Privacy and Policy

PRIVACY POLICY

Information provided pursuant to art. 13 et seq. of EU Regulation 2016/679 (GDPR)

Pursuant to articles 13-14 et seq. of EU Regulation 2016/679 (GDPR), we provide you with the following information

Index

Introduction. 1

Categories of personal data processed 2

Categories and types of treatments 2

Purpose and legal basis of the processing. 2

Categories of third parties to whom the data may be communicated 4

Joint data controller. 5

External data controller. 5

Duration of treatment and storage period. 5

Rights of the interested party. 6

Right to lodge a complaint with the Guarantor, or appeal to the judicial authority 7

Cookie Policy. 8

General information, deactivation and management of cookies. 8

Technical Cookies 8

Third party cookies 9

Profiling Cookies. 9

Introduction

This information is provided by Scovaventi SS Agricola (Scovaventi), with registered office in Loc.

Contact email of the Data Controller for information relating to processing:info@scovaventi.it

The data collected are processed in accordance with the principles of correctness, transparency, limiting them only to the purposes necessary for the exercise of their activity, minimizing, updating and adopting all the necessary measures to guarantee the accuracy of the data processed and, finally, guaranteeing confidentiality and integrity of the same.

The data processing occurs manually, electronically and electronically; security measures are adopted to avoid the risk of unauthorized access, destruction or loss, or processing that is not permitted or does not comply with the purposes of the collection.

It is specified that in the following information when the terms such as Owner, Interested Party, Manager are mentioned, reference is made to the definitions of the same as set out pursuant to art. 4 EU Regulation 2016/679 (GDPR).

Categories of personal data processed

Scovaventi SS Agricola will process the following personal data:

• Personal data, address of residence or domicile and contact details (i.e. telephone, email address, certified e-mail), more generally personal identification data;
• Electronic identification data;
• Banking, payment and/or financial data;
• Health data, such as certifications aimed at obtaining tax reductions and/or exemptions;
• Family data;
• Images, sound recordings and video surveillance images;
• Telematic traffic data;
• Judicial data;
• Trade union membership data.

Scovaventi SS Agricola, as also highlighted in this list, also processes or could process data included among those provided for in the art. 9 1st co. of EU Regulation 2016/679 (GDPR). (so-called special categories of data). This processing, which will take place according to the principles of correctness, lawfulness, transparency and protection of confidentiality, is permitted and carried out in compliance with the provisions of the art. 9 2nd co. lit. a), b) and f) of EU Regulation 2016/679 (GDPR).

Categories and types of treatments

The data provided are processed by Scovaventi SS Agricola for the execution of operations such as, for example:

collection, recording, organisation, structuring, storage, adaptation or modification, retrieval, consultation, use, communication by transmission, comparison, interconnection, limitation, erasure or destruction.

This list is merely an example of some of the types of processing that are implemented on the basis of the data of which Scovaventi SS Agricola is the Data Controller.

The types of further processing that can be implemented, in addition to those indicated above, are for example: automated and systematic evaluation processes, profiling, systematic surveillance and use of new technologies or application of technical and organizational means.

The latter types of processing, where present, will be given appropriate indication in the information in the paragraph " Purpose and legal basis of the processing ".

Purpose and legal basis of the processing

The data provided are processed by Scovaventi SS Agricola for the following purposes:

• the fulfillment of legal obligations, or institutional purposes as provided for in the Statute of Scovaventi SS Agricola, as well as for the fulfillment of obligations arising from the contracts signed from time to time between Scovaventi SS Agricola and the users interested in the processing;
• Administration and personnel management;
• IT security: the Data Controller, in line with the provisions of Recital 49 of EU Regulation 2016/679 (GDPR), processes, also through its suppliers (third parties and/or recipients), the personal data of the interested party relating to traffic in strictly necessary and proportionate measure to guarantee network and information security, i.e. the ability of a network or information system to resist, at a given security level, unexpected events or illicit or malicious acts that compromise the availability, authenticity, integrity and confidentiality of personal data stored or transmitted. The Data Controller will promptly inform the Interested Parties, if there is a particular risk of violation of their data, in compliance with the obligations arising pursuant to art. 33 of EU Regulation 2016/679 (GDPR) relating to notifications of personal data breaches.

