Policy on personal data processing based on

REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016 (“GDPR”)

Introduction

The Data Controller is La Sapienza Società Agricola Semplice, with registered office in Via della Torre, 5, 05020, Montecchio (Tr), Italy, Chamber of Commerce of Perugia, VAT number 03538870548, owner of the website www.latartufaiavilla.com (Website).

Purchasing through the Website

La Sapienza shall acquire and process your personal data to process your request to purchase through the Website.

Marketing

If you provide your explicit consent, La Sapienza shall process your personal data to send you promotional communications and/or newsletter regarding services offered for sale by La Sapienza or by third parties.

Profiling

If you provide your explicit consent, La Sapienza shall process your personal data for the analysis of your consumer choices and purchasing habits (known as “profiling”), through a study of the type and frequency of your online purchases, in order to send newsletter and/or advertising material of La Sapienza or third-parties that may be of particular interest to you.

Soft Spamming

La Sapienza is entitled to sale its services using the email that you communicated during your first purchase on the Website, if this service is similar of the first sale (soft spamming). You may at any time notify La Sapienza of your refusal to receive this type of communication.

Pursuant to the GDPR, La Sapienza shall process the personal data provided by you as indicated in this privacy policy.

Summary

• Art. 1. Purpose of the processing. Legal basis. Mandatory or optional nature of data provision and consequences of any refusal.
• Art. 2. Methods of Processing Personal Data
• Art. 3. Data Disclosure
• Art. 4. Data Controller
• Art. 5. Data Storage
• Art. 6. Transfer of Personal Data to Third Countries
• Art. 7. Rights of the Data Subject
• Art. 8. Amendments

Article 1. Purpose of the processing. Legal basis. Mandatory or optional nature of data provision and consequences of any refusal.

La Sapienza shall process the personal data provided by you for the following purposes:

• for administrative/accounting purposes. The legal basis for the processing is La Sapienza’s commitment to be compliance with a legal obligation or to take steps at the request of the data subject prior to entering into a contract, as the case may be;
• in the case of the execution of an purchase order, to allow the conclusion of the purchase contract and the proper execution of transactions related to the same (and, where necessary, to fulfill tax obligations). The legal basis for the processing is La Sapienza ‘s commitment to be compliance with a legal obligation or to perform a contract to which the data subject is party;
• limited to the email address provided by you when purchasing services offered, to enable the direct sale of similar services (soft spamming), without requiring your express and prior consent and provided that you do not exercise your right to object. The legal basis for the processing is La Sapienza ‘s legitimate interest to perform these activities. This legitimate interest is equal to the user’s interest to riceve “soft-spam” comunication;
• if you provide your explicit consent, for La Sapienza to send you newsletter and for market research purposes also aimed at evaluating the level of customer satisfaction and to send you promotional communications in relation to the services of La Sapienza and / or third-parties, by email (marketing purposes); if you provide your explicit consent, for the analysis of your consumer choices and purchasing habits (known as “profiling”), by La Sapienza, through a study of the type and frequency of your online purchases, in order to send informative and/or advertising material about services of La Sapienza and / or third-parties, that may be of particular interest to the user, by email (profiling purposes). The legal basis for the processing is your consent;
• in order to answer to your requests by email, by telephone. The provision of data is purely optional. However, as the said processing is necessary in order to respond to your request, your refusal to provide the relevant data will prevent you from obtaining answer from the customer care of La Sapienza. The legal basis for the processing is the La Sapienza’s legitimate interest to perform these activities. This legitimate interest is equal to the user’s interest to receive answer by La Sapienza.

The provision of data for the purposes set out in at Point b) is purely optional. However, as the said processing is necessary in order to enable you to provide the purchasing your refusal to provide the relevant data will prevent you from completing a purchase.

Consent to marketing and profiling purposes is purely optional. Failure to consent will have the following consequences.

Failure to consent to the processing of personal data for marketing purposes will prevent you to receive promotional communication and newsletter regarding services of La Sapienza and/or third-parties and will prevent La Sapienza to carry out market research purposes aimed at evaluating the level of customer satisfaction.

Failure to consent to the processing of personal data for profiling purposes will prevent La Sapienza from studying the type and frequency of your online purchases, in order to send to you newsletter and/or advertising material that may be of particular interest to you regarding services of La Sapienza and/or third-parties.

