Privacy Notice

Introduction

This notice is provided pursuant to articles 13 and 14 of Regulation (EU) 2016/679 ("GDPR") and Italian Legislative Decree no. 196 of 30 June 2003 ("Italian Privacy Code") to users who interact with the website https://www.marabotto.com (the "Website"). The notice describes how personal data of users who visit the Website, fill in the contact form, request the catalogue or submit requests through the order form are processed.

The notice does not apply to other sites, pages or online services that may be reached via links on the Website but refer to resources outside the Data Controller's domain.

Data Controller

The Data Controller is Marabotto Giacomo & Figli S.r.l., registered office at Via A. Volta 9, 12100 Cuneo (CN), Italy — VAT / Tax Code 00198980047.

• Tel. (+39) 0171 67229
• Email info@marabotto.com
• Certified mail info@pec.marabotto.com

The Data Controller has not appointed a Data Protection Officer (DPO) as the mandatory requirements set out in art. 37 GDPR do not apply.

Personal data collected

The Website collects the following personal data, exclusively in connection with interactions voluntarily initiated by the user:

a) Browsing data

The IT systems and software procedures used to operate the Website acquire, during their normal operation, some data whose transmission is implicit in the use of Internet communication protocols (e.g. IP addresses, browser and operating system type, date and time of the request). Such data are used solely to obtain anonymous statistical information on the use of the Website and to check its correct operation; they are deleted or anonymised immediately after processing.

b) Data provided through the contact form and the catalogue request

When the user fills in the contact form or requests the commercial catalogue, data voluntarily provided are processed, including name, company name, email address, country and the content of the request. Such data are used to reply to the user's request, send the requested documentation and, where relevant to the request received, for any subsequent commercial contacts relating to the Data Controller's products and services.

c) Data provided through the order form

The Website provides an order form reserved for commercial customers (retailers, distributors, importers, HORECA operators) for submitting order requests to our sales office. The form does not constitute a direct sale to the final consumer and in no case entails the processing of payment data (credit cards, IBAN or other financial credentials).

The following data are processed through the order form:

• Identification and contact data: company name, contact person, email address, telephone number;
• Administrative data: VAT number or customer code (if existing);
• Request data: list of selected products, quantities (cartons/units), any free notes entered by the user.

A draft of the order being compiled is stored locally on the user's device through the browser's storage features (localStorage), for the sole purpose of allowing the user to resume the compilation at a later time. Such information remains exclusively on the user's device and is not transmitted to any server until the user voluntarily submits the request. The user can delete this data at any time through their browser settings.

d) Cookies

For details on the use of cookies, please refer to the Cookie Policy. As of the publication date of this notice, the Website uses exclusively technical cookies necessary for its operation and does not use profiling cookies. Any future introduction of statistical, analytical or marketing tools will be accompanied by an update of this notice and of the Cookie Policy and, where required by applicable law, by the collection of prior user consent.

Source of data

The personal data processed through the Website are collected directly from the data subject through the completion of the forms available on the Website, the sending of communications by email or other information voluntarily transmitted by the user in the course of interactions with the Data Controller.

Purposes and legal basis of processing

Personal data are processed for the following purposes and on the following legal bases:

• Response to user requests (contact form, catalogue request) and management of subsequent commercial relationships: performance of pre-contractual measures taken at the request of the data subject and legitimate interest of the Data Controller in following up the requests received and the interest shown in its products and services (art. 6(1)(b) and (f) GDPR).
• Management of order requests submitted through the order form: performance of pre-contractual measures and, in case of fulfilment, performance of the supply contract (art. 6(1)(b) GDPR), as well as compliance with tax and accounting legal obligations (art. 6(1)(c) GDPR).
• Management of commercial relationships with customers, suppliers and partners: performance of the contract and legitimate interest of the Data Controller in the proper management of its business activity (art. 6(1)(b) and (f) GDPR).
• Security of the Website, prevention of abuse and protection of IT systems: legitimate interest of the Data Controller in ensuring the integrity, availability and security of its IT systems and digital infrastructure (art. 6(1)(f) GDPR). For this purpose, technical logs and information relating to accesses to the Website may be collected and stored, exclusively for security purposes, prevention of misuse and detection of any anomalies or unlawful activity.
• Compliance with legal obligations and protection of the Data Controller's rights in court (art. 6(1)(c) and (f) GDPR).

