PRIVACY POLICY SUMMARY

CONTACT INFORMATION

Data Controller:

ComCart S.r.l., an Italian company with registered office in Gatteo a Mare (FC), via Matteotti 43, Tax Code and VAT number 04412340400

Email address: info@comcart.it

PERSONAL DATA COLLECTED BY THE WEBSITE FOR THE FOLLOWING PURPOSES (USING THE INDICATED SERVICES)

Purpose:

• Contacting the User

Tools:

– Contact form

Personal Data: first and last name, email address, Cookies, Usage Data, other types of Data.

– Mailing list or newsletter sending (if the User has subscribed to the related service).

Personal Data: first name; last name; email address; Cookies, Usage Data, other types of Data.

• Statistics

Tools:

-Google Analytics with anonymized IP

Personal Data: Cookies and Usage Data

-Google Tag Manager

Personal Data: Cookies, Usage Data, other types of Data.

• Displaying content from external/third-party platforms

Tools:

-Instagram, Facebook, Stripe

Personal Data: Cookies; Usage Data; other types of Data.

• Managing contacts and sending messages and/or newsletters

Tools:

• Interaction with external data collection platforms and other third parties

Tools:

-Google invisible reCAPTCHA

Personal Data: Cookie; Usage Data; other types of Data.

-Google Tag Manager

Personal Data: Usage Data; other types of Data.

• Behavioral targeting and remarketing

Tools:

-Facebook and Instagram Remarketing

Personal Data: Usage Data; email, Cookies, other types of Data.

Personal Data: first name; last name; email address, phone number, gender, date of birth, Skin Data, Data on purchased/interested products, Cookies, Usage Data, other types of Data.

 

• Registration and authentication

Tools:

-WordPress.com

Personal Data: various types of Data.

• Platform services

Tools:

-WordPress.com

Personal Data: various types of Data.

***

FULL PRIVACY POLICY

The Data Controller, as better defined below, considers the privacy of its Users to be of fundamental importance and ensures that the processing of Personal Data is carried out in compliance with the current privacy regulations, and in particular with the European Regulation no. 2016/679 and the national legislation on personal data protection, D. Lgs. 196/2003 as still in force and the related national adaptation legislation D. Lgs. 101/2018 on personal data protection. To this end, the  Data Controller has adopted the following Privacy Policy to regulate and inform the Users of the Site www.fruttetoitalia.com about the methods and purposes of processing the Personal Data of the Users themselves.

The User is kindly requested to review this document each time they connect to the Site, as it may be subject to revisions, additions, and/or changes, occasioned by regulatory requirements and/or changes and/or additions to the functionalities of the Site itself.

Data Controller:

ComCart S.r.l., an Italian company with registered office in Gatteo a Mare (FC), via Matteotti 43, Tax Code and VAT number 04412340400

Email address: info@comcart.it

TYPES OF DATA COLLECTED

Among the Personal Data collected by www.fruttetoitalia.com as well as by all landing pages connected and/or related to it (hereinafter for brevity the “Site“), independently or through third parties, to whose privacy policy reference is made, there are: email, personal data of various nature as better specified below, cookies, and usage data.

Complete details on each type of data collected are provided in the dedicated sections of this privacy policy, or through specific information texts displayed before the data collection itself.

Personal Data may be freely provided by the User or, in the case of Usage Data, collected automatically during the use of the Site.

Unless otherwise specified, all Data requested by the Site is mandatory. If the User refuses to provide them, it may be impossible to provide the Service.

In cases where some Data is indicated as optional, Users are free to refrain from communicating such Data, without this having any consequence on the availability of the Service or its operation.

Users who have doubts about which Data is mandatory are invited to contact the Controller.
The possible use of Cookies by the Site or by the third-party service owners used by the Site, unless otherwise specified, is intended to provide the Service requested by the User, in addition to the other purposes described in this document and in the Cookie Policy, if available.

The User assumes responsibility for the Personal Data of third parties obtained, published, or shared through the Site and guarantees to have the right to communicate or disseminate them, releasing the Controller from any responsibility towards themselves and third parties.

