2. Types of data processed
- personal data and contact details provided by the User at the time of registering with the Site;
- data provided in case of requests of information or assistance by the User; and
(hereafter the "Personal Data").
3. Purposes of the processing
VALAGRO shall process the Personal Data of the Users for the following purposes:
- allow the use of the services offered through the Site, including the registration with the Site through the creation of a personal account, necessary to access to Site’s restricted area;
- answering requests of information or assistance sent by the Users. This activity may be automatic, through access to the restricted area mentioned in the previous point, or through the direct contact with members of the staff, agents, distributors or other subjects appointed by VALAGRO;
- managing complaints and disputes;
- for the purposes of compliance with the applicable domestic and European law and/or to answer the requests of public authorities;
(the purposes from point a) to point d) above shall be collectively referred to as “Contractual Purposes”);
- performing a potential merger, transfer of assets, transfer of business or business unit, disclosing and transferring the Personal Data of the User to the third party/ies involved;
(the purpose under point e) shall be referred to as “Purposes of Legitimate Interest”)
- subject to the prior consent of the User, for sending direct marketing communications through traditional and electronic means (including email, SMS, MMS, social media, instant message systems, mobile applications, banners, faxes, post and telephone), for the promotion and/or sale of VALAGRO’s products and/or services, as well as for market surveys or other studies useful for the improvement of its products and/or services;
(the purposes under point e) shall be referred to as “Marketing Purposes”)
4. Legal basis of the processing
The processing of Personal Data of the User is necessary with reference to the Contractual Purposes given its essentiality for the purposes of:
- using the services of the Site with reference to the cases under Section 3, points a) to c);
- complying with the provisions of the applicable laws and regulations as provided for by Section 3, point d).
If the Users do not intend to disclose their Personal Data for such Contractual Purposes, they may not be able to use the services and functionalities of the Site.
The processing of Personal Data of the User for the Purposes of Legitimate Interest shall be carried out pursuant to Article 24, par. 1, point d) of Legislative Decree no. 196/2003 (“Privacy Code”) and for the pursuance of one of VALAGRO’s legitimate interests, which is equally balanced with the interests of the Users, since processing of Personal Data is limited to what is strictly necessary for the performance of the activities specified above pursuant to Article 6 f) of the Privacy Regulation. The processing for the Purposes of Legitimate Interest is not mandatory and the User may object to the said processing subject to the modalities under this information; however, should the User object to the said processing, his Personal Data may not be used for the Purposes of Legitimate Interest.
Finally, the processing for Marketing Purposes is optional. Should the User deny his consent, he may not receive the commercial communications under Section 3, point f). The Users may at any time withdraw their consents according to the modalities specified in this information.
5. Modalities to process the data
The Personal Data of the Users may be processed with paper and/or computer means, and they shall be protected through adequate security measures capable of guaranteeing their confidentiality and security.
6. Disclosure of the data
For the Contractual Purposes, the Personal Data of the Users may be transferred to the following categories of intended recipients, located in the European Union: (a) third party service providers that assist and advice VALAGRO with reference to the activities of the following sectors (by way of mere example): technological, administrative, legal, insurance, and IT; (b) companies of the VALAGRO group; (c) subjects and authorities whose right to access the Personal Data of the Users is expressly granted by the law, by regulations or other measures issued by the competent authorities. Such intended recipients, depending on the case, will process the Personal Data acting as data controllers, data processors, or other persons in charge of the processing.
For the Purposes of Legitimate Interest specified above, the Personal Data of the Users may be transferred to the following categories of intended recipients, located in the European Union: (a) third party service providers that assist and advice VALAGRO; (b) companies of the VALAGRO group; (c) potential buyers of VALAGRO and entities resulting from the merger or any other form of transformation regarding VALAGRO; and (d) competent authorities.
For the Marketing Purposes specified above, the Personal Data of the Users may be transferred to the following categories of intended recipients, located in the European Union: (a) third party service providers that assist and advice VALAGRO with reference to the activities involving the sending of commercial communications; and (b) companies of the VALAGRO group.
A complete list of data processors appointed by VALAGRO is available upon request through the modalities specified in this information.
7. Transfer of data abroad
The Personal Data may be freely transferred outside the domestic territory to countries located in the European Union. Any transfer of the Personal Data of the User to Countries located outside the European Union shall take place, in any case, in compliance with the appropriate and adequate guarantees for the purposes of the transfer pursuant to the applicable rules and regulations and in particular pursuant to Articles 45 and 46 of the European Privacy Regulation.
8. Rights of the Users
The Users may exercise the following rights at any time, free of charge, by sending an email at firstname.lastname@example.org:
- obtain from VALAGRO confirmation as to whether or not the Personal Data concerning them exist, and receive information about the contents and source of the Personal Data, verify the accuracy thereof and request the Personal Data be integrated, updated, or rectified;
- obtain the erasure, anonymization or the blocking of the Personal Data that have been processed in breach of the applicable law, if any;
- object in whole or in part to the processing on legitimate grounds; and
- withdraw at any time the consent to the processing of Personal Data (in relation to the processing operations for which such consent is possibly necessary) without prejudice to the lawfulness of the processing based on the consent given prior to withdrawal.
In addition to such rights, the Users shall also have the right, which may be exercised at any time, to:
- ask VALAGRO to limit the processing of their Personal Data in the case that: (i) the Users contest the accuracy of their Personal Data for a period enabling VALAGRO to verify their accuracy; (ii) the processing is unlawful and the Users oppose the erasure of their Personal Data and requests the restriction of their use instead; (iii) although VALAGRO no longer needs the Personal Data for the purposes of the processing, the Personal Data are necessary to the Users for the establishment, exercise or defence of legal claims; (iv) the Users have objected to the processing pursuant to Article 21(1) of the European Privacy Regulation pending the verification as to whether or not VALAGRO has compelling legitimate grounds to continue the processing which override those of the data subject;
- object to the processing of Personal Data;
- request the erasure of the Personal Data concerning them without undue delay;
- obtain the portability of the Personal Data; and
- lodge a complaint with the competent data protection authority where the necessary requirements for that are met.
9. Retention periods
- for the Contractual Purposes and Purposes of Legitimate Interest, the Personal Data shall be stored for a period equal to the period of use of the services offered through the Site and for the 10 years following the termination thereof, save for the cases in which the storage for a subsequent period is required in the context of a legal proceeding, or by a request of the competent authorities or pursuant to the applicable laws and regulations;
- for Marketing Purposes, the Personal Data shall be stored for the time of the registration of the User with the Site, and thereafter for 24 months following deactivation or cancellation of the account;
Once the above-mentioned terms have expired, the Personal Data of the User may be erased, anonymised, and/or aggregated.
10. How can the controller be contacted?