Bonomelli S.r.l., with registered office in Via Enrico Mattei 6, Zola Predosa (hereinafter “Bonomelli“), a company belonging to Gruppo Montenegro, in its capacity as data controller, wishes to inform users (the “Users“) of the website www.cannamela.it (the “Website“) about the procedures whereby Bonomelli processes their personal data, pursuant to Legislative Decree no. 196/2003 as subsequently amended (the “Privacy Code“) and the new European Regulation no. 679/2016 on the protection of personal data (the “Privacy Regulation“).
1. Data controller and data processors
The Data Controller is Bonomelli S.r.l., a company belonging to Gruppo Montenegro, with registered office in Via Enrico Mattei 6, Zola Predosa, which can be contacted at the following email address: privacy.montenegrocorporate@montenegro.it. Bonomelli has appointed Imille s.r.l., among others, as data processor. The full list of data processors is available upon written request sent to the above email address.
2. Personal data collected:
Bonomelli processes data provided by Users, including:
a) personal data (first name, last name, date of birth, sex) and contact data provided at the time of registration on the Website;
b) data provided in case of request for information and assistance
c) browsing data relating to the use of the services offered through the Website, collected via cookies in accordance with the cookie policy available at the following link: http://www.cannamela.it/cookie-policy;
d) data provided and collected for the purposes of and as part of any participation in contests and/or prize operations carried out online by Bonomelli, its being understood that in this case this privacy policy shall be deemed supplemented by the privacy information regulating the processing of personal data for the relevant contests and/or prize operations.
In the event of the User registering with the Website through Facebook, Bonomelli will process the following data collected through Facebook: User ID and/or username associated with Facebook and a link to the User’s profile. If the User does not want such data to be shared with Bonomelli, he or she will need to register manually with the Website. Health data and in general special categories of personal data, within the meaning of article 9 of the Privacy Regulation, are not processed. Data of minors will be processed in the manner set forth in paragraph 8 below. The aforementioned data are processed only to the extent that they are necessary to achieve the purposes described in paragraph 4 of this Privacy Policy.
3. Data processing methods.
The User’s personal data are processed with the aid of computerised and/or paper means and are protected by appropriate security measures to ensure the confidentiality and security of the personal data. In particular, Bonomelli takes appropriate organisational and technical measures to protect the personal data in its possession against loss, theft, unauthorised use, disclosure or amendment.
4. Processing purposes
The purposes for which the User is requested to provide Bonomelli with personal data are as follows:
a) to allow the User to register on the Website and benefit from the services made available through the Website, including customer support and/or reporting services made available through the Website, the chance to take part in prize events and request discount coupons, send applications through the Website and assert and defend rights with respect to the User and third parties (hereinafter jointly referred to as “Contractual Purposes“)
b) to comply with legal and regulatory obligations, if any (hereinafter jointly referred to as “Legal Purposes“);
c) with the User’s consent, to send newsletters and commercial communications, through traditional means of communication and by email, for the promotion and/or sale of products and/or services marketed by Bonomelli (“Bonomelli Marketing Purposes“)
d) with the User’s consent, to send marketing communications from other Gruppo Montenegro companies in relation to their products and services in the manner set out in point c) above (“Third-Party Marketing Purposes“)
e) to carry out activities relating to business and company branch transfers, acquisitions, mergers, demergers or other transformations and for the execution of such transactions (“Legitimate Business Interest Purposes“).
5. Legal basis of processing
The processing of personal data for the Contractual Purposes is mandatory as it is necessary for the purposes of registration with the Website and the use of specific services offered through the Website. The provision of personal data for Legal Purposes is mandatory as it is required under applicable laws. If the User does not want his or her personal data to be processed for these purposes, it will not be possible for him or her to use the Website and the services made available through it. The processing of personal data for Bonomelli Marketing Purposes and Third-Party Marketing Purposes is optional and subject to the User’s prior consent. Failure to provide consent will make it impossible for Bonomelli and Gruppo Montenegro companies to keep the User updated on new products or services, promotions, offers and to send communications or other informative material. Processing for Legitimate Business Interest Purposes is carried out pursuant to article 24, paragraph 1, letter d) of the Privacy Code and for the pursuit of the legitimate interest of Bonomelli and its counterparties in carrying out the economic operations indicated therein pursuant to article 6, letter f) of the Privacy Regulation, adequately balanced against the interests of Users inasmuch as processing is carried out within the limits strictly necessary for the performance of such operations. This is without prejudice to the User’s right to object to processing for such purposes in accordance with the provisions of paragraph 9 of the Privacy Policy.