METHODS AND PLACE OF PROCESSING OF THE COLLECTED DATA

The Data Controller adopts appropriate security measures to prevent unauthorized access, disclosure, modification or destruction of Personal Data.

The Processing is carried out using IT and/or telematic tools, with organizational methods and with logics strictly related to the purposes indicated. In addition to the Controller, in some cases, other subjects involved in the organization of the Controller and/or in the management of the Site (by way of example and not limited to: administrative, commercial, marketing, legal, system administrators, etc.) or external subjects (by way of example and not limited to: accountants, external legal advisors, third-party technical service providers, postal couriers, hosting providers, IT companies, communication agencies and/or, address management and email message sending service providers, etc.) may have access to the Data, also appointed, if necessary, as Data Processors by the Controller. The updated list of Data Processors may be requested at any time from the Data Controller.

LEGAL BASIS OF PROCESSING

The Controller lawfully processes Personal Data relating to the User if one of the following conditions exists:

• the Data Subject has given consent to the processing of their Personal Data for one or more specific purposes, pursuant to GDPR, art. 6, paragraph 1, letter a). Note: in some jurisdictions, the Data Controller may be authorized to process Personal Data without the User’s consent or without another of the legal bases specified below, until the User objects (“opt-out”) to such Processing. However, this does not apply if the Processing of Personal Data is regulated by European legislation on personal data protection;
• the Processing is necessary for the performance of a contract with the User and/or for the implementation of pre-contractual measures, pursuant to art. 6, paragraph 1, letter b) of the so-called GDPR 2016/679;
• the Processing of Personal Data is necessary to fulfill a legal obligation to which the Controller is subject, pursuant to GDPR, art. 6, paragraph 1, letter c);
• the Processing is necessary for the protection of the vital interests of the data subject or another natural person, pursuant to GDPR, art. 6, paragraph 1, letter d);
• the Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the Data Controller, pursuant to art. 6, paragraph 1, letter e) of the GDPR;
• the Processing of Personal Data is necessary for the pursuit of the legitimate interest of the Data Controller or third parties, unless such interests are overridden by the interests or fundamental rights and freedoms of the Data Subject that require the protection of personal data, in particular where the Data Subject is a minor, all pursuant to GDPR, art. 6, paragraph 1, letter f).

Pursuant to art. 6 of the GDPR, Personal Data acquired through the Site without the Data Subject’s consent will be processed by the Data Controller for the management and maintenance of the Site, to allow the use of the Services, to satisfy User requests, to enable effective communication with customers, to fulfill obligations provided by law, regulations, community legislation or orders of the Authorities or in any case for purposes related to the activities and functions of the Controller or finally to prevent or detect fraudulent activities or abuses against the Controller through the Site.

It is always possible to request the Controller to clarify the concrete legal basis of each Processing and, in particular, to specify whether the Processing is based on the law, provided for by a contract, or necessary to conclude a contract.

PLACE OF PROCESSING OF PERSONAL DATA

The Data is processed at the registered and/or operational headquarters of the Controller and/or in any other place where the parties involved in the Processing are located and/or at the Controller’s offices and/or at other subjects or IT systems/servers of other subjects specifically designated as (external) Data Processors.

For further information, the User is invited to contact the Controller.

The User’s Personal Data may be transferred to a country different from the one in which the User is located. To obtain further information on the place of Processing, the User can consult the relevant section of this notice.

The User has the right to obtain information regarding the legal basis of the transfer of Data outside the European Union or to an international organization of public international law or constituted by two or more countries (such as the UN), as well as regarding the security measures adopted by the Controller to protect the Data. If one of the transfers just described takes place, the User can refer to the respective sections of this document or request information from the Controller (as specified in the “CONTACT INFORMATION” section).

RETENTION PERIOD

The Data are processed and stored for the time required by the purposes for which they were collected.

The User can obtain further information regarding the retention period of individual Personal Data processed by contacting the Controller (as specified in the “CONTACT INFORMATION” section).

At the end of the retention period, the Personal Data will be deleted. Therefore, upon the expiration of this period, the right of access, deletion, rectification, and the right to data portability, opposition, limitation to the processing of the same, can no longer be exercised.

