Privacy policy
According to Legislative Decree 196/2003 and Regulation (EU) 2016/679 (hereinafter the “Regulation”), this page describes how the personal data of users who visit the website accessible online at the following address is processed: https://granoro.it/en/
Users are informed that, as a result of visiting this website, data relating to identified or identifiable individuals may be processed.
These provisions do not apply to other websites, pages or online services accessible via hyperlinks that may be published on this website.
The data controller is PASTIFICIO ATTILIO MASTROMAURO GRANORO S.R.L., represented by its current legal representative, with its registered office in Corato (BA) – Provincial Road 231, km 35.100 (email: pasta@granoro.it, certified email: amministrazione@pec.granoro.it, Tel.: +39 0808721821 (hereinafter also “the Data Controller”)
Source of data and type of data collected
- Data provided by the User
The Data Controller collects the personal data provided by users:
- when purchasing a product/service offered. The data collected by the Data Controller may include, but is not limited to: personal details, contact details, location data, corporate and financial information; information relating to creditworthiness, payment information, and VAT number.
- when creating an account or registering on the Website. The data collected by the Data Controller may include, but is not limited to: personal details and contact details.
- when filling in the form in the “work with us” section and/or sending their CV to the dedicated email address.
Personal data requested may include, in addition to personal and contact details, all information contained in the CV, should the user submit it to the Data Controller via the specified channels.
- when sending a message via the contact channels and/or contact forms available on the website.
The optional and voluntary sending of messages to the contact addresses, as well as the completion and submission of the forms on the website, implies the acquisition of the sender’s contact details needed to provide a response, as well as all personal data included in the messages.
- Browsing data
The Data Controller collects data relating to how the user uses the website.
The IT systems and software procedures used to operate this website automatically collect some personal data during their normal operation; the transmission of this data is implicit in the use of Internet communication protocols.
This category of data includes the IP addresses or domain names of the computers and devices users employ, the URI/URL (Uniform Resource Identifier/Locator) addresses of the resources requested, the time of the request, the method used to submit the request to the server, the size of the file received in response, the numerical code indicating the status of the response given by the server, and other parameters relating to the user’s operating system and IT environment.
Such data, which is necessary for the use of web services, is also processed for the following purposes:
- to obtain statistical information on the use of the services (most visited pages, number of visitors by time of day or day of the week, geographical areas of origin, etc.);
- to check that the services provided are working as they should.
Browsing data is not retained for more than seven days and is deleted immediately after it has been aggregated (unless required for the investigation of criminal offences by the judicial authorities).
- Cookies and other tracking mechanisms
This website uses cookies to ensure that its services are as efficient and user-friendly as possible.
Therefore, when you visit the Website, a small amount of information is stored on your device in the form of small text files known as ‘cookies’, which are saved in your web browser’s directory. There are various types of cookies, but essentially the main purpose of a cookie is to make the Website work more efficiently and to activate certain features.
For more information about the cookies used on this website, please see our cookie policy at the following link.
Purpose of data processing
Depending on the type of processing to be carried out, the Data Controller uses the data collected and/or provided by the User for the following purposes:
- to process and fulfil orders, manage payments, communicate with the user regarding the order, handle any returns, provide customer support and facilitate the collection of products. They will also be used to collect information and data prior to entering into a contract; to exchange information for the purposes of fulfilling the terms of the contract, including activities prior to and following the conclusion of the contract; to make enquiries or respond to enquiries received; to manage accounting and tax compliance;
- to carry out the preliminary and follow-up activities relating to the application for registration in the register/creation of the User Account, as well as to fulfil any other obligations arising therefrom;
- to respond to any messages, requests for information and/or services received from users via the contact addresses and/or forms available on the website;
- to respond to any applications received from Users, submitted via the form provided in the “work with us” section or using the contact details on the website;
- to manage and monitor risks, prevent potential fraud, insolvency or breaches of contract; to prevent and manage potential disputes, and to take legal action as necessary.
Legal basis for data processing
With regard to the purposes set out in the previous clause, the legal basis for these is, in relation to the point:
- the need to carry out a contract to which the data subject is a party or to take measures preliminary to stipulating a contract at the data subject’s request;
- the need to carry out a contract to which the data subject is a party or to take measures preliminary to stipulating a contract at the data subject’s request. The processing of special categories of personal data, where such data are included in the data subject’s Curriculum Vitae, is carried out where necessary to comply with specific legal obligations, in particular for the purposes of establishing a work relationship (Article 88 of EU Regulation 2016/679), as well as to ensure equal opportunities in employment (see Authorisation No. 1/2016).
- the need to uphold the legitimate interests of the data controller (in particular with regard to the prevention of fraud and insolvency).