It is understood that La Sapienza may use your personal data to comply with legal obligations and to perform the purchase contract.

You may revoke your consent using the relevant link indicated in any promotional email sent by La Sapienza . Credit card payments on the Website

In order to make a payment through one of the payment cards offered on the Website, you shall enter the data of the payment card directly on a page that will communicate through secure encryption protocol with the payment service provider (which will act as an independent data controller). These data will not pass through the server of La Sapienza which, therefore, will not process such data in any way.

In execution of the legal obligations provided for by Directive 2015/2366/ (EU) on payment services in the internal market (PSD2), You are informed that, with reference to purchases made on the Web Site by credit card, data necessary for the conclusion of the purchase process may include the phone number communicated by You, or a different personal data necessary to complete the purchase process. In order to allow you to complete the purchase, the payment institution in charge of managing the transaction will send you an authentication code, which must be reported by You during the purchase process to meet the authentication criteria provided by PSD2 (Strong Customer Authentication). The processing of your personal data for these purposes has as its legal basis the fulfillment of legal obligations and does not require your consent.

To provide the above-indicated data is necessary to make purchases on the Website.

Special Categories of Personal Data. Judicial Data

La Sapienza does not process special categories of personal data nor judicial data.

Article 2. Methods of Processing Personal Data

The processing of your personal data will be carried out by electronic or automated means, in the manner and with the appropriate tools to ensure the security and confidentiality in accordance with the GDPR.

The information and methods of processing will be relevant and not excessive in relation to the type of services provided. Data will be managed and protected in environments where access is under constant control.

Art. 3. Data Disclosure

For the purposes described in this privacy policy, the personal data provided by you may be disclosed or communicated to the following parties:

• to all those parties (including Public Authorities) that have access to the data by virtue of regulatory or administrative measures;
• to parties who process online payment transactions;
• to companies, consultants or professionals in charge of the installation, maintenance, updating and the management of La Sapienza‘s hardware and software or which La Sapienza uses for the provision of its services;
• to the companies that send the newsletters and/or other informative communications transmitted on behalf of La Sapienza;
• to the employees and/or collaborators of La Sapienza;
• companies managing online payment transactions;
• to all those public and/or private parties, natural and/or legal persons (legal, administrative and tax consultancy firms), where the communication is necessary or of practical use for the correct fulfilment of contractual obligations undertaken in relation to the services provided through the Website, and of legal obligations.

Your data may be disclosed only in anonymous and aggregated form for statistical or research purposes.

Art. 4. Data Controller

You can contact La Sapienza, as Data Controller, at the following addresses:

• La Sapienza Società Agricola Semplice, Via della Torre, 5, 05020, Montecchio (Tr), Italy
• By telephone: +39 3428798417
• By email, writing to: info@latartufaiavilla.com

Art. 5. Data Storage

Personal data will be stored according to the following logics:

• for marketing purposes, until consent is revoked;
• for profiling purposes, until consent is revoked;
• for the purpose of executing the sales contract, for 10 years from the date of receipt of the purchase order;
• for the purpose of defense in court, until the judgment becomes final;
• for the purpose of complying with legislation, for the time necessary for this purpose;
• for the purpose of performing any service requested through the Site, for the time necessary to execute the request.

Art. 6. Transfer of Personal Data to Third Countries

La Sapienza will transfer your personal data to U.S.A.. With reference to this country, The European Commission has established that the protection of personal data is adequate according to the GDPR, therefore personal data may be transferred.

Art. 7. Rights of the Data Subject

Pursuant to GDPR (Article 13), you have the right to:

• request access to and rectification or erasure of personal data or restriction of processing or object to their processing, in addition to the right to data portability
• withdraw consent at any time without prejudice to the lawfulness of processing based on consent given prior to the withdrawal
• lodge a complaint before a supervisory authority (for instance, the Italian Data Protection Authority).

The above-mentioned rights may be exercised by making a request to at the contacts indicated above.

Art.8. Amendments

La Sapienza reserves the right to change this privacy policy at any time, giving suitable notice to users and ensuring in any case an adequate and similar protection of personal data. In order to view any changes, you are invited to regularly consult this privacy notice.