INTRODUCTION

Matteo Rigoni, for Azienda Agricola Tarcisio Rigoni di Matteo Rigoni, registered office: Via Cul De Ola 90, 36100 Vicenza; operational office: Via Giacomelli 16, Val Liona, Vicenza. VAT no.: 02645760246, in its capacity as data controller (hereinafter, the “Controller”), hereby informs you, pursuant to Articles 13 and 14 of EU Regulation no. 2016/679 (hereinafter, the “GDPR”) and in compliance with Legislative Decree no. 196/03 (hereinafter, the “Privacy Code”, as amended by Legislative Decree 101/18), that your data will be processed in the manner and for the purposes set out below:

1. Subject matter of the processing

In view of the services and products offered by our organisation, the Controller processes personal and identifying data that do not fall within the special categories (for example: first name, surname, tax code/VAT number, email address, telephone number — hereinafter, “personal details” or simply “data”) provided by you when requesting services/products from our organisation and/or upon the conclusion of contractual agreements and/or promotional initiatives, and for the purposes set out below.

This website uses log files, in which information collected automatically during users’ visits is stored. The information collected may include the following:

• Internet Protocol (IP) address;
• Type of browser and parameters of the device used to connect to the website;
• Name of the internet service provider (ISP);
• Date and time of the visit;
• Web page from which the visitor arrived (referral) and the page from which they exited;
• Where applicable, the number of clicks.

The above information is processed by automated means and collected exclusively in aggregate form, in order to verify the correct functioning of the website and for security reasons. Such data are never used to identify or profile users, but solely for the purpose of protecting the website and its users; the legal basis for such processing is the legitimate interest of the data controller.

2. Purposes of the processing and legal basis for the processing

Your personal data are processed:

A – Without your express consent, since the processing arises from legal and/or contractual obligations or relates to legitimate interests (Privacy Code and Article 6 GDPR), for the following purposes:

• To manage and maintain the services/products requested by the data subject and to contact the data subject in order to organise the services/products requested;
• To fulfil pre-contractual, contractual and tax obligations arising from existing relationships with you;
• To comply with obligations laid down by law, by regulation, by EU legislation or by an order of the Authorities, including accounting and tax obligations;
• To prevent or detect fraudulent activities or harmful abuse and/or for the purposes provided for by applicable anti-money laundering legislation;
• To meet mandatory requirements arising from organisational and management models based on specific recognised standards (for example ISO, UNI standards, etc.) required by law and/or from specific contractual requirements requested by the data subject and/or stated as a requirement of the services;
• To exercise the Controller’s rights, for example the right of defence in legal proceedings;
• To ensure that the data subject can be contacted regarding information relating to the services requested and their management;
• To allow registration for the services and to allow the sending of information useful to the data subject in relation to the services requested;
• To process special categories of data for the services requested, falling within the cases set out in Article 9(2), points “b” to “j”;
• For legitimate interest relating to commercial communications providing updates on our organisation’s initiatives.

With regard to the data collected through the website:

• To allow registration on the website (where available);
• To allow us to reply to the questions you submit through the contact form;
• To manage and maintain the website;
• To prevent or detect fraudulent activities or abuse harmful to the website;
• For legitimate interest relating to communications (including commercial communications) providing updates on our organisation’s initiatives and/or arising from applicable regulatory/legislative requirements.

B – Only subject to your specific and separate consent, given by accepting the newsletter subscription through the interface of our website (Article 7 GDPR and Legislative Decree 196/03), for the following purposes:

B.1 Marketing and/or commercial purposes: commercial communications and/or advertising material concerning products or services falling within our legitimate interest. Please note that, if you are already a customer of ours, we may send you commercial communications relating to services and products similar to those you have already used, unless you object (Privacy Code).

For any other purposes, the Controller will provide specific privacy notices and will define the related consent requirements and/or supplementary information for the processing.

This privacy notice does not cover any processing carried out by third parties that may be reached through links present on the website; for such processing, reference must be made to the relevant privacy notice.

3. Methods and duration of the processing

The processing of your personal data is carried out by means of the operations set out in Legislative Decree 196/03 and in Article 4(2) GDPR, namely: collection, recording, organisation, storage, consultation, processing, alteration, selection, retrieval, comparison, use, interconnection, blocking, disclosure, erasure and destruction of data. Your personal data are processed both in paper form and by electronic and automated means.

The Controller will process personal data for as long as is necessary to fulfil the purposes set out above and, in any event, for no longer than 10 years from the termination of the relationship for the purposes referred to in point 2.A (subject to other legislative requirements). For the purposes referred to in point 2.B, the Controller will process the data until consent is withdrawn, or for 5 years from the interruption of relations/communications with the data subject following the initial collection.

Profiling: no data profiling is carried out.

4. Access to data

You may access your data at any time by submitting a simple request to the addresses indicated in this privacy notice.

