pursuant to Art. 13 EU Regulation 2016/679

This is provided to you as a data subject ("Data Subject") to inform you that your personal data will be processed by our company following your registration. The processing will be carried out in accordance with the criteria of the European Data Protection Regulation, EU Reg. 2016/679 ("GDPR"). According to the aforementioned regulation, the processing must be based on the principles of correctness, lawfulness and transparency, as well as the protection of your confidentiality and your rights.

1. DATA CONTROLLER:
Masi Agricola S.p.A., in the person of its legal representative pro tempore ("Masi" or "Data Controller"), in its capacity as the operational parent company of the companies of the "Masi Group", including Canevel Spumanti S.p.A., on which it plays a role of direction, coordination and synergic management, providing services directly (with its own structure and organisation) and indirectly (through selected suppliers), is therefore to be considered the Data Controller pursuant to Art. 4 of the GDPR, for itself and on behalf of the other companies of the "Masi Group" indicated at www.masi.it.

2. CONTACT DETAILS OF THE DATA CONTROLLER:

For any request related to the processing of personal data or to exercise the rights provided by articles 15-21 of the GDPR, the data subject may contact our Privacy Service:

Masi Agricola S.p.A. - P.IVA 03546810239
Headquarters: Via Monteleone, 26 – 37015, Sant'Ambrogio di Valpolicella (VR), Italia
Phone: 045 683 2511
Email: privacy@masi.it 

If it is not possible to correctly identify the request, the Privacy Service may request additional information for the sole purpose of correctly identifying the person concerned.

3. LEGAL BASIS AND PURPOSE: 

The personal data processed by the data controller (including: first name, last name, e-mail, telephone number, address, VAT number, etc.) are collected for the following purposes and in accordance with the specific legal basis:

1. To enable the performance of a contract or pre-contractual measures to which the data subject is a party, pursuant to article 6, par. 1, letter b) of the GDPR;
2. To carry out marketing activities by sending commercial communications, promotions, discounts, rebates and other special services using newsletters, as well as invitations to participate in events or shows dedicated to Masi S.p.A. customers, for which the consent is required pursuant to art. 6, par. 1, letter a), GDPR;
3. To carry out profiling activities, through the analysis of information relating to your interests, preferences for our products and services and consumption choices, also through the detection of the type and frequency of purchases made by you online, in order to provide you with a personalised service on the occasion of your future purchases through the enotecamasi.it website, for which the consent is required pursuant to art. 6, par. 1, letter a), GDPR. 
   If you have also consented to the processing of your personal data for marketing purposes, we may send you promotions and/or invitations to initiatives that are more in line with your profile, preferences and expectations;
4. Sending informative, institutional and/or commercial communications regarding services similar to those covered by previous sales between the parties, through the use of newsletters and/or the sending of personal invitations to events and trade fairs, for which consent is not required, so-called soft-spam, pursuant to art. 130, paragraph 4 of Legislative Decree 196/2003 and art. 6, paragraph 1, letter f) of the GDPR;
5. Fulfilment of legal obligations or for the pursuit of a legitimate interest of the data controller pursuant to article 6, paragraph 1, letters c) and f) of the GDPR (for example, the establishment, exercise or defence of a right in all competent venues, including the recovery of credit through extra-judicial procedures), in compliance with the conditions and restrictions provided for by the applicable legislation;
6. The communication of personal data within the companies belonging to the "Masi Group" for internal administrative purposes, in the legitimate interest of the data controller as per art. 6, par. 1, letter f) GDPR.

For the purposes referred to in points a), e) and f), the provision of the data is obligatory, the data will be collected without your consent, otherwise the Data Controller will not be able to proceed with the execution of the contract or the pre-contractual negotiations. For the purposes referred to in points b) and c), the provision of the data is optional and, in the event of failure to provide the data, the data controller will not be able to proceed for that specific purpose without having obtained your prior and explicit consent. For the purposes referred to in point d), the provision of the data is optional and, in the absence of your explicit consent, the data controller may continue to send you communications unless you object to such processing.

However, you may at any time ask the data controller to clarify the specific legal basis of any processing and/or object to processing based on legitimate interest by contacting our Privacy Service at: privacy@masi.it.

4. MODALITIES: 

Personal data will be processed, also with the aid of automated tools, by the Data Controller and by the Data Processors in charge duly appointed for the correct fulfilment of the purposes indicated at point 3), using electronic tools and paper archives, with the application of security measures aimed at guaranteeing the confidentiality of personal data and preventing unauthorised access.

5. COMMUNICATION: 

The data will be processed at the operational offices of the Data Controller and at any other place where the parties involved in the processing are located. Accounting/fiscal data may be communicated to duly appointed external parties who carry out activities on behalf of the data controller, such as but not limited to: accountants, credit institutions and related external professionals. The processed data may be communicated to duly appointed external partners and suppliers who guarantee the same level of technical/organisational/informatic/legal protection as the data controller. The transfer of personal data collected in third countries outside the EU and their dissemination (e.g. social networks, websites, etc.) is not envisaged. The Data Controller may use automated procedures, including profiling, to achieve the purposes set out in point 3 of this document, based on what is defined in these Regulations. The personal data relating to the processing in question may be transferred to companies connected to Masi for the purpose of achieving the purposes set out in this Privacy Policy, providing sufficient guarantees to implement appropriate technical and organisational measures so that the processing meets the security requirements set out in this Agreement and in the GDPR.

6. DATA RETENTION: 

The Controller shall process personal data in relation to the purposes set out in point 3 above:

1. 10 years from the termination of the commercial or contractual relationship;
2. until the consent is revoked by the data subject, and in any case for a maximum of 24 months, without prejudice to the lawfulness of the processing during the period of consent. In the event of revocation, Masi will cease any further communication with the Data Subject;
3. until the revocation of the consent by the data subject, without prejudice to the lawfulness of the processing during the period of validity of the consent. If the user has given specific consent for marketing and profiling purposes, the data provided by him/her will be processed for an appropriate and reasonable period of time, and in any case not exceeding 12 months for profiling purposes and 24 months for marketing purposes. Data relating to purchasing habits will in any case be rendered anonymous 12 months after the purchase;
4. until the data subject objects to such processing. The data subject may, at any time and free of charge, stop receiving these communications by writing to privacy@masi.it, without prejudice to the lawfulness of the processing during the period preceding the communication. In case of request for cancellation, the data controller will not send any further communication;
5. for the time strictly necessary to carry out this purpose;

7. RIGHTS OF THE DATA SUBJECT:

The data subject has the right to request from the data controller access to, rectification or erasure of his/her personal data, or restriction of the processing of his/her personal data, or the right to object to the processing of his/her personal data, as well as the right to request the portability of the data, as provided for in Articles 15-21 of the GDPR. The request may be made by email or registered mail addressed to the Privacy Service with the subject line "Request by the Data Subject", specifying in the request the right that the Data Subject wishes to exercise (cancellation, rectification, portability, erasure), together with a valid email/PEC address to which the response should be sent. The Data Controller or a anyone appointed by the same will proceed to satisfy the request within 30 days from the date of receipt. Should the response be complex, this period may be extended to a further 30 days, subject to timely notification to the data subject. If you consider it appropriate to exercise your rights, you have the right to lodge a complaint with the competent supervisory authority, which is the Garante per la Protezione dei Dati Personali, with registered office in Piazza Venezia 11, Rome.