Privacy (EN) – EVO Tabarrini

– DEFINITIONS –

Data Holder: Azienda Agricola Gianni Tabarrini, hereafter referred to simply as ”Company” or “Holder”;

User: the subject interested in the services provided by the Holder, recipient of this information;

Website: portal available to the link https://www.evotabarrini.it hereafter referred to simply as the “Site“;

Email contacts: the email addresses specified in the Contacts section, hereafter referred to simply as “Contacts“;

EU Regulation: EU Regulation 2016/679;

EEA: European Economic Area;

Cookie Policy: the document available to the link: https://www.evotabarrini.it/cookie-policy

– PREMISE –

This document is intended to illustrate the methods and purposes of the processing of the User‘s personal data carried out by the Company as the Holder in the provision of services rendered through the Site.

In relation to certain services, the Company reserves the right to provide particular documentation which may from time to time supplement or modify this information. In case of conflicting information with this, the terms of the particular information relating to the specific service will prevail.

The provisions herein shall be considered applicable to anyone who browses the Site and / or in any case interacts with the Company electronically, including by means of any existing or upcoming mobile applications, and more generally to individuals whose personal data are collected and processed in the context of the provision of services / products offered by the Company.

The processing of the personal data of the interested parties will take place in compliance with the applicable legislation, with particular reference to the EU Regulation concerning the protection of individuals with regard to the processing of personal data, as well as the national implementation provisions and the provisions of the National Supervisory Authority ( ie the Guarantor for the protection of personal data).

1. Field of Application

Everyone has the right to the protection of their personal data.

For this reason, the Company has always been strongly committed to guaranteeing respect for the confidentiality of data subjects and their right to be adequately informed about the collection and methods of processing their data.

It is therefore specified that this documentation must be considered to refer and therefore apply only to the Services offered by the Holder, without extending:

a) to the products and / or services provided by third parties through the Site;

b) to pages or sites accessible via links from the Site if they refer to products and / or services managed and / or provided by third parties.

Each User is therefore invited to carefully read the related privacy policies for a more detailed understanding of the treatments carried out by third parties through these sites and / or services.

This information, therefore, does not concern the treatments that these subjects will put in place in their capacity as independent Data Controllers (independent Data Holders).

Every time a User establishes an independent relationship with the subjects in question through the Site, he has the burden of reading and verifying the information that these subjects provide, so as to know the purposes and the legal basis of the treatments and to express informed of any consent required.

2. Purpose and legal basis of the processing

The personal data of the interested parties are processed by the Holder for the purposes specified below:

