We hereby inform you that our company processes your personal data in full compliance with the current national and European regulations on personal data protection.

Pursuant to Article 13 of EU REGULATION 679/2016, we inform you that:

1) Purpose of processing: Personal data is processed in the course of the company’s normal business activities for the following purposes:

a) exclusively aimed at fulfilling contractual obligations or acquiring pre-contractual information, as well as information relating to the data subject’s requests for supplies and services;

b) related to obligations provided for by laws, regulations, and EU legislation as well as provisions issued by authorized authorities and supervisory bodies, and obligations in tax and accounting matters.

2) Categories of collected data: The collected data falls into the category of identifying personal data (personal information, tax code or VAT number, identification document details) strictly related to and instrumental in managing relationships with customers and suppliers (e.g., acquisition of preliminary information for contract conclusion, execution of operations based on obligations arising from the concluded contract, fulfillment of tax and accounting obligations, etc.).

3) Legal basis of the processing: The processing of your data for the purposes mentioned in point 1 letters a) and b) of this notice is lawful, since:

• it is carried out in the execution of a contract to which you are a party or for the implementation of pre-contractual measures taken at your request;

• it is necessary to comply with a legal obligation incumbent on the Data Controller (in relation to obligations provided by laws, regulations, EU legislation, and tax and accounting obligations);

• The processing of your data for the purposes indicated in point 1) letter c) will only be carried out if you have given your specific consent for such purposes.

4) Methods of data processing: Data is processed using paper, computer and telematic tools with logic strictly related to the purposes themselves and, in any case, in such a way as to guarantee the security and confidentiality of the data. Specifically, we inform you that your data is:

• processed lawfully, fairly and transparently;

• collected for the above-stated, explicit and legitimate purposes, and subsequently processed in a manner compatible with those purposes;

• adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed (“data minimization”);

• accurate and, if necessary, updated, deleted and/or rectified;

• stored in a form that allows your identification for a period not exceeding the achievement of the purposes for which they are processed;

• processed in a way that ensures adequate security of personal data, including protection, through appropriate technical and organizational measures, from unauthorized or unlawful processing and from accidental loss, destruction or damage.

5) Data communication: For the achievement of the stated purposes, your data may be communicated exclusively to the following entities: credit institutions for managing collections and payments arising from contract execution; companies or third parties responsible for printing, enveloping, shipping and/or delivering documents; couriers and postal service providers; companies, consultants or professionals possibly in charge of the installation, maintenance, updating and general management of the controller’s information systems; credit recovery, transfer and protection companies; professional firms and consultants for legal, tax, commercial, labor and organizational matters; company collaborators and employees in charge of processing; and those entities to whom communication is necessary or functional to the proper fulfillment of contractual obligations or obligations deriving from the law or who have access to personal data by virtue of regulatory or administrative provisions.

These parties act as External Data Processors, or operate independently as separate Data Controllers.

The complete list of data processors is available at the company’s headquarters and may be requested from the Data Controller indicated above.

6) Data disclosure and profiling: For the achievement of the stated purposes, your data will not be subject to disclosure nor to any entirely automated decision-making process, including profiling.

7) Transfer abroad: Your personal data is not transferred outside the national territory.

8) Mandatory/optional provision of data: Without prejudice to the data subject’s personal autonomy, the provision of personal data may be:

• strictly necessary for managing and executing ongoing or forming contractual relationships, or for implementing pre-contractual measures taken at your request;

• mandatory in relation to obligations provided for by laws, regulations, EU legislation, and provisions issued by authorized authorities and supervisory bodies, as well as tax and accounting obligations;

9) Refusal to provide data: Any refusal by the data subject to provide personal data for the purposes indicated in point 1 of this notice will make it impossible to correctly and fully execute the contract of which you are a party or to implement pre-contractual measures taken at your request.

10) Data retention period: Your personal data will be stored in a form that allows your identification for a period not exceeding the achievement of the purposes for which they are processed, and in any case in compliance with the legal obligations related to data retention periods (tax audits and statute of limitation for exercising rights).

11) Rights of the data subject: At any time, you may exercise, pursuant to Articles 15 to 22 of EU Regulation no. 2016/679, the right to:

• request confirmation of the existence or not of your personal data;

• obtain information on the purposes of processing, categories of personal data, recipients or categories of recipients to whom personal data have been or will be communicated, and, when possible, the storage period;

• obtain rectification and erasure of data;

• obtain restriction of processing;

• obtain data portability;

• object to processing at any time, including for direct marketing purposes;

• oppose automated decision-making, including profiling;

• revoke consent at any time without affecting the lawfulness of processing based on consent before its withdrawal;

• lodge a complaint with a supervisory authority.

The data controller is GARESIO SOCIETA’ SEMPLICE AGRICOLA, represented by the legal representative pro tempore, with registered office in Località Sordo, 1 – 12050 Serralunga D’Alba (CN).

I diritti di cui sopra potranno essere esercitati con richiesta scritta rivolta al Titolare del trattamento via lettera raccomandata, o anche a mezzo posta elettronica al seguente indirizzo e-mail: amministrazione@garesiovini.it