STATEMENT PURSUANT TO ARTICLE 13 OF EU REGULATION 2016/679
SAMMONTANA S.p.A. Società Benefit (hereinafter also referred to as “Sammontana” or the “Company”) values and respects your privacy. Sammontana invites you to carefully read this privacy statement (hereinafter the “Privacy Policy”), drawn up in accordance with Article 13 of EU Regulation 2016/679 (hereinafter simply referred to as the “Regulation” or “GDPR”), which outlines Sammontana's policy with regard to the processing of personal data collected while you navigate the website http://www.sammontanaitalia.it (hereinafter the “Website”).
We inform you in advance that your personal data will be processed in accordance with the national and European privacy legislation currently in force and in keeping with the principles of fairness, lawfulness, transparency and protection of your privacy and rights.
Table of contents
1. Data Controller
2. Types of personal data processed
3. Purposes and methods of data processing
4. Legal basis for processing personal data
5. Recipients/categories of recipients of personal data
6. Data collection and consequences of withholding data
7. Withdrawal of consent
8. Data retention period
9. Rights of Data Subjects
10. Filing a complaint with the Personal Data Protection Authority
11. Personal Data of minors
12. Updates and amendments
13. Links to other websites
14. Co-processing of statistical data with Meta
1. Data Controller
Data Controller is SAMMONTANA S.p.A. Società Benefit, headquartered in Via Tosco Romagnola n. 56, 50053 Empoli (FI), telephone: 0571 7076, Fax n. 0571 707447, E-mail: privacy@sammontana.it, certified e-mail: sammontana@legalmail.it
2. Types of personal data processed
Sammontana collects and processes personal data (hereinafter collectively referred to as “Personal Data” or simply “Data”) relating to users (hereinafter the “User” or “Users”) and, more specifically:
- Navigation data: information systems and software procedures used to operate the Website collect personal data as part of their standard functioning: the transmission of those data is an inherent feature of Internet communication protocols.
Such information is not collected in order to be associated with identified data subjects; however, because of its very nature, it might allow user identification after being processed and matched to data held by third parties. This category of data includes, among other things, the IP addresses or computer domain names used by Users who connect to the Website, the URI (Uniform Resource Identifier) addresses of requested resources, the time of the request, the method used to submit the request to the server, the size of the file obtained in reply, the numerical code indicating the status of the server response (successfully performed, error, etc.) and other parameters associated with the User's operating system and computer environment.
These data are not intended to be disclosed and are only used to obtain anonymous statistical information on Website usage and to check the Website's proper functioning. They are retained for the time required in accordance with applicable legislation. These data might be used to establish liability in case of alleged computer crimes committed against the Website.
- Data provided voluntarily by Users when filling out online forms: personal identification data and contact details, for example email, first name, last name, address, Zip Code, town, province, telephone number, e-mail address.
- Cookies: this Website uses automatic data collection systems that acquire data, such as cookies, which are not directly provided by the User. A cookie is a small text file, a reminder of the Internet page visited: it contains small bits of information that can be recorded on the User's computer when the browser calls up a particular website. In this way, the website can automatically adapt to the User, for example by sending content in a format compatible with the browser used or with specific display settings (style, colour, etc.).
Depending on their characteristics and functions, different types of cookies can be stored on a computer for varying periods of time.
This Website uses the following types of cookies:
- necessary technical cookies - they are used for the sole purpose of carrying out the transmission of an electronic communication, ensuring the proper display of the website and facilitating navigation within it, or to provide services explicitly requested by the User.
- analytics cookies - they are used to collect anonymous statistical information on the use of the website in order to make a statistical analysis of traffic (access and visits to the site) and optimize its functioning;
- profiling cookies - they are used to trace specific actions or recurring behavioural patterns in the use of the available functionalities (patterns) back to specific, identified or identifiable individuals for the purpose of grouping the different profiles within homogeneous, multi-sized clusters; the aim is to enable the Controller to send targeted advertising messages, i.e. messages that reflect the preferences expressed by Users in the context of their web-browsing activities.
Cookies can also be classified according to their origin:
- first-party cookies, i.e. cookies directly generated and managed by the administrator of the website that the User is visiting;
- third-party cookies, i.e. cookies generated and managed by entities different from the administrator of the website that the User is visiting.
Please refer to the “Cookie policy” for further details.
3. Purposes and methods of data processing
The Personal Data voluntarily provided by the User by filling in the "Contact us" form on the Site are collected and processed to contact you back and/or to receive a reply to the message sent to Sammontana.
Personal Data will be processed by the Data Controller, Data Processors and persons in charge of the processing ("Authorized Persons" or "Persons in Charge"); they will observe all appropriate measures to ensure their security and confidentiality, by means of paper-based or computer-based tools, in accordance with the principles of the law, protecting the confidentiality of the data subjects and their rights by adopting appropriate technical and organizational measures to ensure a level of security appropriate to the risk.
4. Legal basis for processing personal data
The legal basis for processing personal data for the purposes set out in section 3 is consent freely given by the data subjects pursuant to Article 6, paragraph 1, letter a) of the Regulation.
5. Recipients/Categories of Recipients of Personal Data
Your Personal Data may be communicated, exclusively for the above-mentioned purposes, to the following categories of recipients:
- individuals, companies, associations or professional firms which provide assistance and consulting services to our Company, typically, but not exclusively, in the areas of accounting, administration, legal, tax and financial matters; internet service providers, providers of cloud or IT services, Website administrators, who need to access your Data for purposes related to your request to be contacted by Sammontana, and all attendant activities, to the extent strictly necessary for the performance of their duties;
- subsidiary companies, companies within the same corporate Group to which the Company belongs;
- individuals whose right to access your Data is recognized under applicable laws and regulations;
- public and private entities that manage ordinary and commercial mail delivery services;
- other individuals who may become aware of your Personal Data, such as members of our staff involved in the operations performed to fulfil your contact requests.