The data collected through the Website are used exclusively to manage the requests received, provide the requested information and documentation, develop any commercial relationships arising from the interest shown by the user and comply with applicable legal obligations. The Data Controller does not carry out automated profiling activities or automated decision-making processes based on the data collected through the Website. Any future structured marketing activities or systematic promotional communications will be governed by a specific notice and, where required by applicable law, by prior consent of the data subject.

Processing methods and retention

Personal data are processed by electronic means, adopting technical and organisational measures adequate to ensure their security, confidentiality, integrity and availability, in accordance with arts. 25 and 32 GDPR. The data can only be accessed by authorised personnel of the Data Controller's sales and administrative offices, who have been duly instructed.

Data are retained for the following periods, except where different time limits are imposed by applicable law:

• Contact / catalogue form requests: for the time necessary to handle the request and, subsequently, for a maximum of 24 months in order to allow any further communications connected with the same request.
• Order requests: for the duration of the commercial relationship and, in any case, for the period required by tax, accounting and civil law obligations (typically 10 years from the date of the document, pursuant to art. 2220 of the Italian Civil Code).
• Browsing data: anonymised or deleted at the end of processing, save for the need to retain them for the investigation of offences pursuant to applicable law.

Recipients of the data

Personal data are not disclosed to the public. They may only be communicated to the following parties, within the limits of what is strictly necessary for the purposes indicated above:

• authorised personnel and collaborators of the Data Controller, duly instructed and bound to confidentiality;
• providers of technological services (Website and database hosting, email, IT maintenance), appointed as Data Processors pursuant to art. 28 GDPR;
• professional advisors (accountants, lawyers, auditors) within the context of compliance with legal obligations or for the protection of the Data Controller's rights;
• public authorities, supervisory bodies and judicial authorities, where required by law or regulation.

The up-to-date list of Data Processors appointed by the Data Controller pursuant to art. 28 GDPR may be requested at any time using the contact details indicated in this notice.

Transfer of data outside the EU

Personal data are generally processed within the European Economic Area. Should the data need to be transferred to third countries for technical reasons relating to hosting or email service providers, the Data Controller ensures that such transfer takes place in compliance with arts. 44 et seq. of the GDPR, relying on adequacy decisions of the European Commission or, failing that, on the Standard Contractual Clauses approved by the European Commission or on other appropriate safeguards.

Data concerning minors

The Website is intended exclusively for a professional audience (food sector operators, distributors, importers, retailers) and is not addressed to minors. The Data Controller does not knowingly collect personal data of persons under 16 years of age. Should the inadvertent collection of data referable to minors be detected, such data will be promptly deleted.

Your rights

Pursuant to arts. 15-22 GDPR, the data subject has the right to:

• obtain confirmation as to whether or not personal data concerning them exist and access such data (art. 15);
• obtain the rectification of inaccurate data or the integration of incomplete data (art. 16);
• obtain the erasure of data ("right to be forgotten"), in the cases provided for (art. 17);
• obtain the restriction of processing, in the cases provided for (art. 18);
• obtain the portability of the data provided, in a structured and readable format (art. 20);
• object to processing for reasons connected with the data subject's particular situation (art. 21);
• withdraw at any time any consent given, without affecting the lawfulness of processing based on consent before withdrawal;
• lodge a complaint with the competent supervisory authority — in Italy, the Italian Data Protection Authority (www.garanteprivacy.it).

The rights may be exercised at any time, without formalities, by writing to the Data Controller's contact details indicated in the "Data Controller" section. The Data Controller will respond to the request within the legal time limits (generally within 30 days of receipt).

Nature of the provision of data

The provision of data is free and optional. However, failure to provide the data marked as mandatory in the forms on the Website (contact form, catalogue request, order form) makes it impossible to respond to the user's request or to process the order request submitted.

Automated decision-making

The Data Controller does not carry out fully automated decision-making processes, including profiling, pursuant to art. 22 GDPR.

Changes to the notice

This notice may be amended or supplemented, including to meet the requirements of applicable legislation. Changes will be published on the Website and shall be deemed effective from the date of publication. Users are therefore invited to consult this page periodically, checking the "Last updated" date at the top.