The legal basis of such processing is compliance with legal obligations and the legitimate interest of the Data Controller in carrying out processing with the aim of protecting company assets and security of offices and systems;

• Profiling: the personal data of the interested party may also be processed for profiling purposes, as defined in the art. 4 of EU Regulation 2016/679 (GDPR); the personal data of the interested party, including both the so-called particular (Art 9 GDPR) or judicial data (Art 10 GDPR) will be processed to allow controls for the purpose of monitoring and preventing fraudulent payments and/or defaults by software systems that carry out a verifies in an automated manner and prior to the start of the enforcement phase of the credits claimed by the Owner. This processing is carried out for the legitimate interest of the Data Controller;
• Soft Marketing and Marketing: is the hypothesis in which the Data Controller wants to use the data provided by customers for further purposes, such as sending promotional communications relating to services provided by the Data Controller himself or by third parties, such as for example: commercial information and promotional, direct sales, market research on products, services and events, delivery of vouchers or coupons for the collection of small prizes/freebies of minimum economic value (hereinafter collectively referred to as "marketing activities"). The processing for marketing purposes will take place through the use of remote communication techniques, such as telephone, e-mail, mms, sms, whatsapp, apps, social media networks and others, also through automated systems. The provision of personal data for this purpose is optional and the processing requires the consent of the interested party. The consent given for the sending of commercial and promotional communications via automated tools also extends to traditional contact methods. This activity, however, is subject to the presence of the following requirements:

1. it can only be carried out for the transmission of e-mail messages (phone calls are excluded);
2. the email address of the interested party/customer must be the one previously indicated on the occasion of the sale of products or services;
3. the messages must be sent for the purpose of direct sales of products and/or services provided by the owner (and not by third parties);
4. the product or service must be similar to those already purchased by the interested party or, at least, connectable to it;
5. the recipient must not have refused, at the beginning or during the processing, the sending of promotional communications and, furthermore, must have the possibility to object to the processing of data at any time, free of charge and simply (opt-out option present in the emails sent).

This type of service allows you to manage a database of email contacts, telephone contacts or contacts of any other type, used to communicate with the user/interested party. These services, it should be noted, could also allow the collection of data relating to the date and time of display of messages by the user/interested party, as well as information on clicks on links included in the messages.

• ecommerce: the Data Controller allows you to purchase its products directly from its website. On this occasion the user will be able to register his account on the website or not and then complete the order. The data that will be processed are those necessary for issuing the invoice (i.e. identification data, accounting data, payment data), those for shipping and those for navigation through profiling cookies. The payment systems made available to the Data Controller on its website are by credit card and PayPal (in relation to the latter payment method, please refer to the PayPal privacy page: https://www.paypal.com /it/webapps/mpp/ua/privacy-full).
• Newsletter: the newsletter service consists of sending electronic communications following the express request of the recipient/interested party, for which the consent provided by the same when completing the subscription form for the newsletter service where this information is present is sufficient. It should be noted that there is no further processing of the data beyond the mere sending of the newsletter and, in any case, the data collected is that strictly necessary for sending the newsletter itself. This type of service allows you to manage a database of email contacts, telephone contacts or contacts of any other type, used to communicate with the user/interested party. These services, it should be noted, could also allow the collection of data relating to the date and time of display of messages by the user/interested party, as well as information on clicks on links included in the messages. For the newsletter, the Data Controller uses the following software: MailChimp: is a platform created for the marketing management of small companies. The company that owns the platform is The Rocket Science Group, LLC, 675 Ponce de Leon NE, Suite 5000, Atlanta, GA 30308 USA. For privacy management, please refer to the company website: https://mailchimp.com/legal/privacy/
• Personal data collected for anti-fraud purposes only, unlike the data necessary for the correct execution of the required service, will be immediately deleted at the end of the control phases.

The Data Controller arranges for the use of adequate security measures in order to preserve the confidentiality, integrity and availability of the interested party's personal data and imposes similar security measures on third party suppliers and Managers.

