Information on data processing

Art. 13 and art. 14 EU Reg. 679/2016

We inform you that the processing of your personal data will be carried out with fairness and transparency, for lawful purposes and protecting your privacy and your rights, and also inform you of the following.

The processing of personal data means any operation or set of operations, carried out with or without the use of automated processes and apply to personal data or collections of personal data, even if not recorded in a database.

Data controller

The company PODERE L’AGAVE srl,

based in Via G.B. Sammartini, 19  20125 Milano (MI)

(VAT 10420690967) Certified Email: poderelagave@pec.it   MAIL: info@poderelagave.com

Tel.: 0565.703171 Fax: 0565.705905, (di seguito, la “Società”) informa di essere Titolare del trattamento.

Source of data processed

The personal data held by the company are collected from the client (data subject) by acquisition, orally and/or on paper and/or electronically, at our registered office and/or operations site or on the website www.poderelagave.com (“site”) in the registration area dedicated to purchasing/ reservations /requests for information about products and services.

Subject of processing

The company processes the personally identifiable information (e.g., name, surname, company name, address, e-mail, telephone, bank account) you supply for the conclusion of contracts for the supply of hotel and/or catering services rendered by the Controller.

When appropriate and at your request, the company processes special categories of data – mostly regarding needs arising from health conditions and in any case related to service provision by the controller.

These data are obtained, however just because you supply during the provision of the service and/or catering.

Purpose and legal basis of personal data processing

Personal information and data belonging to special categories supplied can be used for the following purposes:

  • a – to fulfil the obligations arising from the contract or to take pre-contractual measures, including its particular needs/demands;
  • b – in order to comply with legal obligations to which they are subject, including any administrative, accounting and tax activities connected to the requested service;
  • c – to fulfil the obligation laid down in article 109 of the R.D. 18.6.1931, No. 773, which requires us to record and report to the police the identity of the customers accommodated;
  • d – as necessary to establish, exercise or defend a legal claim;
  • e – to send communications aimed at promoting and/or the direct sale of products or services similar to those you have already purchased (so called “soft spamming”), without prejudice to its right to object at any time;The processing of data for the purpose 2 sub a) does not require his consent because the processing is necessary for the fulfilment of specific contractual obligations regarding your request for services, in accordance with art. 6, c. 1, par. GDPR b).

Purposes of personal data processing

2. b) and 2 c) does not require your consent, as it is necessary to fulfil the legal obligations governing the controller, pursuant to arts. 6, c. 1, par. c GDPR).

2. d), and 2. e) does not require your consent as it is necessary for the purposes of the legitimate interests of the Controller, pursuant to arts. 6, c. 1, par. f GDPR).

Provision of data and consequences of refusal

The provision of data for the purpose under 2.2), sub b) and 2, c) is required to comply with the legal and contractual obligations by the data subject and the Controller.

The provision of data for the purposes under 2. d), and 2. e) is necessary for the purposes of the legitimate interests of the companies listed above.
In all these cases, the missing data will make it impossible for the Company to respond to your request for product/service/subscription and thus to conclude the contract.

Data controller

The processing of personal data is carried out by means of the operations indicated in art. 4, No. 2) GDPR and namely through: collection, recording, organization, storage, consultation, processing, modification, selection, extraction, comparison, use, interconnection, blocking, communication, cancellation and destruction of data.
The personal data will be processed using manual, computerized and electronic logic strictly correlated to the same purposes to ensure the security and confidentiality of data.

Type, time and method of retention of data processed

These data will be stored in accordance with the principle of proportionality and relevance and not excessively and in any case only until the processing purposes have been attained or until- if previously made- withdrawal of consent by the data subject if necessary.
However, the processing controller believes that maximum data retention must be identified as no longer than 10 years following its registration/collection. This period is considered to be reasonable and proportionate to the purposes of marketing and profiling that we intend to achieve, considering the type of personal data processed and purposes thereof.
The Processer will process the data belonging to special categories for as long as necessary to fulfill the purposes set out above and in any event within 30 days of the end of the stay, barring special situations resulting either from the need to maintain such data for a longer time (for example and not exhaustively in the presence of tax exemptions in your favor related to a disability).
Upon expiration of this retention period, the personal data shall automatically be deleted or rendered anonymous in a permanent and irreversible manner.
The data are kept, as stated, in the files present at the site and/or on servers in Italy and the data controller is the company.
If the company decides to rely on other companies for the technical management of the database or for the management and implementation of profiling and marketing activities, such persons will be designated as data processors and follow the instructions issued by the company both contractually and in the letter of appointment for the processor.

