Privacy Policy
DATA PROCESSING FORM
FOR NEWSLETTER AND MARKETING PURPOSES
pursuant to Article 13 of Regulation (EU) No 2016/679 of the European Parliament and of the Council of 27 April 2016
Pursuant to Article 13 of the General Data Protection Regulation – Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (hereinafter referred to as “GDPR”), we will provide you with information relating to the processing of your personal data provided to allow the relationship with Cereal Docks S.p.A.
| Data Controller |
|---|
| The Data Controller is Cereal Docks S.p.A., with registered office in Camisano Vicentino (VI) Via dell’Innovazione n. 1, tax code and registration number with the Register of Companies of Vicenza: 02218040240 (hereinafter referred to as ‘Controller’ or ‘Company’ or ‘Cereal’). |
| Data Protection Officer (hereinafter referred to as “DPO”) |
| The Controller makes use of the group DPO appointed pursuant to Article 37(2) of the GDPR. The DPO’s contact details can be found on the Controller’s website or at the Controller’s registered office. To exercise your rights and for any communication, problem and/or request for clarification regarding the protection of your personal data, you may freely contact the DPO. |
Mandatory purposes for which the processing does not require your consent
| Purpose | Legal basis of the treatment |
|---|---|
| Managing the storage and storage of data, sending of information and communications, including electronic communications, requested by you through the Company’s website, sending of documents relating to the relationship with the Company. | (Art. 6, paragraph 1, letter c), GDPR) Treatment necessary to fulfil a legal obligation to which the Controller is subject (Art. 6, Paragraph 1, lett. f), GDPR) Treatment necessary for the pursuit of the legitimate interest of the Controller related to the organizational and administrative management of its organization |
Optional purposes for which the processing requires your consent
| Purpose | Legal basis of the treatment |
|---|---|
| Promotional and marketing activities with the provision of material and information on new products, promotions, discounts, benefits and other services of interest to you related to your business, also by sending special material in paper and / or electronic form, by means of newsletters (e-mail, sms, mms, instant messaging); sending information and news about the Company and its activities by means of newsletters (e-mail, sms, mms, instant messaging); invitations to events organized or sponsored by the Company; carrying out market surveys and/or customer satisfaction surveys. | (Art. 6, paragraph 1, letter a), GDPR) Consent of the data subject |
Recipients of personal data
For the fulfilment of the purposes indicated above, your personal data may be communicated to:
-
employees and/or collaborators of the Data Controller, duly appointed as authorised and trained subjects on the methods of processing such data;
-
other companies of the ‘Cereal Docks’ Group for the management of specific functions and/or services;
-
third parties other than the Controller, such as:
| Third parties or categories | Purpose | Notes |
|---|---|---|
| Computer companies | Management, maintenance, updating of systems and software used by the Controller and video surveillance systems | Appointment as data controller (Art. 28, GDPR) |
| Providers of networks, electronic communication services and computer and telematic services for the storage and management of computer data | Hosting, housing, Cloud, SaaS and other remote IT services essential for the provision of the activities of the Controller; filing and storage services in accordance with electronic documents | Appointment as data controller (Art. 28, GDPR). Cloud Services may involve data processing in countries outside the EU, which guarantee appropriate confidentiality rights |
| Consultants, professionals, law firms, arbitrators, insurance companies, experts, brokers | Judicial, extra-judicial and accident insurance activities Organisational, administrative, financial and accounting management | Appointment as data controller (Art. 28, GDPR) |
The companies of the Cereal Docks Group and third parties to whom your personal data may be disclosed act as:
-
Data controllers, i.e. subjects who determine the purposes and means of the processing of personal data;
-
Data processors, i.e. subjects who process personal data on behalf of the Data Controller;
-
Joint controllers of the treatment that determine jointly with the Company the purposes and means of the treatment.
The list and the updated information of the subjects identified as owners, managers or joint holders is available at the Company.