For the execution of the contract or in any case to provide the Services requested by the User.
The data of the User and of the persons indicated by him will be processed by the Company for the execution of the contractual relationship and the provision of the Services provided at User request.
In particular, the Company may process the data of the User and of the persons indicated by him for carrying out operational and administrative activities necessary for:
(i) manage registration, authentication and access to the platform;
(ii) provide geolocation services, statistical analysis and other similar services related to the supply of products and / or services of the Company;
(iii) manage requests for the purchase of goods or services offered through the platform directly by the Company or by third parties, including the purchase of accessory goods or services with respect to the Company‘s goods / services;
(iv) manage payment transactions at the request of the User to allow banking and credit institutions to proceed with the verification of the chosen payment method, the charges and the management of other service procedures;
(v) offer a platform of contacts and useful information on the world of agri-food production in general, through newsletter services and facilitating communication and information between users through networking and messaging services and their participation in various types of initiatives (playful, recreational, beneficial) organized by the Company or by third parties;
(vi) manage, at the request of the User, the interactions of the Services with third-party social network platforms, to which users can connect according to their preferences in order to share activities or information concerning them;
(vii) provide the Services through which the Company allows participants in various kinds of events (playful, recreational, charitable) and subjects authorized by them, to purchase, upon registration to its Services, the photographic and video footage that portray them during the conduct of the event;
(viii) the issuance of administrative, accounting and tax documents relating to the Services requested by the User.
For this purpose, the Company may process the data indicated in points 1), 2), 3), 4), 5) of the following article 3).
The legal basis of the processing is represented by Article 6, paragraph 1, lett. b) of the EU Regulation, as the processing is necessary to execute a contract to which the User is a party or in any case to provide the Services requested by the interested party.
Where for the purposes of providing the requested Services, the Company needs to process particular categories of User data, the legal basis of the processing will also be represented by the User‘s explicit consent pursuant to article 9, paragraph 2, lett. . a) of the EU Regulation.
Failure to provide consent, as well as its revocation, will make it impossible to provide the requested Services.
Similarly, where the Service requested by the User requires the use of data relating to the location of the electronic device used by the User for the purpose of using the Service, the Company will request the prior consent of the interested party for this purpose, which can be revoked in any time.
In relation to the publication and distribution, through the Site, of photographs and videos relating to events of various kinds (playful, recreational, charitable), individual users will be asked for a specific authorization upon registration.
Finally, where on the express indication of the User and always for the purpose of providing the Services, the Holder is to process personal data of people who do not have a direct relationship with the Company (for example, the identification or contact data of a third party), the processing will be based not only on the need to provide the requested Service and on the authorization indirectly provided by the interested party, but also on the legitimate interest of the Holder pursuant to Article 6, paragraph 1, lett. f) of the EU Regulation, to the extent that the User providing the third party’s data through the Services declares to do so with the prior authorization of the interested party and the processing of the latter’s data by the Company, as well as being reasonably foreseeable by the interested party in the light of what is declared by the User, does not affect their fundamental rights and freedoms.
In this case, the interested party still has the right to object at any time, for reasons related to his particular situation, to the processing of his personal data, by writing to the Contacts.
For the fulfillment of legal obligations
The data of the User and of the persons indicated by him will be processed by the Company for the fulfillment of legal obligations, such as, by way of example, tax obligations related to the execution of the contract and the provision of the Services. For this purpose, the Company may process the data indicated in points 1), 2), 3) 4), 5) of the following article 3).
The basis of the processing is represented by art. 6, paragraph 1, lett. c) of the EU Regulation as the processing is aimed at fulfilling a legal obligation to which the Holder is subject.
For marketing purposes
The Company may process the User‘s data, through the use of traditional systems (paper mail, calls with an operator), for sending commercial communications and / or for promotional initiatives on its products and services.