Data access

Your data may be made available for the purposes specified in items a), b) and c):

-to employees and associates of the Controller, in their capacity as persons in charge of processing and/or processors and/or system administrators and with the pertinent appointment document.

-to third party companies or other entities (indicatively, professional firms, consultants, insurance companies, service companies, etc.) outsourced activities on behalf of the Controller, in their capacity as external delegates and/or processors for the data processing.

All those appointed will perform exclusively processing operations, on behalf of the Controller and/or the Processor, within the limits, in the forms and in accordance with the procedures set forth in the respective documents of nomination and/or election and/or appointment.

Provision of data and consequences of refusal to reply

The provision of data for the purposes set out in points a), b) and c), is required. In their absence, we will not be able to provide the services referred to in point a).

Deletion of data

Without the need for express consent (ex art. 6 par. GDPR), b) and c) the Processer may disclose your data only for the purposes stated in item a) to control authorities and judicial authorities and to those persons to whom such disclosure is required by law to carry out the purposes mentioned.
These subjects will process data in their capacity as independent data controllers.

Data Controller and Processors

The data processing controller is the company mentioned in the first paragraph.
In addition, the list of data controllers in outsourcing, of which the writer uses, can be consulted at any time at the company’s headquarters.
The updated list of data Processors (if appointed); can be found at the premises above and/or on the site.

Rights of the data subject and how to exercise them

As data subject, you have the rights under art. 15 GDPR, namely the rights to request and obtain from the processor -without “justified delay”–confirmation of whether or not personal data processing concerning the data subject is ongoing, and the following information:

  • a) Purpose of processing;
  • b) the categories of personal data;
  • c) the recipients or categories of recipients to whom the personal data have been or will be provided;
  • d) the period of retention of personal data;
  • e) the existence of the right of the data subject to ask the data controller to correct or delete personal data or to oppose its processing.

The data subject has the right to obtain the updating, integration of information, its cancellation, transformation into anonymous form or blocking of data processed unlawfully; the processer has the right to oppose, for legitimate reasons, the processing of data.
Where applicable, shall also have the rights laid down in articles. 16-21 GDPR:

  • f) right of correction;
  • g) right to be forgotten;
  • h) right to limitation of processing;
  • i) right to data portability;
  • l) right to object as well as rights to claim authority.

The data subject may exercise the above rights at any time by sending an e-mail to: info@poderelagave.com or a registered letter to our Office Via G.B. Sammartini, 19 20125 Milano (MI)

Data transfer to foreign countries (outside the EU)

Or your data will not be disclosed and will not be transferred to third countries or to international organizations.

Information on data processing for marketing purposes and to transfer data to third parties for such purposes

Reg. UE 679/2016

“Processing” means any operation or set of operations, carried out with or without the use of automated processes and applied to personal data or personal data sets, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, comparison or interconnection, restriction, cancellation or destruction.

Source of data processed

The personal data held by the company are collected from the client (data subject) by acquisition, orally and/or on paper and/or electronically, to our registered office and/or operations site or on the website www.poderelagave.com (“site”) in the registration area dedicated to unsolicited promotional information on products and services.

Subject of processing

The company processes the personally identifiable information (e.g., name, surname, company name, address, e-mail, telephone, bank account) you supply for the conclusion of contracts for services rendered by the Controller.

Purposes of personal data processing

Promotional, advertising and marketing purposes in general.

Processing for marketing purposes is the only processing provided regarding the data subject wishing to provide their consent by signing this form and/or registering on the site.

The company states that the data collected may be processed to:

  • send information and advertising material, or solicitation of promotional or commercial nature;
  • carry out direct sales or placement of products or services of the company;
  • send commercial information or interactive commercial communications pursuant to article 58 of Decree 206/2005 through the use of email;
  • process studies, research, and market statistics;
  • send unsolicited commercial communications in accordance with article 9 of Legislative Decree 9 April 2003 n. 70 transposing E-commerce directive 2000/31/EEC.

Please be informed specifically and separately, as required by art. 21 of the Regulation that the data subject shall have the right to object at any time to the personal data processing concerning him or her processed for such purposes and that if the party concerned objected to the processing for direct marketing purposes, personal data will no longer be processed for such purposes.

In case of service provided through the website, please note that accessing and browsing of the site are free but the ability to receive marketing communications is permitted only with the prior written consent or by registering on the site.

