Information pursuant to Article 13 of Reg. 2016/679 / EU on the processing of personal data (so-called "GDPR")
The following information concerns the processing of data by Green Valley srl on the websites www.greenvalleysrl.com, www.greenvalleysrl.it and www.greenvalleysrl.eu or other websites and owned services.
1. Treatment of personal data
By "processing of personal data" we mean any operation or set of operations, carried out with or without the aid of automated processes and applied to personal data or sets of personal data, even if not registered in a data bank, such as the collection , the registration, organization, structuring, storage, processing, selection, blocking, adaptation or modification, extraction, consultation, use, communication by transmission, dissemination or any other form of making available, comparison or interconnection, limitation, cancellation or destruction.
Green Valley Srl, shows the highest attention to the protection of personal data having adopted adequate and necessary measures for the protection of data and the conservation of the same by virtue of the application of the national and European regulations of reference and having examined every risk connected activities mentioned above.
Access to some sections of the site and / or any requests for information or services by users of the site can be subject to the insertion of personal data, whose processing will take place in compliance with the General Data Protection Regulation (EU Regulation 2016/679) and the national legislation in force.
This information is intended to allow users to know, even before accessing the various sections of the site and providing their data, how Green Valley Srl processes the personal data of users and it will in any case be necessary for the user to do so. read before giving your personal data by filling in the appropriate spaces in the various sections of the site, providing consent to the processing of data.
The processing will be carried out manually and electronically or in any case with the aid of computerized or automated tools.
According to the rules of the Code and the Regulation, the treatments carried out by the Data Controller will be based on principles of correctness, lawfulness and transparency and protection of confidentiality.
2. Object of the treatment and method of collection
The Data Controller processes personal, identification data (for example, name, surname, address, social security number, telephone number, e-mail address, bank and payment reference) - hereinafter, "personal data" or even "data" communicated by the interested party on the occasion of the conclusion of the contract for the services offered by the Data Controller.
The personal data being processed were collected directly by the interested party.
In addition to personal data provided directly by the user, when connecting to the site, the computer systems and software procedures used to operate the site indirectly acquire some personal data whose transmission is implicit in the use of internet communication protocols.
3. Purpose of processing and legal bases
The provision of data is optional, but it is, in part, necessary (i.e. for data whose boxes are marked with an asterisk) so that Green Valley can meet the user's needs within the scope of the site's functionality.
Failure, partial, incorrect provision of personal data marked with an asterisk, as necessary for the execution of the requested service, does not make such execution possible; while the partial or incorrect provision of unnecessary optional personal data does not entail any consequence.
Personal data will be processed by the Data Controller primarily exclusively for purposes strictly connected and instrumental to the fulfillment of the obligations inherent in the contractual relationship, the pre-contractual and tax obligations and the fulfillment of obligations under current legislation and in particular:
a) to conclude the contracts for the services offered by the Data Controller;
b) fulfill the pre-contractual, contractual and tax obligations deriving from existing relationships with the interested party;
c) for the management of receipts / payments;
d) to fulfill the obligations established by the civil and / or tax laws;
e) to fulfill the obligations established by a regulation, both nationally and internationally, by community legislation or by an order of the Authority (such as for anti-money laundering);
f) to exercise the rights of the owner, for example, the right to defense in court.
Access, communication and dissemination of personal data for the pursuit of the primary purposes of the processing.
In all the cases described above for the pursuit of the primary purposes, the data of the interested party may be made accessible and brought to the attention of:
· employees, workers and internal consultants in charge of administrative, secretarial, technical or other obligations and collaborators of the Data Controller, who, operating under the direct authority of the latter, have been appointed in charge of the processing and have received, in this regard, adequate operating instructions;
· third-party companies or other subjects (by way of example: professional firms, consultants in charge of carrying out legal and / or tax activities, to subjects who carry out data processing and / or bookkeeping and consequent obligations on behalf of the Data Controller) who carry out activities on behalf of the Data Controller, in the capacity of external data processors and who, in turn, have given, in this regard, adequate operating instructions to their employees and managers.
The Data Controller may also communicate personal data externally to the following third parties to whom the communication is necessary for the fulfillment of the contract and the obligations arising from the same, the pre-contractual and tax obligations and, more generally, for the fulfillment of obligations required by current legislation.
In this perspective, personal data may be communicated by the Data Controller to the subjects indicated below:
· to the judicial and police authorities or to other public administrations for the fulfillment of regulatory obligations;
· to credit institutions for the management of collections and payments;
· to companies that carry out management and maintenance of electronic communication equipment;
· to all natural and legal persons in cases where the communication is necessary for the primary purposes of the processing.
These subjects will process the data in their capacity as independent data controllers.
Exclusion of the need to acquire consent to the processing of personal data.
