PRIVACY POLICY GINARTE – 2024 Version
Before transmitting any personal data, we invite you to carefully read this Information Notice drafted pursuant to Articles 13 and following of the EU Regulation 2016/679 (hereinafter also GDPR). It contains important information about the processing of your personal data. The data controller informs you that your personal data will be processed in compliance with Privacy regulations and principles of lawfulness, fairness, transparency, purpose limitation, storage limitation, data minimization, accuracy, integrity, and confidentiality. Therefore, in relation to the above, the data controller provides the following information.

 

1. DATA CONTROLLER
The data controller is Ginarte S.r.l., headquartered at Via degli Artigiani snc – Loc, 50022 Panzano In Chianti FI, VAT number 10298070961, Tel. 055852593, represented by its legal representative.

 

2. PURPOSES, LEGAL BASIS OF THE PROCESSING, AND NATURE OF THE PROVISION
Your personal data will be processed for the following purposes:

2.1 Website Navigation.
The processing is necessary for the pursuit of the legitimate interest of the data controller or third parties, provided that the interests or fundamental rights and freedoms of the data subject that require the protection of personal data do not prevail (Art. 6, 1, letter f GDPR and Recital 47), considering the reasonable expectations of the data subject based on their relationship with the data controller. The provision of data is necessary, and failure to provide it will result in the inability to obtain what is requested or to use the services of the data controller.

2.2 Contact Request.
The legal basis is the execution of a contract of which the data subject is a party or the execution of pre-contractual measures adopted at the request of the same (Art. 6, 1, letter b GDPR). The provision of personal data necessary for the provision of services requested by the data subject is necessary. Failure to provide the data will result in the inability to obtain what is requested or to use the services of the data controller.

2.3 Soft-spam.
In the context of a purchase, to allow the direct offer by the data controller of products similar to those already purchased, provided that you do not object to such processing in the manner provided by this information notice. The legal basis for the processing is the legitimate interest of the data controller, which can be considered equivalent to the data subject’s interest in receiving “soft-spam” communications pursuant to Art. 130, 4, Legislative Decree 196/2003 and subsequent amendments. The provision of personal data is optional and does not preclude processing for other purposes.

2.4 Newsletter.
The data subject has given consent to the processing of their personal data (Art. 6, 1, letter a GDPR). Consent can be revoked at any time (without prejudice to the processing carried out until the intervention of such revocation). The provision of personal data is optional and does not preclude processing for other purposes.

2.5 Organizational Management of the Contractual Relationship, including Payments and Invoicing.
The execution of a contract of which the data subject is a party (Art. 6, 1, letter b GDPR). The provision of data is necessary, and failure to provide it will result in the inability to obtain what is requested or to use the services of the data controller.

2.6 Fulfill Legal, Accounting, Administrative, and Fiscal Obligations.
The fulfillment of legal obligations to which the data controller is subject (Art. 6, 1, letter c GDPR). The provision of data is necessary, and failure to provide it will result in the inability to obtain what is requested or to use the services of the data controller.

 

3. DATA RECIPIENTS
The personal data processed by the data controller will not be disclosed. However, they may become known to the following categories of recipients: a) subjects who may access the data by virtue of legal provisions of national law of the State to which the data controller belongs and by Community law; b) those authorized to process data duly appointed pursuant to Art. 29 GDPR and Art. 2-quaterdecies Legislative Decree 196/2003 and subsequent amendments; c) subjects who process data on behalf of the data controller who have been appointed, through contract or other legal act, as data processors pursuant to Art. 28 GDPR.

 

4. DATA TRANSFER
The management and storage of personal data will take place on servers located within the European Union of the data controller and/or third-party companies duly appointed as data processors. The data will not be transferred outside the European Union. However, the data controller, if necessary, will have the right to move the server’s location to Italy and/or the European Union and/or non-EU countries. In such a case, the data controller ensures that the transfer of data outside the EU will take place in accordance with applicable legal provisions by stipulating, if necessary, agreements that guarantee an adequate level of protection and/or adopting the standard contractual clauses provided by the European Commission.

 

5. DATA RETENTION
Personal data will be processed by the data controller only for as long as necessary for the purposes for which they were collected. Specifically, your data will be retained until you revoke your consent. In particular, personal data will be processed for a period of time equal to the minimum necessary, as indicated by Recital 39 GDPR, without prejudice to any further retention period that may be imposed by legal provisions, as also provided by Recital 65 GDPR.

 

6. RIGHTS OF THE DATA SUBJECT, COMPLAINT, JUDICIAL REMEDY
The data subject, or a person authorized, can exercise the following rights: a) the right of access – Art. 15 GDPR; b) the right to rectification as provided by Art. 16 GDPR; c) the right to erasure according to Art. 17 of the EU Regulation 2016/679; d) the right to restriction of processing when one of the cases provided by Art. 18 of the EU Regulation 2016/679 occurs; e) the right to request certification that the operations performed under Articles 16, 17, and 18 GDPR have been brought to the attention of those to whom the data have been communicated or disclosed, except where this proves impossible or involves a disproportionate effort compared to the protected right; f) the right to data portability as provided by Art. 20 GDPR; g) the right to object to the processing of personal data pursuant to Art. 21 GDPR; h) the right to withdraw consent at any time, as established by Art. 7 GDPR; i) the right to lodge a complaint with a supervisory authority, pursuant to Art. 77 of the EU Regulation 2016/679; l) the right to an effective judicial remedy pursuant to Art. 79 GDPR. Should you wish to exercise your rights, you may contact the data controller at the contact points indicated in this information notice drafted pursuant to current Privacy regulations. Additionally, the list of data processors is available at the data controller’s headquarters, and you can request it through any of the contacts provided in section 1 of the information notice titled “DATA CONTROLLER.” The data controller remains available for any clarification needs, and should the processing be modified compared to what is described in this document, the data controller will provide an updated information notice.

 

Last modified: March 2024