Privacy Policy

INFORMATION NOTICE PURSUANT TO ART. 13 OF EU REGULATION 2016/679
(GENERAL DATA PROTECTION REGULATION)

With this notice Feudi di San Gregorio (hereinafter: "Company" or "Controller"), in its capacity as controller of the processing of personal data collected during the use of the website feudi.com ("Website"), informs you, pursuant to art. 13 of European Regulation no. 679/2016 (hereinafter, "GDPR"), that your data will be processed in the manner and for the purposes set out below.

In compliance with the provisions of the GDPR, the processing carried out by the Controller will be based on the principles of lawfulness, fairness, transparency, purpose limitation and storage limitation, data minimisation, accuracy, integrity and confidentiality.

1. Identity and contact details of the Controller

The Controller of the processing of your personal data is Feudi di San Gregorio Società Agricola S.p.A., with registered office in c.da Cerza Grossa, snc – 83050 Sorbo Serpico (AV).

2. Purpose of the processing and legal basis

a. Legal and contractual purposes – processing necessary to fulfil a contractual or legal obligation to which the Controller is subject, or to perform services or comply with a specific request of the data subject

Your personal data – including, by way of example, identification and contact data; internet browsing information; and, in general, any information suitable to make the data subject identified or identifiable – may be processed, without the need for consent, where this is necessary to comply with obligations deriving from legal provisions, as well as from rules, codes or procedures approved by Authorities and other competent Institutions.

Your personal data will also be processed for purposes related and/or connected to the provision of services by the Controller within the framework of browsing the Website.

In this regard, we inform you that the computer systems and software procedures used to operate the Website acquire, in the ordinary course of their operation, certain personal data that are then implicitly transmitted in the use of Internet communication protocols. This is information that is not collected to be associated with identified data subjects, but which, by its very nature, could, through processing and association with data held by third parties, allow users to be identified. This category of data includes the IP addresses or domain names of the computers used by users connecting to the Website, the URI (Uniform Resource Identifier) notation addresses of the requested resources, the time of the request, the method used to submit the request to the server, the size of the file obtained in response, the numerical code indicating the status of the response given by the server (successful, error, etc.) and other parameters relating to the user's operating system and computer environment. These data are used solely for the purpose of obtaining anonymous statistical information on the use of the site and to check its correct operation, and are kept for the duration of the browsing session.

In addition, your personal data may be processed for the management of relations with authorities and third-party public bodies for purposes connected with specific requests, the fulfilment of legal obligations or particular procedures.

Such data – the provision of which is necessary for browsing the Website – will also be processed by electronic means, recorded in dedicated databases, and used strictly and exclusively within the framework of browsing the Website. Since the communication of your data for the aforementioned purposes is necessary in order to maintain and provide the services, failure to provide it will make it impossible to provide the specific services in question.

b. Establishment, exercise or defence of legal claims

In addition, your personal data will be processed whenever it is necessary in order to establish, exercise or defend a right of the Controller in court. The data may be used to ascertain liability in the event of hypothetical computer crimes against the Website.

c. Legitimate interest of the Controller

The Controller may process, without your consent, your personal data in the following case: 
- analysis, in anonymous and aggregate form, of the use of the services enjoyed, to identify users' habits and preferences, to improve the services provided and to meet specific needs of users, as well as the planning of initiatives connected with the improvement of the services provided.

The legal basis for the processing of personal data for the purposes referred to in letter a) is art. 6, paragraph 1, letter b) of the GDPR, as the processing is necessary for the provision of the services or to respond to requests of the data subject. With reference to the purposes referred to in letters b) and c), the legal basis is to be found in the legitimate interest of the Controller, which prevails over the rights and freedoms of the data subjects.

Lastly, for marketing and profiling cookies, the processing is based on consent to the processing of personal data (art. 6, par. 1, letter a) of the GDPR. Consent is given through the banner and the cookie policy of the site, to which this notice refers.

3. Recipients of the personal data

For the pursuit of the purposes indicated in point 2, the Controller may communicate your personal data to third parties, such as, for example, those belonging to the following subjects or categories of subjects:

• police forces, armed forces and other public administrations, for the fulfilment of obligations laid down by law, regulations or EU legislation. In such cases, under the applicable data protection legislation, the obligation to obtain the prior consent of the data subject to such communications is excluded;
  
• other companies belonging to the same group or contractually linked to the Controller that carry out, by way of example, consultancy activities, as well as support for the provision of services rendered by the Controller.
  

In this context, your personal data may be processed by subjects or categories of subjects acting as Data Processors pursuant to art. 28 of the GDPR or who are authorised to process the data pursuant to art. 29 of the GDPR. Beyond the aforementioned cases, your data will not be disclosed. The Controller guarantees the utmost care so that the communication of your personal data to the aforementioned recipients concerns exclusively the data necessary to achieve the specific purposes for which they are intended. 

