© 2023 Cereal Docks Spa Società a Socio Unico - P.Iva: 02218040240 - Reg. Imp. di Vicenza 215209 - Cap. Soc. 10.000.000 € i.v.

Privacy Policy IGO


Protection of personal data is an important commitment for Cereal Docks S.p.A. (hereinafter “Cereal Docks” or “Company”).

(EU) Regulation 2016/679 “(EU) Regulation 2016/679 of the European Parliament and Council dated 27 April 2016 related to "the protection of natural persons for what concerns their personal data, and the free circulation of that data” (hereinafter “GDPR”) coming into force provided the opportunity to further adapt the activities performed by the Company to the personal data transparency and protection principles, respect of the rights and fundamental freedoms of all the data subjects, whether they were employees, collaborators, customers, suppliers or third parties interested in receiving information.

Cereal Docks therefore implemented its “Privacy Organisational Model” (MOP) described generally below, aimed at analysing all data processing, organising them functionally and managing them securely and transparently. This website section also provides information on data subject rights and how they can be exercised with the Controller.


1 - GDPR Privacy Organisational Model
1.1 - Subjects
1.2 Analysis of the risk and privacy risk prevention measures
2 - Transparency and data subject rights
2.1 - Rights concerning the protection of personal data
2.2 - Exercising rights
2.3 - Forms and information notices




The Data Controller is:
Cereal Docks Organic S.r.l.  (hereinafter also “CONTROLLER”)
Via Dell’Innovazione, n. 1, 36043 – Camisano Vicentino (VI)
Tel. +39 0444 419411
email: This email address is being protected from spambots. You need JavaScript enabled to view it.
Certified Electronic Mail: This email address is being protected from spambots. You need JavaScript enabled to view it.
VAT number and Tax Code: 04063200242


The CONTROLLER has decided to appoint an internal “Privacy team” of persons with organisational, technical and IT skills.
The Privacy team’s task is to support the activities of the CONTROLLER.


The MOP envisages that each employee/collaborator of the CONTROLLER only processes data that is indispensable for his/her tasks, based on the internal organisation and, above all, the purposes indicated and proposed by the data subject (so-called principle to “purpose limitation and data minimisation”, art. 5 paragraph 1, letter b) and c) of the GDPR). For this purpose, processing has been segmented into uniform areas of processors, limiting employees/collaborators operating in each area to a specific processing area. Each authorised processor has received specific instructions on personal data processing from the CONTROLLER. For that purpose, the design of the IT system is “compartimentalised”. The employee/collaborator can only access data that is indispensable for their jobs from their IT position. The specific processing areas are designated after careful analysis of the structure and company organisation and of the flow of internal and external data to the Company. This is summed up in a specific internal matrix identifying the processing environment of each area. The employee/collaborator has also been given internal regulations on the use of IT instruments and the rules of conduct, including ethical ones, on all information accessed due to his/her specific job. To effectively guarantee adjustment to the personal data processing principles, the CONTROLLER has also envisaged training and updating courses on the subject for employees/collaborators who, due to their jobs, process personal data.


The CONTROLLER uses computer systems to manage and organise its activities. For that reason, CONTROLLER activities have always been based on care over the construction of software, how it is used, and data security. Parties with “administrator” privileges in the company are specifically appointed and trained. Even the other external specialised companies accessing company data are specifically appointed as External Processors and/or External System Administrators pursuant to art. 28 of the GDPR. The suppliers or external computer services are chosen with care for their professional skills, not purely technical but also related to data protection, favouring certified companies.

PROCESSORS (pursuant to art. 28 GDPR)

In principle, the CONTROLLER manages all processing activities internally. Any outsourcing to third parties of certain activities implying the processing of data on behalf of the CONTROLLER is specifically indicated in the single information notices. In these cases the relationship with the third party is regulated by a specific contract appointing the “Processors” pursuant to art. 28 of the GDPR.

The CONTROLLER entrusts that processing activity to external parties providing sufficient guarantees on implementing suitable technical and organisational measures to meet the GDPR requirements and guarantee protection of data subject rights.


According to the so-called “accountability” principles, the CONTROLLER is responsible for implementing a number of measures – organizational, physical, legal, technical and IT – to prevent the risk of breaching the rights and personal freedoms of the data subjects. To achieve this goal, risks are continuously analysed, based on the processing, instruments used, type and amount of data processed.


