Privacy policy updated to GDPR 679/2016

Foreword

Chimento Oro Srl, with headquarters in Via Vecchia Ferriera 5, 36100 Vicenza VI, VAT number 03994560245 (hereafter referred to as the “Owner”), as a data controller, would like to inform you, pursuant to art. 13 Legislative Decree 30.6.2003 n. 196 (hereafter, “Privacy Code”) and art. 13 EU Regulation n. 2016/679 (hereafter “GDPR”) that your data will be processed in the following way and for the following purposes:

1) Object of the privacy notice

Chimento Oro processes personal and non-sensitive data (in particular your name, surname, social security number, VAT number, email address, telephone number – hereafter “personal data” or even “data”) provided by customers at the time of registration to Chimento Oro’s website and/or upon signing up for the newsletter offered by Chimento Oro.

2) Purpose of the data processing

Your personal data will be processed:

A) Without your express consent (pursuant to Article 24 paragraph a, b, c Privacy Act and Article 6 para. b, and GDPR), for the following Service purposes:

• To allow you to register to our website;

• To manage and maintain our website;

• To allow customers to sign up to the newsletter service provided by Chimento Oro and any additional Services customers may request;

• To fulfill our pre-contractual, contractual and tax obligations which arise as a result of our relationship with you;

• To comply with the law, a regulation, community legislation or an order of the Law Authority;

• Prevent or discover fraudulent activity or malicious use of the website;

• Exercise our rights as Owner, for example the right to defence in court.

B) Subject only to your specific and express consent (articles 23 and 130 of the Privacy Act and article 7 of the GDPR), for the following Marketing Purposes:

• To send you e-mail newsletters, commercial communications and/or advertising material on products or services offered by the Owner. Please note that if you are already a customer, and unless you opt out, we may send you commercial communications relating to Chimento Oro services and products which are similar to those you have already used (Article 130(4) of the Privacy Act).

3) How we use your information

Your data will be processed by means of the operations indicated in art. 4 of the Privacy Act and art. 4(2) GDPR. More precisely, it involves: collection, registration, organization, storage, consultation, processing, modification, selection, extraction, comparison, use, interconnection, blocking, communication, cancellation and destruction of personal data. Your personal data will be subject to paper, electronic and automated processing.

Chimento Oro will process personal data for the time necessary to provide our services.  This will never be for more than 10 years after the termination of the relationship which was sustained to provide our services or for more than 2 years after the collection of data for Marketing Purposes.

4) Access to data

Your data may be made accessible for the purposes referred to in art. 2(A) and 2(B):

• To the employees and collaborators of Chimento Oro, in their capacity as persons in charge and/or internal managers of the data processing and/or system administrators;

• To external companies for support activities in the study of the feasibility of the customer’s project, for technical project management activities, for the storage of personal data, etc.) or to third parties (for example, providers of the management and maintenance of the website, suppliers, lenders, professional offices, etc) that carry out outsourcing activities on behalf of the Owner, in their capacity as external data processors.

5) How we share your information

Without your express consent (previously

art. 24(a), (b), (d) Privacy Act and art. 6(b) and (c) GDPR), Chimento Oro may share your data for the purposes referred to in art. 2(A) to Supervisory Bodies, Judicial Authorities and to all the other subjects to whom the communication is mandatory by law for the accomplishment of said purposes. Your information will not be disseminated.

6) Data transfer

Your personal data will be stored and processed on servers located within the European Union of the Owner and/or third-party companies appointed by the Owner as Data Processors. Our servers are currently located in Italy. Your data will not be transferred outside the European Union. It is understood that Chimento Oro, where necessary, will have the right to move the server location to Italy and/or the European Union and/or non-EU countries. In such a case, Chimento Oro hereby guarantees that the transfer of data outside of the EU will take place in accordance with the applicable legal provisions, stipulating, if necessary, agreements that guarantee an adequate level of protection and/or adopting the standard contractual clauses provided by the European Commission.

7) Nature of the provision of data and consequences for refusal to respond

The provision of data for the purposes referred to in art. 2(A) is mandatory. Without your data, we cannot secure neither your registration to the website nor the services set out in art. 2(A). However, sharing data for the purposes referred to in art. 2(B) is optional. You can therefore decide not to share any data or to subsequently deny the processing of data you previously shared: in this case, you will no longer receive newsletters, commercial communications and advertising material concerning the Services offered by Chimento Oro. In any case, you will continue to be entitled to the Services referred to in art. 2(A).

8) Customer rights

In your capacity as an interested party, you have the rights set out in art. 7 of the Privacy Code and art. 15 GDPR and precisely the right:

A) To obtain confirmation of the existence of any of your personal data, even if not yet registered, and for this to be communicated in an intelligible manner;

B) To obtain information on:

• The origin of the personal data;

• Purposes and methods of processing;

• The logic applied in case your data be processed with the aid of electronic instruments;

• The identifying details of the owner, the managers and the designated representative pursuant to art. 5(2) of the Privacy Code and art. 3(1) GDPR; and the subjects or categories of subjects to whom the personal data may be communicated or who may become aware of it in their capacity as designated representatives in the territory of the State, managers or agents;

C) To receive:

• Updating, rectification or, when needed, integration of data;

• The cancellation, anonymisation or blocking of data processed unlawfully, including data the retention of which is unnecessary for the purposes for which the data was collected or subsequently processed;

• The attestation that the operations referred to in art. 8(A) and (B) have been brought to the attention, also with regard to their content, of those who have received the data, except in the case where this fulfilment proves to be impossible or involves a use of means clearly disproportionate to the protected right;

D) To object, wholly or partly:

• For legitimate reasons, to the processing of your personal data, even if pertinent to the purpose of the collection;

• To the processing of your personal data for the purpose of sending advertising or sales material or for carrying out market research or commercial communication through the use of automated call systems without the intervention of an operator through email and/or through traditional marketing methods by telephone and/or post. It should be noted that the right of opposition of the interested party, set out in point B), for direct marketing purposes through automated methods extends to the traditional ones and that in any case persons concerned may always exercise their right of opposition even only partially. Therefore, the interested party can decide to receive communications only via traditional methods or only automated communications or none of the two types of communication.

• Where applicable, you also have the rights referred to in Articles 16-21 GDPR (Right of rectification, right to be forgotten, right of limitation of treatment, right to data portability, right of opposition), as well as the right to complain to the Competition Authority.

9) How you can exercise your rights

You can exercise your rights at any time by sending:

• A Signed For letter addressed to: Chimento Oro slr, based in via Vecchia Ferriera 5 36100 Vicenza

• An e-mail to info@chimento.it

• A certified e-mail to chimentoorosrl@chimento.it

10) Minors

This website and the services of the Owner are not intended for minors under the age of 18 and Chimento Oro does not intentionally collect personal information about minors. In the event that information on minors were to be unintentionally registered, Chimento Oro will delete it in a timely manner at the request of users.

11) Owner, manager and agents

The Data Controller is Chimento Oro srl with registered office in via Vecchia Ferriera 5, 36100 Vicenza. The updated list of data processors is kept at the Data Controller’s headquarters.

12) Changes to this report

This information may change. It is therefore advisable to regularly check this information and always refer to the latest version.