PURPOSES OF PROCESSING OF COLLECTED DATA

The User’s Data is collected to allow the Controller to provide its Services, as well as for the following purposes:

• Contacting the User
• Statistics
• Displaying content from external/third-party platforms
• Managing contacts and sending messages and/or newsletters
• Interaction with external data collection platforms and other third parties
• Behavioral targeting and remarketing
• Registration and authentication
• Platform services

For further detailed information on the purposes of Processing and on the Personal Data concretely relevant for each purpose, the User can refer to the following section of this document.

DETAILS ON THE PROCESSING OF PERSONAL DATA

To verify the methods of Processing Personal Data according to the pursued purposes, the User can consult the appropriate section below.

1. Contacting the User:

In order to contact the User, the Data Controller may use the Personal Data collected through the following tools:

– Contact form; Mailing list or newsletter sending (if the User has subscribed to the related service).

Personal Data: first name; last name; email address, phone number, gender, date of birth, Skin Data, Data on purchased/interested products, Cookies, Usage Data, other types of Data.

For the contact form, the Google invisible reCaptcha service is active (see the specific section below).

For more information, the User is invited to consult the “Hubspot” section.

2. Statistics

The services contained in this section allow the Data Controller to monitor and analyze traffic data and are used to keep track of User behavior.

These purposes are pursued through the following tools:

-Google Analytics with anonymized IP;

Google Analytics is a web analysis service provided by Google for statistical purposes to understand how visitors interact with the Site, compile reports, and share them with other services developed by Google. Google Analytics may use a set of cookies to collect information and generate statistics on the use of the Site, without providing personal information about individual visitors to Google. The User’s IP address is anonymized. Anonymization works by shortening the IP address of Users within the borders of the member states of the European Union or in other countries adhering to the European Economic Area agreement. Only in exceptional cases will the IP address be sent to Google’s servers and shortened within the United States.

However, it should be noted that the data may also be processed outside the EEA.

It is also advised to the User that from July 16, 2020, Google no longer bases the Processing of Users’ Personal Data on the EU-U.S. Privacy Shield for transferring data from the European Economic Area and the United Kingdom to the United States; from September 30, 2020, more precisely, Google has updated its Personal Data Processing policy and uses the standard contractual clauses approved by the European Commission and based on the adequacy decisions of the European Commission itself regarding certain countries, depending on the cases, for data transfers from the EEA to the United States and other countries.

Regarding the use of cookies by Google Analytics, the User is invited, in any case, to carefully consult the related privacy policy and cookie policy, as well as the paragraph of this Cookie Policy “How can I give or revoke consent to the installation of Cookies?” through the browser settings and the section of this Policy relating to the Privacy Shield.

• Google Tag Manager

This Site uses Google Tag Manager. Google Tag Manager is a solution managed by Google LLC that allows managing website tags using a dedicated interface.

Google Tag Manager is a tag management system for managing JavaScript and HTML tags used for tracking and analysis on websites. Tags are small pieces of code that, among other things, are used to measure traffic and visitor behavior, to understand the effect of online advertising and social channels, to set up remarketing and targeting towards target groups, and to test and optimize websites.

The Tag Manager tool itself (which implements the tags) is a cookie-free domain and does not record Personal Data. This tool allows the activation of other tags that may, in turn, record Data under certain circumstances.

For more information on the Google Tag Manager privacy policy, please consult the following link https://policies.google.com/privacy?hl=en, for the terms of use https://www.google.com/analytics/tag-manager/use-policy/, and for privacy responses of Google Tag Manager https://support.google.com/tagmanager/answer/7207086.

Personal Data: Usage Data; other types of Data.

3. Displaying content from external/third-party platforms

This type of service allows you to view content hosted on external platforms directly from the pages of the Site and interact with them.

If such a service is installed, it is possible that, even if not actively used, it collects traffic data related to the pages where it is installed.

These purposes are pursued through:

• Facebook, Facebook Widget;

The Site features redirect or share buttons to the social platform Facebook and to individual social network pages linked to the Data Controller.

