORY AUTHORITY
By contacting the office at the e-mail address privacy@caffitaly.com, the interested party can ask the Company to access the data concerning him, their cancellation, the correction of inaccurate data, the integration of incomplete data, the cancellation of the Data, the limitation of processing in the cases provided for by art. 18 GDPR, as well as to oppose, for reasons connected to one’s particular situation, to the processing carried out for the legitimate interest of the owner.
Furthermore, in the event that the processing is based on consent or on the contract and is carried out with automated tools, the interested party has the right to receive the Data in a structured format, commonly used and readable by automatic device, as well as, if technically feasible, to transmit them to another holder without impediments.
The interested party has the right to lodge a complaint with the competent supervisory authority in the Member State in which he habitually resides or works or in the State in which the alleged violation has occurred.
The interested party has the right to revoke the consent given at any time for marketing purposes and to oppose the processing of the data processed for the same purposes. The possibility remains for the interested party who prefers to be contacted for the aforementioned purpose exclusively through traditional methods to express their opposition only to the receipt of communications through automated methods.