This page describes the methods and logic behind the processing of personal data of users who consult the website: carvinea.com (hereinafter the “Website”). This privacy notice is provided pursuant to Article 13 of Regulation (EU) 2016/679 'General Data Protection Regulation' (hereinafter GDPR) and current Italian data protection legislation, Legislative Decree 196/2003 as amended, particularly by Legislative Decree no. 101/2018, to those who interact with the website starting from the address carvinea.com, and not for other external websites that may be linked.

1. DATA CONTROLLER

The data controller responsible for the processing of personal data (hereinafter the “Data Controller”) is:

Carvinea società agricola a Responsabilità Limitata
SP 32
72012 Carovigno (BR) - Italy
VAT number IT00949790729
email info@carvinea.com

2. TYPES AND METHODS OF DATA COLLECTION

The personal data collected, processed, recorded, stored, and/or transferred to third parties by the Data Controller are identifying data of natural persons (including, by way of example but not limited to, names, surnames, addresses, tax identification codes, phone / mobile numbers, dates or places of birth, etc.).

Personal data may be provided by the Data Subject voluntarily or mandatorily. The latter case applies to data essential to enable the Data Controller to perform the requested service or whose collection is linked to the need to protect legitimate interests of the Data Controller or for legal matters. Failure to provide data deemed necessary to obtain the service/product requested from the Data Controller will make it impossible to provide it. In such cases, no liability may be attributed to the Data Controller.

Data collected through access to the website may be provided voluntarily (for example, by filling out the contact form on the Site) or involuntarily, as occurs during browsing on the site.

Navigation data

The IT systems and software procedures used to operate this website acquire, during their normal operation, some personal data whose transmission is implicit in the use of Internet communication protocols.

This category of data includes IP addresses or domain names of computers and terminals used by users, URI/URL (Uniform Resource Identifier/Locator) addresses of requested resources, time of request, method used to submit the request to the server, size of the file obtained in response, numerical code indicating the status of the server response (successful, error, etc.), and other parameters related to the user's operating system and IT environment.

These data, necessary for the use of web services, are also processed for the purpose of:

• obtaining statistical information on service usage (most visited pages, number of visitors per hour slot, geographical origin, etc.);
• checking the correct functioning of offered services.

Data provided by the user

The optional, explicit, and voluntary sending of messages to the contact addresses on the Website, or the filling out of contact forms present on the Website, entails the acquisition of the sender's contact details, necessary to respond, as well as all personal data included in the communications.

Cookies and other tracking systems

Cookies are not used for user profiling, nor are other tracking methods employed.

Instead, session cookies (non-persistent) are used strictly limited to what is necessary for safe and efficient browsing of the site. Storage of session cookies on terminals or in browsers is under user control; on servers, at the end of HTTP sessions, information relating to cookies remains recorded in service logs, with retention periods not exceeding seven days, same as other navigation data.

3. PURPOSES OF PROCESSING

Personal data collected are processed by the Data Controller for the following purposes:

a. to fulfill pre-contractual, contractual, and tax obligations arising from existing or newly established relationships;

b. to ensure the proper execution of business activities (record keeping and accounting, office management, personnel management, etc.);

c. to carry out marketing activities, consisting of sending newsletters and/or commercial/marketing communications and/or advertising materials relating to services/products offered by the Data Controller;

d. to monitor the interests and preferences of data subjects;

e. to improve and optimize the services offered by the Data Controller;

f. to obtain anonymous statistical information on website usage and check its correct operation;

g. to establish, exercise, or defend a legal claim in court.

4. LEGAL BASIS FOR PROCESSING

The Data Controller processes Personal Data relating to the User if one of the following conditions applies:

• the User has given consent for one or more specific purposes; in some jurisdictions, the Controller may be allowed to process Personal Data until the User objects to such processing (“opt-out”), without having to rely on consent or any other of the following legal bases. This, however, does not apply whenever processing of Personal Data is subject to European data protection law;
• processing is necessary for the performance of a contract with the User and/or for any pre-contractual obligations thereof;
• processing is necessary for compliance with a legal obligation to which the Data Controller is subject;
• processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the Data Controller;
• processing is necessary for the purposes of legitimate interests pursued by the Data Controller or by a third party.

In any case, the Data Controller will gladly help to clarify the specific legal basis that applies to the processing, and in particular whether the provision of Personal Data is a statutory or contractual requirement, or a requirement necessary to enter into a contract.

5. RETENTION PERIOD

Personal data shall be processed for as long as strictly necessary to achieve the purposes for which they were collected, observing all necessary precautions to prevent data loss, unlawful or incorrect use, and unauthorized access.