Categories of third parties to whom the data may be communicated

The data held by the Data Controller may be communicated to third parties for the fulfillment of legal obligations, as well as for the execution of the contract signed between Scovaventi SS Agricola and the individual user/interested party and furthermore, given that the communication of the personal data of the Interested takes place mainly towards third parties and/or recipients whose activity is necessary for the performance of activities inherent to the Data Controller's activity as well as to respond to certain legal obligations, the data may be communicated to the following categories of subjects:

• Third party suppliers who carry out technical and organizational services for Scovaventi SS Agricola (purposes such as software maintenance and management, printing and sending correspondence);
• Credit and digital payment institutions, banking/postal institutions (purposes such as management of collections, payments);
• Studies, consultants and companies in the context of assistance and consultancy relationships (purposes i.e. fulfillment of legal obligations, exercise of rights, protection of contractual rights, credit recovery);
• Financial administration, public bodies, judicial authorities, supervisory and control authorities (and this for purposes such as, among others, the fulfillment of legal obligations, the defense of rights, the formation or updating of lists and registers kept by public authorities or similar bodies based on specific legislation);
• Subjects formally delegated or having recognized legal titles (i.e. legal representatives, curators, guardians).

The Data Controller requires its Third Party Suppliers and Data Processors to comply with security measures equal to those adopted for the Interested Party, restricting the Data Processor's powers of action to the processing connected to the requested service and also requesting that the Data Processor at his/her time adopts and respects the duties imposed by EU Regulation 2016/679 (GDPR) in relation to the processing of data with which it comes into contact.

The Data Controller does not transfer personal data to countries in which EU Regulation 2016/679 (GDPR) is not applied (non-EU countries), or countries with which an agreement is not specifically provided for with the EU authorities or individual member states ( for example Privacy Shield EU-US). Otherwise, it will be the Data Controller's responsibility to inform the interested party in advance of this type of transfer.

The legal basis of such processing is the fulfillment of the services inherent to the institutional tasks of the Data Controller, compliance with legal obligations as well as the legitimate interest of Scovaventi SS Agricola in carrying out the processing necessary for these purposes.

Joint data controller

Scovaventi SS Agricola. to carry out its business, especially in the marketing sector, it uses programs and social networks which, by their nature, are to be considered joint controllers of data processing. Specifically, Scovaventi SS Agricola uses the following promotional tools:

• Facebook and Instagram: are social networks in which individual users must previously and independently register. The data acquired through social networks are managed according to the methods established by them, to which please refer: https://it-it.facebook.com/privacy/explanation .

External data controller

During the processing of data, Scovaventi SS Agricola makes use of the following external managers to whom the data of interested parties may be communicated or can access them:

• Zucchetti supplier and maintainer of the Ad Hoc Revolution software, software that is used as company management;
• Andrea Imperato: professional who takes care of the accounting relating to the Data Controller and provides the Team System software for electronic invoicing;
• Enzo Bergamini and Simona Albini: professionals who act as labor consultants in the interests of the Data Controller;
• Yes I Am as website maintainer;
• Aruba as website hosting provider;
• Linkway in its role as hosting provider and maintainer of the internal network;

The contact details for the individual external managers will be provided, where necessary and upon written request sent by email to the reference address of the Data Controller info@scovaventi.it

Duration of treatment and storage period

The data will be processed and stored until they are necessary for the legitimate purposes for which they were collected, or until an express request is made by the interested party to delete the data in accordance with the provisions of EU Regulation 679/ 2016.

In the event that the user/interested party forwards personal data to Scovaventi SS Agricola that are not requested or not necessary for the performance of their activity, Scovaventi SS Agricola cannot be considered the owner of these data and will delete them as soon as possible. .

In any case, personal data will be kept for the fulfillment of obligations (e.g. fiscal and accounting) which remain even after the termination of the contract (art. 2220 cc). For these purposes, the Data Controller will only retain the data necessary for the relevant pursuit of the obligation imposed by law.

This is without prejudice to cases in which the rights deriving from the contract must be asserted in court, in which case the personal data of the interested party, exclusively those necessary for such purposes, will be processed for the time necessary for their pursuit.