Facebook shares information globally, both internally with Facebook companies and externally with its partners and the people the User connects with and shares content with worldwide. Information controlled by Facebook may be transferred, transmitted, stored, and processed in the United States or other countries outside the EEA.

According to the related policy, Facebook may use cookies to show ads and present suggestions for businesses and other organizations to people who might be interested in their products, services, or promoted causes, to measure the performance of advertising campaigns of businesses using Facebook products, to show and measure ads across different browsers and devices used by the same person, to provide statistical data on people using Facebook products, on people interacting with ads, websites, and apps of advertisers, and on businesses using Facebook products, and to enable functionality that allows Facebook to provide its products.

Additionally, when visiting the Site, the Facebook Pixel cookie may be installed, allowing the Data Controller to monitor conversions occurring on the Site as a result of ads being run on Facebook.

Information collected through cookies may be shared with organizations outside of Facebook, such as advertisers and/or advertising networks for ad delivery and to measure the effectiveness of advertising campaigns.

Furthermore, the User is informed that as of July 16, 2020, Facebook no longer bases the Processing of Users’ Personal Data on the EU-U.S. Privacy Shield for transferring data from the European Economic Area and the United Kingdom to the United States; instead, it uses standard contractual clauses approved by the European Commission and based on the European Commission’s adequacy decisions regarding certain countries, as applicable, for data transfers from the EEA to the United States and other countries.

Regarding the Privacy Shield, the User is referred to the relevant paragraph in the cookie policy.

In this case, the following Personal Data are processed: Cookies; Usage Data; other types of Data.

For more information on the installation and use of cookies by Facebook, the User is requested to carefully review the related cookie policy. Finally, please read the privacy policy of the service carefully for detailed information on the collection and transfer of Personal Data, User rights, and how to configure privacy settings satisfactorily.

For behavioral targeting and remarketing, this Site uses Facebook remarketing services managed through Hubspot. For more information on Hubspot, the User is invited to consult the appropriate section.

• Instagram, Instagram Widget

The Site features redirect or share buttons to the social platform Instagram, owned by Facebook, and to individual social network pages linked to the Data Controller.

Facebook/Instagram shares information globally, both internally with Facebook/Instagram companies and externally with partners and the people the User connects with.

Based on the related policies, Instagram uses cookies, pixels, local storage technologies, and other similar technologies to show the User relevant content to provide the service and for reasons related to its own use, as well as to collect information about the User’s use of Instagram. Instagram may also use these technologies to remember the User’s choices (e.g., username, language, or geographic area where the User is located) and personalize the Service to offer better features and content. Instagram and its advertising partners may use these technologies to show the User ads relevant to their interests. These technologies store the User’s device visits and may also be able to track the device’s browsing activities on sites and services other than Instagram. This information may be shared with organizations outside of Instagram, such as advertisers and/or advertising networks for ad delivery and to measure the effectiveness of advertising campaigns.

Information controlled by Facebook/Instagram may be transferred, transmitted, stored, and processed in the United States or other countries outside the User’s country of residence or outside the EEA for the purposes described in the regulations at the following links: Facebook Terms; Instagram Terms.

Furthermore, the User is informed that as of July 16, 2020, Facebook/Instagram no longer bases the Processing of Users’ Personal Data on the EU-U.S. Privacy Shield for transferring data from the European Economic Area and the United Kingdom to the United States; instead, it uses standard contractual clauses approved by the European Commission and based on the European Commission’s adequacy decisions regarding certain countries, as applicable, for data transfers from the EEA to the United States and other countries.

Regarding the Privacy Shield, the User is referred to the relevant paragraph in the Cookie Policy.

In this case, the following Personal Data are processed: Cookies; Usage Data; other types of Data.

Regarding the management of cookies installed by Instagram and the related deactivation methods, the User is invited to carefully review, in addition to the related privacy policy of the service, also thecookie policy, for detailed information on the collection and transfer of Personal Data, User rights, and how to configure privacy settings satisfactorily.

Regarding the terms of use of the Instagram service, the User is finally invited to consult the said terms.

For behavioral targeting and remarketing, this Site uses Instagram remarketing services managed through Hubspot. For more information on Hubspot, the User is invited to consult the appropriate section.

 

• Stripe

Credit/debit card payment for Products sold by the Site is made through the Stripe gateway. This is a third party that may install cookies: therefore, the User is invited to read the related  privacy policy.

4. Contact management and sending messages and/or newsletters

This type of service allows managing a database of email contacts, phone contacts, or contacts of any other type, used to communicate with the User.

These services may also allow collecting data related to the date and time messages are viewed by the User, as well as the User’s interaction with them (e.g., detecting the use of links included in messages).

 

• Google invisible reCaptcha

reCAPTCHA is a free captcha service from Google that protects websites from spam software and misuse by non-human visitors. This service is mainly used when filling out contact forms to ensure that specific actions on the internet are performed by humans and not bots. Classic captchas work with small tasks that are easy for humans to solve but provide significant difficulties for machines. With reCAPTCHA, the User no longer has to actively solve puzzles. The tool uses modern risk techniques to distinguish people from bots. The only thing the User needs to do is check the “I’m not a robot” text box. However, with Invisible reCAPTCHA, even this is no longer necessary. reCAPTCHA integrates a JavaScript element into the source text, after which the tool runs in the background and analyzes the User’s behavior. The software calculates a so-called captcha score from the User’s actions. Google uses this score to calculate the probability that the User is a human before entering the captcha. reCAPTCHA and Captcha, in general, are used whenever bots could manipulate or misuse certain actions (such as registrations, surveys, etc.).

By using reCAPTCHA, data is transmitted to Google to determine if the User is truly human. reCAPTCHA thus ensures the security of our website and, consequently, also of the User.

IP addresses and other data necessary for Google’s reCAPTCHA service may be sent to Google, whose servers may be located in the USA.

First, the reCAPTCHA algorithm checks if Google cookies from other Google services (YouTube, Gmail, etc.) have already been placed in the User’s browser. Then reCAPTCHA sets an additional cookie in the User’s browser and takes a snapshot of the browser window itself.

The IP address that the User’s browser transmits to Google is generally not combined with other Google data from other company services.

However, the data will be combined if the User is logged into their Google account while using the reCAPTCHA plug-in.

If you want to prevent your data and behavior from being transmitted to Google, you must completely log out of Google and delete all Google cookies before visiting our website or using the reCAPTCHA software. Generally, data is automatically sent to Google as soon as you visit our website. To delete this data, you must contact Google Support at  https://support.google.com/?hl=en-GB&tid=111401120.

If you use our website, you agree that Google LLC and its representatives automatically collect, modify, and use the data.

You can find more information about reCAPTCHA on the Google developers page at https://developers.google.com/recaptcha/.

For more information, please read the Privacy Policy and Terms of Service of Google carefully.

Personal Data: Cookies; Usage Data; other types of Data.

 

• Google Tag Manager

This Site uses Google Tag Manager. Google Tag Manager is a solution managed by Google LLC that allows managing website tags using a dedicated interface.

Google Tag Manager is a tag management system for managing JavaScript and HTML tags used for tracking and analysis on websites. Tags are small code elements that, among other things, are used to measure traffic and visitor behavior, understand the effect of online advertising and social channels, set up remarketing and targeting towards target groups, and test and optimize websites.

The Tag Manager tool itself (which implements the tags) is a cookie-free domain and does not record Personal Data. This tool allows the activation of other tags that may, in turn, record Data under certain circumstances.

For more information on the Google Tag Manager privacy policy, please consult the following link https://policies.google.com/privacy?hl=en, for the terms of use https://www.google.com/analytics/tag-manager/use-policy/, and for privacy responses of Google Tag Manager https://support.google.com/tagmanager/answer/7207086.

Personal Data: Usage Data; other types of Data.

6. Behavioral targeting and remarketing

This type of service allows this Site and its partners to inform, optimize, and serve ads based on the User’s past use of this Site.

This activity is facilitated by tracking Usage Data and using trackers to collect information that is then transferred to partners managing remarketing and behavioral targeting activities.

