Information on the processing of personal data
This document sets out the terms and purpose of the processing of personal data put in place by Società Cooperativa Agricola Sant’ Ursula, as the data controller (hereinafter also "Sant’Orsola" or "Controller"), and any additional information required by law, including information on the rights of the interested party and their exercise.
Regulation (EU) 2016/679 on the protection of personal data (hereinafter, the "Regulation") establishes rules relating to the protection of individuals with regard to the processing of personal data, as well as rules relating to the free movement of such data and it protects the fundamental rights and freedoms of natural persons, with particular reference to the right to personal data protection.
Article. 4, no. 1 of the Regulation states that "Personal Data" must be understood as any information concerning an identified or identifiable natural person (hereinafter, "Interested").
The term "Processing" should instead be understood as any operation or set of operations, carried out with or without the aid of automated processes and applied to Personal Data or sets of Personal Data, such as collection, registration, organization, structuring, storage, adaptation or modification, extraction, consultation, use, communication by transmission, dissemination or any other form of making available, comparison or interconnection, limitation, cancellation or destruction (art.4, n.2 of the Regulation).
Pursuant to articles 12 et seq. of the Regulation, it is also provided that the interested party must be made aware of the appropriate information relating to (i) the processing activities that are carried out by the data controller and (ii) the rights of the interested parties.
1. Purposes of data processing and legal basis
Personal data are provided directly by the interested party to Sant’Orsola through email or other contact methods (e.g. registration for events organized by Sant’Orsola, fairs, etc.). The processing of such data is aimed at:
- 1.1Processing the communications transmitted by the interested party and the purposes related to them, including the response to requests sent by the interested party and the possibility of contacting the interested party in this regard;
- 1.2fulfilling the obligations established by laws, regulations or community legislation, in particular related to civil, tax and accounting legislation, as well as to implement provisions issued by authorities legitimated by the law or by supervisory and control bodies.
Since the processing of personal data, other than those of a "sensitive" nature, for the purposes referred to in points (1.1), (1.2) mentioned above, is necessary, respectively, for the execution of a request made by the interested party , for the execution of pre-contractual measures adopted at the request of the same and for the fulfillment of contractual and legal obligations, the consent of the interested party is not required.
2. Methods of processing and retention
In accordance with the provisions of art. 5 of the Regulation, the Personal Data being processed are:
- 2.1processed in a lawful, correct and transparent way towards the interested party;
- 2.2collected and recorded for specific, explicit and legitimate purposes, and subsequently processed in terms compatible with these purposes;
- 2.3adequate, relevant and limited to what is necessary with respect to the purposes for which they are processed;
- 2.4exact and, if necessary, updated;
- 2.5processed in such a way as to guarantee adequate security;
- 2.6stored in a form that allows the identification of the interested party for a period of time not exceeding the achievement of the purposes for which they are processed.
Personal Data will be processed by the Controller with automated and non-automated tools; the retention in electronic form of Personal Data takes place in secure servers located in controlled access areas and with restricted access. Specific security measures are observed to prevent data loss, illicit or incorrect use and unauthorized access.
3. Nature of the collection and consequences in case data are not provided.
The provision of Personal Data for the purposes referred to in points (1.1) and (1.3) is optional. Failure to provide the data will, however, result in the impossibility for the Data Controller to process the requests for information received by the interested party.
4. Retention of personal data.
- 4.1Personal Data are kept for the time strictly necessary to achieve the purposes for which they were collected and processed. With reference, in particular, to the purposes referred to in points (1.1) and (1.2), the Personal Data will be stored to proceed with the Processing for the purpose of processing the requests for information by the interested party, including therein regarding the products and to the services of the Controller.
- 4.2It is understood, however, that once the purposes of the processing have been exhausted or in the event of the exercise of the right to object to the processing or the revocation of the consent given, the Data Controller will in any case be entitled to further store the Personal Data, in whole or in part, for certain purposes, such as asserting or defending a right in court (for example, in the event of possible disputes regarding the activities carried out by the Data Controller).
5. Communication of personal data.
Personal Data will be accessible to the persons in charge of the Processing, and may also be communicated to the external collaborators of the Data Controller in fulfillment of the purposes referred to in paragraph 1 of this information document.
6. Disclosure of personal data.
Personal data are not subject to disclosure.
7. Transfer of personal data abroad.
Personal Data will not be transferred outside the European Union for the purposes referred to in paragraph 1.
8. Rights of the interested party
At any time the interested party can access personal data in order to correct them, delete them and, in general, exercise all the rights which are expressly recognized under the applicable legislation on the protection of personal data, and in detail: the right to obtain confirmation of the existence or not of Personal Data and their communication in an intelligible form, to know its origin, purposes and methods of treatment; the right to obtain an indication of the identification details of the Data Controller, of the data processors and of the subjects or categories of subjects to whom the Personal Data may be communicated; the right to verify the accuracy of Personal Data or request its integration or updating or rectification; the right to request cancellation, transformation into anonymous form or blocking of Personal Data processed in violation of the law, as well as their limitation pursuant to the law and to oppose in any case, in whole or in part, for legitimate reasons to their Processing; the right to the portability of their Personal Data, as well as the right to lodge a complaint, a report or an appeal to the Authority for the protection of personal data, where the conditions exist. The applicable legislation also recognizes the right of the interested parties to oppose the processing of personal data for the purposes referred to in point (1.2) of this information document, as well as the right to withdraw their consent to the processing of personal data at any time, without prejudice, however, to the lawfulness of the processing implemented by the Data Controller on the basis of the consent given before the revocation.
9. Data controller and data processor.
Data controller of the processing is Società Cooperativa Agricola Sant’Orsola based in Cirè di Pergine Valsugana (TN), Via Per Trento n. 11/E. Telephone number: +39 0461 518111. Fax number: +39 0461 518131. E-mail: firstname.lastname@example.org.
10. Communications and exercise of the rights of the interested party.
To exercise the rights referred to in paragraph 8, the interested party may contact the Data Controller at any time, at the following addresses: