pursuant to Article 13 of Regulation (EU) 2016/679 (‘Privacy Policy’)

This Privacy Policy is provided pursuant to Regulation (EU) 2016/679 (hereinafter ‘Regulation’ or ‘GDPR’) and describes the methods used to process the Personal Data of Users who visit or use this Website, accessible at the address https://oleage.it/ (hereinafter also ‘Website’) or use the services offered by Società Eupalm S.r.l. via the Website.

The Data will be used for the purpose of providing services to the User, fulfilling legal obligations and sale of products, including those necessary for acceptance of purchase orders, payments and delivery and relating to credit cards and current accounts used for bank transfers or other available payment methods.

A. DATA CONTROLLER
The Data Controller is EUPALM S.r.l., with registered office at Via Col Di Lana 54, 06132 Perugia, Italy, VAT no. 03875550547, represented by its legal representative pro tempore (hereinafter ‘Data Controller’), e-mail [email protected]

B. TYPES OF DATA COLLECTED, PURPOSES, LEGAL BASIS AND RETENTION PERIODS

1. Browsing data
Personal Data may be collected automatically by the Data Controller or through third parties.
In this case, the computer systems and software procedures responsible for operation of this Website acquire certain digital/technical Personal Data on Users (e.g., IP address, browser type, operating system, domain name and web addresses of sites used to access/leave the Website, etc.), whose transmission is implicit in normal internet function.

Purposes, retention period and legal basis for processing: this Data may be processed for the sole purpose of obtaining anonymous statistical information on Website usage and/or for monitoring and ensuring correct function or service provision.
This Data will be deleted immediately after processing, on completion of the User’s browsing session.
Processing is carried out on the basis of the Data Controller’s legitimate interest in making the Website accessible and ensuring safe browsing (Art. 6, par. 1, lett. f). Exclusively for the specific activity of profiling, consent must be provided by the Data Subject (Art. 6, par. 1, lett. a).

2. Email contact by the User, telephone contact and form completion
Optional, explicit and voluntary sending of emails to the addresses indicated on this Website shall result in subsequent acquisition of the Data communicated the User, including their email address, and consent to receive responses to their requests.
In this case, provision of email addresses and any other Data is optional but essential in order to use the service and receive a response to your request and, if you do not provide them, we will be unable to process it.

Purposes, retention period and legal basis for processing: Personal Data provided in this way is used for the sole purpose of fulfilling or replying to requests sent and is only communicated to third parties where necessary for this purpose.
The Data is retained for the period necessary for the purposes of fulfilling the request and in compliance with current legislation.
Processing is carried out for fulfilment of contractual and pre-contractual obligations undertaken by the Data Controller in relation to the service (Art. 6, par. 1, lett. b).

3. Account creation and order fulfilment
By generating an account, the User provides the platform with the Data necessary in order to place Orders in accordance with our Terms and Conditions. The Data provided permits identification for accessing the account and supplies information on transactions when an order is placed with one of the Partner businesses on the platform.
Information on transactions enables us to:

• process the order and issue a tax receipt (invoice);
• the platform does not store information on your credit card;
• arrange delivery or collection.

Retention period and legal basis for processing: Data provided voluntarily by the User is retained for the period necessary for the purposes of fulfilling the request and in accordance with current legislation and contractual obligations of any kind.
Processing is carried out for fulfilment of contractual and pre-contractual obligations undertaken by the Data Controller in relation to the service (Art. 6, par. 1, lett. b).

4. Newsletters and marketing/promotional communications
Where explicitly requested by Users, their contact Data may be provided for the purpose of receiving marketing and/or informative communications regarding the Data Controller’s business.
Provision of this Data for these purposes is entirely optional but essential for provision of the promotional information service described above.
To send you newsletters, we use this tool:

Purposes, retention period and legal basis for processing: Personal Data provided in this way (name, surname and email address) is used for the sole purpose of fulfilling or replying to requests and is only communicated to third parties where necessary for this purpose and only subject to provision of explicit consent by the Data Subject.
The Data is retained for the period necessary for performance of the activity for which it is provided and, in any case, no longer than the two years expressly prescribed by law (unless consent is renewed by the Data Subject for use for other purposes in accordance with current legislation).
Processing is carried out on the basis of explicit consent by the Data Subject (Art. 6, par. 1, lett. a).

5. This Website uses tracking, profiling and technical cookies. For details, please refer to our Cookie Policy

C. INTEGRATION OF SOCIAL MEDIA PLUGINS
We have integrated social media (Facebook and Instagram) social media plugins into the Website. This means that, when you click or touch one of the buttons (such as Facebook’s ‘Like’ button), certain information is shared with the social media service providers.
If you are connected to your social media account when you click or touch one of these buttons, the social media provider may connect this information to your social media account. Depending on your settings, they could also display these actions on your social media profile so that they are visible to other users on your network.

D. PROCESSING METHODS
The Data Controller processes Users’ Personal Data in accordance with appropriate security measures designed to prevent unauthorised access, disclosure, modification or destruction of the Personal Data.
Processing is performed using computerised and/or telematic tools and according to organisational methods and logics strictly related to the specified purposes.

E. DATA RECIPIENTS
The Data collected is processed by the Data Controller’s personnel (‘Data Processors’), subject to prior authorisation and on the basis of specific instructions provided with regard to purposes and methods of processing.
In some cases, the Data could be accessed by categories of Data Processors involved in organisation of the Website (administrative, marketing or legal personnel or system administrators) or by external subjects (such as suppliers of third-party technical services, postal couriers, hosting providers, IT companies or advertising agencies) who may, where necessary, be appointed as Data Supervisors by the Data Controller.
In addition, subjects appointed as Data Supervisors pursuant to Art. 28 of the GDPR or Sub-Supervisors, who the Data Controller uses for provision of the services or performance of the activities for which it is responsible, may be recipients of Data collected during browsing of the Website or use of the services, within the limits of their respective assignments.
A list of these may be requested from the Data Controller using the contact details provided in section A.
If, in provision of the services offered by the Website, a Data Supervisor pursuant to Art. 28 of the GDPR or a Sub-Supervisor is appointed, the Data will be communicated to our Data Controller and/or Data Supervisor.

F. TRANSFER OF DATA
The Personal Data provided will not be transferred abroad.

G. RIGHTS OF THE DATA SUBJECT
Data Subjects (identified or identifiable individuals to whom the Data refers) may exercise the specific data protection rights listed below:
a) right of access: the right to obtain confirmation from the Data Controller as to whether or not Personal Data concerning them is being processed and, where this is the case, to access the Personal Data and detailed information regarding the origin, purpose of processing, categories of Data processed, recipients to whom the Data will be communicated and/or transferred, and more;
b) right to rectification: the right to obtain rectification by the Data Controller without undue delay of inaccurate Personal Data and to have incomplete Personal Data completed, including by providing a supplementary statement;
c) right to erasure (‘right to be forgotten’): the right to obtain erasure by the Data Controller of Personal Data without undue delay where: i. necessary Data is no longer necessary for the purposes of processing; ii. the data subject withdraws the consent on which processing is based and there is no other legal ground for processing; iii. the Personal Data has been unlawfully processed; iv. the Personal Data has to be erased for compliance with a legal obligation;
d) right to object: the right to object at any time to processing of Personal Data whose legal basis is a legitimate interest of the Data Controller;
e) right to restriction of processing: the right to obtain restriction of processing from the Data Controller where the accuracy of the Personal Data is contested by the Data Subject (for a period enabling the Data Controller to verify the accuracy of the Personal Data), processing is unlawful and/or the Data Subject opposes processing;
f) right to data portability: the right to receive Personal Data in a structured, commonly used and machine-readable format and to transmit this Data to another Data Controller, if technically feasible, only where processing is based on consent or on a contract and only for Data processed by automated means;
g) right to lodge a complaint with the supervisory authority: without prejudice to any other administrative or judicial remedy, if Data Subjects consider the data processing relating to them infringes the GDPR, they have the right to lodge a complaint with the supervisory authority in the Member State of their habitual residence, place of work or place of the alleged infringement.

Exercise of the rights under Article a), above, must take place by written communication sent to one of the following email addresses:

• Data Controller: [email protected]