Rights of the interested party

The interested party has the right to obtain the following from the data controller:

1. Confirmation as to whether or not personal data concerning you is being processed and, if so, to obtain access to the personal data and the following information:

• The purposes of the processing;
• The categories of personal data in question;
• The recipients or categories of recipients to whom the personal data have been or will be communicated, in particular if recipients are from third countries or international organizations;
• When possible, the expected retention period of personal data, or, if it is not possible to identify the term, the criteria used to determine this period;
• The existence of the interested party's right to ask the Data Controller to rectify or delete personal data, where possible, or to limit the processing of personal data concerning him or her or to oppose their processing;
• The right to lodge a complaint with a Supervisory Authority;
• If the data are not collected from the interested party, all available information on their origin;
• The existence of an automated decision-making process, including profiling, and, at least in such cases, significant information on the logic used, as well as the importance and expected consequences of such processing for the interested party;
• The adequate guarantees that the third country (non-EU) or an international organization provides to protect any data transferred.

1. The right to obtain a copy of the personal data being processed, provided that this right does not adversely affect the rights and freedoms of others. In the event of further copies requested by the interested party, the Data Controller will have the right to charge a reasonable fee based on administrative costs.
2. The right to obtain from the Data Controller the rectification of inaccurate personal data concerning him without unjustified delay.
3. The right to obtain from the Data Controller the deletion of personal data concerning him without unjustified delay, if the reasons provided for by EU Regulation 2016/679 (GDPR) pursuant to art. 17, including, for example, the case in which they are no longer necessary for the purposes of the processing or this is assumed to be illicit, and always if the conditions established by law exist. The rights referred to in paragraphs 1 and 2 of the art. 17, pursuant to paragraph 3 letter. b) of the same article do not apply in the event that the processing is necessary for the fulfillment of a legal obligation that requires the processing provided for by the law to which the Data Controller is subject or for the execution of a task carried out in the public interest ;
4. The right to obtain from the Data Controller the limitation of processing, in the cases provided for pursuant to art. 18 of EU Regulation 2016/679 (GDPR), such as where its accuracy is contested, for the period necessary for the Data Controller to verify its accuracy. The interested party must also be informed, within a reasonable time, of when the suspension period has been completed or the cause of the limitation of processing has ceased to exist, and therefore the limitation itself revoked. Pursuant to art. 18, 2nd co. of EU Regulation 2016/679 (GDPR), if the processing is limited, such personal data may still be processed if the processing is carried out for reasons of relevant public interest of the Union or of a Member State.
5. The right to obtain communication from the Data Controller of the recipients to whom the requests have been sent of any rectifications or cancellations or limitations of processing carried out, unless this proves impossible or involves a disproportionate effort;
6. the right to receive the personal data concerning him or her in a structured, commonly used and machine-readable format and the right to transmit such data to another Data Controller without impediments on the part of the Data Controller to whom he or she provided them, in the cases provided for by the art. 20 of the GDPR, and the right to obtain the direct transmission of personal data from one Data Controller to another, if technically feasible.
7. The interested party has the right to object at any time, for reasons related to his particular situation, to the processing of personal data concerning him pursuant to art. 6 1st co, lett. e) of), including profiling on the basis of these provisions. In this case, the Data Controller will refrain from further processing the personal data unless he demonstrates the existence of compelling legitimate reasons to proceed with the processing which prevail over the interests, rights and freedoms of the interested party or the assessment, exercise the defense of a right in court.

Right to lodge a complaint with the Guarantor, or appeal to the judicial authority

The interested party has the right to choose the legal protection remedy that he deems most effective, opting between a complaint to the Guarantor and an appeal before the Judicial Authority. The choice of one procedural instrument excludes the other. The interested party can contact the Guarantor via complaint as provided for pursuant to art. 77 of EU Regulation 2016/679 (GDPR). This protection is an alternative to any other action instituted or to be instituted before the ordinary Judicial Authority pursuant to art. 82 of EU Regulation 2016/679 (GDPR).

* * *

Cookie Policy

General information, deactivation and management of cookies

Cookies or other identifiers consist of portions of code placed on the user's device within the browser that assist the Data Controller in providing the service based on described purposes.

