DATA PROCESSING POLICY


The Carosello di D’Arpa Roberta & C. s.n.c. (hereinafter: "Titleholder”), as supervisor of the tours.paololeo.it website, owned by Cantine Paolo Leo s.r.l., pursuant to ex art. 13 and 14 of EU Regulation 2016/679 (hereafter, the "Regulation"), concerning the protection of individuals with regard to the Processing of Personal Data (hereafter, the "Data"), provides the following information.

1.Titleholder of Data processing

The “Titleholder” of Data processing is Carosello di D’Arpa Roberta & C. s.n.c., in the person of its current legal representative, headquartered in San Donaci (BR), via Mesagne, 9 – P. C. 72025 - e-mail: tours@paololeo.it.

2.Type of processed Data

The Personal data collected, directly provided by the Interested party or through the website www.tours.paololeo.it, independently or through third parties, or acquired from third people, are: Cookies, Usage data, Identification data of the Interested party (name and surname, place of birth, tax code, registered residence and domicile, e-mail address, telephone number).
The Interested party, by filling in the contact form inserted in the aforementioned website with his/her data, consents to their use to respond to requests for information, quotes, or any other kind of request indicated by the form header.
The Regulation, in art. 9, defines "particular" those data suitable to reveal racial or ethnic origin, political opinions, religious or philosophical convictions, or trade union membership, as well as genetic data, biometric data intended to uniquely identify a natural person , data relating to the person's health or sexual life or sexual orientation.
The Titleholder, in relation to the purposes indicated in this statement, does not process particular Data.
Any use of Cookies - or other tracking tools - by the website www.tours.paololeo.it or by the owners of third party services used by the aforementioned website, unless otherwise specified, has the purpose of providing the service requested by the Interested party, as well as the additional purposes described in this document and in the Cookie Policy, if available.
The Interested party assumes responsibility for the personal data of third parties obtained, published or shared through the aforementioned website and guarantees that he has the right to communicate or disseminate them, freeing the owner from any liability to third parties.

3. Purpose of data processing, legal basis, mandatory or optional nature of providing them.

The Titlehoder processes the Data of the Interested party for the following purposes by adopting specific legal bases from time to time.
a) Contractual purposes, connected and instrumental to the establishment and management of contractual relationships with the Titleholder, aimed at concluding a contract to take advantage of the wine tour services.
For the pursuit of these purposes, the data processing is to be considered necessary for negotiations, for the conclusion and execution of the contractual relationship. Therefore, without the provision of data, no contract can be stipulated with the Titleholder, nor can any preliminary information be provided. Pursuant to the art. 6 of the Regulation, therefore, the express consent of the Interested party to the data processing will not be required for the pursuit of this purpose. The legal basis, in fact, is the execution of the contract and / or pre-contractual measures.
b) Fulfillment of all the obligations of the Titleholder, established by law, by the regulations and by the community legislation, as well as dispositions given by public Authorities and / or by the Supervisory and control body. For the pursuit of these purposes, the Data processing is to be considered necessary for the execution of the contractual relationship. Therefore, without the provision of data, no contract can be stipulated with the Titleholder. Pursuant to the art. 6 of the Regulation, therefore, the express consent of the Interested party to the data processing will not be required for the pursuit of this purpose.
c) Promotion of products and services of the Titleholder and of the subsidiaries, affiliates or associates, also through specialized companies, carried out by sending advertising material, telephone contacts and any other form of electronic communication; survey of the degree of satisfaction with the quality of the services, carried out both directly by the Titleholder and through third-party operators specialized in this, through telephone interviews, interactive questionnaires, market surveys. Marketing activities through its Lead Generation. Despite the right of the Interested party to refuse for free and despite the possibility that the Titleholder uses the e-mail addresses and telephone numbers provided by the Interested party without requiring the consent of the latter with given limits to the offer of services or products similar to those covered by the contractual relationship already stipulated, for the pursuit of this purpose, the provision of the Data of the Interested party is optional and is not necessary to stipulate contracts with the Titleholder.
For the pursuit of this purpose, the express consent of the Interested party is required. The Interested party may grant or deny his consent, and may revoke it at any time with the procedures laid down by the following point "Rights of the Interested party". In the event that the Interested party denies his consent, this purpose cannot be pursued; in case the interested party revokes his consent, this purpose can no longer be pursued after the revocation.
d) For security purposes, it should be noted that the Titleholder, at its offices, also processes the Data through video surveillance systems: the information relating to these types of treatment is available at the premises where the systems are installed.
e) For purposes related to the exercise or protection of a right of the Titleholder in court procedure or out-of-court procedure, even in the event of non-execution of the contract. In this case, the legal basis of Data processing will be the legitimate protection interest of the Titleholder.
f) For purposes related to IT security activities relating to: the control and monitoring, for security purposes, of the use of the instrumentation and IT infrastructure of the Titleholder; the implementation of data breach detection and notification procedures. In this case, the legal basis of Data processing will be the execution of the contract stipulated between the Titleholder and the Interested party; the fulfillment of legal obligations (for the detection and notification of data breach events); the legitimate interest consisting in ensuring the correct management of the IT infrastructure.
g) For statistical surveys and for needs to improve the earned service. In this case the legal basis of treatment will be the legitimate interest of the Titleholder.

