This policy describes the procedures followed by Pasticceria Confetteria Cova S.r.l. (hereinafter "Cova" or the "Controller" or the “Company”) in relation to the processing of personal data collected through the website www.pasticceriacova.com (hereinafter the "Website").
Unless otherwise stated, this policy also applies as an information notice - in accordance with art. 13 of Regulation (EU) no. 2016/679 (hereinafter the "GDPR") - rendered to those who interact with the Website (hereinafter the "User").
Information on the processing of detailed personal data is provided, where necessary, in the pages relating to the individual services offered through the Website. Such information is aimed at defining the limits and methods of processing the personal data of each service, on the basis of which the User can freely express his consent, where necessary, and possibly authorize the collection of data and their subsequent processing.
DATA CONTROLLER. DATA PROCESSOR.
The Data Controller is Cova, with registered office in Via Pietro Cossa 2, 20122 Milano (MI), tel. +39 0276002750, e-mail firstname.lastname@example.org. The updated list of any data processors is available at the registered office of the Controller.
TYPES OF DATA PROCESSED.
They may be collected and processed through the Website:
- navigation data;
- personal data provided voluntarily by the User through the forms present within the Website.
Cookies are small text files that websites you visit send to your terminal, where they are stored, and then retransmit to the same websites the next time you visit. Cookies allow websites to function properly and efficiently to improve your experience by allowing the website to store information in the memory of your computer or other devices.
The Website uses technical cookies. Such cookies, due to the technical nature, do not require the prior consent of the User to be installed and used.
In particular, the cookies used on the Website are traceable to the following subcategories:
- browsing or session cookies, which ensure normal browsing and use of the Website and to collect anonymous information about how users use the website and how many visitors has the website, where they come from, and the other websites they have visited. As they are not stored on the user's computer, they disappear when the browser is closed;
- analytical cookies, such as, for example, those used by Google Analytics, with which statistical information are collected and analyzed, through the computer and other devices, on the number of users of the website, or on the number of clicks on the page during their navigation, or from which website users come and the pages they have visited;
- social widgets and plugins: some widgets and plugins made available by social networks may use their own cookies to facilitate interaction with the website of reference.
The third party cookies installed on the Website are listed below. For each of them, there is a link to the relative information notice on the processing of personal data carried out and the methods for deactivation of any cookies used. With regard to third party cookies, the Controller is only obliged to insert the link to the third party's website in this policy. On the other hand, the latter is required to provide information and indicate how to consent to and/or deactivate cookies.
- Google Analytics: https://support.google.com/analytics/answer/6004245
Cookies may be disabled by the User by checking and/or changing their browser settings based on the instructions made available by their providers to the links listed below.
PURPOSE AND LEGAL BASIS OF THE PROCESSING.
Personal data collected through the Website will be processed:
- for the management of requests for information submitted by the User;
- for sending commercial communications about products and services, by e-mail, text message, mms, fax or the like and/or by postal service or operator telephone calls;
- to carry out profiling activities with a view to carrying out the activities referred to in letter b);
- for the sharing and/or communication of data to Cova's business partners - for the sending by the latter of commercial communications on their own products and services;
- for the performance of sales agreement to which the User is a party or for taking pre-contractual measures at his request;
- for the performance of legal obligations, including any administrative or accounting activities, in connection with the sale;
- in the context of the communication of data between the Company and parent, subsidiary or affiliated companies, for administrative and accounting purposes, or related to activities of an organizational nature - including those functional to the fulfilment of contractual and pre-contractual, administrative, financial and accounting obligations;
- for the sending of communications aimed at the promotion and/or direct sale of products or services similar to those you have already purchased (so-called "soft spamming"), without prejudice to your right to object at any time.
The processing of personal data for the purposes under a) does not require the consent of the User as the processing is necessary to meet specific requests of the subject concerned under art. 6, par. 1, lett. b) of the GDPR. The processing of personal data for the purposes under b), c) and d) requires the consent of the User pursuant to art. 6, par. 1, lett. a) of the GDPR.
The processing of personal data for the purposes under e) does not require the consent of the User as the processing is necessary for the fulfillment of specific contractual obligations, pursuant to art. 6, par. 1, let. b) of the GDPR. The processing of personal data for the purposes under f) does not require the consent of the User as it is necessary to comply with the legal obligations to which the Controller is subject, under art. 6, par. 1, let. c) of the GDPR. The processing of personal data for the purposes sub g) and h) does not require your consent as it is necessary for the pursuit of the legitimate interests of the Controller, pursuant to art. 6, par. 1, let. f) of the GDPR.
TRANSFER OF DATA TO THIRD COUNTRIES.
