Skip to content

PRIVACY POLICY

Privacy Policy pursuant to EU Regulation No. 679/2016 (GDPR)

Premise

St. Roch S.r.l., as Data Controller (hereinafter also: “St. Roch“ or “Data Controller”) pursuant to EU Regulation No. 679/2016 (hereinafter: “GDPR”) invites you, before communicating any personal data to Data Controller, to carefully read this Privacy Policy because it contains important information on the protection of your personal data.

This Privacy Policy:

  • is intended for the strochleviottoz.com website (hereinafter: “Website”)
  • · forms an integral part of the website and the services we offer
  • · is made pursuant to art. 13 of the GDPR to those who interact with the web services of the website or who contact St. Roch S.r.l. by mail, fax or e-mail

INDEX

Below we provide the index of this Privacy Policy so that you can easily find the information relating to the processing of your personal data that interests you.

  1. 1. DATA CONTROLLER: WHO WE ARE AND WHAT WE DO
  2. 2. WHAT DATA WE PROCESSEDWHAT DATA WE PROCESS
  3. 3. WHY WE PROCESS YOUR DATA – PURPOSE OF PROCESSING
  4. 4. LEGAL BASIS AND MANDATORY OR OPTIONAL NATURE OF PROCESSING
  5. 5. RECIPIENTS OF PERSONAL DATA
  6. 6. RETENTION OF PERSONAL DATA
  7. 7. TRANSFERS OF PERSONAL DATA
  8. 8. RIGHTS OF DATA SUBJECT
  9. 9. UPDATES
  10. 10. CONTACT DETAILS

1. DATA CONTROLLER: WHO WE ARE AND WHAT WE DO

Data Controller is St. Roch S.r.l., with headquarters in Località Torrent de Maillod, 4 – 11020 Quart (AO), VAT n. 00040900078, R.E.A. AO – 31329 engaged in the manufacture of liqueurs, alcoholic and non-alcoholic beverages in general, with related packaging, bottling and marketing.

2. WHAT DATA WE PROCESSED

We inform you that the personal data being processed may consist – depending on how you use our services or otherwise interact with the website – of any information concerning your person that may make you identified or identifiable, including textual information and any other information provided, depending on the type of services requested.
Personal data may be provided voluntarily by the user or collected automatically and will be processed in connection with the following services:

  • a. Legal age verification: on each login page and once per session (expiring every 20 minutes), the user is verified to be at least 18 years of age.
  • b. Purchasing information and preferences: items displayed and placed in the shopping cart.
  • c. Purchase of products: to complete an order for products offered on the website, we will collect personal data from the purchaser (necessary to manage billing and shipping) such as: e-mail address, first name, last name, billing and/or shipping address, telephone number, tax code or VAT number. Other data, not compulsory to complete the order, may also be requested, including any notes on the order. Please note that the data required to process payments are handled entirely by third parties, in this case PayPal.
  • d. Account creation: the e-mail address, username and password will be collected for account creation.
  • e. Other data contained in the account: within the account, in addition to the data required for creation, the data provided for billing and shipping and the history of orders placed will be collected.
  • f. Sales promotions: name, surname and e-mail address will be collected for subscription to the mailing list. Additional optional data may also be collected, such as birthday, telephone number and company affiliation.
  • g. Browsing data: while browsing the Site, the computer systems and software used to operate the Site may collect certain data such as the user’s IP address, operating system and computer environment, browser type, browser ID, date and time of visit, time spent on our services and any errors that may occur while browsing. This data is used for the sole purpose of obtaining any anonymous statistical information on the use of the Site to check its correct functioning, to identify anomalies and/or abuses, and is deleted immediately after processing. The data could be used to ascertain responsibility in the event of hypothetical computer crimes against the Site or third parties.
  • h. Cookies: information on the cookies used by the website is available at the following URL https://strochleviottoz.com/dichiarazione-sulla-privacy-ue/

3. WHY WE PROCESS YOUR DATA - PURPOSE OF PROCESSING

Your personal data will be processed, with your consent where necessary, for the following purposes, where applicable:

3.1. 3.1. allow navigation of the Site and the provision of St. Roch services through the Site.
3.2. respond to specific requests, including the telephonic ones, addressed to St. Roch.
3.3. execute the contract of sale of our products, manage orders and process related payments.
3.4. create and manage your account.
3.5. notify the user by e-mail in the event of products left in the shopping cart.
3.6. provide the user with discount codes to be applied on purchases made on the Site.
3.7. with prior consent, allow the user to be subscribed to the St. Roch mailing list, which will send commercial and promotional communications via automated contact methods (e-mail).
3.8. fulfil any obligations under applicable laws, regulations or EU legislation, or comply with requests from the authorities.
3.9. to ascertain, exercise or defend a right of the Controller in court or whenever the judicial authorities exercise their functions.
3.10. for statistical purposes, without it being possible to trace the identity of the user.

Your personal data will also be processed with the help of automated tools.

Specific security measures are observed to prevent loss of data, illegal or incorrect use and unauthorised access.

4. LEGAL BASIS AND MANDATORY OR OPTIONAL NATURE OF PROCESSING

The legal basis for the purposes set out in sections 3.1., 3.2., 3.3., 3.4., 3.5. and 3.6. is Article 6(1)(b) of GDPR ([…] processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract […]), as the processing is necessary for the provision of services. The provision of personal data for these purposes is optional, but failure to do so would result in the impossibility of activating the services requested.