4. Data processing modality.

The Data processing is carried out in a non-automated way (paper), as well as with the aid of electronic tools and computerized methods, according to logic related to the purposes indicated above and, in any case, in order to guarantee the security and confidentiality of the Data themselves.
The Titleholder guarantees that personal data, which are found to be in excess or not pertinent to the purpose for which they are collected and processed, even after checks, will not be used except for any conservation (pursuant to the law) of the act or of the document containing them.
Personal data are stored in paper, IT and electronic archives, located within the European Economic Area ("EEA").

5. Terms of data storage.

In accordance with the requirements of Art. 13, paragraph 2, lett. a) of the Regulation, we inform you that the Data are kept until the expiry of the ten-year term connected to the legal obligations and the limitation periods. After this deadline, the Titleholder adopts technical and organizational measures to ensure that the Data are deleted. The data can be kept for an even longer period if this should become necessary to guarantee the management of the contract and the fulfillment of legal obligations.
Once the purposes that legitimize the storage and processing of the personal data of the interested party have been completed, the Titleholder will take care to delete them or make them anonymous within 6 months from the cessation of the reasons for the conservation and treatment.

6. Categories of people to whom the Data may be communicated.

In carrying out its activities, and in relation to the purposes indicated above, the Titleholder will process the Data of the Interested party mainly within its corporate structure, taking advantage of people authorized to processing Data and the Data Processors who, therefore, will have access to the Data of the Interested party. Furthermore, the Data, in relation to the purposes indicated above, can be communicated outside the company to the following categories of people.
a) Subsidiaries, companies controlled by the Titleholder or companies connected, even if negotiated, to the Titleholder.
b) Persons who carry out professional assistance and consultancy activities in favor of the Titleholder (such as, accountants, lawyers, auditing firms that certify the financial statements, companies that provide IT services necessary for the functioning of the systems and applications involved in the treatment).
c) People who carry out marketing activities on behalf of the Titleholder; this communication may take place with specific reference to the purposes indicated under letter "c" of point 3 above.
These people belonging to the categories indicated above will operate on the basis of specific instructions received by the Titleholder and will be appointed, pursuant to articles 28 or 29 of the GDPR.
Employees and collaborators operating within the organization of the Data Controller or on behalf of the latter may also become aware of the Data, as "authorized persons" or "Data Processors".

7. Transfer abroad.

The personal data of the Interested party will not normally be transferred outside the EEA. In case it should be necessary to transfer personal data outside the EEA, for the management or for the execution of the contractual and pre-contractual relationship or if required by law, the Titleholder will guarantee a level of protection similar to the European one, as required by Chapter V of the GDPR. For further information on the mechanism used for the transfer of Personal data outside the EEA, it is possible to contact the Titleholder at the addresses indicated in Chapter I above.

8. Rights of the Interested party.

The Interested party has the right to ask the Titleholder to access his Data and to correct or cancel them or to limit their Process or to oppose their Process.
The Interested party has the right to data portability, and in particular has the right to receive his Personal Data provided to the Titleholder in a structured format, commonly used and readable by an automatic device. Furthermore, he has the right to transmit such Data to another Titleholder without hindrance by the latter, if the Data processing is based on Consent or on a contract, and the data processing is carried out by automated means.
In exercising his rights in relation to Data portability, the Interested party has the right to obtain the direct transmission of Data from one Titleholder to another, if technically feasible.
If the Data processing is based on article 6, paragraph 1, letter a), or on article 9, paragraph 2, letter a) of EU Reg. 679/16, the Interested party has the right to withdraw the consent in any moment without prejudice to the lawfulness of the Data processing based on the consent given before the revocation; in this case, the revocation of Consent will prevent any further execution of the intellectual work contract stipulated with the Titleholder.
The Interested party, pursuant to the articles 77 and following of EU Reg. 679/16, for the protection of his rights concerning the Data processing, has the right to lodge a complaint with the Data Protection Authority and to appeal to the judicial authority.
If the right of objection is exercised, the Titleholder will refrain from further processing the data on which this right has been exercised. The Titleholder may however continue to process the data if i) proves that the interests or fundamental rights and freedoms of the Interested party that requires the protection of Personal data are not prevalent in comparison with the binding legitimate reasons on which the Data processing is based; ii) the Data are used to ascertain, exercise and defend the rights of the Titleholder in court.
If Personal data should be processed for direct marketing purposes, the Interested party has the right to object at any time to the processing of Personal data concerning him and carried out for these purposes, including any profiling in so far as it is connected to direct marketing activities.
In the event that Personal data are processed for scientific or historical research purposes or for statistical purposes, the Interested party, also in this case for reasons related to his particular situation, has the right to object to the processing of Personal data, unless the Data processing is necessary for the performance of a public interest tasks.
The rights in question may be exercised by submitting a request to the Titleholder at the addresses indicated in Article 1.
The Titleholder will proceed to process the request of the Interested party concerning the exercise of his right without delay and, in any case, at the latest within one month of receiving it. The deadline can be extended for two months, if necessary, taking into account the complexity and the number of requests received. In such cases, the Titleholder will inform the Interested party about the reasons of the extension within one month of receiving the request.
It should be noted that if the requests of the Interested party are manifestly unfounded or excessive, in particular for their repetitive nature, the Titleholder can:
- charge the interested party a reasonable cost contribution, taking into account the administrative costs incurred to provide the information and documentation requested;
- refuse to satisfy the request

9. Cookie Policy

This website uses only technical cookies