INFORMATION NOTICE ON THE PROCESSING OF PERSONAL DATA
pursuant to art. 13 del Regolamento Europeo 2016/679 (GDPR)
Data Controller is SaGa Coffee S.p.A. with registered office in Località Casona 1066 - 40041 Gaggio Montano, Bologna, Italy
e-mail: firstname.lastname@example.org (“Company”).
The Data Protection Officer (“DPO”) can be reached out to the following e-mail address: email@example.com.
LEGAL BASIS AND PURPOSES OF THE PROCESSING – DATA RETENTION PERIOD
The personal data you have provided us with may be processed:
- on the basis of a contract to which you are a party, for sending, via emails, information communications; in such case the data shall be retained until unsubscription request from the newsletter service;
- on the basis of your consent (optional and withdrawable at any time) and until revocation thereof, for marketing purposes: by way of example, sending of business/promotional communications – via automatic contact methods (e.g. e-mail or SMS) and conventional methods (e.g. by post) – on Company products/services, carrying out of customer satisfaction surveys, market researches and statistical analyses.
The provision of possible data marked with an asterisk (*) in the data collection form you should be asked to fill in is compulsory for providing you with the information requested; the refusal to provide such data does not allow, therefore, the Company to send you the Newsletters and to let you use our promotional initiatives.
The data may be communicated to parties acting as data controllers (such as e.g. supervisory and regulatory authorities and bodies and any public or private entity legally authorised to request the data) or processed, on Company’s behalf, by external entities appointed as data processors, who are provided with suitable operating instructions (such as, for instance, companies offering service of email sending; companies providing the service of management and maintenance of the website of the Company; companies offering services of market survey; marketing companies).
SUBJECTS AUTHORISED TO PROCESS DATA
The data may be processed by employees in company departments who are responsible for carrying out the activities outlined above and have been authorised to process the data and have received suitable operating instructions.
TRANSFER OF PERSONAL DATA OUTSIDE THE EU
Data may be transferred and processed in one or more countries within or outside the European Union and, in particular, at our subsidiaries in Italy, France, Spain, Portugal, Germany, Austria, Belgium, Poland, Romania, United Kingdom, Denmark, Russia, Argentina, Brazil, United States, Canada, China and Australia.
We may only transfer personal data outside the European Union to countries that are deemed by the European Commission to offer an adequate level of protection (a list of these countries is available below: http://ec.europa.eu/justice/data-protection/international-transfers/adequacy/index_en.htm), or where the Evoca Group has put in place adequate safeguards to try to preserve the privacy of the data (for which we usually use one of the forms of data transfer contract approved by the European Commission, a copy of which is available at the following address: http://ec.europa.eu/justice/data-protection/international-transfers/transfer/index_en.htm).
DATA SUBJECTS RIGHTS
By contacting the Privacy Office via e-mail sent to firstname.lastname@example.org, the data subjects can ask the controller for the access to their personal data, their deletion, the correction of inaccurate data, the integration of incomplete data, the restriction of the processing in the cases set out in article 18 GDPR.
Furthermore, in the case where processing is based on consent or on a contract and is carried out with automated tools, data subjects have the right to receive the personal data in a structured, commonly used and machine-readable format, and to transmit them to another data controller without obstruction.
Data subjects have the right to lodge a complaint with the competent Supervisory Authority in the member state where they are resident or where they work, or the member state where the alleged breach took place.
Data subjects have the right to withdraw the consent expressed at any time for marketing purposes, as well as to object the processing for marketing purposes. Unprejudiced is the faculty of the data subject who prefers to be contacted for the abovementioned purposes solely by traditional ways, of expressing its opposition exclusively to the receipt of automated communications.