Bonomelli S.r.l., with registered office in Via Enrico Mattei 6, Zola Predosa (hereinafter “Bonomelli“), a company belonging to Gruppo Montenegro, in its capacity as data controller, wishes to inform users (the “Users“) of the website www.cannamela.it (the “Website“) about the procedures whereby Bonomelli processes their personal data, pursuant to Legislative Decree no. 196/2003 as subsequently amended (the “Privacy Code“) and the new European Regulation no. 679/2016 on the protection of personal data (the “Privacy Regulation“).
1. Data controller and data processors
The Data Controller is Bonomelli S.r.l., a company belonging to Gruppo Montenegro, with registered office in Via Enrico Mattei 6, Zola Predosa, which can be contacted at the following email address: firstname.lastname@example.org. Bonomelli has appointed Imille s.r.l., among others, as data processor. The full list of data processors is available upon written request sent to the above email address.
2. Personal data collected:
Bonomelli processes data provided by Users, including:
a) personal data (first name, last name, date of birth, sex) and contact data provided at the time of registration on the Website;
b) data provided in case of request for information and assistance
3. Data processing methods.
The User’s personal data are processed with the aid of computerised and/or paper means and are protected by appropriate security measures to ensure the confidentiality and security of the personal data. In particular, Bonomelli takes appropriate organisational and technical measures to protect the personal data in its possession against loss, theft, unauthorised use, disclosure or amendment.
4. Processing purposes
The purposes for which the User is requested to provide Bonomelli with personal data are as follows:
a) to allow the User to register on the Website and benefit from the services made available through the Website, including customer support and/or reporting services made available through the Website, the chance to take part in prize events and request discount coupons, send applications through the Website and assert and defend rights with respect to the User and third parties (hereinafter jointly referred to as “Contractual Purposes“)
b) to comply with legal and regulatory obligations, if any (hereinafter jointly referred to as “Legal Purposes“);
c) with the User’s consent, to send newsletters and commercial communications, through traditional means of communication and by email, for the promotion and/or sale of products and/or services marketed by Bonomelli (“Bonomelli Marketing Purposes“)
d) with the User’s consent, to send marketing communications from other Gruppo Montenegro companies in relation to their products and services in the manner set out in point c) above (“Third-Party Marketing Purposes“)
e) to carry out activities relating to business and company branch transfers, acquisitions, mergers, demergers or other transformations and for the execution of such transactions (“Legitimate Business Interest Purposes“).
5. Legal basis of processing
6. Scope of communication and dissemination of data
Bonomelli, for the purposes set forth in paragraph 4, may communicate Users’ data, strictly necessary for each type of processing, to the following entities:
a) to collaborators, employees and suppliers of Bonomelli, as part of their duties and/or possible contractual obligations with them, inherent to business relations with Users
b) to sub-suppliers and/or sub-contractors engaged in activities connected with the performance of services and products offered by Bonomelli
c) to other companies belonging to Gruppo Montenegro;
The User’s personal data will not be disseminated.
7. Personal data transferred abroad
Personal data may be freely transferred outside Italy to countries within the European Union, but may also be transferred outside the European Union and in particular to the United States. Any transfer of the User’s personal data to countries outside the European Union will, in any event, take place in compliance with the guarantees appropriate and adequate for the purposes of the transfer itself in accordance with applicable legislation and in particular article 44 of the Privacy Code and articles 45 and 46 of the Privacy Regulation. The User may obtain a copy of the guarantees implemented by Montenegro by sending a request to email@example.com.
8. Children under 16 years of age
9. Users’ rights
The User may, at any time and free of charge (a) obtain confirmation of the existence or non-existence of data concerning him or her and be informed of the same; (b) be informed of the origin of the data, the purposes of processing and its methods, as well as the logic applied to the processing carried out by electronic means; (c) request the updating, rectification or – if he or she is interested – supplementing of the data (d) obtain the erasure, transformation into anonymous form or blocking of any data processed in breach of the law, as well as object to processing on legitimate grounds; (e) object, in whole or in part, to the processing of data concerning him or her for the purposes of direct marketing carried out using automated and/or traditional methods; (f) revoke, at any time, consent to the processing of data, without prejudice to the lawfulness of the processing based on the consent given prior to the revocation. In addition to the rights listed above, with effect from 25 May 2018, the User may at any time, in accordance with the procedures set out below, (a) request the restriction of the processing of personal data in the event that (i) it disputes the accuracy of the personal data, for the period necessary to verify the accuracy of such personal data; (ii) processing is unlawful and the User objects to the erasure of the personal data and requests instead that its use be restricted; (iii) although Bonomelli no longer needs the personal data for processing purposes, the personal data are necessary for the User to establish, exercise or defend a legal claim; (iv) the User has objected to the processing pursuant to article 21(1) of the Privacy Regulation pending verification as to whether the legitimate reasons of the data controller prevail over those of the data subject; (b) object at any time to the processing of the personal data; (c) request the erasure of personal data concerning him or her without undue delay; (d) obtain the portability of personal data concerning him or her; (e) lodge a complaint with the Data Protection Supervisory Authority whenever entitled to do so. The User may at any time exercise the above rights, change the contact details, notify Bonomelli of any updates to his or her data, request the removal of his or her personal data communicated by third parties, or obtain further information on Bonomelli’s use of his or her personal data, by contacting Bonomelli at firstname.lastname@example.org.
10. Retention periods
Bonomelli will retain personal data for the period necessary to fulfil the purposes for which the data were collected pursuant to paragraph 2 above. In any event, the following retention periods shall apply to the processing of personal data for the purposes set out below: -data collected for the Contractual Purposes referred to in paragraph 4, lett. a) shall be retained for the entire duration of the contract and for 10 years after the expiry of the contract for the purpose of defence and/or to enforce a right of Bonomelli in judicial and/or out-of-court proceedings in the event of disputes related to the performance of the contract;
-data collected for the Legal Purposes as set forth in paragraph 4, letter b) shall be retained for a period equal to the duration prescribed by law for each type of data;
-data collected for the Bonomelli Marketing Purposes as set forth in paragraph 4, letter c) shall be retained for a period equal to the duration of the User’s registration with the Website and/or participation in the contest, as well as for two years following their termination, deactivation and/or erasure
-data collected for Third-Party Marketing Purposes as set forth in paragraph 4, letter d) shall be retained for a period equal to 12 months after collection;
-data collected for the Legitimate Business Interest Purposes as set forth in paragraph 4, letter e) shall be retained for a period of 10 years from the time of collection.
Once this period has expired, the User’s data may be erased, anonymised and/or aggregated.
11. Amendments and updates