Information pursuant to the GDPR
This information is provided pursuant to the article 13 of Leg. Dec. 30.06.2003, 196 (“Personal Data Protection Code”) and article 13 of the EU Regulation n. 2016/679 (“General Data Protection Regulation”).
The company TOSTI SRL, in the persons of Michele Tosti and Benedetta Tosti, as Controllers and Processors of the data (hereinafter referred to as, “Data Controller”), informs its users that pursuant to article 13, of Leg. Dec. 30.06.2003, 196 (hereinafter referred to as, “Privacy Code”) and by article 13, of the EU regulation n. 2016/679 (hereinafter referred to as, “GDPR”) that your data will be processed in the following ways and for the following purposes:
1. Data Processing
The Data Controller safeguards your personal data and complies with the applicable legislation on personal data protection (Privacy Code and GDPR 12016/679). Your personal data is kept confidential and is only transferred to third parties according to the provisions of this Policy, or with your consent. We process personal data which you provide when using the website and/or after registration on the website.
Specifically, we process:
a) identifiable, non-sensitive personal data (specifically, name, surname, tax code, VAT number, email address, phone number – hereinafter referred to as, “personal data” or also “data”) that you have provided directly, when registering on the website and/or the request to use individual socio-educational and socio-welfare services offered; strictly nominal data of users under 18.
b) data which you have not directly provided – and in any event obtained in compliance with art. 14, comma 5, GDPR – whose transmission is connected to the use of Internet communication protocols (but not limited to, accesses to the website, amount of data transferred, status message of accesses made, session ID number, IP addresses, URL addresses, etc.). This data allows us to reconstruct your visits to the website.
2. Purposes of processing
Your personal data is processed:
A) without your explicit consent (art. 24, lett. a), b), c), Privacy Code and art. 6, lett. b), e), GDPR), for the following scope of services:
a) to process a contract request or to comply with requests made prior to entering into a contract;
b) to implement pre-contractual measures taken at your request;
c) to process internal statistical data;
d) to comply with tax requirements deriving from existing business relationships with you;
e) to comply with an obligation imposed by a law, regulations or Community legislation or by order of the competent Authorities;
f) to protect the vital interests of the data subject or another natural person;
g) for the performance of a task carried out in public interest or in the exercise of official authority vested in the Data Controller;
h) to prevent or detect fraudulent or malicious activities harmful to the website;
i) processing is necessary for the purposes of the legitimate interests pursued by the Data Controller or by third parties, within the limits and conditions set out in art. 6, letter f), GDPR;
l) to exercise the rights of the Data Controller, (for example, the right to defence in court);
2.2 Only subject to your specific and distinct consent (articles 23 and 130 of the Privacy Code and article 7 of the GDPR), for the following Marketing Purposes:
a) send you newsletters, commercial communication and/or promotional material on products and/or services offered by the Data Controller, which are different/dissimilar from those already acquired via email.
3. Nature of data provision
The data provision of your data for the purposes referred to in point 2, letter A), numbers i and ii) are mandatory. In their absence we can neither guarantee your registration to the site nor the possibility to carry out your requests. The provision of data for the purposes described in point 2, letter b) is optional. You can therefore decide not to give any data or subsequently deny the possibility of processing data already provided. In this case, you will no longer receive our newsletters, but you will continue to receive our services and will maintain your right to registration on the website.
4. Data Processing Operations
The processing of your personal data is carried out by means of the operations set out by article 4 of the Privacy Code and by article 4, n. 2 of the GDPR and more precisely: collection, registration, organization, conservation, consultation, processing, modification, selection, extraction, comparison, use, interconnection, blocking, communication, cancellation and destruction of the data. The processing of your data will take place following the principles of correctness, lawfulness and transparency and may also take place using automated systems designed to memorize them, manage them and transfer them, using suitable instruments, in so far as they appropriate and state of the art, to guarantee the security and confidentiality through the use of appropriate procedures to avoid the risk of loss, unauthorised access, illicit use and dissemination.
5. Data Retention
The Data Controller will retain personal data for the time necessary to fulfil the aforementioned purposes and in any case for no more than 2 years from the data collection for marketing purposes. Upon expiry of this period, the data will be destroyed or made anonymous.
6. Data Access
The personal data processed by the Data Controller will not be disclosed, that is they will not be disclosed to indeterminate subjects, in any possible form, including that of their availability or simple consultation. Instead, they may be communicated to workers who are employed by the Data Controller and to some external subjects who collaborate with them. Specifically, your data may be available to:
a) employees and collaborators of the Data Controller, consultants authorised to manage the website to provide the related services (for example: customer services, IT departments etc.), in their capacity as internal Data Processors and/or Data Processors and/or System Administrators;
b) third parties or other entities (for example: credit institutions, professional service firms, consultants, insurance companies, etc.) who carry out outsourcing activities on behalf of the Data Controller in their capacity as external Data Processors and/or Data Processors.
Your data may also be communicated, to the extent strictly necessary, to parties entitled to access such information pursuant to the laws, regulations or EU legislation.
7. Communication of data
Without your express consent (ex. article 24, letters a), b), d) of the Privacy Code and article 6 letters b), c) of the GDPR), the Data Controller can communicate your data for the purposes indicated to supervisory bodies, legal authorities as well as all other entities to whom they are legally required to disclose information, for the accomplishment of said purposes.
