Information according to Article 13 of Regulation (EU) 2016/679 – WEB

With this document (“Information”), the Data Controller, as defined below, wishes to inform you about the purposes and methods of processing your personal data and the rights recognized to you by Regulation (EU) 2016/679 regarding the protection of individuals with regard to the processing of personal data and on the free movement of such data (“GDPR”). This Information may be supplemented by the Data Controller in case additional services requested by you require further processing.

Data Controller

Caseificio Maldera s.r.l. with registered office at Via Gen. Carlo Alberto Dalla Chiesa 4, 70124 Bari (BA), Italy; Phone: +39 080 3580565; Email: info@caseificiomaldera.it; VAT/ Tax Code: 06408730726

Types of processed data

The processing activities carried out are aimed at acquiring the following personal data:

Cookies: Profiling Cookies; Behavioral data: Browsing logs; Common data: Personal data. Categories of data subjects

The processing activities carried out are directed to the following categories of data subjects: Individuals, legal entities, public and private organizations.

Purposes of processing and lawful basis for processing

  1. WEBSITE – Navigation Data Obtaining anonymous statistical information on usage, ensuring the correct functioning of the website, verifying responsibilities in case of hypothetical computer crimes against the Data Controller.

Lawful Basis for Processing: Legitimate Interest – Art. 6, para. 1, let. f. GDPR

Purposes of Processing: 1) Data analysis to perform the evolution and maintenance of the website; 2) Verification of responsibilities in case of potential computer crimes against the website and/or the Data Subjects; 3) Anonymous statistical analysis of website usage.

Nature of provision:

Mandatory – Failure to provide data will result in the impossibility for the company to provide the web service.

Retention period of personal data:

Data is retained for 30 days.

Processing methods:

Processing is carried out using computerized tools.

  1. WEBSITE – Requests from the Website Requests made by data subjects through the Data Controller’s website.

Lawful Basis for Processing: Contractual Performance – Art. 6, para. 1, let. b. GDPR

Purposes of Processing: 1) Sending requests through web platform tools.

Nature of provision:

Optional – Failure to provide data will result in the impossibility for the Data Controller to respond to the data subject’s requests.

Retention period of personal data:

Fulfillment of the request.

Processing methods:

Processing is carried out using computerized tools.

  1. WEBSITE – Use of Service and Reserved Area Use of services offered through the Data Controller’s website’s reserved area.

Lawful Basis for Processing: Contractual Performance – Art. 6, para. 1, let. b. GDPR

Purposes of Processing: 1) Registration within the reserved area; 2) Use of the service provided through access to the reserved area of the website.

Nature of provision:

Optional – Failure to provide data will result in the impossibility for the Data Controller to provide services through the reserved area of the website.

Retention period of personal data:

User deletion.

Processing methods:

Processing is carried out using computerized tools.

  1. WEBSITE – Remarketing Use of Google AdWords and Facebook advertising platforms to advertise the products/services offered by the Data Controller on third-party websites. Remarketing activity may include conducting advertising campaigns on Google’s search results page, on a site in the Google Display Network (Google Adsense), or within the Facebook social network, targeting visitors to the website who have consented to this purpose. Third-party providers, including Google and Facebook, use cookies to display ads based on previous visits to our website. All data collected will be used in accordance with our privacy policy, as well as the privacy policies of Google and Facebook. You can opt-out of remarketing advertising campaigns through the following links: for Google: – https://support.google.com/ads/answer/2662922?hl=enhttps://adssettings.google.com/authenticated?hl=en#display_optout for Facebook: https://www.facebook.com/ads/website_custom_audiences/

Lawful Basis for Processing: Consent – Art. 6, para. 1, let. a. GDPR

Purposes of Processing: 1) Use of cookies for configuring and managing advertising campaigns conducted on the Facebook platform and Google Display Network.

Nature of provision:

Optional – Failure to provide consent will result in the impossibility for the Data Controller to promote products/services on third-party sites other than those of the Data Controller.

Retention period of personal data:

The period of use of remarketing cookies, used by this site, is 30 days for Google AdWords and 30 days for Facebook social media.

Processing methods:

Processing is primarily carried out using computerized tools.

  1. FACEBOOK SOCIAL PAGE When a user uses the Page administered by the Data Controller, Facebook (“Social Media”) collects information such as the types of content viewed or interacted with, actions taken, as well as information about the devices used (IP addresses, operating system, browser type, language settings, cookie data).

Page Insights are aggregated statistics created from certain events recorded by Facebook’s servers when users interact with the Pages and the content therein.