Some services offer a remarketing option based on email address lists.

• Facebook and Instagram Remarketing

Facebook (and Instagram) remarketing is a remarketing and behavioral targeting service provided by Facebook Inc.

With the help of the Facebook pixel (or equivalent functions for transferring event data or contact information via interfaces or other software in apps), Facebook (/Instagram) can target visitors of this Site’s online services for ad presentation.

Therefore, this Site uses the “Custom Audiences” remarketing function of Facebook Inc.: this allows Site Users to view interest-based ads (“Facebook Ads” or “Instagram Ads”) when browsing the social networks Facebook or Instagram or other websites using this process. Thus, ads that interest the User are shown to make online offers more interesting for him/her.

The use of Custom Audience causes the User’s browser to automatically establish a direct connection to the Facebook/Instagram server.

The Data collected is processed by Facebook Inc. in the United States.

This Site has no control over the scope of Data collected and the further use of the aforementioned Data by Facebook Inc.: therefore, please read the related Privacy Policy of Facebook and the Privacy Policy of Instagram carefully.

The User can obtain more information about Facebook’s behavioral advertising by visiting this page: https://www.facebook.com/help/164968693837950

To disable interest-based Facebook ads, please follow these instructions: https://www.facebook.com/help/568137493302217

Facebook adheres to the Self-Regulatory Principles for Online Behavioral Advertising established by the Digital Advertising Alliance. To opt-out of Facebook and other participating companies through the Digital Advertising Alliance in the United States  http://www.aboutads.info/choices/, the Digital Advertising Alliance of Canada in Canada http://youradchoices.ca/ or the European Interactive Digital Advertising Alliance in Europe http://www.youronlinechoices.eu/, or disable it using your mobile device settings.

Opting out of the “Facebook Custom Audiences” feature is available for users who have logged in at https://www.facebook.com/settings/?tab=ads#.

Personal Data: Usage data; email, Cookies, other types of Data.

 

8. Registration and authentication

Tools:

-WordPress.com

To register for the restricted area and authenticate during login, this Site uses the WordPress platform. For more information on data processing by WordPress, users are invited to review the related  privacy policy.

Personal data: various types of Data.

9. Platform services

The Site was created using the WordPress.com platform.

Users are invited to review the related privacy policy.

Personal Data: various types of Data.

PRIVACY SHIELD

The Privacy Shield, or the “privacy shield” between EU and USA, is a self-certification mechanism for companies established in the USA that intend to receive Personal Data from the European Union. It was also deemed adequate by the European Commission in 2016.

In particular, companies commit to respecting the principles contained therein and to providing data subjects (i.e., all individuals whose Personal Data has been transferred from the European Union) with adequate protection tools, under penalty of removal from the list of certified companies (“Privacy Shield List”) by the US Department of Commerce and possible sanctions by the Federal Trade Commission.

However, with Decision 2016/1250 of July 16, 2020 on the adequacy of protection offered by the EU-US privacy shield regime – known as “Schrems II Judgment“, the Court of Justice of the European Union (CJEU) ruled that the Privacy Shield does not offer an adequate level of protection for Personal Data transferred from the EU to a company established in the United States.

With the same judgment, the European Court of Justice confirmed decision 2010/87, validating the standard contractual clauses for the transfer of personal data from the EU to a non-EU state.

Users are invited to consult the FAQ regarding the Schrems II judgment and its effects prepared by the European Data Protection Board (EDPB), the website www.privacyshield.gov and the Italian Privacy Authority website to better understand the issue.

COMMUNICATION AND DATA TRANSFER

The Controller specifies that maximum care and confidentiality in Data Processing is one of its fundamental values.

User Data may be communicated to third parties.

The Controller may use Data Processors and service providers for Data Processing, to the extent necessary to provide services, such as authentication services, hosting and maintenance, data analysis services, email messaging services, delivery services, payment transaction management, solvency, address and email verification.