In addition, the Company may use the e-mail address provided in the context of the supply of products and services for the direct sale of products and services similar to those already purchased.
For the pursuit of these purposes, the Company may process the data indicated in point 2) of Article 3).
The Company will carry out this activity in compliance with the principles of the EU Regulation and for the pursuit of its own legitimate interest (see Article 6, paragraph 1, letter f of the EU Regulation); in any case, the User can oppose the receipt of such communications at any time, even during registration for the Services, by writing to the Contacts.
Therefore, the individual communications sent via email will contain a hypertext link to oppose in a simple and intuitive way to the receipt of further communications.
Furthermore, subject to the express and specific consent of the User (see Article 6, paragraph 1, letter a of the EU Regulation), the Company may process the User‘s data for the purposes indicated above, as well as to invite him to participate in promotional initiatives (present and future), loyalty programs or initiatives with third party partners and to carry out market surveys and analysis of the level of customer satisfaction, using automated communication channels (e.g. SMS, e-mail, calls without operator , notifications on the App).
For the pursuit of this purpose, the Company may process the data referred to in point 2) of Article 3; moreover, if the User has given his consent to carry out the profiling activities referred to in point 4) below, the Company may also process the information indicated in points 1), 3) of the article 3).
The consent given by the User can be revoked at any time by writing to the Contacts.
For profiling purposes
Subject to the express and specific consent of the User (see Article 6, paragraph 1, letter a of the EU Regulation), the Company may process the User‘s data to better understand his habits and interests and, consequently, offer products and services that the Company believes will be to your liking.
In particular, based on participation in previous events, the area of residence, browsing the Site, the User could be suggested events to participate in.
For the pursuit of this purpose, the Company may process the data referred to in points 1), 2), 3), 4), 5) of article 3). The consent given by the User may be revoked at any time by writing to Contacts.
For communication purposes to third parties for marketing purposes
Subject to the express and specific consent of the User (see Article 6, paragraph 1, letter a of the EU Regulation), the Company may communicate certain User data to event organizers and companies with which the Company could conclude partnership agreements for the purpose of making offers of interest or advantageous for the users / customers of the Company.
These organizers and companies will therefore be able to use User data for commercial and promotional purposes, using both automated systems (eg. E-mail) and traditional channels (eg paper mail).
The identification data of the User, his address or registered office and his contact details (telephone number and e-mail address) may be communicated. The consent given can be revoked at any time by writing to the Contacts.
For video communication purposes
In order to document the events and manifestations of various kinds organized, the Company may also acquire, directly or through its commercial partners, the relative photographic and / or video footage.
The legal basis of the processing is represented by art. 6, paragraph 1, lett. f) of the EU Regulation to the extent that the Company uses the data for information purposes without interfering with the rights and freedoms of the interested party and the processing of data relating to the results and photographic / video recordings in the terms described above is reasonably foreseeable by the interested party who takes part in an event of a public nature and whose results are intended to be disseminated and commented on even outside the circle of participants.
In the case of photographic / video reproductions used by the Company for the purpose of documenting the events, the legal basis of the processing may also be represented by the specific consent given by the interested party at the time of registering for the event. In any case, the interested party has the right to object at any time, for reasons related to his particular situation, to the processing of his personal data and to revoke the consent previously given, by writing to the Contacts.
For purposes related to corporate transactions or the transfer or rental of the Holder’s company
The Company may transfer the data of the interested parties to subjects resulting from corporate transactions of which the Company is a part (for example, mergers, demergers, incorporations, etc …) or to companies that purchase or rent the Company of the Holder or which in any case, on the basis of a specific agreement, take over from the latter in the sale of products / services.
In this case, the transfer will be aimed at allowing the normal continuation of relations in relation to the provision of the Services and will be based on the legitimate interest of the Holder (see Article 6, paragraph 1, letter f of the EU Regulation), without prejudice to the right of the interested party to oppose at any time, for reasons connected with his particular situation, by writing to the Contacts.
For the pursuit of this purpose, the Company may process the data referred to in points 1), 2), 3) 4), 5) of Article 3).