Period of retention of personal data
We explain below the period of retention of personal data or, if this is not possible, the criteria used to determine this period.
| Personal data and documents | Retention period or criteria for determining it |
|---|---|
| Personal data and documents relating to the relationship with the Company | For the duration necessary to pursue the purposes of the processing and also subsequently, within the limits granted by law, for administrative and accounting purposes, as well as to assert or protect the rights of the Controller, where necessary |
Rights of the data subject
We inform you of the existence of certain rights provided by the GDPR with regard to personal data and the processing thereof that you may request from the Controller.
| Diritto | Descrizione | Modalità per renderlo effettivo |
|---|---|---|
| Right of withdrawal of consent (Art. 13, Paragraph 2, letter c) | You have the right to withdraw consent for the processing operations for which you are requested, without prejudice to the lawfulness of processing based on consent prior to withdrawal | Forms on the website or available from the Controller |
| Right of access to data (Art. 15) | You may request: (a) the purposes of the processing; (b) the categories of personal data concerned; (c) the recipients or categories of recipients to whom the personal data have been or will be disclosed, in particular if they are recipients from third countries or international organisations; (d) where possible, the expected retention period for the personal data or, where that is not possible, the criteria used to determine that period; (e) the existence of the right of the data subject to request the controller to correct or erase the personal data or to restrict the processing of personal data concerning him or to object to their processing; (f) the right to lodge a complaint (g) all available information on the origin of data, if they are not collected from the data subject; (h) the existence of an automated decision-making process, including profiling as referred to in Article 22 (1) and (4), and, at least in such cases, relevant information on the logic used and the importance of and the anticipated consequences of such processing for the data subject. You have the right to request a copy of the personal data being processed | Forms on the website or available from the Controller |
| Right of rectification (Art. 16) | You have the right to request the rectification of inaccurate personal data concerning you and to obtain the integration of incomplete personal data | Forms on the website or available from the Controller |
| Right to be forgotten (Art. 17) | You have the right to obtain from the Controller the cancellation of personal data concerning you if the personal data are no longer necessary with respect to the purposes for which they were collected or otherwise processed | Forms on the website or available from the Controller |
| Right to limitation of processing (Art. 18) | You have the right to obtain from the Data Controller the restriction of the processing when you have contested the accuracy of the personal data (for the period necessary for the Data Controller to verify the accuracy of such personal data) or if the processing is unlawful, but you object to the deletion of the personal data and instead request that their use be restricted or if they are necessary for the establishment, exercise or defence of a right in court, while the Data Controller no longer needs them. | Forms on the website or available from the Controller |
| Right to portability (Article 20) | You have the right to receive in a structured format, commonly used and readable by automatic device personal data concerning you provided to us and have the right to transmit them to another Controller if the treatment: (i) was based on consent, (ii) on contract and (iii) whether the processing is carried out by automated means, unless the processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority and such transmission does not infringe the rights of a third party. | Forms on the website or available from the Controller |
| Right of opposition (Art. 21) | You have the right at any time to object, in whole or in part, to the processing of your personal data if the processing is carried out for the pursuit of a legitimate interest of the Controller or if the processing is carried out for direct marketing purposes. | Forms on the website or available from the Controller |
| Right to lodge a complaint with the Control Authority (Art. 77) | You have the right to complain to the Control Authority if you consider that the processing of your data is in breach of the GDPR. |
The exercise of these rights is subject to the limits, rules and procedures laid down by the GDPR and which the interested party must know and implement. Furthermore, in accordance with the provisions of article 12, paragraph 3, the Controller shall provide the interested party with information relating to the action taken without undue delay and, in any case, no later than one month after receipt of the request. This period may be extended by two months, if necessary, taking into account the complexity and number of requests. The Data Controller shall inform the data subject of such extension, and of the reasons for the delay, within one month of receipt of the request.
Changes and updates
This statement may be subject to change and/or addition, also as a result of the applicability of the GDPR and any future changes and/or regulatory updates.
The updated information is constantly available on the website of the Controller.
The personal data provided may be processed by the Data Controller with or without the use of computerised means.
We also inform you that the communication of your personal data for the mandatory purposes indicated is a legal or contractual obligation or a necessary requirement for the performance of contractual obligations, so you have the obligation to provide personal data, because otherwise you will not be able to manage the relationship with the Company.