Some of the purposes of using the Identifiers may also require the User's consent. If consent has already been given, it can be freely revoked at any time by following the instructions contained in this document.

Cookies are data that are sent by the website and stored by the Internet browser on the user's computer or other device (for example, tablet or mobile phone). Technical cookies and third-party cookies may be installed from our website www.scovaventi.it or from the related subdomains.

In any case, the user will be able to manage, or request the general deactivation or deletion of cookies, by changing the settings of their Internet browser. This deactivation, however, may slow down or prevent access to some parts of the site.

The settings to manage or disable cookies may vary depending on the Internet browser used. Therefore, for more information on how to carry out these operations, we suggest that the User consults the manual of their device or the "Help" or "Help" function of their Internet browser.

Below we provide Users with links that explain how to manage or disable cookies for the most popular Internet browsers:

• Internet Explorer: http://windows.microsoft.com/it-IT/internet-explorer/delete-manage-cookies
• Google Chrome: https://support.google.com/chrome/answer/95647
• Mozilla Firefox: http://support.mozilla.org/it/kb/Gestione%20dei%20cookie
• Opera: http://help.opera.com/Windows/10.00/it/cookies.html
• Safari: https://support.apple.com/it-it/guide/safari/sfri11471/mac

It should be noted that the previous links are updated in June 2020, any future changes and/or updates of the information cannot be attributed or attributable to Scovaventi SS Agricola in any way.

Technical Cookies

The use of technical cookies, i.e. cookies necessary for the transmission of communications over an electronic communications network or cookies strictly necessary for the supplier to provide the service requested by the customer, allows the safe and efficient use of our site.

Session cookies may be installed in order to allow access and permanence in the reserved area of ​​the portal as an authenticated user.

Technical cookies are essential for the correct functioning of our website and are used to allow users normal navigation and the possibility of using the advanced services available on our website. The technical cookies used are divided into session cookies, which are stored exclusively for the duration of navigation until the browser is closed, and persistent cookies which are saved in the memory of the user's device until they expire or are deleted by the user. same. Our site uses, among others, the following technical cookies:

• Technical navigation or session cookies, used to manage normal navigation and user authentication;
• Functional technical cookies, used to store customizations chosen by the user, such as, for example, the language;
• Technical analytics cookies, used to understand how users use our website so that we can evaluate and improve its functioning. The data is collected in aggregate or non-aggregated form. Part of these cookies are installed on the site without the user's prior consent as they are less anonymized, as third parties cannot access disaggregated analytics data at the IP address level (in other words, by using these cookies, even third parties are not can know the user's identity).

As required by current legislation on privacy, the user's prior consent is not required for the installation of these cookies. The latter, in any case, can freely block the installation of technical cookies by changing the browser settings as indicated above.

By blocking the installation of technical cookies, or subsequently the same ones, the possibility of accessing the website, using it in whole or in part, enabling or disabling certain functions or receiving certain services could be totally or partially compromised.

Third party cookies

Third-party cookies may also be installed: these are analytical and profiling cookies, such as those of Google Analytics, Google Doubleclick, Criteo, Rocket Fuel, Youtube, Yahoo, Bing and Facebook. These cookies are sent from the websites of the aforementioned third parties external to our site.

Third-party analytical cookies are used to detect information on user behavior on the site. The detection takes place anonymously, in order to monitor performance and improve the usability of the site. Third-party profiling cookies are used to create profiles relating to users, in order to propose advertising messages in line with the choices expressed by the users themselves.

These analytics cookies are installed on the website only with prior prior consent, because they are not anonymized, as third parties can access the disaggregated analytics data at the IP address level (in other words, by using these cookies, third parties could theoretically trace the user's identity through the IP address).

For this reason, when accessing the website a special banner is displayed, which informs the user that (i) third-party analytics cookies are used on the website and that (ii) they must be accepted or rejected by the user individually or jointly. Consent will be stored through a specific technical cookie which will prevent the banner from being displayed again if the website is accessed again. In the event that the user independently deletes the installed technical cookie, the trace of the consent given will automatically be lost and the banner will be visible again on the internet page.

