PERSONAL DATA PROCESSING POLICY PURSUANT TO ARTICLES 13 AND 14 OF
REGULATION (EU) 2016/679 – GENERAL DATA PROTECTION REGULATION (GDPR)
In its capacity as data controller (hereinafter the “Data Controller”), Mutti S.p.A. has published this policy to inform you that – in accordance with Regulation (EU) 679/2016 (“GDPR”) and with applicable legislation, including national legislation, regarding personal data protection (“Privacy Legislation”) – your data will be processed via the methods and for the purposes set out below.
Personal data processing means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
In accordance with GDPR, the personal data processing operations carried out by Mutti S.p.A. will be characterised by the principles of lawfulness, correctness, transparency and confidentiality.
1. SUBJECT OF DATA PROCESSING
The Data Controller processes data provided to them, including: name and surname, place and date of birth, email address, address or domicile, tax code, gender, telephone and fax number, invoicing data and any other type of data associated with the services provided by Mutti S.p.A. (hereinafter “personal data” or simply “data”). Personal data must be:
- collected and processed for specific purposes;
- suitable, pertinent and limited to the purposes for which it was processed;
- accurate and up to date;
- constantly checked and updated;
- stored for no longer than the period required for the purposes for which it was processed;
- processed using technical and organisational methods that guarantee the protection of the data from illegal processing, loss, destruction or accidental damage.
2. PURPOSES OF DATA PROCESSING
The personal data you provide will be processed for marketing purposes, specifically for the sending of commercial and promotional correspondence using automated systems (email/newsletters). The newsletters may include communications relating to products, commercial and promotional information (e.g. discounts), invitations to events, special initiatives, satisfaction surveys etc.
The data you provide may also be processed as part of Mutti S.p.A.’s customer service activities.
You must provide this data for us to be able to carry out the activities set out above. Failure to provide it will mean that Mutti S.p.A. is unable to fulfil these activities.
3. METHODS OF DATA PROCESSING
Personal data processing is carried out via the collection, recording, organisation, storage, consultation, elaboration, alteration, selection, retrieval, alignment, use, disclosure, erasure or destruction.
Your personal data is processed via both paper and electronic and/or automated means.
Your personal data may also be processed by operators who manage the customer telephone assistance service, subsequent to a direct call from the data subject.
Once the service is completed, the user may contact the Mutti S.p.A. customer service department using the following details:
- Freephone number: +39 800 – 86504
For the purposes set out in Article 2, your data will be made accessible to:
- collaborators of the Data Controller, in their capacities as internal Data Processors/appointees and/or system administrators;
- third parties to whom the Data Controller outsources activities, such as providers responsible for managing and maintaining the website, suppliers, lenders, professional firms and so on, provided these have been appointed external Data Processors, limited to the purposes set out in this policy and in accordance with GDPR.
4. DISCLOSURE OF DATA
The data collected will not be disclosed without your explicit consent.
However, in accordance with Article 6 of GDPR, your consent is not required for the Data Controller to disclose your data to supervisory bodies, judicial authorities and any other parties to whom the Data Controller is legally obliged to disclose your data so that it can pursue the purposes stated here. These parties will process the data in their capacities as independent Data Controllers.
5. NATURE OF DATA PROVISION AND CONSEQUENCES OF FAILURE TO RESPOND
Provision of personal data for the purposes set out here is optional. Failure to provide such data may make it impossible for the service to be provided.
6. DATA RETENTION PERIOD AND OTHER INFORMATION
In accordance with Article 13, Paragraph 2, Letter (a) of GDPR, the Data Controller will process personal data for as long as is necessary for fulfilling the purposes set out above, unless the data subject exercises their right to opposition. If this is not forthcoming, the data will be retained for as long as Mutti S.p.A. holds a legitimate interest (Article 6, Paragraph 1, Letter (f) of GDPR) in developing relations with its clientele.
At the end of this period, your data will be erased or made anonymous.
Personal data will be managed and stored on servers located within the European Union. Servers will belong to the Data Controller and/or appointed third-party companies. The servers are currently located in Finland. Nevertheless, it is understood that the Data Controller, where necessary, has the right to move the location of the servers elsewhere within Italy and/or the European Union and/or outside the European Union. In this case, the Data Controller guarantees that the transfer of data outside of the EU will occur in accordance with all applicable laws and, where necessary, will sign agreements to ensure an adequate level of protection and/or adopt standard contractual clauses as set out by the European Commission.
Mutti S.p.A. is committed to protecting the personal data provided to it and to implementing suitable technical and organisational safety measures to protect the data from any attacks, such as unauthorised or illegal processing, as well as from accidental loss, destruction or damage as per Article 32 et seq of GDPR.
7. RIGHTS OF DATA SUBJECTS
In your capacity as data subject, you are entitled to the rights set out in Article 15 of GDPR, specifically:
- the right to obtain confirmation as to whether or not personal data concerning you exists, even if this has not yet been registered, and to obtain a copy of the data in intelligible form;
- the right to obtain confirmation of the purposes and methods of the processing;
- the right to obtain confirmation of the categories of personal data concerned;
- the right to obtain confirmation of the recipients or categories of recipients to whom the personal data may be disclosed or who may become aware of it;
- the right to obtain confirmation of the envisaged personal data retention period, where this is known by the Data Controller;
- the right to be informed of the right to rectification;
- the right to have personal data erased or data processing limited;
- the right to make a complaint;
- the right to find out the origin of the data, in the event that the data was not provided by the data subject;
- the right to be made aware of the existence of an automated collection system;
- the right to be informed of the existence of adequate guarantees in accordance with Article 46 of GDPR in the event that data is transferred to another country or to an international organisation.
8. METHOD OF EXERCISING RIGHTS
You can exercise your rights at any time:
- by sending a letter via recorded delivery to: Via Traversetolo No. 28, Montechiarugolo (PR – 43022);
- by sending an email to: firstname.lastname@example.org
- by calling this number: +39 (0521) 652511;
- by sending a fax to: +39 (0521) 652596;
The Data Controller’s website and services are not for individuals under the age of 18. The Data Controller does not intentionally collect personal data relating to minors. In the event that personal data relating to minors is involuntarily collected, the Data Controller will promptly erase this at the request of a user.
10. DATA CONTROLLER, PROCESSOR AND APPOINTEES
The Data Controller is Mutti S.p.A. (VAT No. 02758310342), Montechiarugolo, Via Traversetolo No. 28 (PR – 43022), Telephone: +39 (0521) 652511, Fax: +39 (0521) 652596, Email email@example.com;
The Data Processor tasked with collecting, storing and retaining data is Promoservice Parma S.r.l., Viale Mentana No. 92 (PR – 43121).
An updated list of Data Processors and appointees is kept at the headquarters of the Data Controller.
11. POLICY MODIFICATIONS
This policy may undergo modifications based on privacy laws. You are advised to regularly consult this policy and to refer to the latest version only.