Your personal data are stored in the Controller's databases and will be processed exclusively by authorised personnel. The latter will be provided with specific instructions on the methods and purposes of the processing. Such data will also not be disclosed to third parties, except as provided above and, in any case, within the limits indicated therein.

Finally, please note that your personal data will not be subject to dissemination, except in the cases described above and/or required by law.

4. Transfer of personal data outside the EU

Your personal data will not be transferred outside the EU, including through inclusion in shared databases managed by third-party companies. 

5. Data retention period

Your data will be kept for a period of time no longer than that necessary for the purposes for which they were collected or subsequently processed in accordance with legal obligations, in compliance with the principles of minimisation and storage limitation provided for by the GDPR.

6. Rights of the data subjects

As a data subject, pursuant to arts. 15-22 of the GDPR,  the following rights are recognised in favour of data subjects with regard to the personal data collected and processed by the Controller for the purposes indicated in point 2: (i) the right of access, in particular by requesting, at any time, confirmation of the existence of your personal data with the Controller's archives and the provision, in a clear and intelligible form, of such information, as well as the right to know the origin, logic and purpose of the processing with express and specific indication of the processors and data processors and of the third parties to whom your data may be communicated; (ii) the right to obtain the updating and rectification of the data, the deletion of superfluous data or their transformation into anonymous form, as well as the blocking of processing and definitive deletion in case of unlawful processing; and (iii) where the conditions are met, the withdrawal of consent, the restriction of processing and data portability. 

The law also recognises you the possibility of lodging a complaint with the Garante per la protezione dei dati personali, should you detect a violation of your rights under the applicable data protection legislation. 

To exercise the rights listed above, you may contact the Controller directly by writing to privacy@feudi.it.

INFORMATION NOTICE PURSUANT TO ART. 13 OF EU REGULATION 2016/679 
(GENERAL DATA PROTECTION REGULATION)

With this notice Feudi di San Gregorio (hereinafter: "Company" or "Controller") informs you that your personal data will be processed in the manner and for the purposes set out below and, in any case, in compliance with the principles of minimisation, fairness, lawfulness, transparency, integrity and confidentiality, as well as with all applicable legal provisions regarding the protection of the right to data protection. This notice is provided pursuant to art. 13 of EU Regulation 2016/679 – General Data Protection Regulation (hereinafter: "Regulation").
In this regard, before communicating any personal data, the Controller invites you to read this notice carefully as it contains important information on the protection of personal data and on the security measures adopted to ensure its confidentiality in full compliance with the Regulation.

A)    CONTROLLER

The Controller of the processing of your personal data is Feudi di San Gregorio Società Agricola S.p.A., with registered office in c.da Cerza Grossa, snc – 83050 Sorbo Serpico (AV).

B)    TYPES OF DATA SUBJECT TO PROCESSING

The Controller will process your personal data collected during registration on the website feudi.com ("Website"), accessing the online shop to purchase products or book guided tours. The data subject to processing may include, by way of example and without limitation, identification data (such as first name, surname, e-mail address, mobile number, tax code) and payment data (such as payment outcome, transaction code and last four digits of the credit card).

C)    PURPOSES OF PROCESSING AND LEGAL BASIS

Your personal data will be processed for the following purposes, as applicable from time to time:

i.    establishment and/or management of the commercial and contractual relationship between you and the Controller / acquisition of pre-contractual information, contractual fulfilment and execution of operations deriving from the contract / administrative and operational management of the contractual relationship (so-called contractual purposes);
ii.    compliance with obligations laid down by law, regulation, EU legislation or an order of an Authority, such as, for example, anti-money laundering obligations and compliance with tax obligations (so-called legal purposes);
iii.    exercise of the rights and legitimate interests of the Controller, such as the right of defence in court and fraud prevention (so-called Controller's legitimate interest purposes);
iv.    to provide the data subject with communications via e-mail regarding services similar to those provided by the Controller, it being understood that, at any time, the data subject will have the possibility to object to the sending of such communications;
v.    subject to the consent of the data subject, for sending communications through traditional and remote means of communication, including SMS, MMS, social networks, instant messages, WhatsApp messages, mobile applications, for the promotion of activities and initiatives of the Controller;
vi.    subject to the consent of the data subject, for carrying out profiling activities, aimed at personalising informational communications for marketing purposes, according to purchasing preferences and/or experiences over time in relation to the services offered by the Controller. For the sake of completeness, we note that the booking of experiences at the Controller's facility takes place through a dedicated channel. 
(hereinafter "Marketing Purposes")

