TEZZELEFRUIT

POLICY REGARDING THE PROCESSING OF PERSONAL DATA

(pursuant to article 13 of EU Regulation 2016/679 “GDPR”)

As the Controller for the processing of personal data within the meaning of EU Regulation 2016/679 “General Data Protection Regulation”, TEZZELEFRUIT SRL hereby informs on the following provisions regarding the protection of persons and other subjects as to the processing of their personal data. The processing of personal data is subject to the principles of correctness, lawfulness, transparency as well as the protection of confidentiality and the rights of the data subject. Personal data may only be collected, processed and used in accordance with the provisions of the aforementioned regulation and the confidentiality obligations contained therein.

1. DATA SUBJECTS

Data subjects are those persons who provide their data to one or more companies of the “TEZZELEFRUIT” group in the following manner:

• by registering on the websites of the TEZZELEFRUIT;
• by registering for and using different services of the TEZZELEFRUIT;
• by purchasing goods through the websites of the TEZZELEFRUIT;
• by contacting (via telephone, fax, e-mail, etc.) the Consumer Care office of the TEZZELEFRUIT;
• by subscribing to the brand newsletters of the TEZZELEFRUIT through the websites;
• by registering for the outdoor events periodically organized by the TEZZELEFRUIT for its brands;
• by participating in online and offline competitions;
• by participating in partnership operations with third-party firms and
• by making purchases during the sample sales, periodically organized by a company of the TEZZELEFRUIT.

2. PURPOSES OF PROCESSING

The personal data provided will be processed for the following purposes:

1. a) Use of the services offered by the TEZZELEFRUIT – fulfilment of the purchase contracts concluded in the online store

The personal data of the data subjects are processed in order to enable those persons to use the services and to fulfil and carry out the sales contracts concluded in the online stores. In particular, the data will be processed for the following purposes:

• customer management;
• after-sale assistance;
• settlement of disputes;
• customer billing history;
• measurement of customer satisfaction;
• tax or other legal requirements.

The processing of personal data in connection with the purposes mentioned under lit. a) is necessary to ensure the correct management of the business relationship. The provision of personal data is mandatory in order to fulfil and carry out the above-mentioned purposes. The personal data that must be disclosed by the data subject are marked with an asterisk.

If the data subject does not provide or provides incorrect and/or incomplete mandatory personal data, the Controller cannot guarantee the performance of the service and/or the fulfilment of the contract.

The processing is carried out based on art. 6, par. 1, letter b) GDPR and, limited to compliance with tax and accounting legislation, on the basis of art. 6, par. 1, letter c) GDPR.

The personal data processed for these purposes will be processed for a period necessary for the provision of the services and/or for the fulfilment of the sales contract concluded with the data subject and thereafter as long as permitted by law.

1. b) Market studies and statistical purposes

For these purposes, the data are processed exclusively in anonymous form, meaning that an identification of the person concerned is no longer possible.

1. c) Direct marketing

The personal data will also be processed, with the consent of the data subject (art. 6, par. 1, letter a) GDPR), for the following marketing purposes:

• sending the brand newsletter of the TEZZELEFRUIT and newsletters informing about sample sales events;
• sending periodic commercial communications regarding products and services offered by a company of the TEZZELEFRUIT;
• promotional activities also related to the transmission of advertising and promotional material.

The provision of data for the purposes mentioned under lit. b) and c) is not mandatory and the refusal by the data subject to consent to the processing for this purpose will have no negative impact on the business relationship with the Controller. The person concerned may revoke his/her consent at any time.

For the purposes of direct marketing, the Controller also processes and evaluates data regarding the data subject’s purchase behaviour and the use of websites of the TEZZELEFRUIT in order to carry out a profiling of data subjects which is used solely for sending personalised advertising material based on the interests of the data subject. For the purposes of direct marketing, the personal data of the data subject are processed until the previously given consent is revoked. The personal data processed for the purposes of profiling, including data on purchase behaviour, are processed in accordance with the cancellation policy of the TEZZELEFRUIT, in any case only for the maximum time permitted by law.

3. METHOD OF PROCESSING

The personal data may be processed in the following ways:

• processing of data through completion of factsheets, coupons and questionnaires;
• processing by computer and automated means;
• manual processing through paper-based archives;
• processing of data collected by third parties;
• transfer to third parties for processing operations.

