PRIVACY POLICY

 We invite you, before transmitting any personal data, to carefully read this information drawn up pursuant to articles 13 et seq. of GDPR: it contains important information on the processing of your Personal Data. The data controller informs that he will process your personal data in compliance with the Privacy legislation and the principles of lawfulness, correctness, transparency, purpose limitation and conservation, data minimization, accuracy, integrity, confidentiality. 

Therefore, in relation to the above, the owner provides the following information. 

1. DATA CONTROLLER 

Poggio Torselli Srl – Via Scopeti, 10, 50026 San Casciano in Val di Pesa (FI), VAT number 04989060480 – Tax code 05719421009, Telephone: 055 829 0241, in the person of its legal representative. 

2. PURPOSE AND LEGAL BASIS OF THE TREATMENT 

Your personal data will be processed for the pursuit of the following purposes: 

a. Website navigation. Article 6, par. 1, lit. f and recital 47 of the GDPR: the processing is necessary for the pursuit of the legitimate interest of the data controller or of a third party, provided that the interests or fundamental rights and freedoms of the data subject who require the protection of personal data do not prevail, taking into account the reasonable expectations fed by the interested party based on his relationship with the data controller. Activities strictly necessary for the functioning of the website and for the provision of the navigation service on the platform, therefore, the provision is necessary. 

b. Contact request. Article 6, par. 1, lit. b GDPR: the processing is necessary for the execution of a contract of which the interested party is a party or for the execution of pre-contractual measures adopted at the request of the same. The provision of personal data necessary for the provision of the services requested by the interested party is necessary. Failure to provide data will make it impossible to obtain what is requested or to use the services of the data controller 

c. Organizational management of the contractual relationship, including payments and invoicing. Article 6, par. 1, lit. b GDPR: the execution of a contract to which the data subject himself is a party. 

d. Fulfill legal, accounting, administrative and tax obligations. Article 6, par. 1, lit. c GDPR: the fulfillment of legal obligations to which the owner is subject. 

e. For carrying out the Soft-spam activity. In the context of a purchase through the Website, to allow the direct offer by the Data Controller of products similar to those already purchased, provided that you do not object to this treatment in the manner provided for in this information. The legal basis of the processing is the legitimate interest of the Data Controller which can be considered equivalent to the interest of the interested party in receiving “soft-spam” communications pursuant to art. 130, paragraph 4, Legislative Decree 196/2003 and subsequent amendments 

f. Newsletter activity. Article 6, par. 1, lit. a and recital 47 of the GDPR: the interested party has given his consent to the processing of his personal data. Consent revocable at any time (without prejudice to the treatment carried out up to the intervention of such revocation). The provision is optional and does not preclude processing for other purposes. 

g. Marketing activity. Article 6, par. 1, lit. a and recital 47 of the GDPR: the interested party has given his consent to the processing of his personal data. Consent revocable at any time (without prejudice to the treatment carried out up to the intervention of such revocation). The provision is optional and does not preclude processing for other purposes. 

3. RECIPIENTS OF PERSONAL DATA 

The personal data processed will not be disclosed to third parties. They may become aware of your data, in relation to the processing purposes set out above: a) subjects who can access the data under the provisions of the law provided for by the law of the European Union or that of the Member State to which the data controller is subject; b) the subjects appointed by the owner as authorized for processing pursuant to the article 29 GDPR; c) the subjects who process data on behalf of the owner who have been appointed, by contract or other legal act, as data controllers, article 28 GDPR. 

4. PERIOD OF STORAGE OF PERSONAL DATA 

Your personal data will be kept for the period necessary to pursue the purposes relating to the named point “PURPOSE OF THE TREATMENT”. Specifically, they will be processed for a period of time equal to the minimum necessary pursuant to Recital 39 of the GDPR, without prejudice to a further retention period that may be imposed by law pursuant to Recital 65 of the GDPR.. 

5. TRANSFER OF PERSONAL DATA 

The management and storage of personal data will take place on servers located within the European Union and, therefore, your personal data will not be transferred to non-EU countries. However, should it be necessary to move the location of the servers, the owner ensures that the transfer of data outside the EU will take place in compliance with the provisions of the law and stipulating, if necessary, agreements that guarantee an adequate level of protection and / or adopting the standard contractual clauses provided by the European Commission. 

6. NATURE OF THE PROVISION 

The provision of personal data necessary for the purpose of providing the services requested by the interested party is necessary and failure to provide it will make it impossible to activate the requested services. With regard to the personal data that the data controller is obliged to know in order to fulfill the obligations established by laws, regulations and community legislation, or by provisions issued by Authorities and by supervisory and control bodies, failure to provide it makes it impossible to establish or continue the relationship, to the extent that such data are necessary for the execution of the same. 

7. RIGHTS OF THE INTERESTED PARTY 

You, or a person delegated in writing, can exercise the following rights: a) the right of access – article 15 of EU Reg. 2016/679; b) the right of rectification – article 16 of EU Reg. 2016/679; c) i the right to be forgotten – Article 17 of EU Reg. 2016/679; d) the right to limitation of processing – article 18 of EU Reg. 2016/679; e) the right to request certification that the operations carried out pursuant to articles 16, 17 and 18 of EU Reg. 2016/679 have been brought to the attention, also as regards their content, of those to whom the data have been communicated or widespread, except in the case in which this fulfillment proves impossible or involves the use of means manifestly disproportionate to the protected right; f) the right to data portability – article 20 of EU Reg. 2016/679; g) the right to object to the processing of personal data – article 21 of EU Reg. 2016/679; h) the right to withdraw consent at any time – Article 7 of EU Reg. 2016/679; i) the right to lodge a complaint – Article 77 GDPR; l) the right to lodge a judicial remedy – Article 79 GDPR. 

The list of data processors is available at the headquarters of the owner and the interested party can request it from one of the contacts in point 1 of the information called “DATA CONTROLLER”. 

In addition, the data controller remains available for any clarification needs and, in the event that the processing should be modified with respect to that described in this document, the data controller will provide updated information.