INFORMATION PURSUANT TO ARTICLES 13-14 OF THE GDPR (GENERAL DATA PROTECTION REGULATION) 2016/679
Val d’Orcia Paesaggio Culturale, Data Controller, informs you that your data will be processed in the manner and for the purposes indicated below.
The Data Controller undertakes to protect the privacy and confidentiality of Personal Data in compliance with the principles of correctness, lawfulness, transparency and protection of your rights.
1) TYPES OF DATA PROCESSED
We process personal data communicated by you (name, email, company name, telephone number, etc.) when you spontaneously send requests and data that is collected independently by the website.
- Data provided by you: personal, identification and non-sensitive data communicated by you to make requests via email, through the contact form or by telephone about our products/services.
- Data we collect automatically: anonymous data collected using cookies or similar technologies: for more information, see the Cookie Policy below.
N.B.: Users under the age of 16 cannot provide any personal data without the consent of their parents or guardians.
2) PURPOSES AND LEGAL BASES OF PROCESSING
We will process your personal data:
A) to fulfill our contractual obligations; to provide a response to your requests for information; to calculate a quote you have requested; to execute contracts for the sale of products or the assignment for the provision of services; to guarantee you the necessary assistance regarding the products and services purchased.
B) to carry out aggregated statistical analyses on an anonymous basis to improve our services;
C) for administrative purposes and for the fulfillment of legal obligations such as those of an accounting, fiscal nature, or to comply with requests from judicial authorities.
D) in the case of sending a curriculum vitae, exclusively for selection purposes.
3) IS THE PROVISION OF DATA MANDATORY?
The provision of your data is always optional, but failure to provide it may make it impossible to proceed with certain processing operations, such as those strictly connected to the fulfillment of a contract or the provision of the services you have requested.
4) PLACE, METHOD OF PROCESSING AND RETENTION PERIOD
The processing of your personal data is carried out by means of the operations indicated in Art. 4 of the Privacy Code and Art. 4 No. 2) GDPR and specifically: collection, registration, organization, storage, consultation, processing, modification, selection, extraction, comparison, use, interconnection, blocking,
communication, cancellation and destruction of data.
Your personal data is stored at the Data Controller’s headquarters and is subjected to both paper and electronic and/or automated processing with logic strictly related to the purposes indicated and in any case in such a way as to guarantee the security and confidentiality of the data itself. The data you send is not saved on our website.
The Data Controller will process personal data for the time necessary to fulfill the aforementioned purposes and in any case for no longer than 10 years from the termination of the relationship for the Purposes referred to in point C and for no longer than 38 months from the collection of data for the Purposes referred to in point B.
5) DATA ACCESS
Your data may be made accessible for the purposes indicated in point 2:
- to employees and collaborators of the Data Controller, in their capacity as persons in charge and/or internal data processors and/or system administrators;
- to third-party companies or other subjects (website providers, cloud providers, e-payment service providers, suppliers, technicians responsible for hardware and software assistance, shippers and carriers, credit institutions, professional firms, etc.) who carry out outsourced activities on behalf of the Data Controller, in their capacity as data processors.
6) DATA TRANSFER
The data will not be disseminated, sold or exchanged with parties other than the data controller, data processors and appointed persons without your express and explicit consent.
7) YOUR RIGHTS
You have the right to know what your personal data being processed is. In particular, you are granted the right of access, rectification, cancellation as well as the right to data portability, the right to limitation of processing and the right to object to processing, if the conditions are met.
Below we provide you with a brief illustration of the rights that are recognized to you with reference to the processing of your personal data.
- The right of access allows you to obtain confirmation as to whether or not personal data concerning you is being processed by the Data Controller and, if so, to access such data and related information;
- The right to rectification allows you to obtain the modification of inaccurate personal data concerning you without undue delay and, taking into account the purposes of the processing, to obtain the integration of incomplete personal data;
- The right to erasure allows you to obtain the erasure of data concerning you without undue delay (e.g. when your personal data is no longer necessary in relation to the purposes for which it was collected), without prejudice to the exceptions provided for by applicable law (e.g. when the retention of your data is necessary for compliance with legal obligations applicable to the data controller). The cancellation will be carried out within the technical timescales provided;
- The right to data portability allows you, in certain circumstances provided for by applicable law, to receive in a structured, commonly used and machine-readable format the personal data concerning you that you have provided. You can transmit this data to another data controller, provided that this right can be recognized to you in light of applicable law, and without prejudice to the case in which this may cause damage to the rights and freedoms of others;
- The right to restriction of processing allows you, in certain circumstances provided for by applicable law, to obtain the restriction of the processing of your personal data. In such cases, the Data Controller may continue to process your data only in certain cases, for example for the exercise of the right of defense or to protect the rights of another natural or legal person;
- The right to object to processing certain circumstances provided for by applicable law, to object to the processing of your personal data unless there are overriding legitimate grounds, rights or freedoms that allow the Data Controller to continue the processing;
To obtain more information on the processing of your personal data or to exercise your rights, please contact us.
8) CHANGES TO THE INFORMATION NOTICE
This Information Notice may undergo changes. It is therefore advisable to regularly check this Information Notice and refer to the most up-to-date version.
Last updated: May 2025