Disclosure pursuant to Art. 13 of Reg. EU 2016/679 on the protection of personal data

BeriCalce S.r.l., Via Piave 23, 36033 Isola Vicentina (VI), P.IVA and C.F. 04346470240, as the owner of the processing of personal data, informs you, pursuant to Art.

13 of Reg. EU 2016/679 (Data Protection Reg., henceforth only “GDPR”), regarding the essential elements of the processing operations performed and explained below.

We would like to emphasize that our reality operates in full compliance with the applicable Italian legislation on personal data protection and the GDPR, recognizing its absolute importance.

Therefore, we encourage you to carefully read this policy (henceforth just “policy”) before proceeding to browse, as it contains important information about the protection of personal data and the security measures taken to ensure their confidentiality.

This policy also:

• is intended to be made only for the bericalce.com website (henceforth only “website”) while it does not apply to other websites that may be consulted through external links;
• Is intended as a disclosure made pursuant to Art. 13 of the GDPR to those who interact with the website.

These are the essential elements of the treatments carried out.

Personal data subject to processing

Personal data means any information relating to an identified or identifiable natural person with particular reference to an identifier such as a name, an identification number, location data, an online identifier, or one or more features of his or her physical, physiological, mental, economic, cultural, or social identity.

The personal data collected by the website are as follows:

browsing data: the website’s computer systems collect some personal data whose transmission is implicit in the use of Internet communication protocols. This is information that is not collected to identify you, but by its very nature could, through processing and association with data held by third parties, allow you to be identified. The data collected include, for example, the IP addresses or domain names of the devices used to connect you to the website, the time of the request, the method used in submitting the request to the server, the

size of the file obtained in response, the numeric code indicating the status of the response given by the server (successful, error, etc.) and other parameters related to your operating system and computer environment;

1. voluntarily provided data: through the website you have the opportunity to voluntarily provide personal data, for example, name and e-mail address to contact us through the “contact us” form. We will use this data in accordance with applicable current legislation, assuming it relates to you. In the event that the data are referable to third parties, for the latter, you stand as an autonomous data controller, assuming all the obligations and responsibilities of In this sense, it confers on the point the widest indemnity with respect to any dispute, claim, request for compensation for damages from processing, etc. that may be received by our reality from third parties whose personal data have been processed through its use of the website in violation of the applicable legislation currently in force.

Purpose of processing and legal basis

Specifically, your personal data are processed for the following purposes and legal bases:

• • website display and navigation (these are activities related to the proper provision of the various features you requested, for security reasons and to ascertain liability in case of hypothetical computer crimes against the website, as well as to obtain anonymous statistical information on the use of the website and to check its proper functioning); the Legal basis of the above purpose is identified in the contract and pre-contractual measures (Art. 6.1, letter b, GDPR);
  • activities related to contact management (examples of activities are: filling in the “contact us” form on the website or more generally sending an e-mail involving the processing of personal data such as, for example, first name, last name, subject); the Legal basis of the above purpose is identified in the contract and pre-contractual measures (Art. 6.1, letter b, GDPR);
  • activities related to the performance of the contract to which you are a party, including the pre-contractual phase (examples of activities are: the provision of a service, the response to a request, the request for contact via the “contact us” form, ); the Legal basis of the above purpose is identified in the contract and pre-contractual measures (Art. 6.1, letter b, GDPR);

statistical research/analysis on aggregated or anonymous data (this is an activity that does not involve the processing of personal data, since it does not

involve user identification and are used, for example, to measure website operation, measure traffic, and assess interest);

• activities related to the establishment and/or exercise and/or defense of rights (examples of activities are: disputes related to the proper fulfillment of the contractual relationship, warnings, debt collection); the legal basis for the above purpose is identified in the legitimate interest (art. 6.1, letter f, GDPR);
• other activities in execution of legal obligation/authority orders (such as, for example, communication to third parties); the legal basis is identified in the legal obligation (Art. 6.1, letter c, GDPR);
• maintenance of computer systems and devices (Persons in charge of performing maintenance and repairs on the Site may accidentally gain access to your personal data. These events are entirely occasional and unforeseeable and in any case devoid of identification purposes and limited in duration to the execution of the maintenance/repair work); the legal basis of the above purpose is identified as legitimate interest (Art. 6.1(f) GDPR).

None of our processing is based on consent. The legal bases on which we operate are: contract, legal obligation, and legitimate interest.

We do not conduct processing with automated decision making or profiling. Specific disclosures will be posted on pages of the Site set up to provide certain services (e.g., “contact us” form).

Data retention times

Your personal data will be kept for the time strictly necessary to carry out the purposes outlined above and to fulfill the obligations required by law. In particular, for the website display and navigation your data are deleted after 7 days, unless they are necessary for the exercise or defense of rights, for the activities related to contact management your personal data is deleted at the time when the purpose of     contact,   by   reply   o   by   correspondence,   for   the   activities    related to the execution of the contract to which you are a party (including the pre-contractual phase), your personal data are retained for the duration of the contractual relationship and, once the relationship has ended, will be retained for the needs of establishing/exercising/defending a right, for the activities related to the establishment and/or exercise and/or defense of rights, up to the time allowed by national legislation to protect its interests (Articles 2946 and 2947 Civil Code), subject to further preservation in the case of interruption of the statute of limitations; for the activities in execution of legal obligation/orders Authority and for the activities of

maintenance of computer systems and devices, referring to personal data that we have for the other purposes indicated in this policy, the retention times coincide with those identified from time to time for the aforementioned purposes.