8. Transfer of data
The management and storage of personal data will take place on the Data Controller’s server and/or those of third parties entrusted and duly appointed as Data Processers, located within the European Union, in compliance with article 45 et seq., GDPR. Currently the servers are located in the European Union. The data will not be transferred outside the European Union. It remains understood that should it be necessary to move the location of the servers, in Italy and/or the European Union and/or countries outside the EU, this move will always be made in accordance with article 45 et seq., of the GDPR. In that case, however, the Data Controller will guarantee from that moment that transfers of data outside the EU will take place in accordance with the applicable laws subject to the stipulation of agreements which guarantee an adequate level of protection and/or apply the standard contract terms provided by the European Union.
9. Navigation data
The computer systems and software procedures used to operate the website can acquire during their normal operation some personal data whose transmission is implicit in the use of Internet communication protocols. This information is not collected to be associated with identified subjects but by their very nature when processed or associated with data held by third parties, could allow users to be identified (i.e., parameters relative to the users’ operating system and IT environment). These data are used by Data Controller for the sole purpose of obtaining anonymous statistical data concerning use of the site and its correct functioning and are deleted immediately after processing. These data can also be used to ascertain responsibility in case of hypothetical computer crimes which could be damaging to the website.
10. Cookies
When you use our website, Cookies are stored on your computer. Cookies are small text files that are saved on your computer and provide us with specific information. They are widely used in order to make websites work or work more efficiently, to improve user experience as well as to provide specific information to the website owner. Our site uses Cookies which remain on your computer for different times. Some expire at the end of every session and others remain for longer so that when you return to our website, you enjoy a better user experience. Web browsers allow you certain control over Cookies via the browser settings. The majority of browsers allow you to block Cookies or to block the Cookies from certain sites. The browsers can also help you to delete Cookies when you close the browser. However, you should bear in mind that any opt-outs or preferences you have set up on the website will be lost. Please read the technical information about your browser for instructions. If you choose to disable the Cookie settings or if you refuse to accept a Cookie, some parts of the service may not function correctly or they might be considerably slower.
11. Rights of the interested party
In your quality as the interested party, you have rights set out by article 7 of the Privacy Code and article 15 of the GDPR and specifically the rights to:
a) obtain the confirmation of the existence or not of personal data concerning you, even if not yet registered and their communication is in an intelligible form;
b) obtain the indication:
b.1 of the origin of the personal data;
b.2 of the purposes and methods of the processing;
b.3 of the logic applied in case of processing being carried out with the aid of electronic instruments;
b.4 of the identification details of the Data Controller, the managers and the designated representative pursuant to article 5, comma 2 of the Privacy Code and article 3, comma 1 of the GDPR;
b.5 the subjects or categories of subjects to whom the personal data may be communicated or who may become aware of it in their capacity as designated representative in the territory of the State, managers or agents;
c) obtain:
c.1 the updating, rectification or when interested, integration of the data;
c.2 the cancellation, the transformation into anonymous form or blocking of data processed unlawfully, including data whose retention is unnecessary for the purposes for which the data were collected or subsequently processed;
c.3 the attestation that the operations referred to in letters c.1 and c.2 have been brought to the attention, also as regards their content, of those to whom the data have been communicated or disseminated, except in the case where such fulfilment is proven impossible or involves a use of means manifestly disproportionate to the protected right;
d) object, in whole or in part:
d.1 for legitimate reasons to the processing of personal data concerning you, even if pertinent to the purpose of collection;
d.2 to the processing of personal data concerning you for the purpose of sending advertising or direct sales material or for carrying out market research or commercial communication, through the use of automated call systems without the intervention of an operator by email and/or through traditional marketing methods by telephone and/or paper mail.
It should be noted that the right of opposition of the interested party, as set out in point d.2 above, for direct marketing purposes through automated methods extends to traditional ones and that in any case, the possibility remains for the data subject to exercise the right to object, even only partially. Therefore, the interested party can decide to receive only communications using traditional methods or only automated communications or neither of the two types of communications.
Where applicable, you also have the rights referred to in articles 16 – 21 of the GDPR (Right of rectification, right to be forgotten, right of limitation of treatment, right to data portability, right of opposition), as well as right of complaint to the Guarantor Authority.
12. Procedures for exercising your rights
You have the right to ask the Data Controller to access data which concerns you, for their correction or deletion, the integration of incomplete data, restriction of processing; to receive the data in structured, commonly used and machine-readable formats; to revoke any consent given regarding the processing of your sensitive data at any moment and object, in whole or in part, the use of the data; to lodge a complaint with the Supervisory Authorities, as well as exercise your other rights recognised by the applicable regulations.
You can exercise your rights at any time by sending:
registered post with return advice of receipt to Tosti S.r.l., with registered office in Viale Manzoni, 84/e, Ponte S. Giovanni (PG), recorded in the companies register of Perugia (n. 02930270547) tostisrl@pec.it
13. Children
Where the data subject who provides the data is under 16 years of age, processing of their data shall only be lawful only if and to the extent that consent is given or authorised by the holder of parental responsibility over the child for whom the identification data has been acquired.
14. Data Controller, Data Managers and those in charge of data processing
The Data Controller is Tosti S.r.l., with registered office in Viale Manzoni, 84/e, Ponte S. Giovanni (PG), recorded in the companies register of Perugia (n. 02930270547), in the persons of Michele Tosti and Benedetta Tosti.
The updated list of data managers and those in charge of data processing is kept at the Data Controller’s headquarters.
15. Changes to this Privacy Policy Statement
This information is subject to change. It is therefore advisable to regularly check it and to refer to the latest version.
Perugia 25/11/2020
No products in the cart.