In all the cases illustrated above (for the hypothesis of communication to third parties) the Data Controller is not obliged to acquire specific consent to the processing of data as all the treatments described above pursue primary purposes for which Article 24 of the Code of privacy and art. 6, paragraph 1, letters b), c) e) and f) of the Regulation exclude the need to acquire specific consent, both because the processing is necessary to fulfill an obligation established by law, by a regulation or by community legislation, or because the processing is necessary to perform obligations deriving from the contractual relationship to which the interested party is a party or to fulfill, before the conclusion of the contract, specific requests of the interested party. If the interested party does not intend to provide the personal data requested and necessary based on the foregoing, the consequence would be the impossibility for the Data Controller to fulfill the obligations and perform the contract.
4. Promotional, advertising and marketing purposes
The personal data collected as part of the signing of the contract or previous relationships that led to the formalization of the same may also be processed by the Data Controller, both in paper form (eg: filling in forms, coupons and similar paper following use in via electronic) and with automated / computerized methods, for purposes of commercial promotion, advertising communication, solicitation of purchasing behavior, market research, surveys (including telephone, online or through forms), statistical processing (in identification form), others marketing research in a broad sense (including prize events, games and competitions), hereinafter collectively referred to as "Treatment for Marketing Purposes".
By granting consent to the Processing for Marketing Purposes, the Data Subject specifically acknowledges these promotional, commercial and marketing purposes in the broad sense of the processing (including the consequent management and administrative activities) and expressly authorizes the Data Controller to proceed with this processing. both pursuant to article 23 of the Privacy Code (where the means used for the processing for marketing purposes are the telephone with operator or other non-electronic, non-telematic means or not supported by automatic, electronic or telematic mechanisms and / or procedures ), which pursuant to art. 130 of the Privacy Code (where the means used for the Processing for Marketing Purposes are e-mail, fax, sms, mms, automatic systems without operator intervention and similar, including electronic platforms and other telematic means), which - finally - pursuant to art. 6, paragraph 1, letter (a) of the Regulations.
Pursuant to the General Provision of the Privacy Guarantor of 15 May 2013 entitled "Consent to the processing of personal data for" direct marketing "purposes through traditional and automated contact tools", the interested party's attention is specifically drawn to the fact that:
1. any consent given for the sending of commercial and promotional communications, on the basis of art. 130, paragraphs 1 and 2, of the Code (i.e. through the use of e-mail, fax, sms, mms, automatic systems without operator intervention and similar, including electronic platforms and other telematic means) will imply the receipt of such communications, not only through said automated methods of contact, but also through traditional methods, such as paper mail or calls via operator;
2. the right of opposition of the interested party to the processing of their personal data for "direct marketing" purposes through the aforementioned automated methods of contact, will in any case extend to the traditional ones and, even in this case, the possibility of exercising this right in part, as provided for by art. 7, paragraph 4, of the Code, both with respect to certain means and with respect to certain treatments;
3. resta ferma la possibilità per l’Interessato che non intenda prestare il consenso nei termini sopra indicati, di manifestare l'eventuale volontà di ricevere comunicazioni per le suddette Finalità di Marketing esclusivamente attraverso modalità tradizionali di contatto, ove previste: tale volontà potrà essere esercitata gratuitamente inviando una semplice email all’indirizzo di posta elettronica: email@example.com
For the purposes of the principle of fulfillment of the privacy obligations for the owner in compliance with the principles of simplification of the same obligations (Article 2 of the Code) and pursuant to the aforementioned General Provision of the Privacy Guarantor of 15 May 2013, the Data Controller informs the Interested party that the specific consent formula available on the basis of the consent collection procedure provided for from time to time will be unitary and comprehensive and will refer to all possible means of marketing processing, pursuant to articles 23 and 130 of the Code, without prejudice to the possibility for the interested party to notify via email to the email address: firstname.lastname@example.org, a different will as to the use of certain means and not of others for the receipt, subject to consent, of marketing communications. Furthermore, again for the purposes of the principle of fulfilling the privacy obligations for the Data Controller in compliance with the principles of simplification of the same obligations (Article 2 of the Code), the Data Controller informs the Data Subject that the specific consent formula will be unitary and comprehensive and will also reference to all the different and possible marketing purposes specified here (i.e. without multiplying the consent formulas for each distinct marketing purpose pursued by the owner), without prejudice to the possibility for the interested party to notify via email to the email address: email@example.com a different selective will as to consent or denial of consent for individual marketing purposes.
To proceed with the Processing for Marketing Purposes, it is mandatory to acquire specific, express, documented, preventive and entirely optional consent.
Consequently, where the interested party decides to give specific consent, he must be informed in advance and aware that the purposes of the processing pursued are of a specific commercial, advertising, promotional and marketing nature in the broadest sense. With a view to absolute transparency, the Data Controller informs the Data Subject that the data will be collected and subsequently processed on the basis of specific consent:
1. to send advertising and information material (eg Newsletters), of a promotional nature or in any case of a commercial solicitation nature, pursuant to Articles 23 and 130 of the Privacy Code;
2. to carry out direct sales or placement of the Controller's products or services;
3. to send commercial information; carry out interactive commercial communications also pursuant to Article 58 of Legislative Decree 206/2005 through the use of email;
4. to elaborate studies, researches, market statistics;
5. to send unsolicited commercial communications pursuant to Article 9 of Legislative Decree 9 April 2003 no. 70 of transposition of the so-called Directive on Electronic Commerce 2000/31 / EEC, which provides that unsolicited commercial communications must be immediately and unequivocally identifiable as such and contain the indication that the recipient of the messages may oppose the receipt of such communications in the future.