Consent and optional/obligatory conferral.

The processing of your personal data, for the purposes outlined above, may be carried out without your consent.

The provision of your data, which you undertake to provide to us contractually or by legal obligation, is obligatory and constitutes a necessary web requirement for the conclusion of the contract and failure to provide it will result in our inability to give effect to contracts and other related obligations. Any other provision of your personal data (e.g. for sending requests that have not yet been contracted or for browsing the website) is purely optional. The only consequence of failure to provide optional information will be the inability to provide or perform the requested services.

Categories of recipients

In addition, your personal data may be communicated to third parties, for technical and operational needs strictly related to the purposes set forth above and in particular to the following categories of subjects:

1. 1. 1. parties necessary for the provision of the services offered by the Website including but not limited to sending e-mail and analyzing the operation of the Website who typically act as data controllers of our entity;
      2. entities, professionals, companies or other structures entrusted by us with the processing related to the fulfillment of contractual, administrative, accounting, insurance and management obligations associated with the ordinary course of our economic activity, including for credit recovery purposes;
      3. to public authorities and administrations for purposes related to the fulfillment of legal obligations or to subjects entitled to access them by virtue of provisions of the law, regulations, EU regulations;
      4. banks, financial institutions or other entities to which the transfer of the aforementioned data is necessary for the conduct of the business of our company in connection with the performance by us of the contractual obligations assumed towards you;

Providers of installation, support and maintenance services of computer and telematics equipment and systems and all services functionally related to and necessary for the performance of the services covered by the contract;

1. persons authorized by us to process data who have committed themselves to confidentiality or have an appropriate legal duty of confidentiality (e.g., employees and contractors).

Foreign transfers

The Data Controller does not transfer personal data outside the European Economic Area. The Owner, however, reserves the option of using cloud services; in which case, the service providers will be selected from among those who provide adequate guarantees in compliance with applicable regulations in force.

Method of treatment

The processing of your personal data will be done both electronically and on paper. The processing will, however, be carried out mainly by computer tools and in any case with observance of the minimum precautionary measures of data security and confidentiality. In particular, technical, IT, organizational, logistical, and procedural security measures have been implemented to prevent loss, illegal or irrelevant use of data, and unauthorized access to them.

Cookie

We do not use cookies, except of a technical nature in order to ensure proper viewing and navigation of the website. Technical cookies do not require any consent.

Please be advised that you can configure your browser to not automatically accept cookies.

Below are some instructions for disabling cookies on popular browsers:

• • • • Google Chrome
      • Mozilla Firefox
      • Apple Safari
      • Opera
      • Microsoft Edge
      • Microsoft Internet Explorer

Rights of the data subject and complaint before the Guarantor

Please be advised that with regard to the processing of your personal data you may exercise the following rights:

1. Right to obtain access to your personal data (Art. 15 GDPR): you may contact us to find out whether your personal data is being processed and the legal information about the processing;
2. Right of rectification (Art. 16 GDPR): obtain the correction of your inaccurate personal data or the integration of incomplete data;
3. Right to erasure/oblivion (Art. 17 GDPR): obtain the erasure of your personal data, in the cases provided for by law;
4. Right to restriction of processing (Art. 18 GDPR): obtain the submission of your personal data to storage only, to the exclusion of other activities, in the cases provided for by law;
5. Right to portability (Art. 20 GDPR): to obtain your personal data in a structured, commonly used and machine-readable format and to obtain, also, the direct transmission of the data to another data controller, in the cases provided for by law;
6. Right to object (Art. 21 GDPR): right to have further processing of personal data cease for reasons related to your particular situation, subject to the prevalence of our compelling legitimate reasons, in cases provided for by law;
7. Right to withdraw consent (Art. 7.3 GDPR): right to withdraw consent at any time for cases where processing is based on the

To exercise the above rights, you may use the Controller’s contact information provided in this policy.

The exercise of rights is not subject to any form requirement and is free of charge.

We also inform you of your right to file a Complaint before the competent Data Protection Authority . Recall that the complaint, in accordance with Art. 77.1 GDPR, can be brought by the data subject to the Authority of the place where the data subject usually resides, where he/she works or where the alleged violation occurred.

Data controller

The Data Controller is BeriCalce S.r.l. Contact details of the Data Controller:

• e-mail: info@bericalce.com
• phone: 0444 929102
• paper mail: Via Piave 23, 36033 Isola Vicentina (VI)

Changes

This policy is effective as of May 25, 2018. We reserve the right to change or simply update its content, in part or in full, including due to changes in applicable regulations. The updated policy will be promptly posted on this website. Therefore, we encourage you to visit this page regularly to view any updates.