Some of the Data Processors/service providers mentioned in the previous sections are located outside the European Union (EU)/European Economic Area (EEA). In any case, User Personal Data will be shared with countries outside the EU/EEA, provided that:

• the country in question is considered a safe third country;
• the Data Processor/service provider in question has adhered to the European Commission’s standard contracts for the transfer of Personal Data to third countries;
• the Data Processor/service provider in question is certified according to art. 40 of the GDPR or
• the Data Processor/service provider in question has approved binding corporate rules.

User Personal Data may be communicated or shared to comply with a legal obligation or the instructions of a Court/Judicial Authority or any other competent entity or to enforce or apply the Site’s Privacy Policy and/or other agreements or to protect the rights or security of the Controller, Data Processors, service providers and/or other third parties or for fraud protection or credit risk reduction.

User Personal Data, and in particular email addresses, may also be communicated or shared with companies and/or third parties with whom the Controller collaborates and/or has entered into agreements when Users have subscribed to the newsletter, expressly consenting through the “point and click” method to the transfer of said Data to companies and/or third parties for the purposes indicated in the related consent (for example Hubspot – for more information please consult the related section), including marketing purposes through Profiling.

USER RIGHTS

Users can exercise the following rights regarding Data processed by the Controller:

• right to withdraw consent at any time. Users can withdraw consent previously given for the processing of their Personal Data (see GDPR, art. 7);

• right of access. Users have the right to obtain confirmation from the Data Controller whether Personal Data concerning them is being processed and, if so, to access their Personal Data and receive all information about it (including processing purposes), as well as a copy of said Data (see GDPR, art. 15);

• right to rectification of Personal Data. Users have the right to obtain rectification of inaccurate Personal Data concerning them from the Data Controller without undue delay. Taking into account the purposes of processing, data subjects have the right to obtain completion of incomplete personal data, including by providing a supplementary statement (see GDPR, art. 16);

• right to erasure (“right to be forgotten”). Users have the right to obtain erasure of Personal Data concerning them from the Controller without undue delay in such cases: if Personal Data is no longer necessary or the User withdraws consent on which processing is based and there is no other legal basis for processing or if the User objects to processing or Personal Data has been unlawfully processed or if it must be erased to comply with a legal obligation under Union or Member State law to which the Data Controller is subject or if Personal Data was collected in relation to the offer of information society services (see GDPR, art. 17);

• right to restriction of processing. Users have the right to obtain restriction of processing from the Data Controller in the following cases: if the accuracy of Personal Data is contested by the User or if processing is unlawful and the data subject opposes erasure of Personal Data and requests restriction of their use or if the User who has objected to processing is awaiting verification regarding the possible prevalence of the Controller’s legitimate grounds over those of the User (see GDPR, art. 18);

• right to data portability. Users have the right to receive Personal Data concerning them, which they have provided to the Controller, in a structured, commonly used and machine-readable format and have the right to transmit such data to another controller without hindrance from the Controller to whom the personal data was provided (see GDPR, art. 20);

• right to object to Personal Data processing. Users can object at any time to the processing of personal data concerning them (when carried out on a legal basis other than consent). In particular, where Personal Data is processed for direct marketing purposes, Users have the right to object at any time to the processing of personal data concerning them carried out for such purposes, including profiling insofar as it is related to such direct marketing (see GDPR, art. 21);

• right to lodge a complaint with the competent supervisory authority. Users can lodge a complaint with the competent personal data protection supervisory authority (in Italy:  www.garanteprivacy.it) and before the competent courts of Member States (see GDPR, art. 77 and following).

How to exercise your rights

To exercise their rights as indicated above, Users, without payment of any fee or charge (except as provided in art. 12 paragraph 5 of the GDPR), can address a request to the Controller’s contact details, specifically to:

Frutteto Italia SRL, Italian company with registered office via Padania 9 – 26030 Volongo (CR) – Italy Share capital paid up €142,857.00
Cremona company register office – REA: 200021 – VAT: 01770310199

Controller’s email address: info@fruttetoitalia.it

Controller’s certified email address: fruttetoitalia@legalmail.it

Phone contact: +39 0372 845 745

 

Cookie Policy

The Site uses Cookies. To find out more and to view the detailed information, the User can consult the Cookie Policy.