The Data may be communicated and/or transferred to the Controller's commercial partners located in countries outside the European Union that may not guarantee an adequate level of protection. In particular, the transfer may be made to the following countries, on the basis of the conditions of legitimacy indicated in relation to each of them:
- People’s Republic of China, on the basis of your explicit consent;
- Honk Kong, on the basis of your explicit consent;
- Republic of China, on the basis of your explicit consent;
- Macao, on the basis of your explicit consent;
- United Arab Emirates, on the basis of your explicit consent;
- Japan, on the basis of your explicit consent;
- Kingdom of Saudi Arabia, on the basis of your explicit consent;
- Qatar, on the basis of your explicit consent;
- Kingdom of Bahrain, on the basis of your explicit consent;
- South Korea, on the basis of your explicit consent;
- United States, on the basis of your explicit consent;
- Turkey, on the basis of your explicit consent;
- The principality of Monaco, on the basis of your explicit consent.
PROVISION OF DATA AND CONSEQUENCES IN CASE OF FAILURE TO PROVIDE.
The provision of personal data for the purposes under a), b), c) and d) is optional and failure to provide them shall result, as a consequence, the only impossibility for the Data Controller to manage and process requests or to send commercial communications on products and services of the same or to carry out the activities specified.
The provision of personal data for the purposes under e) and f) is necessary to fulfill the legal and contractual obligations on the part of the subject concerned and the Controller. The provision of personal data for the purposes under g) is necessary for the pursuit of the legitimate interests of the Company indicated above. In all these cases, failure to provide the data shall make it impossible for the Company to respond to your purchase request and manage your contractual relationship.
RECIPIENTS OR CATEGORIES OF RECIPIENTS.
Personal data may be made accessible, brought to the attention of or communicated to the following subjects, who will be appointed by, depending on the case, as processors or subprocessors:
- companies of the group to which the Controller belongs (parent companies, subsidiaries, affiliated), employees and/or collaborators in any capacity of the Controller and/or companies in the group to which the Controller belongs;
- public or private entities, natural or legal persons, which the Controller uses to carry out activities instrumental to achieving the abovementioned purpose or to which the Controller is required to communicate personal data, by virtue of legal or contractual obligations;
- Cova's business partners located in countries outside the European Union.
In any case, personal data will not be disclosed.
The data shall be stored for a maximum period of time equal to the period of prescription of the rights that can be activated by the Controller, as applicable from time to time. In the case of processing for marketing purposes, the data shall be stored for a maximum period of 24 months; for profiling purposes, the data shall be stored for a maximum period of 12 months.
Concerned subjects are entitled to the rights set out in art. 15 to 20 of the GDPR. By way of example, any concerned subject may:
- obtain confirmation as to whether or not personal data relating to him are being processed;
- where processing is ongoing, to obtain access to personal data and information relating to the processing and to request a copy of the personal data;
- rectify inaccurate personal data and integrate incomplete personal data;
- to obtain, where one of the conditions laid down in art. 17 of GDPR are satisfied, the deletion of personal data concerning him;
- to obtain, in the cases provided for in art. 18 of the GDPR, the restriction of processing;
- receive their personal data in a structured format that is commonly used and machine-readable, and request their transmission to another controller if technically feasible.
RIGHT OF OBJECTION.
Every concerned subject has the right to object at any time to the processing of his/her personal data carried out in order to pursue a legitimate interest of the Controller. In the event of objection, personal data will no longer be processed, unless there are legitimate reasons to carry out the processing that prevail over the interests, rights and freedoms of the concerned subject or for ascertaining, exercising or defending a right in court.
RIGHT TO REVOKE THE CONSENT.
In the event that consent is required for the processing of personal data, each interested party may, at any time, revoke the consent already given, without prejudice to the lawfulness of the processing based on consent given before the revocation. Consent can be revoked by writing an email to email@example.com.
RIGHT OF OBJECTION AND REVOCATION OF CONSENT IN RELATION TO THE PROCESSING CARRIED OUT FOR MARKETING PURPOSES.
With reference to the processing of personal data for the purposes under lett. b), d) and h) each concerned subject may revoke at any time any consent given or object their processing, by writing an email to firstname.lastname@example.org. Objection to the processing exercised through these methods also extends to the sending of commercial communications by postal service or telephone calls with an operator, without prejudice to the possibility of exercising this right in part, objecting for example only the processing carried out through automated communication systems.
RIGHT TO COMPLAIN TO THE SUPERVISORY AUTHORITY.
In addition, any concerned subject may lodge a complaint with the Italian Data Protection Authority in the event that he/she believes that his/her rights under the GDPR have been violated, in accordance with the procedures indicated on the Italian Data Protection Authority’s website accessible at: www.garanteprivacy.it.
Having read and understood the information notice on the processing of my personal data:
- I consent to the processing of my personal data for sending commercial communications about products and services under lett. b)
- I consent to the sharing and/or communication of my personal data to Cova's business partners located in extra EU countries for the purpose of sending them commercial communications on their own products and services under lett. d)
- I consent to the processing of my personal data for the performance of profiling activities aimed to sending commercial communications about products and services, under lett. c)