Privacy Policy
Franco srl, with registered office at Via Martiri di Niccioleta 12, Abbadia San Salvatore, Tax ID and VAT no. 01596660520 (“Franco srl”) is a company that offers the possibility of purchasing its products online (hereinafter, “Services”).
In the course of its business, Franco srl processes personal data in compliance with current legislative and contractual provisions, using methods based on the principles of fairness, lawfulness, and transparency, while protecting the data subject’s confidentiality and rights.
DATA CONTROLLER
Through this document, Franco srl, as the personal data controller (hereinafter, “Controller”), intends to provide the notice required by Articles 13 et seq. of EU Regulation 679/2016 (hereinafter, the “Regulation”), regarding the processing of personal data of users (hereinafter, “User/Users”) who visit the website https://collettivobotanico.com/ (hereinafter, the “Site”).
1) TYPE OF DATA PROCESSED AND TYPES OF PROCESSING
a) Browsing data: the IT systems and software procedures used to operate this Site acquire, during their normal operation, certain personal data whose transmission is implicit in the use of Internet communication protocols. This information is not collected to be associated with identified data subjects, but by its very nature could, through processing and association with data held by third parties, allow users to be identified. This category of data includes the IP addresses or domain names of the computers used by users who connect to the Site, the URI (Uniform Resource Identifier) notation addresses of the requested resources, the time of the request, the method used to submit the request to the server, the size of the file obtained in response, the numerical code indicating the status of the response given by the server (successful, error, etc.), and other parameters related to the user's operating system and IT environment. This data is used solely to obtain anonymous statistical information on the use of the Site and to check its correct functioning, and is deleted immediately after processing. The data could be used to ascertain liability in the event of hypothetical cybercrimes against the Site: except for this possibility, web contact data does not currently persist for more than seven days.
b) Data provided voluntarily by the user to purchase a product on the Site and/or use a Service: finalizing the sale of a product through the Site and/or using the Services entails the processing of user data for the sole purpose of offering the Services and fulfilling the relevant contractual and administrative obligations, including, by way of example, processing the order and payment, and sending the purchased product. The data subject to processing is: first name, last name, address, country of residence, email address, telephone number.
c) Data provided voluntarily by the user for sending promotional communications regarding the Services: in the event that the Data Subject subscribes to the newsletter service or expresses their consent to receive commercial or marketing communications from the Controller, the data will be processed for the purpose of sending such communications via email or regular mail to the addresses provided by the Data Subject. The data subject to processing is: name, email, domicile.
d) Cookies: for data processing via cookies, please see the relevant policy
2) PURPOSE AND LEGAL BASIS OF PROCESSING
The User data collected will be processed by the Controller:
SITE FUNCTIONALITY: to pursue a legitimate interest of the Controller, consisting of ensuring the security of the Site and the information exchanged on it, namely the ability of said Site to resist, at a given level of security, unexpected events or illicit or malicious acts that compromise the availability, authenticity, integrity, and confidentiality of stored or transmitted personal data and the security of related services offered or made accessible. The legal basis for processing is Article 6, para. 1, letter f) of the Regulation.
USE OF SERVICES: to use the Services offered through the Site, for example, to allow the user to purchase a product, etc. The legal basis for processing is Article 6, para. 1, letter b) of the Regulation, as the processing is necessary for the performance of a contract to which the data subject is a party;
SENDING OF COMMERCIAL/PROMOTIONAL COMMUNICATIONS BY THE CONTROLLER: in the event that the Data Subject has given their explicit consent, to send invitations to events organized by the Controller or for sending promotional communications regarding the Controller’s business. The legal basis for processing is Article 6, letter a) of the Regulation, i.e., the consent of the Data Subject.
3. DURATION OF PROCESSING AND DATA RETENTION PERIOD
For the purposes referred to in art. 2) above, personal data will be processed for the period strictly necessary to achieve the aforementioned objectives and also subsequently for the fulfillment of legal obligations and/or for defensive purposes.
