Access to certain sections of the website www.oleificiozucchi.it (hereinafter referred to as the “website”) and/or the submitting of any requests for information or services by data subjects using the Website (hereinafter referred to as “users”) may involve the input of personal data. The processing of such data by Oleificio Zucchi S.p.A. (hereinafter referred to as “Zucchi”), the data controller, is carried out in compliance with Regulation (EU) 2016/679 (hereinafter referred to as the “GDPR”) and Legislative Decree no. 196/2003 as amended (hereinafter referred to as the “Data Protection Code”).
The purpose of this privacy notice is to inform users, before they access the various sections of the website and provide personal data, of how Zucchi processes their personal data.
This privacy notice will also be duly referred to in the pages of the website where the user will be required to enter his/her personal data and will only apply to the data processing carried out through this website www.oleificiozucchi.com. It does not apply to other websites or sections/pages/spaces controlled by Third Parties that Users may wish to access through specific links on the website.
Data Controller
The data controller is Oleificio Zucchi S.p.A., in the person of its legal representative pro tempore, with registered office in Cremona, Via Acquaviva 12, 26100; email address: privacy@zucchi.com.
Purposes of processing, types of data, retention and nature of provision
The purposes of the processing of personal data provided directly by users by filling in the appropriate online forms, or by contacting the Data Controller at the email addresses indicated on the website, may be the following:
1. To respond to requests for information/suggestions sent by users to Zucchi through the email address rp@zucchi.com and to respond to enquiries of a commercial nature related to Zucchi’s products and/or other types of commercial requests (Commercial Contacts section)
- Type of personal data processed: first name, last name, email address, street, town/city, postal code, province and any data voluntarily included by the user in the message.
- Retention period: personal data relating to business correspondence are stored for 10 years from receipt of the communication, in accordance with article 2220 of the Italian Civil Code.
- Provision of personal data: providing personal data is optional: however, some data are marked as mandatory (such boxes are marked with an asterisk) so that Zucchi can satisfy users’ requests. Failure to provide, or the partial or incorrect provision of, personal data marked with an asterisk, to the extent that they are required to process/respond to requests, will make such processing/response impossible; failure to provide, or the partial or incorrect provision of, personal data that is not required will have no consequences.
- Legal basis: performance of pre-contractual and contractual measures (art. 6(1)(b) GDPR)
2. Inclusion in the database of spontaneous applications, for the exclusive purposes of personnel search and selection and any subsequent establishment of an employment or collaboration relationship (Human Resources Area Contacts section).
- Type of personal data processed: personal data such as first name, last name, personal details, contact details, area of interest and information contained in the Curriculum Vitae (to be attached to the application) such as educational qualifications and previous professional experience; special categories of personal data (by way of example, data disclosing health conditions such as disability or membership of a protected category), will only be processed to the extent strictly necessary and pertinent to the processing purposes described below).
- Retention period: the data provided will be stored in the database of spontaneous applications for at most 12 months from the date of receipt of the data and of the Curriculum Vitae.
- Provision of personal data: the provision of data is optional; however, refusal to provide such data will make it impossible for the Data Controller to process your data and, consequently, to assess the possible establishment of a working relationship.
- Legal basis: For the processing of personal data for this purpose, it is not necessary to obtain your consent, since the processing is based on the legal basis referred to in article 6(1)(b) of the Regulation (execution of pre-contractual measures) and, for special data, on the need to fulfil obligations or exercise rights provided for by applicable labour laws (pursuant to article 9(2)(b) of the Regulation).
Method of processing
Your data will be processed mainly using electronic and computer systems and stored on both digital and paper media. Processing is protected by appropriate technical and organisational security measures pursuant to article 32 of the GDPR. The Data Controller does not adopt automated decision-making processes, nor does it publish, expose or make available to unspecified third parties the personal data collected.
Categories of processed personal data
In addition to the common personal data directly provided by users (such as first name, last name, postal address, email address, etc.) using the appropriate data entry forms, when connecting to the website, the computer systems and software procedures used to operate the website itself indirectly acquire certain personal data, the transmission of which is implicit in the use of Internet communication protocols. Such data are processed for the sole purpose of carrying out statistical surveys in an anonymous form, and therefore will not be directly or indirectly traceable to users.
Categories of persons who may become aware of users’ personal data
Personal data may be accessible to employees or collaborators of the Data Controller who, operating under the latter’s direct authority, have been authorised to process such data pursuant to article 29 of the GDPR, have received precise operating instructions and are committed to confidentiality, as well as any external consultants duly appointed as Data Processors pursuant to article 28 of the GDPR.
The data will also be processed by the Company TwentyTwenty S.r.l., with registered office in Via Savona 19/A – 20144 Milan, Italy, as provider of development, supply and operational management services of the company’s technology platforms, which acts as Data Processor and is bound to specific data protection obligations pursuant to article 28 of the GDPR.
The data will not be subject to dissemination.
Transfer of personal data to a third country or to an international organisation outside the European Union
The User’s personal data will be processed within the territory of the European Union and will not be disseminated. If necessary, for technical or operational reasons, the Company reserves the right to transfer the User’s personal data to countries outside the European Union for which “adequacy” decisions by the European Commission exist, i.e. on the basis of adequate safeguards or specific exemptions provided for in EU Regulation 2016/679 (GDPR).
Data subject’s rights
The User may exercise, at any time, with respect to the Data Controller the following rights provided for in articles 15, 16, 17, 18, 20 and 21 of the European Regulation:
- right of access, which enables him/her to obtain from the Data Controller confirmation as to whether or not the personal data relating to him/her are being processed and, if so, to obtain access to that data;
- right to rectification, which allows him or her to obtain from the Data Controller the rectification and/or supplementing of any of his or her personal data which prove to be inaccurate and/or incomplete;
- right to erasure, which allows him or her, in the specific cases provided for by article 17 of the Regulation, to obtain from the Data Controller the erasure of his or her personal data;
- right to restriction of processing, which allows him or her, in the specific cases provided for by article 18 of the Regulation, to restrict the processing of his or her personal data by the Data Controller;
- right to object, which allows him or her to object to the processing of his or her personal data under specific conditions;
- right to data portability, which allows him or her, in certain cases and with respect only to the data provided by him or her, to request the receipt of his or her personal data in a structured, commonly used and machine-readable format.
In order to exercise the rights referred to in this Section, the User may address his or her requests, at any time, to the email address privacy@zucchi.com.
In case of unlawful processing of personal data, Users also have the right to lodge a complaint with the competent Data Protection Authority or to seek judicial remedy.
Last update: August 2024