6. Scope of communication and dissemination of data
Bonomelli, for the purposes set forth in paragraph 4, may communicate Users’ data, strictly necessary for each type of processing, to the following entities:
a) to collaborators, employees and suppliers of Bonomelli, as part of their duties and/or possible contractual obligations with them, inherent to business relations with Users
b) to sub-suppliers and/or sub-contractors engaged in activities connected with the performance of services and products offered by Bonomelli
c) to other companies belonging to Gruppo Montenegro;
The User’s personal data will not be disseminated.
7. Personal data transferred abroad
Personal data may be freely transferred outside Italy to countries within the European Union, but may also be transferred outside the European Union and in particular to the United States. Any transfer of the User’s personal data to countries outside the European Union will, in any event, take place in compliance with the guarantees appropriate and adequate for the purposes of the transfer itself in accordance with applicable legislation and in particular article 44 of the Privacy Code and articles 45 and 46 of the Privacy Regulation. The User may obtain a copy of the guarantees implemented by Montenegro by sending a request to privacy.montenegrocorporate@montenegro.it.
8. Children under 16 years of age
The Website offers services that can also be used by persons under the age of 16. In these cases, Bonomelli collects and processes the personal data of minors exclusively for the purposes and in the manner set out in this Privacy Policy in compliance with the rules on the processing of personal data of minors set out in article 8 of the Privacy Regulation, with the prior consent of the parent and/or guardian and/or entity acting on their behalf, whose data may only be collected to obtain said consent in the manner set out in the Website.
9. Users’ rights
The User may, at any time and free of charge (a) obtain confirmation of the existence or non-existence of data concerning him or her and be informed of the same; (b) be informed of the origin of the data, the purposes of processing and its methods, as well as the logic applied to the processing carried out by electronic means; (c) request the updating, rectification or – if he or she is interested – supplementing of the data (d) obtain the erasure, transformation into anonymous form or blocking of any data processed in breach of the law, as well as object to processing on legitimate grounds; (e) object, in whole or in part, to the processing of data concerning him or her for the purposes of direct marketing carried out using automated and/or traditional methods; (f) revoke, at any time, consent to the processing of data, without prejudice to the lawfulness of the processing based on the consent given prior to the revocation. In addition to the rights listed above, with effect from 25 May 2018, the User may at any time, in accordance with the procedures set out below, (a) request the restriction of the processing of personal data in the event that (i) it disputes the accuracy of the personal data, for the period necessary to verify the accuracy of such personal data; (ii) processing is unlawful and the User objects to the erasure of the personal data and requests instead that its use be restricted; (iii) although Bonomelli no longer needs the personal data for processing purposes, the personal data are necessary for the User to establish, exercise or defend a legal claim; (iv) the User has objected to the processing pursuant to article 21(1) of the Privacy Regulation pending verification as to whether the legitimate reasons of the data controller prevail over those of the data subject; (b) object at any time to the processing of the personal data; (c) request the erasure of personal data concerning him or her without undue delay; (d) obtain the portability of personal data concerning him or her; (e) lodge a complaint with the Data Protection Supervisory Authority whenever entitled to do so. The User may at any time exercise the above rights, change the contact details, notify Bonomelli of any updates to his or her data, request the removal of his or her personal data communicated by third parties, or obtain further information on Bonomelli’s use of his or her personal data, by contacting Bonomelli at privacy.montenegrocorporate@montenegro.it.
10. Retention periods
Bonomelli will retain personal data for the period necessary to fulfil the purposes for which the data were collected pursuant to paragraph 2 above. In any event, the following retention periods shall apply to the processing of personal data for the purposes set out below: -data collected for the Contractual Purposes referred to in paragraph 4, lett. a) shall be retained for the entire duration of the contract and for 10 years after the expiry of the contract for the purpose of defence and/or to enforce a right of Bonomelli in judicial and/or out-of-court proceedings in the event of disputes related to the performance of the contract;
-data collected for the Legal Purposes as set forth in paragraph 4, letter b) shall be retained for a period equal to the duration prescribed by law for each type of data;
-data collected for the Bonomelli Marketing Purposes as set forth in paragraph 4, letter c) shall be retained for a period equal to the duration of the User’s registration with the Website and/or participation in the contest, as well as for two years following their termination, deactivation and/or erasure
-data collected for Third-Party Marketing Purposes as set forth in paragraph 4, letter d) shall be retained for a period equal to 12 months after collection;
-data collected for the Legitimate Business Interest Purposes as set forth in paragraph 4, letter e) shall be retained for a period of 10 years from the time of collection.
Once this period has expired, the User’s data may be erased, anonymised and/or aggregated.
11. Amendments and updates
This privacy policy is valid from the date of its publication. Bonomelli may amend and/or supplement it, including as a consequence of any subsequent amendments and/or supplements to the Privacy Regulation. Amendments will be notified in advance and the text of the constantly updated policy can be viewed at the link www.cannamela.it. If the User has any doubts, remarks or complaints about the manner in which his or her personal data are collected or used, he or she should contact Bonomelli through the Contact section of the Website.