INFORMATION ON THE PROCESSING OF PERSONAL DATA pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (GDPR) RELATING TO THE PROCESSING CONNECTED TO PURCHASES ON THE SITE

​

Premise

Gluten free foods srl is the owner of the Site and part of the purchase contracts concluded through the Site.

Pursuant to art. 26 GDPR, the customer is informed that Gluten free foods srl is the owner of the processing of personal data necessary for the processing of the customer's position for the purposes of legal or conventional guarantees, including the management of shipping procedures and any return of products, for assistance with purchases on the Site, for the management and maintenance of the Site.

Pursuant to art. 26 GDPR, the customer is informed that Gluten free foods srl. is the data controller and Drop srl is responsible for the processing of the customer's personal data necessary to: process payment data and issue the related tax document, fulfill and manage orders, manage the refund procedure for purchased products, fulfill the provisions of the tax legislation.

​

1. Identity and contact details of Gluten free foods srl - as data controller - Gluten free foods srl - as data controller - for purposes related to purchases on the Site

In the event of a purchase on the Site, the personal data of customers in relation to this purchase will be processed by

Gluten free foods srlpiva 07421790721 with registered office in Gravina in Puglia, Via Einstein

can be contacted at the following addresses:

- Address: Via Einstein 14/15, Gravina in Puglia

- Telephone number: 080 325 4176

- e-mail address: hello@pastagustosa.it

 

2. Processing of data by the data controller and data processor for the purpose of executing the purchase contract on the Site

The data controller and data processor, in the case of a purchase on the Site, will process the customer's personal data:

- to execute the obligations arising from the data controller and data processor from the purchase contract on the Site, such as, by way of example, the delivery of the products sold; And

- to allow the fulfillment of the obligations arising on the customer from the purchase contract on the Site, such as, by way of example, the payment of the products purchased.

The legal basis for this treatment is the fulfillment of the contract (art. 6.1.b) of the GDPR.

For this purpose, the owner e  data processor will process the Customer's data for the time strictly necessary to carry out the individual processing activities (e.g. the data necessary for the execution of the purchase contract on the Site until upon delivery of the product), it being understood that, once this term has expired, the data controller and data processor will be able to keep the data for the purposes and for the maximum retention periods referred to in the following sections of this information and/or in any case in the established cases by the GDPR and/or by law.

The provision of data for the aforementioned purpose is optional, there is no legal or contractual obligation to communicate the data; it is, however, a necessary requirement for the conclusion of the purchase contract on the Site: failure to communicate the data will make it impossible for the user to conclude this contract.

​

3. Processing of data by the data controller for assistance purposes in relation to purchases on the Site

The data controller, in the case of purchases on the Site, will process the personal data of the customer or user for general assistance activities in relation to purchases on the Site and therefore to respond to requests for information from customers or users or for respond to complaints, reports and disputes.

The legal basis of this treatment is the execution of pre-contractual measures to be taken at the request of the interested party (art. 6.1.b GDPR) or, depending on the case, the legitimate interest of the data controller (art. 6.1.f GDPR) . Indeed, it constitutes the legitimate interest of the data controller to respond to requests for information and/or reports and/or disputes and/or complaints from customers and users of the Site. The legitimate interest of the data controller, thus identified, can therefore be considered prevailing over the fundamental rights and freedoms of the interested party, also on the basis of such reasonable expectations.

In any case, the customer has the right to object, at any time, for reasons related to his personal situation, to the processing of personal data concerning him for the purpose of assistance.

To exercise this right, the Customer can write to Gluten free foods. to the email addresses set out in clause 1 above.

Further information

In the case of exercising the right to oppose the processing of data for the purpose of assistance, the data controller will refrain from further processing the personal data of customers or users for this purpose, unless it demonstrates the existence of compelling legitimate reasons to proceed with the processing that prevail over the interests and rights and freedoms of the interested party or for the assessment, exercise or defense of a right in court.