The data will always be processed in accordance with the principles set out in art. 32 GDPR.

4. DISCLOSURE/TRANSFER

The personal data provided will be kept at the headquarter of the Controller and will only be passed on to persons who are in a position to provide the necessary services for the correct handling of the business relationship with the data subject and the fulfilment of the contract, always under guarantee of the protection of the rights of the data subject.

The personal data provided will be processed only by personnel expressly authorized therefore by the Controller and specifically by the following categories of processors:

The personal data provided may be transferred to third parties solely for the purposes described above, and specifically to:

• forwarding agents, carriers, delivery services, mailing providers, logistics firms;
• consultants and professionals, in one-off disclosures or as part of a course of dealing;
• banks and credit institutions;
• providers of IT services.

The personal data provided by the data subject may be transferred within the TEZZELEFRUIT, namely to Italian and foreign companies of the TEZZELEFRUIT. The personal data may be transferred and disclosed to public bodies, for example police or courts, only in cases permitted by law.

5. DATA CONTROLLER

The Controller for the processing of personal data is TEZZELEFRUIT SRL. with offices at Laives Via A. Hofer 3

6. DATA PROTECTION OFFICER

The Controller has nominated a data protection officer for the entire TEZZELEFRUIT. The data protection officer can be contacted via: e-mail: info@tezzelefruit.it

7. RIGHTS OF THE DATA SUBJECT

The data subject has the right to obtain from the Controller access, communication, rectification, integration, updating, cancellation and portability of personal data concerning him/her, as well as the right to exercise in general all the rights provided for in chapter III of the GDPR, as indicated below:

Chapter III (Art. 12 – 23) GDPR

1. a) access to personal data: the data subject has the right to obtain information free of charge about the personal data held by the Controller and processing of said personal data, as well as to obtain a copy in an accessible format;
2. b) rectification of data: the Controller will correct or supplement incorrect or inaccurate data, including data which has become incorrect or inaccurate due to a non-carried out update, on the basis of a notice received by the data subject in this regard);
3. c) withdrawal of consent: if the processing is carried out on the basis of a consent previously given by the data subject, the latter may withdraw consent at any time, without this, affecting the lawfulness of the processing provided before the withdrawal;
4. d) erasure of data (“right to be forgotten”): the data subject may request, for example, erasure when the data are no longer necessary for the purposes for which they were collected or processed or when they have been processed unlawfully, when they have to be deleted in order to fulfil a legal obligation, when the data subject has withdrawn consent and there is no other legal basis for the processing, or when the data subject objects to the processing;
5. e) restriction of processing: the data subject may request this in certain cases: – where the accuracy of the data is contested, within the time necessary for verification; – where the lawfulness of processing is contested and the data subject opposes to erasure; – need to use the data for the data subject’s rights of defence, while they are no longer useful for the purposes of processing; if there is opposition to processing, during the time the necessary verifications are carried out – the data will be stored in such a way as to be restored, but, in the meantime, they are not available for consultation by the Controller except for the sole purpose to verify the validity of the data subject’s request or its objections.
6. f) objecting in whole or in part to the processing for legitimate interests: in certain circumstances the data subject may nevertheless object to the processing of his/her personal data, in particular, if the personal data are processed for purposes of direct marketing, the data subject has the right to object at any time to the processing, including profiling to the extent that it is related to such direct marketing. When personal data are processed for purposes of scientific or historical research or for statistical purposes, for reasons related to his particular situation, the data subject has the right to object the processing, unless the processing is necessary for the performance of a task carried out in the public interest;
7. g) data portability: if the processing is based on consent or on a contract and is carried out by automated means, upon request of the data subject, the latter will receive in a structured format, commonly used and machine-readable, the personal data concerning him and may transmit them to another controller, without hindrance by the Controller to whom he provided them and, if technically feasible, may obtain that such transmission is made directly by the latter;
8. h) lodging a complaint with the supervisory authority (the territorial competent supervisory authority of data protection).

To exercise the rights indicated above, the person concerned may contact the Controller by post or by e-mail at the addresses indicated.

8. UPDATES

The Controller reserves the right to update this policy regarding the processing of personal data at any time for organizational reasons or in order to comply with new legal regulations. It is therefore recommended to visit this page regularly and to check the date of the last change indicated at the end of the page.

The last update of this policy was made on the 04/05/2019.