Specifically, personal data will be processed for no longer than 10 years after termination of the relationship for the purposes referred to in points 3a and 3b, and for no longer than 5 years for the purposes in points 3c, 3d, and 3e, unless it is believed, in good faith, that applicable laws or regulations permit or require a longer retention period.

Data collected for the purposes referred to in point 3g will be kept for as long as required for judicial proceedings.

Once these terms expire, your personal data will be deleted from our systems in compliance with applicable regulations.

6. DATA RECIPIENTS

Data collected by the Data Controller may be disclosed, strictly within the limits relevant to the purposes indicated in point 3 “PURPOSES OF PROCESSING”, to the following entities or categories of entities:

• employees of the Data Controller, who will process them as authorized personnel under the Controller’s direct and careful supervision;
• collaborators of the Data Controller who will process data on behalf of the Controller as Data Processors pursuant to Article 28 of the GDPR;
• public / private entities to whom communication is required by law, regulation, or national/EU legislation, as well as for the performance of contractual obligations;
• legal, accounting, and labor consultants for the review and resolution of potential legal matters concerning contractual positions;
• external specialized firms consulting on accounting and tax management matters;
• technical personnel responsible for hardware and software assistance.

All data acquired by the Data Controller for the purposes under point 3 above may also be communicated, where necessary, to judicial authorities or entities to whom communication is mandatory by law.

With the exception of subjects listed in points a) and b), other recipients will process data in their capacity as independent Data Controllers.

7. PROCESSING METHODS

Personal data are processed exclusively for the purposes stated above using manual, IT, or telematics tools, and are stored in databases.

The Data Controller has implemented appropriate security measures to maintain integrity and security, as well as to prevent destruction, loss, accidental or unlawful alteration, unauthorized disclosure of, or access to Personal Data transmitted, stored, or otherwise processed.

Should the Data Subject suspect any improper use, loss, or unauthorized access to their personal data, they are invited to notify the Data Controller immediately using the contact details provided in point 1 of this privacy policy.

8. PLACE OF PROCESSING AND DATA TRANSFERS

All collected data are processed on paper or using automated tools at the Data Controller’s registered office indicated on the carvinea.com website, as well as at the premises of the web hosting and/or website management company. Currently, the servers are located in Italy.

Should data be transferred outside the European Economic Area or EEA (i.e., EU Member States plus Norway, Iceland, and Liechtenstein), the Data Controller ensures that the transfer will take place in compliance with applicable laws, entering into agreements that guarantee an adequate level of protection if necessary and/or adopting the Standard Contractual Clauses provided by the European Commission.

9. USER RIGHTS

The GDPR guarantees data subjects a series of rights regarding their personal data processed by the Data Controller.

Users may exercise certain rights regarding their Data processed by the Controller.

In particular, the User has the right to:

• withdraw consent at any time. Users have the right to withdraw consent where they have previously given their consent to the processing of their Personal Data.
• object to processing of their Data. Users have the right to object to the processing of their Data if the processing is carried out on a legal basis other than consent. Further details on the right to object are provided in the section below.
• access their Data. Users have the right to learn if Data is being processed by the Controller, obtain disclosure regarding certain aspects of the processing, and obtain a copy of the Data undergoing processing.
• verify and seek rectification. Users have the right to verify the accuracy of their Data and ask for it to be updated or corrected.
• restrict the processing of their Data. Users have the right, under certain circumstances, to restrict the processing of their Data. In this case, the Controller will not process their Data for any purpose other than storing it.
• have their Personal Data deleted or otherwise removed. Users have the right, under certain circumstances, to obtain the erasure of their Data from the Controller.
• receive their Data and have it transferred to another controller. Users have the right to receive their Data in a structured, commonly used, and machine-readable format and, if technically feasible, to have it transmitted to another controller without any hindrance. This provision is applicable provided that the Data is processed by automated means and that the processing is based on the User's consent, on a contract which the User is part of, or on pre-contractual obligations thereof.
• lodge a complaint. Users have the right to bring a claim before their competent data protection supervisory authority or take legal action.

Users are informed that where their Data are processed for direct marketing purposes, they can object to that processing at any time without providing any justification. To learn whether the Data Controller is processing data for direct marketing purposes, Users may refer to the relevant sections of this document.

10. EXERCISING THESE RIGHTS

To exercise User rights, Users can direct a request to the contact details of the Data Controller provided in this document. The Data Controller undertakes to respond within 30 days and, should it be impossible to meet this deadline, to provide reasons for any necessary extension of the timeframes.