Information pursuant to article 13-14 of EU Regulation 2016/679.
The owner of the processing of personal data (Data Controller) is ENOTECA VINOWINE, with registered office in Via Garibaldi, 29/A - 12061 Carrù (CN), Tel. 0173 065257, enotecavinowine@gmail.com - enotecavinowine@legalmail.it.
Your personal data are processed by subjects authorized by the owner and by the personal data responsible, specifically appointed and instructed by ENOTECA VINOWINE, as owner, or by autonomous "Data Controllers", authorized to access them on the basis of legal provisions and other regulations.
PURPOSE OF PROCESSING DATA AND LEGAL BASIS
Depending on the products, services or functions you intend to use from time to time, the following data will be processed, as the case may be: identification data (for example, name, surname, e-mail, country, contact details, etc.); economic and transactional information (for example, payment or card information, information about purchases made, orders, returns, etc.); connection, geolocation and navigation data (if, for example, there is interaction using the mobile phone) commercial information (for example, subscription to our newsletter), data related to your tastes and preferences.
The personal data provided will be processed for the following purposes: 1. Management of your registration as a user at the site platform; 2. Tax compliance and execution of the purchase contract or service with you stipulated; 3. Fulfillment of your requests through the customer service channels; 4. Sending periodical newsletters, with your optional consent.
Concerning the cases mentioned in points 1, 2 and 3, the legal basis for processing is the necessity to execute the contract to which the data subject is a party; whereas for point 4, the legal basis is the consent of the data subject.
METHOD OF PROCESSING
The personal data collected will be processed in the fullest respect for the necessary security and confidentiality, on paper and computer supports as well. The data controller, in compliance with the provisions of EU Regulation 2016/679, has prepared an accurate and detailed plan of organizational and technological measures to ensure an adequate processing of personal data and in accordance with what is required.
COMMUNICATION OF DATA TO THIRD PARTIES
In carrying out the task entrusted to him, the Data Controller will make use of the work of authorized personnel, expressly appointed and adequately trained (personnel belonging to the administrative, accounting and IT area) and of external personnel for particular phases of own activity. The Data Controller may, for legal obligations or to fulfil the contract/ mandate, communicate the personal data in its possession to public offices or third parties (employment consultants, banks, lawyer, etc.) to whom the faculty to process the data is recognized by specific provisions of law, institutional functions, regulations or EU legislation or by contract/explicit mandate from the interested party.
Anyway the personal data acquired by the Data Controller may be communicated, always in a confidential manner, to subjects who provide services to the Data Controller; these subjects act in full effect, in their turn, as Data Processors. In any case, an updated list of the persons in charge and of any third parties recipients of communication of personal data, is available in the registered office of the Data Controller and may be sent to the person concerned, upon specific request.
RETENTION PERIOD
The personal data will be kept for the time necessary to fulfil the above purposes and in any case for no later than 10 years from the termination of the contractual relationship, for administrative and accounting purposes. You can cancel your subscription to the Newsletter at any time through the "Newsletter" section of the Platform. It will be possible to unsubscribe from the newsletter by a link written on the email or by accessing the personal area. NATURE OF THE DATA AND CONSEQUENCE OF THE LACK OF COMMUNICATION Except in the cases where the acquisition of data takes place automatically (due to the simple navigation on the site by the user, browsing data and technical cookies) or where the provision of data is necessary for the use of the services that the user requires, the provision of any other personal data is entirely voluntary. Without the provision of obligatory personal data for the purposes described in points 1, 2 and 3, is not possible to give the products requested, wholly or in partly. TRANSFER OF DATA Personal data may be transferred to countries of the European Union and to third countries, for the purposes indicated. In order to ensure the efficiency of the service, some of these providers could operate outside the European Economic Area that doesn't provide a level of data protection not comparable to the European Union standard. In such cases, the data are transferred with adequate guarantees and always safely. The only data outside the European Union are Google Analytics, that are uploaded to Google’s servers. RIGHTS OF THE INTERESTED PARTY: Pursuant to the GDPR (General European Data Protection Regulation), the following rights (that may be exercised against ENOTECA VINOWINE) are granted to the person concerned: a) the right to obtain, from Data Controller, the confirmation that the personal data are being processed and, if so, to obtain access to personal data and information pursuant to art. 15 of the GDPR and in particular those relating to the purposes of the processing, the categories of personal data in question, the recipients or categories of recipients to whom the personal data have been or will be communicated, the retention period, etc.; b) the right to obtain, if the personal data are inaccurate, the rectification of their personal data, as well as the integration of the same data if they are considered incomplete, always in relation to the purposes of the processing (art. 16); c) the right to delete data ("right to oblivion"), in the cases provided for in art. 17; d) the right to limit the data processing, in the cases provided for in art. 18; the right to data portability pursuant to art. 20; the right to object to the processing of their personal data pursuant to art. 21; the right to withdraw their consent at any time without prejudice to the legality of the processing carried out prior to the withdrawal, only for the purposes whose the legal basis is the consent (art. 7). Finally, please note that you have the right to lodge a complaint with the Guarantor for the Data Protection or with another Supervisory Authority pursuant to art. 13, par. 2, letter d) of the GDPR. These rights may be exercised by a request to the Data Controller, using the contact details above.