3. Type of data processed

Navigation data
The IT systems and procedures that allow the operation of the sites from which the Company‘s Services are provided acquire, during their normal operation, some personal data whose transmission is implicit in the use of Internet communication protocols.
This is information that is not collected to be associated with individual data subjects, but which by their very nature could, through processing and association with data held by third parties, allow the User to be identified.
This category of data includes, by way of example, the IP addresses or domain names of the computers used by users who connect to the Company‘s Site, the addresses in URI (Uniform Resource Identifier) notation of the requested resources, the relative time, the method used to submit the request to the server, the size of the file obtained in response, the numerical code indicating the status of the response given by the server (successful, error, etc.) and other parameters relating to the operating system and the IT environment of the User.
These data, processed for the sole purpose of obtaining anonymous statistical information on the use of the sites in question and to check their correct functioning, are deleted immediately after their processing. They can also be used to ascertain responsibility in the event of computer crimes against the Company‘s website and their users, even at the request of the judicial authority.
Data provided voluntarily by the User
The Company will process the personal data that the User will provide when registering, requesting a specific service (for example, registering for an event) or in any case as part of the relationship with the Company. Such data may include:
- identification and contact data (name, surname, sex, date of birth, company or company name, address, registered office, telephone and e-mail addresses);
- payment and billing data (data relating to credit cards and other payment systems used by the User);
- particular categories of data whose processing is necessary as part of the provision of a Service requested by the User;
- personal information published and shared directly by the interested party. The provision of personal data is a necessary requirement for the provision and subsequent use of the requested Services. Failure to provide certain data (personal details, e-mail address, postal address, payment data and telephone number, etc …) therefore, could make it impossible for the Holder to provide the requested Services. In this regard, the Company will indicate from time to time, also through its own forms, the data whose conferment is strictly necessary for the use of the Services and the additional data whose conferment is instead necessary only in order to enrich your User experience. as part of the Services themselves.
Public and/or freely accessible data and photographic/video footage
The Company processes personal data related to the image of the participants from time to time captured during events of various kinds (playful, recreational, charitable) for:
(i) document the event on the Site;
(ii) make the photos and videos available on the Site in order to allow the same participants to purchase and share the photos and videos that portray them.
The Company may also acquire the footage of the event through its commercial partners, or, depending on the case, perform them directly.
Each participant is free to authorize a family member or friend to view and purchase their photos and videos through the Site; We therefore recommend the utmost care and responsibility in choosing the person with whom to share the codes and credentials of the Services that allow viewing and purchasing the footage.
In this regard, it is also specified that:
- the lack of authorization with respect to photographic and video shooting and their making available for the purposes described above will make it impossible to register for the event, considering that in light of the public performance of the events, it is in fact impossible to exclude people who have denied their authorization;
- through the Services of the Holder, the interested User (or the persons authorized by him) can only purchase the photographs and videos that portray him or photographs deemed of general interest in relation to the event; however, in consideration of the public performance of the events, it is not possible to exclude that the photographs and videos in question also contain the image of interested parties other than the participant who purchases the photo or video;
- given the characteristics of the events, video and photo shooting could also be made in places or in ways that are not reported or with not always visible.
  If a User does not agree with the use of his image in the terms described above, he should not take part in the events in relation to which the organizers acquire, at the time of registration, the rights for the subsequent publication and distribution of the footage, even for a fee. and through the services of third parties, including the Company.
  Without prejudice to the above, the interested party can always send a written request to the Holder in order to obtain the removal of their image from the Site, or the obscuring of the same, after identifying the photograph or video that portrays it. If the photographic and video footage are instead published and distributed by third parties, even through the Site, the interested party must contact the third party, as independent data holders, for the purpose of exercising their rights.
Third party data
When the User provides a telephone number or other address to which a message can be automatically sent, or the identification and contact data of a person to be registered for an event or other Company initiative, the use of such data takes place under the sole responsibility of the User who must obtain the express authorization of the interested party for this purpose.
For the purpose of performing the Services requested by the interested party, the Company may acquire and process data transmitted, subject to the authorization of the interested party, from third parties who provide the latter with specific services.

4. Processing methods and data retention period

All the User‘s personal data are mainly processed through electronic tools and methods, however processing by paper means is not excluded.

The data will be stored in a form that allows the identification of data subjects only for the time strictly necessary to achieve the purposes for which the data were originally collected and, in any case, within the limits of the law.

In order to ensure that personal data is always accurate, updated, complete and relevant, we invite each User and other interested parties to keep their data updated through the specific functions of the Site, reporting any changes made by writing to the Contacts.

Personal data will be processed only for the time necessary in relation to the purposes described above.

Unless otherwise provided in this information and in the detailed information relating to specific Services, the Holder will comply with the following retention periods:

for purposes related to the execution of the contract and the supply of products / services requested by users, the data will be processed by the Company for the entire duration of the relationship and as long as there are obligations or fulfilments related to the execution of the same; after this deadline, in the event of disputes and always for data relating to orders or purchases made through the Site, in light of the ordinary limitation period of rights (10 years in Italian law), the retention period will be extended for further 11 years for purposes related to the fulfillment of legal obligations and to allow the Company to defend its rights in the face of possible disputes within the limitation period;
for the fulfillment of legal obligations, the data will be processed and stored by the Company as long as the need for processing persists to comply with these legal obligations;
with reference to the processing for marketing purposes, carried out on the basis of a legitimate interest of the Company or with the consent of the User, the data will be processed for the entire duration of the relationship with the User and as long as there are obligations or obligations connected to the ” execution of the aforementioned relationship, except for any revocation of the consent previously given or opposition to processing;
for profiling purposes, the data will be processed for a maximum period of 12 months or for the different period that may be required by law or by provisions of the Guarantor Authority, after which the data will be kept if necessary to pursue other purposes or will permanently deleted;
in relation to further data processed by virtue of a legitimate interest of the Holder as described above, the data will be processed as long as the legitimate interest persists, without prejudice to the right of opposition of the interested party.

5. Communication of personal data to third parties

No data will be disclosed or communicated to third parties unless with the express and specific consent of the interested party, except for the communication of the data disseminated or otherwise shared by the User himself through the Site in accordance with the provisions of article 6) of this information document.