As explained in Facebook’s Privacy Policy, the Social Media collects and uses information to provide statistical data collection services defined as Page Insights to page administrators to enable them to understand how people interact with the content therein.

Details on the processing methods carried out by Facebook are available at the following link:

https://www.facebook.com/privacy/explanation

Details on personal data processed for Insights are available at the following link:

https://www.facebook.com/legal/terms/information_about_page_insights_data

Details on cookies used by Facebook are available at the following link:

https://www.facebook.com/policies/cookies/

The Data Controller as the Page administrator and Facebook Ireland Limited (4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland) are joint controllers for the processing of such personal data recorded for the events provided through Page Insights (“Insights Data”).

The joint controllership agreement between the Data Controller and Facebook covers the creation of such events and their aggregation into Insights on the Page provided to each administrator.

The legal basis for processing is the legitimate interest of the Data Controller, art. 6, para. 1, let. f), GDPR. Therefore, the acquisition of your prior consent to the processing is not necessary.

Lawful Basis for Processing: Legitimate Interest – Art. 6, para. 1, let. f. GDPR

Purposes of Processing: 1) Statistical analysis of the usage of elements contained within the Facebook page administered by the Data Controller.

Nature of provision:

Mandatory – Failure to provide the requested data will result in the impossibility for the Data Controller to provide services through the Page published on Facebook.

Retention period of personal data:

The collected data will be processed for the time strictly necessary for the realization of the aforementioned purposes as specified in the Facebook policies described above.

Processing methods:

Processing is carried out using computerized means by the Co-Controller Facebook.

Rights of the data subject – complaint to the supervisory authority

Regarding the processing described in this Information, as a data subject, you may, under the conditions provided by the GDPR, exercise the rights established in Articles 15 to 22 of the GDPR, and in particular, the following rights:

right of access – article 15 GDPR: right to obtain confirmation as to whether or not personal data concerning you are being processed and, where that is the case, access to your personal data; right to rectification – article 16 GDPR: right to obtain without undue delay the rectification of inaccurate personal data concerning you and/or the completion of incomplete personal data; right to erasure (right to be forgotten) – article 17 GDPR: right to obtain the erasure of personal data concerning you without undue delay. The right to erasure does not apply to the extent that processing is necessary for compliance with a legal obligation or for the performance of a task carried out in the public interest or in the exercise of official authority or for the establishment, exercise, or defense of legal claims. right to restriction of processing – article 18 GDPR: right to obtain restriction of processing where: a) the accuracy of the personal data is contested by the data subject; b) the processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of their use instead; c) the data subject needs the personal data for the establishment, exercise, or defense of legal claims; d) the data subject has objected to processing pending the verification of whether the legitimate grounds of the controller override those of the data subject. right to data portability – article 20 GDPR: right to receive the personal data concerning you, which you have provided to the Controller, in a structured, commonly used, and machine-readable format and have the right to transmit those data to another controller without hindrance from the Controller to which the personal data have been provided, where the processing is based on consent and is carried out by automated means. Furthermore, the right to have your personal data transmitted directly from this Controller to another controller where technically feasible; right to object – article 21 GDPR: right to object at any time to processing of personal data concerning you based on legitimate interest, including profiling, unless the Controller demonstrates compelling legitimate grounds for the processing which override the interests, rights, and freedoms of the data subject or for the establishment, exercise, or defense of legal claims. right not to be subject to a decision based solely on automated processing – article 22 GDPR: the data subject has the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her, unless such decision is necessary for entering into or performing a contract between the data subject and a data controller or is based on the data subject’s explicit consent. In any case, automated decision-making shall not concern your personal data, and you may obtain human intervention, express your point of view, and contest the decision at any time. right to lodge a complaint with the supervisory authority: http://www.garanteprivacy.it; revoke consent given at any time and with the same ease with which it was provided without affecting the lawfulness of processing based on consent before its withdrawal. The above rights may be exercised, against the Controller, by contacting the references indicated in the previous point 1. Exercising your rights as a data subject is free of charge pursuant to article 12 GDPR. However, in the case of requests that are manifestly unfounded or excessive, particularly due to their repetitive nature, the Controller may either charge you a reasonable fee taking into account the administrative costs incurred in managing your request or refuse to fulfill your request. Finally, we inform you that the Controller may request additional information necessary to confirm the data subject’s identity.

Right of revocation: The data subject has the right to revoke their consent at any time. Revoking consent does not affect the lawfulness of processing based on consent before revocation.

Right to lodge a complaint: At any time, the data subject has the right to lodge a complaint with the supervisory authority for the protection of personal data, www.garanteprivacy.it.