Additional information on Processing

Defence in court

User Personal Data may be used by the Controller in court or in the preparatory phases of its possible establishment for defense against abuse in the use of the Site or related Services by the User.

Users declare to be aware that the Controller may be obliged to disclose/communicate Data by order of public Authorities.

Specific disclosures

Upon User request, in addition to the information contained in this Privacy Policy, the Site may provide additional and contextual information regarding specific Services or the collection and processing of Personal Data.

System Logs and Maintenance

For operational and maintenance needs, the Site and any third-party services it uses may collect system logs, i.e., files that record interactions and may also contain Personal Data, such as the User’s IP address.

Information not contained in this Privacy Policy

Additional information regarding Personal Data Processing may be requested at any time from the Data Controller as specified in the “CONTACT INFORMATION” section.

Changes to this Privacy Policy

The Data Controller reserves the right to modify or update this Privacy Policy at any time.

Users are invited to regularly consult this page to ensure they always know the latest version of this Privacy Policy (see “Last update date” at the end of this page). If changes concern the processing of Personal Data whose legal basis is consent, the Data Controller will collect User consent again, if necessary.

DEFINITIONS AND LEGAL REFERENCES

“Cookie” or “Cookies”

Small portion(s) of data stored within the User’s device.

“Personal Data” or “Data” or “Personal Datum” or “Datum”

Any information relating to a Data Subject.

“Sensitive and/or special data”

Personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, as well as processing genetic data, biometric data intended to uniquely identify a natural person, data concerning health or sex life or sexual orientation of the person.

“Usage Data”

Information collected automatically through the Site and/or from third-party applications integrated into the Site, including: IP addresses or domain names of computers used by Users connecting to the Site, addresses in URI (Uniform Resource Identifier) notation, request time, method used to forward the request to the server, size of the file obtained in response, numerical code indicating the server response status (success, error, etc.), country of origin, browser and operating system characteristics used by the visitor, various temporal aspects of the visit (e.g., time spent on each page) and details regarding the path followed within the Application, with particular reference to the sequence of pages consulted, parameters relating to the operating system and User’s computing environment.

“Data Subject” or “Data Subjects”

The identified or identifiable natural person to whom Personal Data refers. A natural person is considered identifiable who can be identified, directly or indirectly, with particular reference to an identifier such as name, identification number, location data, online identifier or one or more elements characteristic of their physical, physiological, genetic, mental, economic, cultural or social identity.

“Profiling”

Any form of automated processing of Personal Data consisting of using such Personal Data to evaluate certain personal aspects relating to a natural person, in particular to analyze or predict aspects concerning professional performance, economic situation, health, personal preferences, interests, reliability, behavior, location or movements of said natural person.

“Service”

The service(s) provided by the Site as defined in the related terms (if present) on this site/application.

“Site”

The hardware or software tool through which Users’ Personal Data is collected and processed, specifically www.fruttetoitalia.com as well as all landing pages connected and/or related to it.

“Data Controller” or “Controller”

The natural or legal person, public authority, service or other body which, alone or jointly with others, determines the purposes and means of processing Personal Data; where the purposes and means of such processing are determined by Union or Member State law, the Data Controller or the specific criteria applicable to its designation may be provided for by Union or Member State law. The Data Controller, as better identified above, unless otherwise specified, is the owner of the Site.

“Processing” or “Data Processing”

Any operation or set of operations, performed with or without the aid of automated processes and applied to Personal Data or sets of Personal Data, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or any other form of making available, alignment or combination, restriction, erasure or destruction.

“European Union” or “EU”

Unless otherwise specified, any reference to the European Union contained in this document is intended to extend to all current member states of the European Union and the European Economic Area (EEA).

“User” or “Users”

The individual or individuals who use(s) the Site and who, unless otherwise specified, coincide(s) with the Data Subject.

Legal references

This privacy notice is drafted based on current regulations on the matter, and in particular on the provisions of articles 13 and 14 of Regulation (EU) 2016/679 (GDPR), the related implementing legislation D. Lgs. 101/2018, and within the limits of what is still applicable from D. Lgs. 196/2003.

Last updated: December 4, 2024.