Where the communication to third party suppliers, consultants or partners of the Company should be necessary for needs related to the provision of the Services, the Holder will be responsible for appointing the latter as data processors pursuant to art. 28 of the EU Regulation, by virtue of the demonstrated ability, experience and reliability. Interested parties may request at any time the complete list of data processors appointed by the Company from time to time, by sending a request pursuant to article 9) below.

As already indicated in the previous article 1), where the Company operates as the Holder of a third party supplier who uses the Company‘s web platform to provide goods or services to users, the Company may acquire and transmit User data to respective third party holders, in their capacity as Holder and on the basis of the information autonomously made available by the third party holders.

It is understood that the personal data of users may be freely disclosed to third parties, such as the police or other public administrations, whenever this is permitted by law or required by an order or provision of a competent authority. These subjects will process the data as independent holders.

6. Social networks and third party sites

The Company‘s Site also constitutes a platform for sharing the experiences of each User, both individual and in the context of events and events organized by third parties or by the Company itself, in which a plurality of subjects will participate.

By using the Company‘s Services in the context of events and events of various kinds (playful, recreational, charitable), the User chooses to share and make public their participation in the event, allowing access to their location data those resulting from the related processing in other terms) to anyone who connects to the Company Site or partner webistes through which it is possible to follow the event.

In the case of events and events organized by third parties, the organizer may acquire and process the data of the User who takes part in the event for its own purposes and on the basis of independent information; The User is therefore invited to check with the organizer (and any suppliers used by the organizer) the means and purposes of the processing of his data related to participation in the event. Where provided for in the information relating to each specific event, the Company may also play the role of co-data Holder or independent Holder together with the organizer, with consequent exchange of data and information for the purposes described in the information and in strength of an adequate legal basis.

7. Transfer of personal data outside the EEA

In pursuit of the purposes described above, the Company may also transfer data to third countries or international organizations outside the EEA.

In this case, where the European Commission has recognized that a country not belonging to the EEA is able to guarantee an adequate level of data protection, the personal data of the data subjects may be transferred on this basis.

For transfers to countries or international organizations not belonging to the EEA whose level of protection has not been recognized by the European Commission, the Company will rely on an exemption applicable to the specific situation (for example, transfer necessary to perform a Service at the request of the ‘interested party, as in the case in which an international payment is made) or on one of the following guarantees adequate to ensure the protection of the personal data of the interested parties:
(i) standard contractual clauses, approved by the European Commission, which bind the data importer to process the data in compliance with the EU Regulation and this information;
(ii) binding corporate rules.
To obtain more information on these measures, you can send a written request to the Contacts.

8. Security measures

Taking into account the state of the art and the costs of implementation, as well as the nature, object, context and purposes of the processing, as well as the risks for the rights and freedoms of the data subjects, the Company, also through its own data processors appointed pursuant to art. 28 of the EU Regulation, will implement adequate technical and organizational measures to ensure a level of safety appropriate to the risk in accordance with articles 32 and following of the EU Regulation; these measures include, among others:

pseudonymisation and encryption of personal data;
the ability to ensure the confidentiality, integrity, availability and resilience of processing systems and services on a permanent basis;
the ability to promptly restore the availability and access of personal data in the event of a physical or technical incident;
a procedure for testing, verifying and regularly evaluating the effectiveness of technical and organizational measures in order to guarantee the security of the processing.

9. The rights of the interested party

Pursuant to the EU Regulation, interested parties may exercise the following rights towards the Company:

request and obtain information regarding the existence of their data at the Company as well as regarding the processing of personal data carried out by the Company, as well as obtain access to them;
request and obtain receipt in a structured format, commonly used and readable by an automatic device, of their data provided to the Holder, if the processing is based on consent or on a contract and is carried out by automated means, as well as, where technically possible, the transfer of such data to another data controller;
request and obtain the modification and/or correction of data that are inaccurate or incomplete;
request and obtain the cancellation of their data in the case of data or information that is not necessary – or no longer necessary – for the aforementioned purposes or in the presence of the other conditions provided for by law (see Article 17 of the EU Regulation);
request and obtain the limitation of the processing of their data if the interested party contests its accuracy or in the further hypotheses provided for by art. 18 of the EU Regulation;
oppose the further processing of your data in the cases expressly defined in the previous article 2).