For this purpose, the data controller will process customer and user data for the time strictly necessary to carry out the requested activities (e.g. for the time necessary to provide the requested information).

The provision of data for the aforementioned purpose is optional, there is no legal or contractual obligation to communicate the data; however, considering the purpose of the processing, failure to communicate data and/or exercising the right to object may make it impossible to respond to customer or user requests.

​

4. Data processing by the data controller and data processor for administrative/accounting purposes in relation to purchases on the Site

The data controller and processor, in the case of purchases on the Site, will process the Customer's personal data for the purpose of fulfilling administrative/accounting and/or tax obligations connected to the purchase contract on the Site.

The legal basis of this treatment is the fulfillment of legal obligations (art. 6.1.c GDPR).

The provision of data for the purpose in question is mandatory, because their treatment is necessary to allow the data controller and the data processor to fulfill the legal obligations incumbent on them. Any refusal to provide data for this purpose will make it impossible for the user to make purchases on the Site.

For this purpose, the data controller and data processor will process the customer's data until the expiry of the terms established by law for the performance of each administrative-accounting and fiscal fulfillment and/or for the retention times established by law.

​

5. Data processing by the data controller and data processor in order to allow the exercise of rights

The owner and the person in charge of the treatment in the case of a purchase on the Site, will process the customer and user data in order to:

- respond to requests to exercise the right of withdrawal and/or to requests to exercise the legal guarantee of conformity and/or other rights arising from the purchase contract;

- carry out the activities that prove necessary as a consequence of the exercise of these rights and to proceed, if necessary, with the relative refunds;

- receive and respond to requests to exercise the rights regarding the protection of personal data provided for by the GDPR.

The legal basis of this treatment is the fulfillment of legal obligations (art. 6.1c GDPR).

Further information

The provision of data for the purpose in question is mandatory, because their treatment is necessary to allow the data controller and the data processor to fulfill legal obligations as well as the customer or user to exercise the rights that the law or the contract attribute to them . Any refusal to provide data for this purpose will make it impossible for the customer or user to exercise these rights.

For this purpose, the owner and the person in charge of the treatment will process the customer's or user's data until the expiry of the legal terms established for the exercise of the rights, or for the time necessary for the management and closure of the file; in the case of exercise of the rights provided for by the GDPR, the data will be processed until the certification, by the data controller, of having fulfilled the request or the fulfillment itself.

​

6. Processing of data by the data controller and data processor for the purposes of ascertaining, exercising or defending a right in relation to purchases on the Site

In the case of purchases on the Site, the data controller and data processor will process customer data for the assessment, exercise or defense of a right in all competent offices.

The legal basis for this processing is legitimate interest (art. 6.1.f GDPR).

Constituisce legitimate interest of the owner and of the data processor to seek the means of appeal to guarantee compliance with their contractual rights or to demonstrate that they have fulfilled the obligations arising from the purchase contract on the Site. This legitimate interest is foundation in the constitutionally protected right to defense and can therefore be considered prevailing over the fundamental rights and freedoms of the interested party.

In any case, the customer has the right to object, for reasons related to his personal situation, to the processing of data concerning him for this purpose, by writing to Gluten free foods at the email addresses indicated in clause 1 above.

Further information

The customer is advised that the data controller and processor will keep the data for the purpose of proving fulfillment of the purchase contract on the Site and/or to initiate or respond to actions relating to this contract; for this purpose the data will be kept for 10 years from the delivery of the product or from the termination of the contract, in the event of non-delivery of the product. In the case of exercising the rights provided for by the GDPR, the data will be kept for 5 years starting from the certification of having responded to the request of the interested party.

The provision of data for this purpose is optional: there is no legal or contractual obligation which requires the data subject to provide data for this purpose.