Purpose of communication and disclosure of personal information for promotional purposes, advertising and marketing in general.

For the same purposes as referred to in the preceding Paragraph, the company shall inform the data subject that the data may also be communicated to third party business partners.

Consent to processing for Marketing purposes – if given by the data subject does not also cover different and additional marketing processing represented by the data communication to third parties for the same purposes.

For making such disclosure, it is mandatory for acquisition of the data subject’s informed consent to be additional, separate, additional, documented, measured and entirely optional.

The other addressees of the communication of personal data of data subjects for further processing for Marketing purposes can be identified with reference to the following and the following marketing or economic categories:

  1. a) third parties belonging to the sectors of publishing, sports clubs, suppliers of goods and services by electronic communication, Internet service providers, advertising agencies, companies providing insurance and financial services, companies in the food and catering industries, clothing, ICT hardware and software, banks and credit institutions, travel agencies, companies offering services in the tourism sector, companies offering services and goods for the person, supply company of goods and services in the electricity and gas sector.

In case of request, for the purposes illustrated above, for the data subject’s telephone number, and upon optional and specific consent (which also covers personal data processing) for the of commercial promotion and marketing purposes described above, the company shall inform the data subject that the third parties may lawfully process the telephone use for marketing purposes, even if it is registered in the public record of opposition, as it is a different source from public telephone directories and covered by specific consent, subject to the right of opposition subsequent to processing if the consent is formally revoked.

Purposes of personal data processing

The personal data will be processed using manual, computerized and electronic logic strictly correlated to the same purposes to ensure the security and confidentiality of data. This is also the case when using alternatives to traditional channels (“remote channels”), such as telephone services, telecommunication services and other channeling initiatives based on interaction via the internet.

Data controller

The company Podere L’Agave srl based in Via G.B. Sammartini, 19  20125 Milano (MI)

(VAT 10420690967)  Certified email: poderelagave@pec.it MAIL: info@poderelagave.com

phone: 0565.703171 Fax: 0565.705905, (hereinafter, the “company”) reports being the data controller.

Subjects or categories of entities to which the personal data can be communicated (Processors or Agents)

Your data may be disclosed to the entities designated by such companies as processing Controllers and/or Processors.

The list of processors is available from our registered office.

Subject to your consent, the company may disclose your personal information to third parties who, acting autonomously, may process the same, using automated means of communication (i.e. pre-recorded phone calls, e-mail, fax, sms, mms, app ), for the purposes of commercial information, market research, promotion and sale of their products and services.

The address for the exercise of the rights (including with respect to instances directed to third parties to whom the data was communicated upon specific consent of the data subject) is certified email: poderelagave@pec.it– Email: info@poderelagave.com

Type, Time and method of retention of data processed.

The data that the company intends to retain in its data base are: customer identification data and details about purchases as well as comments and ratings by the data subject about the products and/or services purchased.

These data will be stored in accordance with the principle of proportionality and relevance and not excessively and in any case only until the processing purposes have been attained or until- if previously made- withdrawal of consent by the data subject.

However, the processing controller believes that maximum data retention must be identified as no longer than 5 years following its registration. This period is considered to be reasonable and proportionate to the purposes of marketing and profiling that we intend to achieve, considering the type of personal data processed and purposes thereof.

Upon expiration of this retention period, the personal data shall automatically be deleted or rendered anonymous in a permanent and irreversible manner.

The data are kept, as stated, in the files present at the site and/or on servers in Italy and the data controller is the company.
If the company decides to rely on other companies for the technical management of the database or for the management and implementation of profiling and marketing activities, such persons will be designated as data processors and follow the instructions issued by the company both contractually and in the letter of appointment for the processor.

Rights of the data subject

The data subject is hereby informed that:

  • a) the data subject is entitled to ask the company as data controller for access to personal information, correction or cancellation or limitation of processing concerning the data subject or to oppose its processing, in the cases provided for; 
  • b) the data subject has the right to submit a complaint to the personal data protection authority, following the procedures and guidelines that are published on the official website at www.garanteprivacy.it; 
  • c) the data subject is authorized to request any corrections, cancellations or restrictions of processing carried out at the request of the data subject-unless this proves impossible or involves a disproportionate effort; those requests will be sent by the company to each of the recipients to whom personal data have been transmitted. The company may inform the data subject of such recipients on request. The exercise of rights is not subject to any formal constraint and is free.