Such requests may be addressed to the Company:

through the references available on the Site;
by sending a request to the Contacts;
through other channels that the Company may make available to the User.

Requests sent via email or other channels that do not allow the identification of the applicant, must be accompanied by a copy of the latter’s identity document in order to verify their identity.

In accordance with current legislation, in addition to the aforementioned rights, the data subject also has the right to lodge a complaint with the competent supervisory authority which in Italy is the Guarantor for the protection of personal data, through the following channels:
Post: Piazza di Monte Citorio n. 121 – 00186 – ROME (Italy);
Fax: (+39) 06.69677.3785;
Email: garante@gpdp.it, protocollo@pec.gpdp.it.

10. Links to other websites

The Holder does not control and has no way of supervising either the content or the personal data processing policies of the websites and third-party services accessible through the links contained within the Site. The Company, therefore, cannot in any case be held responsible for the treatments carried out through or in relation to such third party sites.

Users are therefore invited to pay close attention in this regard, by viewing the conditions of use and the privacy policies published on the visited websites/portals.

The Company provides links to websites and services managed by third parties exclusively to facilitate user navigation, it being understood that the activation of such hypertext links does not involve, nor must it imply, any kind of recommendation or report by the Holder for accessing and browsing these websites, nor any guarantee regarding their contents or the goods and services provided through them.

11. Cookies

Normal navigation within the pages of the Site involves the installation, by the Holder or third parties, of small strings of text called cookies, the use of which is aimed both at guaranteeing the normal functionality of the Site, as well as allowing the Holder to offer its users a better browsing experience.

For more information in this regard, interested parties are invited to read the specific policy, prepared by the Holder at the link relating to the Cookie Policy.

12. Childrens

A minor who is at least 16 years old may legitimately authorize their data processing in relation to:

receiving advertising messages, including via text messages, emails, unattended calls, in-app notifications;
carrying out market and satisfaction level analysis through simple questions or questionnaires, by email or telephone;
evaluation of purchases and other activities carried out through the Services for the offer of goods or services in line with your interests;
transfer of data to third party companies for marketing purposes.

Please Note: for the purchase of any good or service that involves the payment of a price to be paid by the minor who has reached the age of 16 and in any case for the signing of a binding contract, the mandatory consent of the holder of parental authority over the minor will always be required.

Equally, the consent of the holder of parental authority is required to authorize the use of the image of the minor who is at least 16 years old, as well as to process particular categories of data concerning him.

For minors under the age of 16, however, whenever the consent of the interested party is required pursuant to this information, it must be provided by the holder of parental authority.

The Company puts in place reasonable measures, in the light of available technologies, to verify that the consent is given by the holder of parental authority over the minor, where required.

In any case, any abuses relating to the processing of children’s data can be reported through the Contacts, in order to allow the Company to take appropriate measures to protect the child concerned, including by immediately blocking the processing of his data.

13. Holder of the treatment

The Holder of the personal data of users and other interested parties is:
Azienda Agricola Gianni Tabarrini – C.F. TBRGNN69M01D653E – P.IVA IT02397140548.
Address and Email: see the Contacts.

The Holder can be freely contacted by interested parties for any doubt or request relating to this Privacy Policy, by writing to the Contacts.

14. Changes and Updates

The Holder may freely modify or update this document, in whole or in part, also in consideration of changes to the law or regulation governing the matter of personal data protection.

It is understood that any changes or updates will be notified to users and other interested parties on the homepage of the Site and through the other channels available from time to time within the Services (for example, in-app communications or email communications for registered users).

The changes will be published and communicated at least 20 days before the time of actual entry into force, in order to ensure a reasonable period of time within which all interested parties can be aware of the changes made, except in the case in which the change is makes it necessary to fulfill a legal obligation or an order from an authority.

For this reason, users and all interested parties are invited to periodically access the Site and to regularly check the other communication channels normally used by the Company in order to be informed of any changes with respect to this information.

Privacy-policy (EN) v. 01 – 2020