​

7. Categories of subjects to whom the data controller and data processor communicate the customer's personal data (recipients)

The subjects to whom the data controller communicates the data act as data controllers ("data processors") or persons authorized to process personal data under the direct authority of the data controller ("persons in charge"), or in the case of third parties used by the data controller, as "sub-managers", pursuant to art. 28.4 of the GDPR, except in cases where the recipient acts (also) as an independent data controller, such as, for example, in the case of couriers.

Further information

The personal data provided by the customer during a purchase on the Site may be communicated by the data controller and data processor to the categories of recipients indicated below.

- companies of the group to which the owner or manager belongs and/or to the employees and/or collaborators of the owner and manager, for the performance of administration, accounting and IT and logistic support activities;

- to all those subjects (including the Public Authorities) who have access to personal data by virtue of regulatory or administrative provisions;

- to companies, consultants or professionals who may be in charge of installing, maintaining, updating and, in general, managing the hardware and software of the data controller or data processor, including cloud computing service providers;

- to companies or internet providers responsible for sending documentation and/or informative material and/or soft-spam emails, always without prejudice to the right of the interested party to refuse the sending of such communications at any time;

- to all those public and/or private subjects, natural and/or legal persons (legal, administrative and fiscal consultancy firms, Judicial Offices, Chambers of Commerce, Chambers and Labor Offices, etc.), if the communication is necessary or functional to the correct fulfillment of the contractual obligations assumed in relation to the services on the Site, as well as the obligations deriving from the law or in the case of assessment, exercise or defense of a right. 

The list of recipients is available at the owner's and manager's offices.

​

8. Transfer to third countries

The customer's personal data collected during a purchase on the Site are not transferred to third countries.

​

9. Rights of the interested party

The interested party has the right to:

- ask the data controller and data processor to confirm whether or not personal data concerning him is being processed and, in this case, to obtain access to personal data (right of access); obtain from the data controller and data processor the rectification of personal data concerning him without unjustified delay. Taking into account the purpose of the processing, the interested party has the right to obtain the integration of incomplete personal data, also by providing a supplementary declaration (right of rectification); obtain from the data controller and data processor the cancellation of personal data concerning him without unjustified delay except in legitimate cases of exemption (right of cancellation);

- obtain from the data controller and data processor the limitation of processing when one of the following hypotheses occurs (right to limitation):

• The interested party disputes the accuracy of the personal data for the period of time necessary for the data controller and processor to verify the accuracy of such personal data;

• The processing is unlawful and the interested party opposes the cancellation of personal data and instead requests that its use be limited;

• Although the data controller and data controller no longer need it for processing purposes, personal data are necessary for the data subject to ascertain, exercise or defend a right in court;

• The interested party has opposed the treatment in the hypotheses of treatment based on the legitimate interest of the owner and of the person in charge of the treatment, for reasons connected to his particular situation, pending the verification regarding the possible prevalence of the legitimate reasons of the owner or of the person in charge of the treatment to those of the interested party;

- receive from the data controller and data processor in a structured format, commonly used and readable by an automatic device, the personal data concerning him and has the right to transmit such data to another data controller without impediments (right to data portability);

 - propose a complaint to a supervisory authority (e.g.: the Guarantor for the protection of personal data) if it considers that the processing that concerns him violates the GDPR;

- oppose, for reasons related to his particular situation, to the processing of personal data concerning him, having as its legal basis the legitimate interest of the data controller or data processor (right of opposition). In the event of exercising the right to object, the data controller and the data processor abstain from further processing the personal data, unless they demonstrate the existence of compelling legitimate reasons for proceeding with the processing which prevail over the interests, rights and freedom of the interested party or for the assessment or defense of a right in court.

The rights referred to in this section may be exercised with a written request to the data controller and data processor at the email address indicated in clause 1 above.

​

10. Changes

Gluten free foods reserves the right to make changes to this information at any time, giving suitable publicity to users of the Site and guaranteeing in any case adequate and similar protection of personal data. In order to view any changes, customers are invited to consult this information on a regular basis.