The MOP envisages constant, careful analysis of risks for the processing of personal data, identified for each activity or service allocated through Records of Processing pursuant to art. 30 paragraph 1 of the GDPR.

Having analysed the processing performed by the CONTROLLER, it is felt that there are currently no risk activities needing a specific assessment of the impact pursuant to art. 35 of the GDPR (so-called (“DPIA” data processing impact assessment).

The analysis of cyber risks and corporate hardware and software infrastructures and on the IT adjustment measures has been conducted by both our System Administrator using specific tools and check lists and by an external company specialised in cyber security, which conducted an in-depth audit with security tests. The results enabled technicians to further improve measures to protect against cyber attacks and threats, graded and proportional to the risk for the rights and freedoms of data subjects.


On this occasion too, the CONTROLLER deems it necessary to inform data subjects of the personal data protection rights attributed to them, as listed below.
  • Right to be informed (data processing transparency)

The data subject has the right to be informed of how the CONTROLLER processes his/her personal data, for what purposes and on other information envisaged by art. 13 of the GDPR. For that purpose, the CONTROLLER has prepared organisational processes enabling, when the personal data are acquired or requested, an Information notice form created “ad hoc” to be issued based on the category the data subject belongs to (employee, customer, supplier, etc.). This document suitably notifies all subjects the data refer to on how the CONTROLLER conducts its processing. The information model may be requested with a specific request addressed to the CONTROLLER.

  • Right to withdraw consent (art. 13)

You have the right to withdraw your consent at any time for all processing where the legitimacy assumption is a display of your consent. Withdrawing consent does not affect the lawfulness of processing based on consent before its withdrawal.

  • Right to access data (art. 15)

You may request a) the purposes of the processing; b) the categories of personal data concerned; c) the recipients or categories of recipient to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organisations; d) where possible, the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period; e) the existence of the right to request from the controller rectification or erasure of personal data or restriction of processing of personal data concerning the data subject or to object to such processing; f) the right to lodge a complaint with a supervisory authority; g) where the personal data are not collected from the data subject, any available information as to their source; h) the existence of automated decision-making, including profiling, referred to in Article 22(1) and (4) and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject. You have the right to obtain a copy of the personal data being processed.

  • Right to rectification (art. 16)

You have the right to obtain rectification of inaccurate personal data concerning you and to have incomplete personal data completed.

  • Right to be forgotten (art. 17)

You have the right to obtain erasure of the personal data concerning you from the controller if the data are no longer needed for the purpose for which they were collected or otherwise processed, if consent is withdrawn, if there is no other overriding legitimate grounds for the processing, if the personal data have been unlawfully processed, if there is a legal obligation to erase them; if the data refer to web services provided to minors without the relative consent. The erasure may take place unless the right to freedom of expression and information is prevalent, they are stored to fulfil a legal obligation or to perform a task in the public interest or exercising public powers, on grounds of public interest in the health sector, for filing purposes in the public interest, scientific or historical research or for statistical purposes or to ascertain, exercise or defend a right before the law.

  • Right to restriction of processing (art. 18)

You have the right to ask the controller to limit processing when the accuracy of the personal data is contested (for a period enabling the controller to verify the accuracy of the personal data) or if processing is unlawful, but you oppose the erasure of the personal data and request the restriction of their use instead, or if they are needed by you to for the establishment, exercise or defence of legal claims, whereas they are no longer needed by the Controller.

  • Right to data portability (art. 20)

You have the right to receive the personal data concerning you which you have provided to a controller, in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller if the processing is based on consent, on a contract and if processing is done automatically, unless the processing is needed to perform a task of public interest or is connected to the exercising of public powers, and that their transmission does not adversely affect the rights and freedoms of others.

  • Right to object (art. 21)

You have the right, at any time, to fully or partially object to the processing of your personal data if that processing is performed to pursue a legitimate interest of the Controller or for direct marketing purposes.

  • Right to lodge a complaint with a Supervisory Authority (art. 77).

Without prejudice to any other administrative or judicial remedy, you shall have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement if you consider that the processing of personal data relating to you infringes this Regulation.

2.2 Exercising rights
To effectively exercise your rights you may ask the CONTROLLER for information, or fill in the access form made available to you here below.
1) Here below please find a draft of the document to be filled in to exercise the rights of the data subject. The form can then be sent to the CONTROLLER, to the addresses indicated above, pursuant to laws in force.
Form to be printed and filled in specifying the right requested
2) Information notice