The processing of your personal data for the aforementioned purposes is based on the following legal bases:

1.    with regard to the purposes referred to in point (i) above, on art. 6, letter (b) of the Regulation, pursuant to which "processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract";

2.    with regard to the purposes referred to in point (ii) above, on art. 6, letter (c), pursuant to which "processing is necessary for compliance with a legal obligation to which the Controller is subject",

3.    with regard to the purposes referred to in point (iii) above, on art. 6 (f) of the Regulation, "pursuit of the legitimate interest of the Controller",

4.     with regard to the purposes referred to in point (iv) above, on art. 130, paragraph iv, of d.lgs. 196/03 (Privacy Code), which allows the sending of marketing communications via e-mail concerning similar services to those provided, to which the data subject may object at the time of data collection and in any subsequent communication, and finally,

5.    with regard to the purposes referred to in points (v and vi) above, on art. 6 (a) of the Regulation, "express consent of the data subject".

The communication of your personal data for the contractual purposes, legal purposes and Controller's legitimate interest purposes is a contractual and/or legal obligation. Failure to communicate it makes it impossible to pursue the purposes described above, in particular the failure to establish the contractual relationship. 

The processing of data for Marketing Purposes is optional. Therefore, in the event of objection to communications or if the data subject denies or withdraws his/her consent, the User will not be able to be updated on activities and initiatives of the Controller, receive newsletters and materials relating to such activities. In any case and at any time, the data subject may withdraw any consent given in accordance with the methods set out in this notice.

D)    RECIPIENTS AND TRANSFER OF PERSONAL DATA

Your personal data may be communicated to third-party companies or other subjects (indicatively, credit institutions, professional firms, consultants, insurance companies for the provision of insurance services, etc.) that carry out outsourced activities on behalf of the Controller, duly appointed as data processors. Beyond the aforementioned cases, your data will not be communicated except to subjects, entities or Authorities towards which communication is mandatory by virtue of legal or regulatory provisions. The personal data will be processed within the European Union. They may be processed in countries outside the European Union, provided that an adequate level of protection is guaranteed, recognised by an adequacy decision of the European Commission. Any transfers of personal data to non-EU countries, in the absence of an adequacy decision of the European Commission, will be possible only if adequate guarantees of a contractual or pact-based nature are provided by the parties involved, including binding corporate rules and standard contractual clauses. 

E)    RETENTION OF PERSONAL DATA

Your personal data will be kept for the period of time necessary for the pursuit of the specific purposes for which they were collected, as indicated in this notice, and in any case:

•    for contractual purposes, business legitimate interest and legal purposes, they will be kept for a period equal to the duration of the contract (including any renewals) and for the 10 years following its termination, resolution or withdrawal, without prejudice to cases where retention for a further period is required for any disputes, requests from competent authorities or under applicable legislation;

•    for marketing purposes, they will be kept for a period of 24 months following collection, without prejudice to any deletion request by the data subject. Your personal data collected for the analysis of characteristics, habits and preferences, also for the purpose of sending promotional communications, will be kept for a period of 12 months following collection, without prejudice to any deletion request by the data subject. 

At the end of these periods, the data will be definitively deleted or anonymised.

F)    RIGHTS OF THE DATA SUBJECTS (cf. arts. 15-22 of the Regulation)

You have the right to ask the Controller, at any time, for access to your personal data, their rectification or erasure or to object to their processing, you have the right to request the restriction of processing in the cases provided for by art. 18 of the Regulation, as well as to obtain, in a structured, commonly used and machine-readable format, the data concerning you, in the cases provided for by art. 20 of the Regulation.

In any case, you always have the right to lodge a complaint with the competent supervisory authority (Garante per la Protezione dei Dati Personali), pursuant to art. 77 of the Regulation, if you consider that the processing of your data is contrary to the legislation in force.

Requests must be addressed in writing to the Controller, by writing to privacy@feudi.it.

COOKIES AND SIMILAR TECHNOLOGIES

The Website uses cookies and similar technologies (localStorage and sessionStorage) to ensure the operation of the store, to store your language and market preferences, to measure the use of the site and, subject to consent, to carry out analytics and marketing activities.

Technical cookies and those strictly necessary for the provision of the requested service are used even in the absence of consent. Analytical and marketing cookies, as well as similar technologies that are not strictly necessary, require express consent, given through the banner and the cookie settings of the Website. The data subject may modify or withdraw his/her choices at any time via the button at the bottom of this page. By closing the banner, only the necessary cookies remain active.

The list below describes the cookies and identifiers used on the Website feudi.com.

Cookies

Similar technologies (localStorage and sessionStorage)