Data provided for commercial communications, opinion polls, and market research will be kept until the Data Subject requests the termination of the activity or for 12 months.
4. METHODS OF PROCESSING
Processing will be carried out both on paper and electronically, with the aid of modern IT systems and manual methods, solely by persons expressly authorized to do so. Processing will take place using logic and methods of data organization strictly related to the obligations, tasks, or purposes above. The Data Controller uses technical and organizational measures to protect the data in its possession from manipulation, loss, destruction, and access by unauthorized persons. Security measures are constantly improved based on technological development.
5. MANDATORY OR OPTIONAL NATURE OF DATA PROVISION
The provision of data referred to in point 1, letter b) is optional. In case of refusal, however, the User will not be able to purchase on the Site.
The provision of data referred to in point 1, letter c) is optional. The user can revoke their consent at any time and without indicating reasons. The easiest way to do this is to click the "Unsubscribe" link, which is found in every newsletter or communication received. Alternatively, the user can send a communication to the Controller at the address info@franconatural.com
6. SCOPE OF COMMUNICATION AND DISSEMINATION
The User’s personal data will be processed by subjects authorized to perform these tasks, duly appointed as data processors or persons in charge of processing, equipped with security measures suitable to ensure the confidentiality of the data subjects to whom the data refers and to avoid undue access by third parties or unauthorized personnel. If necessary, the collected data may be communicated, within the limits strictly relevant to the obligations, tasks, or purposes referred to in point 2, to public or private subjects (insurers, auditing and certification firms, etc.) or to the competent Authorities for the purposes of prevention, investigation, or prosecution of crimes, in compliance with the rules governing the matter. No data will be disseminated.
The updated list of all Data Processors is available at the headquarters of Franco srl and can be requested at the following email address: info@franconatural.com . This list may be subsequently integrated and/or updated as needed.
Among the data processors is Shopify International Limited, Victoria Buildings, 2nd floor, 1-2 Haddington Road, Dublin 4, Ireland ("Shopify"). We use Shopify’s services for the purpose of hosting and displaying our online store. All data collected on the Site is processed on Shopify’s servers. As part of the aforementioned Shopify services, data may also be transferred to Shopify group companies in Canada and the USA. For more information on Shopify’s privacy policy, please visit the following website: https://www.shopify.com/legal/privacy
7. USER RIGHTS
Users have the right to know their rights, which essentially consist of the right to receive information from the other contracting party regarding the existence of the processing of their personal data, as well as to access their data, and to obtain its rectification, integration, updating, deletion, or blocking. The User will also have the right to obtain a copy of their data, the limitation of processing and/or, furthermore, to object to its processing, in addition to the right to data portability and to lodge a complaint with the competent supervisory authorities under the conditions and within the limits indicated in Art. 13 of the Regulation.
For each data subject to processing, the following rights are guaranteed under Articles 15 et seq. of the Regulation:
Right to information;
Right of access by the data subject;
Right to rectification;
Right to erasure (right to be forgotten);
Right to restriction of processing;
Right to data portability;
Right to object.
The user can therefore find out what personal data the Controller holds, its origin, and how it is used, request its updating, rectification, or integration as well as, in the cases provided for by the current provisions, its deletion, the limitation of processing, or object to its processing. Each data subject may, if they wish, request to receive a copy of the personal data held by the Controller concerning them in a format readable by electronic devices and, where technically possible, the Controller may transfer the data directly to a third party indicated by the Data Subject.
Where the user believes that the processing of their personal data has been carried out illegitimately, they may lodge a complaint with one of the supervisory authorities competent for compliance with personal data protection rules. In Italy, the complaint can be submitted to the Italian Data Protection Authority (Garante per la Protezione dei Dati Personali) (http://www.garanteprivacy.it/).
8. EXERCISE OF RIGHTS
To exercise the aforementioned rights, Users can send a communication to the email address info@franconatural.com indicating in the subject line "Privacy - exercise of rights".