In any case, the user is free to block the installation of analytics cookies at any time, without compromising the ability to use the site and enjoy its contents freely.

The use of these cookies is governed by the rules established by the third parties themselves. Therefore, Users are invited to read the privacy information and instructions for managing or disabling cookies published on the following web pages:

• For Google Analytics cookies:
  • privacy policy: https://www.google.com/intl/it/policies/privacy/
  • directions to manage or disable cookies: https://support.google.com/accounts/answer/61416?hl=it
• For Google Tag Manager cookies: it is a tag management service provided by Google Ireland Limited which processes cookies and usage data:
• privacy policy: https://policies.google.com/privacy
• For Google Doubleclick cookies:
  • privacy policy: https://www.google.com/intl/it/policies/privacy/
  • directions to manage or disable cookies: https://www.google.com/settings/ads/plugin
• For Facebook cookies:
• privacy policy: https://www.facebook.com/privacy/explanation
• directions to manage or disable cookies: https://www.facebook.com/help/cookies/
• For Youtube cookies:
• privacy policy: https://www.youtube.com/intl/it/yt/about/policies/#community-guidelines
• directions to manage or disable cookies: https://support.google.com/accounts/answer/61416?hl=it
• For Yahoo cookies:
• privacy policy and instructions for managing or disabling cookies:

https://policies.yahoo.com/ie/it/yahoo/privacy/euoathnoticefaq/

• For Bing cookies:
• privacy policy and instructions for managing or disabling cookies https://privacy.microsoft.com/it-it/privacystatement

It should also be noted that some third-party cookies may be installed by parties with whom there is no direct relationship. For this reason, at the links above the user can independently change their preferences and obtain all the necessary information on their profiling cookies and how to oppose their installation (opt-out).

Profiling Cookies

Profiling cookies are used to create a user profile based on the preferences and tastes expressed by the same user while browsing online and, consequently, advertising messages consistent with the user's profile may be displayed.

As required by current legislation on privacy, the user's prior consent is required for the installation of these cookies. For this reason, when the user accesses the website of the Data Controller, a special banner is displayed informing him/her: (i) profiling cookies are used on the website; (ii) they must be accepted or rejected by the user individually or jointly. Consent will be stored through a specific technical cookie which will prevent the banner from being displayed again if the website is accessed again. In the event that the user independently deletes the installed technical cookie, the trace of the consent given will automatically be lost and the banner will be visible again on the internet page.

The user can freely block the installation of profiling cookies at any time, without limiting his ability to visit the website and enjoying its contents or compromising them. If the user decides to deactivate behavioral advertising it does not mean that they will no longer receive advertising on the site, however the banners they will see may not reflect the user's interests or the preferences indicated by the user for the use of the browser.

Profiling cookies can be installed by the Owner(s) using so-called web analytics software, which are used to prepare detailed and real-time analysis reports relating to information on: visitors to a website, search engines source search, keywords used, language of use, most visited pages.

Profiling cookies can also be installed by third parties who act as independent data controllers (third-party cookies). Below is a list of third-party profiling cookies currently used on the website, indicating the link to the information pages created by their developers:

• Facebook: https://www.facebook.com/privacy;
• Google: https://policies.google.com/privacy

They may collect information and data such as IP address, nationality, city, date/time, device, browser, operating system, screen resolution, browsing origin, pages visited and number of pages, duration of the visit, number of visits made. Such data may be transferred to companies that manage the website on behalf of the Owner, in compliance with and with the limitations imposed by current legislation and the provisions of this Information.

It should also be noted that some third-party cookies may be installed by parties with whom there is no direct relationship. For this reason, at the links above the user can independently change their preferences and obtain all the necessary information on their profiling cookies and how to oppose their installation (opt-out).

The user is informed that by logging in to the website through the credentials of a social network to which the same user is registered, he will receive third-party cookies from the manager of the social network used from time to time which, in addition to allowing the Authentication on the website also pursues the purpose of profiling the user himself. Before accessing the website via the buttons dedicated to social networks, the user is invited to carefully read the information provided by the managers of the social networks themselves regarding the use of these cookies.