Therefore, by giving the optional consent, the interested party specifically acknowledges and authorizes such further, possible secondary treatments.
In any case, even where the interested party has given consent to authorize the Data Controller to pursue all the purposes mentioned in points 1 to 5 above, he will remain free at any time to revoke it, by sending a clear communication to that effect without any formalities. sense to the email email address: firstname.lastname@example.org.
Following the receipt of this opt-out request, the Data Controller will promptly remove and delete the data from the databases used for processing for marketing purposes and inform any third parties to whom the data have been communicated for the same cancellation purposes. The simple receipt of the cancellation request will automatically be valid as confirmation of cancellation.
We inform you specifically and separately, as required by art. 21 of the Regulation that if personal data are processed for direct marketing purposes, the interested party has the right to object at any time to the processing of personal data concerning him carried out for these purposes and that if the interested party objects to the processing for direct marketing purposes, personal data can no longer be processed for these purposes.
5. Data processing for commercial profiling purposes
It is possible that for marketing and service improvement purposes, the Data Controller processes the so-called "profiling" data to evaluate certain aspects or to analyze or predict aspects concerning the economic situation, preferences, interests, reliability, etc.
The profiling activity may concern "individual" personal data or "aggregate" personal data deriving from detailed individual personal data.
5.1 Consent to treatment.
To proceed with a profiling treatment it is mandatory to acquire a specific, separate express, documented, preventive and completely optional consent.
Consequently, where the interested party decides to give specific consent, he must be informed in advance and aware that the purposes of the treatment pursued are of a specific commercial, advertising, promotional and marketing nature in a broad sense based on profiling treatment.
The provision of personal data to the Data Controller and the provision of both the consent to the profiling treatment and the distinct consent to the communication to third parties for the profiling treatment are absolutely optional and optional (and in any case can be revoked without formalities even after the performance) and failure to provide will not determine consequences other than the impossibility for the Owner and for any third party to proceed only with the treatments mentioned.
6. Methods, retention times of personal data and other information
Personal data will be processed in a mainly automated form, with logic strictly related to the aforementioned purposes by the staff and internal collaborators of the owner, by external subjects expressly appointed as data processors.
Apart from these hypotheses, the data will not be disclosed to third parties or disseminated except in cases expressly provided for by national or European Union law.
The data will be processed for the entire duration of the contractual relationships established and also subsequently for the time in which the Data Controller is subject to conservation obligations for legal tax purposes and for other purposes, provided for by law and / or regulations.
With reference instead to the personal data subject to processing for marketing purposes or processing for profiling purposes, the same will be kept in compliance with the principle of proportionality and in any case until the purposes of the processing have been pursued or until - if previously - the revocation of the specific consent by the interested party does not intervene.
7. Owner, managers and processors
The data controller is the Green Valley Srl, C.da Grenne snc, 98061 Ficarra (Me), P.iva 03491290833 Email: email@example.com.
The updated list of data processors and persons in charge of the processing is available at the registered office of the Data Controller and can be consulted by making an informal request, also via email at the following email address: firstname.lastname@example.org
8. Rights of the interested party
Pursuant to Article 7 of the Privacy Code and pursuant to Articles 13, paragraph 2, letters (b) and (d), 15, 18, 19 and 21 of the Regulations, the interested party is informed that he has the following rights:
a) has the right to ask Green Valley srl as data controller to access personal data, correct or delete them or limit their processing or to oppose their processing, in the cases provided;
b) has the right to lodge a complaint with the Guarantor for the protection of personal data as an interested party, following the procedures and instructions published on the official website of the Authority at www.garanteprivacy.it;
c) any corrections or cancellations or limitations of processing carried out at the request of the interested party - unless this proves impossible or involves a disproportionate effort - will be communicated by the Data Controller to each of the recipients to whom the personal data have been transmitted. The Data Controller may communicate these recipients to the interested party if the interested party requests it.
In particular, the interested party may:
1°) obtain confirmation of the existence or not of personal data concerning him, even if not yet registered, and their communication in an intelligible form;
2°) obtain the indication:
a) the origin of the personal data;
b) the purposes and methods of processing;
c) the logic applied in case of treatment carried out with the aid of electronic instruments;
d) the identity of the owner, manager and the representative appointed pursuant to art. 5, paragraph 2 of the Privacy Code and art. 3, paragraph 1, GDPR;
e) the subjects or categories of subjects to whom the personal data may be communicated or who can learn about them as appointed representative in the State, managers or agents.
9. How to exercise the rights by the interested party
The exercise of rights is not subject to any formal constraints and is free.
The address for exercising the rights is: email@example.com
Alternatively, the interested party may, at any time, exercise their rights by sending a registered letter with return receipt. to the following address: Green Valley Srl, C.da Grenne snc, 98061 Ficarra (Me).