The legal basis for the purposes set out in section 3.7. is Article 6(1)(a) of GDPR ([…] the data subject has given consent to the processing of his or her personal data for one or more specific purposes […]), as the user’s consent is required for subscription to the mailing list. The provision of personal data for this purpose is optional, but failure to do so would result in the impossibility of activating the services requested.

The legal basis for the purpose referred to in section 3.8. is Article 6(1)(c) of GDPR ([…] processing is necessary for compliance with a legal obligation to which the controller is subject […]), as the processing is necessary to fulfil legal obligations or to respond to requests from competent authorities, to which the Controller is subject. This implies that such provision of personal data is mandatory.

The legal basis for the purposes referred to in section and 3.9. is Article 6(1)(f) of GDPR ([…] processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject […]), to establish, exercise or defend a right in court. The processing is mandatory, as it is necessary to satisfy the legitimate interest of the Controller.

It should also be noted that the processing referred to in section 3.10. is not performed on personal data and can therefore be freely carried out by Data Controller.

5. RECIPIENTS OF PERSONAL DATA

Your personal data may be shared with:

5.1. 5.1. PayPal, as the platform handling order payments.
5.2. Brevo, as the platform managing the St. Roch’s mailing list.
5.3. Stopdown, which handles communication, mailing list and the website.
5.4. transport companies or forwarding agents, to manage the delivery of products purchased on our website.
5.5. subjects, bodies or authorities to whom it is mandatory to communicate your personal data in accordance with the provisions of law or orders of the authorities.
5.6. persons authorized by St. Roch S.r.l. to process personal data necessary to carry out activities strictly related to the provisions of services, who are committed to confidentiality or have an adequate legal obligation of confidentiality and who guarantee the processing of data in accordance with the GDPR.

The complete and updated list of Data Processors is kept at the operational headquarters of the Data Controller, located in Quart (AO) and can be sent by sending a written request to the Data Controller at the addresses indicated in the “Contact details” section of this document.

6. RETENTION OF PERSONAL DATA

Personal data processed for the purposes set out in section 3. will be kept for the period of time strictly necessary to achieve those same purposes, as well as, in the case of processing carried out for the provision of services, up to the period of time envisaged and permitted by Italian law to protect the interests and rights of defence of St. Roch, having regard to the statute of limitations provided for by the applicable legislation. Further information regarding the period of data retention and the criteria used to determine this period can be verified by sending a written request to Data Controller at the addresses indicated in the “Contact details” section of this policy. In any case, St. Roch S.r.l. may keep your personal data for the period of time provided for and allowed by Italian law to protect its interests and the right of defence, having regard to the statute of limitations provided for by the applicable regulations.

7. TRANSFERS OF PERSONAL DATA

Personal data are stored on servers located within the European Union. It is in any case understood that Data Controller, if necessary, may also move the servers outside the European Economic Area. In this case Data Controller assures as of now that such transfer will take place in compliance with the applicable legislation based on an adequacy decision or Standard Contractual Clauses approved by the European Commission. Further information is available by sending a written request to the Controller using the contact details indicated in the “Contact details” section of this policy.

8. RIGHTS OF DATA SUBJECT

As a data subject, you have the right to request from the Controller, pursuant to Articles 15-22 of the GDPR, the exercise of the following rights under the GDPR:

  • · right of access: enables the data subject to obtain confirmation as to whether or not personal data relating to him or her is being processed by the Controller and, where applicable, to access such data and information relating thereto.
  • · right to rectification: enables the data subject to obtain the amendment of inaccurate personal data relating to him or her without undue delay and, taking into account the purposes of the processing, to obtain the supplementation of incomplete personal data.
  • · right to erasure: allows the data subject to obtain the erasure of data concerning him/her without undue delay (e.g. when his/her personal data are no longer necessary in relation to the purposes for which they were collected), subject to the exceptions provided for in the applicable legislation (e.g. when the retention of data is necessary to comply with legal obligations applicable to the Data Controller).
  • · right to restriction of processing: allows the data subject, in certain circumstances provided for by the legislation, to obtain the restriction of the processing of his/her personal data.
  • · right to data portability: allows the data subject, in certain circumstances provided for by the legislation, to receive in a structured, commonly used and machine-readable format the personal data concerning him/her that he/she has provided to the Controller.
  • · right to object: allows the data subject, in certain circumstances provided for by the legislation, to object to the processing of his/her personal data. In such cases, the Controller shall refrain from further processing the personal data of the data subject, unless the Controller can demonstrate the existence of compelling legitimate grounds for processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defence of legal claims

In any case, the data subject always has the right to lodge a complaint with the Supervisory Authority (Garante per la protezione dei dati personali), pursuant to Article 77 of the GDPR, if he or she considers that the processing of his or her data is contrary to the legislation in force.

Lastly, the data subject may revoke consent at any time, without prejudice to the lawfulness of the processing based on the consent before revocation, by contacting Data Controller at the contact details indicated in this notice (Art. 7(3) GDPR).

To obtain more information on the processing of your personal data or to exercise your rights, you may contact the Controller as indicated in the section “Contact details”.

9. UPDATES

St. Roch S.r.l. reserves the right to modify or simply update the content of this Privacy Policy, in part or in full, also due to changes in applicable legislation. Therefore, Data Controller invites you to visit this section on a regular basis in order to become acquainted with the most recent and updated version of the Privacy Policy so that you are always up to date on the data collected and how St. Roch uses them.

10. CONTACT DETAILS

For questions, requests or to exercise your rights, please contact us at the following e-mail address: saintroch@saintroch.it or send a registered letter to our registered office located in Località Torrent de Maillod, n.4 – 11020 Quart (AO).