Recipients of the data
The personal data processed by the Data Controller is not disclosed; in other words, it is not made known to unspecified parties in any form whatsoever, including by making it available or allowing it to be consulted.
The data may, however, be disclosed to employees working for the Data Controller, as they act under the authority of the Data Controller. Based on their roles and the duties they perform, these employees are authorised to process personal data, taking into account their respective responsibilities and in accordance with the instructions given to them by the Data Controller.
The Data Controller has engaged third-party service providers in connection with operating the website, such as hosting providers, IT maintenance providers, and service providers that enable the integration of additional features into the website which users may use at their discretion.
These service providers, designated as data processors, are provided only with the personal data they need in order to provide the relevant services, and they are not permitted to use or disclose the personal data of data subjects for any other purpose without the data subject’s prior consent.
The data may also be disclosed, if strictly necessary, to parties who, for the purposes of fulfilling orders or other requests, or providing services related to the transaction or the contractual relationship with the Data Controller, are required to supply goods and/or perform tasks or services on behalf of the Data Controller.
Finally, information may be disclosed to parties entitled to access in accordance with the provisions of the law, regulations and EU legislation.
Under no circumstances whatsoever will the Data Controller transfer personal data to third countries or international organisations.
Data retention
The Data Controller will retain and process personal data for as long as is necessary to fulfil the purposes outlined above. Thereafter, the personal data will be retained but no longer processed, for the period specified by the applicable civil and tax legislation.
- Data provided for the purposes of advertising for services other than those already purchased by the data subject, for which the data subject initially gave their consent, will be retained for 24 months, unless the consent is revoked.
- The data collected when creating an account will be retained for the duration of the user’s registration and, in any event, for no longer than a maximum period of 12 (twelve) months of inactivity, or if, within that period, no services have been associated with the account and/or no products have been purchased via the account.
- The data collected when filling in the form in the “lavora con noi” (Work with us) section and/or sending a CV to the address provided will be retained for the time necessary to fulfil the stated purposes and, in any event, for a period not exceeding 12 months from receipt of the data.
- In the event of any dispute, the data collected will be retained for the entire duration of the dispute, until the time limits for bringing an appeal have expired.
It must also be added that, should a user provide the Data Controller with personal data that has not been requested or is not necessary for carrying out the requested service or for providing a service closely related to it, PASTIFICIO ATTILIO MASTROMAURO GRANORO S.R.L. cannot be considered the data controller for such data and will delete it as soon as possible.
With regard to the personal data processed as described in this statement, the data subject has the right at any time to:
- request from the Data Controller access to their personal data and information relating thereto (Article 15 of the GDPR); the rectification of inaccurate data or the integration of incomplete data (Article 16 of the GDPR); the cancellation of personal data concerning them (when one of the conditions set out in Article 17(1) of the GDPR applies, subject to the exceptions provided for in paragraph 3 of that Article); the restriction of the processing of their personal data (when one of the circumstances set out in Article 18(1) of the GDPR applies);
- to request and obtain from the Data Controller – where the legal basis for the processing is a contract or consent, and the processing is carried out by automated means – their personal data in a structured, machine-readable format, including for the purpose of transmitting such data to another data controller (the so-called right to data portability – Article 20 of the GDPR);
- to object at any time to the processing of their personal data where there are specific circumstances concerning them (Article 21 of the GDPR);
- withdraw their consent at any time, provided that the processing is based on their consent for one or more specific purposes. However, processing carried out on the basis of consent prior to its withdrawal remains lawful (Article 7(3) of the GDPR);
The relevant request should be submitted by contacting the Data Controller via certified email (PEC) at: amministrazione@pec.granoro.it , by email at: pasta@granoro.it, or by registered post with return receipt to: Pastificio Attilio Mastromauro Granoro Srl, S.P. 231 km 35.100 – 70033 Corato (BA)
If the data subject considers that the processing of their data is in breach of the provisions of the Regulation, they may lodge a complaint with a supervisory authority (the Italian Data Protection Authority – www.garanteprivacy.it), as provided for in Article 77 of the GDPR, or bring the matter before the appropriate courts (Article 79 of the GDPR).
If the data subject fails to provide the personal data identified as necessary for the performance of the requested service, the data controller will not be able to carry out the processing operations related to the management of that service, nor will they be able to fulfil the obligations arising from it.
Should the data subject fail to give consent to the processing of personal data for the activities that require it, such processing will not take place for those specific purposes; however, this will not affect the provision of other requested services, nor those for which the data subject has already given their consent. Should the Data Subject have given consent and subsequently withdrawn it or objected to the processing of it, their data will no longer be processed for those activities, without this having any detrimental consequences or effects for the Data Subject or for any other services requested.
Automated decision-making processes
The Data Controller does not carry out any processing involving automated decision-making regarding the data of natural persons.
