INFORMATION ARTICLE 13 EU REGULATION 679/2016

We wish to inform you that EU Reg. 679/2016 and the current Italian legislation on the protection of personal data provide for the protection of natural persons with regard to the processing of personal data. According to this legislation, the processing of your data will be based on the principles of correctness, lawfulness and transparency, protecting the confidentiality and security of the data and guaranteeing the exercise of your rights. Pursuant to the aforementioned Article 13 of EU Reg. 679/2016, we therefore provide you with the following information:

    • The identity and contact details of the data controller and, where applicable, of his representative;

The data controller is: SALUMIFICIO LEONI S.R.L., with registered office in Via Carlo Alberto dalla Chiesa n. 7, 42021, Bibbiano (RE), VAT number – Fiscal Code n. 00309520351, Email: francesca.leoni@salumificioleoni.com, PEC salumificioleonisrl@legalmail.it, Tel. 0522/875821, website https://www.salumificioleoni.com/
The data controller is established in the European Union and, therefore, is not required to designate a representative.

    • The contact details of the data protection officer, where applicable;

The data controller does not currently process data falling within the obligation to designate a “Data Protection Officer”, as detailed in Articles 37-38-39 and Recital 97 of EU Regulation 2016/679.

    •  The purposes of the processing for which the personal data are intended as well as the legal basis of the processing;

The purpose of the processing is the following:
Management of requests for contact with our company in order to allow us to respond to your requests/communications. The legal basis of the processing is related to the provisions of art. 6 paragraph 1 letter a) of EU Reg. 679/2016, as the interested party has expressed consent to the processing of his/her personal data for one or more specific purposes. We inform you that for the aforementioned purpose, your personal data will be processed (personal data, contact details such as, for example, email address).

    • If the processing is based on article 6, paragraph 1, letter f), the legitimate interests pursued by the data controller or by third parties;

We inform you that the data processing is not based on Article 6, paragraph 1, letter f), as the processing is not necessary for the pursuit of the legitimate interest of the data controller or third parties, provided that the interests or fundamental rights and freedoms of the data subject that require the protection of personal data do not prevail, in particular if the data subject is a minor.

    • Any recipients or categories of recipients of personal data;

Your personal data will be processed by persons specifically appointed by the data controller as data processors (if appointed) and/or by anyone acting under their authority and/or under that of the data controller and who has access to personal data (Directors/partners/workers of the data controller); these persons will process your data only when necessary in relation to the purposes of the provision and only in the context of carrying out the tasks assigned to them by the data controller, undertaking to process only the data necessary for carrying out such tasks and to perform only the operations necessary for carrying out the same. Your personal data may be communicated, if necessary, to the following categories of recipients:
Providers of IT services related to data processing.
The data will not be disclosed.

    • Where applicable, the intention of the controller to transfer personal data to a third country or to an international organisation and the existence or absence of an adequacy decision by the Commission or, in the case of transfers referred to in Article 46 or 47, or Article 49, paragraph 1, second subparagraph, reference to the appropriate or suitable safeguards and the means to obtain a copy of those safeguards or where they have been made available.

The data controller may transfer personal data to a third country or an international organisation and this may occur in the following cases:
Providers of IT services connected with the processing of personal data – Countries: U.S.A. and any other jurisdiction in which the suppliers or their affiliates, branches or subcontractors operate facilities.
The transfer abroad will take place, as the case may be, pursuant to the Adequacy Decision issued by the European Commission on 10 July 2023 in relation to companies participating in the so-called “EU-U.S. Data Privacy Framework” and/or by virtue of the preparation of Standard Data Protection Clauses pursuant to art. 46, par. 2, letter c) of EU Reg. 679/2016) and/or by virtue of further specific adequacy decisions issued by the European Commission pursuant to art. 45 of EU Reg. 679/2016 and/or by virtue of the preparation of Binding Corporate Rules (“BCR” – Binding Corporate Rules) pursuant to art. 47 of EU Reg. 679/2016).
In the case of transfers pursuant to Article 46 or 47, or Article 49, paragraph 1, second subparagraph, we inform you that a copy of such guarantees may be requested from the data controller by sending a specific request to the contact details previously indicated in point a) of this notice and a copy of such guarantees will be made available at the registered office of the data controller.

In addition to the information previously provided, the data controller provides you with the following additional information necessary to ensure correct and transparent processing:

  • The period for which the personal data will be stored or, if this is not possible, the criteria used to determine this period;

Your data will be stored for the time necessary to achieve the purposes indicated above. In particular, the period of storage will vary based on the requests received and, in any case, will not exceed a period of 12 months.

  • The existence of the right of the data subject to ask the data controller for access to personal data and the rectification or erasure of the same or the limitation of the processing concerning him or her or to object to their processing, in addition to the right to data portability;

You may, at any time, exercise the following rights provided for by EU Regulation 679/2016 against the data controller by contacting the data controller at the contact details indicated in point a) of this information notice or through the methods you deem most appropriate:

  • Right of access by the data subject (Article 15 of EU Reg. 679/2016).
  • Right to rectification (Article 16 of EU Reg. 679/2016).
  • Right to erasure – “right to be forgotten” (Article 17 of EU Reg. 679/2016).
  • Right to restriction of processing (Article 18 of EU Reg. 679/2016).
  • Right to object (Article 21 of EU Reg. 679/2016).
  • Right to data portability (Article 20 of EU Reg. 679/2016).

The full text of the articles of the REG. EU 679/2016 relating to your rights (articles 15 to 22 included) can be consulted at the following link on the website of the Authority for the Protection of Personal Data: https://www.garanteprivacy.it/regolamentoue or, alternatively, it will be provided to you by the Data Controller upon your simple request.

    • Where the processing is based on Article 6, paragraph 1, letter a), or Article 9, paragraph 2, letter a), the existence of the right to withdraw consent at any time without prejudice to the lawfulness of the processing based on the consent given before the withdrawal;

You may exercise the right to withdraw consent at any time towards the data controller, without prejudice to the lawfulness of the processing based on the consent given before the withdrawal, by contacting the data controller through the methods you deem most appropriate or using the contact details indicated in point a) of this information notice.

    • The right to lodge a complaint with a supervisory authority;

If you believe that the processing of your personal data, carried out by the data controller, violates the provisions of EU Reg. 679/2016, you have the right to lodge a complaint with the competent Supervisory Authority, as provided for in Article 77 of EU Reg. 679/2016 itself, or to take appropriate legal action (Article 79 of EU Reg. 679/2016).

    • If the provision of personal data is a legal or contractual obligation or a requirement necessary to enter into a contract, and if the data subject is obliged to provide the personal data as well as the possible consequences of failure to provide such data;

The provision of personal data described above is strictly necessary to process your request for contact with our company in order to be able to respond to your requests/communications; therefore, failure to provide such data could make it impossible to proceed with the aforementioned purposes (in particular, with regard to the “mandatory fields” present in the data collection form).

    • The existence of an automated decision-making process, including profiling referred to in Article 22, paragraphs 1 and 4, and, at least in such cases, significant information on the logic used, as well as the importance and the expected consequences of such processing for the data subject.

The data controller informs you that your data will not be subject to an automated decision-making process, including profiling pursuant to Article 22, paragraphs 1 and 4 of EU Reg. 679/2016.

Finally, the data controller informs you that, if the data controller intends to further process the personal data for a purpose other than that for which they were collected, prior to such further processing he undertakes to provide you with all the information regarding such different purpose and any further relevant information referred to in Article 13 of EU Reg. 679/2016, paragraph 2.