These individuals/entities shall act as Authorized Persons, Autonomous data controllers or Data Processors within the meaning of Article 28 of the EU Regulation. These individuals or entities, which Sammontana relies upon to carry out its activities, provide suitable guarantees of compliance with the personal data processing regulations in force.
Your Personal Data will not be transferred to countries outside the EU.
Your Personal Data will in no case be disclosed.
6. Data collection and consequences of withholding data
The input of Personal Data marked with an asterisk (*) in the “Contact Us” form on the Website is not mandatory but necessary to achieve the purposes stated in section 3. The only consequence deriving from your withholding any of these data is the impossibility of being contacted by the Data Processor and/or of receiving a reply to your message.
The input of Personal Data not marked with an asterisk (*) in the registration form is optional. If you choose not to provide such data, there will be no consequences.
7. Withdrawal of consent
You may at any time withdraw your consent previously provided to us for the purposes stated in section 3 above. Such withdrawal will not affect the lawfulness of processing carried out prior to consent being withdrawn. In order to revoke your consent to data processing, please submit your request for withdrawal to the Data Controller via registered letter, fax or email to the addresses and contact information indicated in section 1 of this Privacy Statement.
8. Data Retention Period
Sammontana will retain your Personal Data for as long as is necessary to complete the activities related to your contact request, unless you withdraw your consent, in which case Sammontana will promptly delete your Personal Data.
9. Rights of Data Subjects
You are entitled at any time to exercise your rights against the Data Controller pursuant to articles 15 and following of the Regulation, which are reported below for your convenience:
— Right of Access and Rectification (Articles 15 and 16 of the Regulation): you are entitled to obtain confirmation of whether or not your Personal Data is being processed and, if so, to access your data. You also have the right to request the rectification of incorrect data and the integration of incomplete data. If you wish, we may provide you with a copy of your Data in our possession.
— Right to Erasure (Article 17 of the Regulation): in the cases provided for by applicable legislation (for ex. personal data is no longer necessary for the purposes for which it was collected or processed, withdrawal of consensus, unlawful processing, etc.) you may request the erasure of your Personal Data, which Sammontana will do without delay.
— Right to restriction of processing (Article 18 of the Regulation): in the cases provided for by applicable legislation (inaccurate personal data, unlawful processing of data, etc.), you are entitled to obtain a restriction of your Personal Data processing.
— Right to data portability (Article 20 of the Regulation): you are entitled to receive your Data in a structured, commonly used and machine-readable format in order to transmit it to another data controller. Alternatively, if requested, we will directly transmit your Data to another data controller.
— Right to object (Article 21 of the Regulation): you have the right, at any time, to object to the processing of your Personal Data on grounds relating to your particular situation pursuant to Article 5, paragraph 1, letters e) or f) of the Regulation, including profiling based on those provisions (legitimate interest of the Data Controller).
You may exercise these rights by contacting the Data Controller via registered letter, fax or e-mail to the addresses and contact information reported in section 1, possibly using the forms made available on the website of the Italian Data Protection Authority (Autorità Garante per la Protezione dei dati personali) (www.garanteprivacy.it).
Upon receipt of your request, Sammontana shall have one month time to take all necessary actions. Within this period, notwithstanding the exercise of your rights, you may receive further automated messages, the transmission of which had been planned prior to your request.
The one-month deadline may be extended by two months in case of a complex request or a large number of requests.
10. Filing a complaint with the Italian Data Protection Authority
If you believe that there has been a violation of your rights to personal data protection, you can file a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali) in the manner and within the terms indicated on the website of the Italian Data Protection Autority (http://www.garanteprivacy.it).
11. Personal Data of minors
The services of this Website are intended for a general audience and are not targeted to individuals under the age of 18. We will not knowingly collect personal information from Users below this age limit. Should we become aware that we have collected personal data belonging to a person under the age of 18, the Data Controller will promptly delete such data.
12. Updates and amendments
The Data Controller may modify, supplement, or simply update, in whole or in part, this Privacy Policy, also to reflect changes in regulations or following the introduction of new sector-specific standards.
Any such updates or amendments will be notified through publication on the Website.
We recommend, therefore, that you regularly access this section to check the publication of the most recent and updated Privacy Policy.
13. Links to other websites
This Privacy Policy is provided for this Website and is not applicable to other external websites that may be accessible through links.
14. Co-processing of statistical data with Meta
This Privacy Policy also applies to the webpage https://www.facebook.com/GelatiSammontana for which Sammontana is a joint data controller for statistical data, together with Meta Platforms Ireland Limited.
The personal data processed are statistical data obtained through the Insight feature of the Facebook page, which provides aggregate data that helps understand how people interact with the pages on the social network.
You can access the Facebook page entitled "Data controller addendum for Facebook page Insights" which outlines the allocation of responsibilities between Meta Platforms Ireland and the User (in this case Sammontana) as the administrator of the page https://www.facebook.com/GelatiSammontana.
On this page you can find information on Facebook's data policies, including the following:
- Type of information collected by Facebook and Instagram
- How Facebook and Instagram use this information
- How this information is shared
- How Meta companies collaborate
- Legal bases for data processing
- How to exercise rights under GDPR
- Data retention period, deactivation and account deletion
- Compliance with legal requests
- Data management and transfer within global services
- Updates and amendments to the policy
- Contact information for Meta Platforms Ireland regarding personal data protection
This page also includes information about Meta Platforms Ireland's cookie policy.