5. Disclosure of data

Your data may be made accessible and/or disclosed for the purposes referred to in points 2.A) and 2.B):

Without prejudice to any disclosure and dissemination carried out in fulfilment of legal obligations, the Controller may disclose your data, in Italy and/or abroad (as indicated in the following points), to:

• Employees and collaborators of the Controller, in their capacity as persons authorised to process data and/or data processors and/or system administrators;
• Technical staff and/or collaborators responsible for administrative, tax and accounting management and/or for fulfilling specific legal obligations, or for which external suppliers have been identified;
• Our network of agents; factoring companies; credit institutions; debt collection companies; credit insurance companies; business information companies for the services requested; professionals and consultants; companies operating in the transport sector; technical staff and collaborators appointed to deliver the services/products requested; supervisory bodies; judicial authorities; as well as all other parties to whom disclosure is mandatory by law for the fulfilment of the aforementioned purposes; and to legal entities entrusted with the services covered by this privacy notice;
• Companies or other legal entities, qualified and appointed pursuant to Article 28 of Regulation 679/16, for support activities including: management and development of communications, management and development of company processes and projects, management and development of communication and promotion systems, and storage of personal data. Access may be granted to third parties and affiliated companies that provide services deemed necessary and/or useful by the Controller for the management of the company’s activities and the related support processes, or requested by you. Such suppliers include companies that maintain IT systems; credit institutions; professional firms; companies providing services on IT systems/platforms that the Controller considers useful to use; and companies carrying out outsourced activities on behalf of the Controller, in their capacity as external data processors;
• It may become necessary to disclose data to recipients as a result of legislative obligations and/or of the Controller’s organisational structure, which entails the involvement of independent parties who may be recipients of data in order to fulfil the legislative obligations arising from the role they hold. Such recipients may include supervisory bodies, inspectors from third-party organisations, persons carrying out AUDITS of our organisation, and parties and/or bodies carrying out inspections at our organisation.

The Controller’s Partners are not authorised to process the data for purposes other than those set out in this privacy notice. Should this become necessary, the processing of the data subject’s personal data must be governed by a separate specific privacy notice and by specific consents identifying the different controller and the relevant purposes.

6. Data transfer

The management and storage of personal data will take place on servers located within the European Union, belonging to the Controller and/or to appointed third-party companies duly designated as data processors. Our internal servers are currently located in Europe. The data will not be transferred outside the European Union. It remains understood, in any event, that the Controller may, should this become necessary, relocate the servers to non-EU countries. In such a case, the Controller hereby guarantees that any transfer of data outside the EU will take place in compliance with the applicable legal provisions, entering into, where necessary, agreements ensuring an adequate level of protection and/or adopting the standard contractual clauses provided for by the European Commission. For certain mailing or storage services we rely on cloud platforms, which may have servers in non-EU countries, but the data are stored there only temporarily for the purpose of the service requested.

7. Mandatory or optional nature of the provision of data and consequences of refusal to provide it

The provision of data for the purposes referred to in point 2.A) is mandatory. Without such data, we would be unable to guarantee you the services referred to in point 2.A). The provision of data for the purposes referred to in point 2.B) is, however, optional.

You may therefore decide not to provide any data, or subsequently to refuse permission to process data already provided: in that case, you will not be able to receive commercial communications and advertising material relating to the Services offered by the Controller. In any event, you will continue to be entitled to the Services referred to in point 2.A).

8. Rights of the data subject

In your capacity as data subject, you have the rights set out in Legislative Decree 196/03 and in Articles 15–22 GDPR, and specifically the right to:

• Obtain confirmation as to whether or not personal data concerning you exist, even if not yet recorded, and to have such data communicated to you in intelligible form;
• Obtain information about: the origin of the personal data; the purposes and methods of the processing; the logic applied where the processing is carried out with the aid of electronic instruments; the identification details of the controller, of the data processors and of the representative designated pursuant to the Privacy Code and Article 3(1) GDPR; and the parties or categories of parties to whom the personal data may be disclosed or who may become aware of them in their capacity as designated representative within the territory of the State, as data processors or as persons authorised to process data;
• Obtain: the updating, rectification or, where you have an interest therein, the integration of the data; the erasure, anonymisation or blocking of data processed unlawfully, including data whose retention is unnecessary for the purposes for which they were collected or subsequently processed; confirmation that the operations referred to in points 8.A) and B) have been notified, including as regards their content, to those to whom the data were disclosed or disseminated, except where this proves impossible or would involve a manifestly disproportionate use of means compared with the right protected;
• Object, in whole or in part: on legitimate grounds, to the processing of personal data concerning you, even where relevant to the purpose of the collection; to the processing of personal data concerning you for the purpose of sending advertising material or direct selling, or for carrying out market research or commercial communication, by means of automated calling systems without the intervention of an operator, by email and/or by traditional marketing methods such as telephone and/or postal mail. Please note that the data subject’s right to object, set out in point B) above, in respect of direct marketing by automated means also extends to traditional means, and that the data subject nevertheless retains the option of exercising the right to object only in part. Accordingly, the data subject may decide to receive only communications by traditional means, or only automated communications, or neither type of communication. Where applicable, you also have the rights set out in Articles 16–21 GDPR (right to rectification, right to erasure, right to restriction of processing, right to data portability, right to object), as well as the right to lodge a complaint with the Data Protection Authority.

9. How to exercise your rights

You may exercise your rights at any time by sending:

• A registered letter with return receipt addressed to: Matteo Rigoni, Via Giacomelli 16, Val Liona, Vicenza;
• An email to matteorig@pec.it;
• To exercise their rights, the data subject may use the form available at https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/1089924 and send it to the contact details specified above.

10. Minors

The Controller’s services are not intended for children under 14 years of age, and the Controller does not knowingly collect personal information relating to minors. Should information concerning minors be recorded unintentionally, the Controller will delete it promptly at the users’ request.

11. Controller, data processors and persons authorised to process data

The data controller is Matteo Rigoni (legal representative pro tempore). The Controller can be contacted at the addresses set out above. The updated list of data processors and of persons authorised to process data is kept at the registered office of the data controller.

12. Data Protection Officer

The Data Protection Officer (D.P.O.) is not applicable to our organisation.

13. Amendments to this privacy notice

This privacy notice may be subject to change. You are therefore advised to check this notice regularly and to refer to the most up-to-date version.