Privacy Policy

Company name: Ecopassion 2.0 Società Cooperativa Sociale
Registered Office: Via Kirchmayr, 4 39031 – Brunico (Italia)
Fiscal Code and Company Register No. 03088800218
REA Number BZ-231153 – Unique Code USAL8PV
Telephone: 39 3805859610
Email: info@ecopassion.com

(hereinafter referred to as “data controller” or “data holder”)

We would like to inform you, as the data subject of your personal data (hereinafter referred to as “data controller” or also “data subject”), pursuant to Art. 13 of the EU Regulation No. 2016/679 (GDPR), that your data will be processed in the following manner and for the following purposes:

OBJECT OF PROCESSING

The data controller processes personal identification data (e.g. first name, surname, tax code, identity card, address, telephone number, email, bank and payment references, multimedia material), hereinafter referred to as ‘personal data’ or also ‘data’, communicated in connection with the conclusion of contracts for the services of the data controller and/or by means of digital methods (e.g. information request forms).
The data may be freely provided or collected autonomously and/or automatically by the data controller.
The data requested by the data controller (manually, digitally and automatically) are generally mandatory in order to ensure the proper functioning of the service. Mandatory data is marked with an asterisk (*) where necessary and possible.
In cases where optional data is to be filled in, it is possible to refrain from communicating it without this having any consequence on the availability of the service or its operation.
The possible use of computer tracking tools (e.g. Cookies) by the website, or by the owners of third party services used by the same, is for the purpose of providing the requested service. Further purposes, if any, are described in this document and in the Cookie Policy, if available.
The interested party assumes responsibility for the third party data obtained, published or shared and guarantees that he/she has the right to communicate or disseminate them, releasing the owner from any liability towards third parties.

METHODS OF PROCESSING

Data processing is carried out by means of the following operations: collection, recording, organisation, structuring, storage, adaptation or modification, extraction, consultation, use, communication by transmission, dissemination or any other form of making available, comparison or interconnection, restriction, deletion and destruction. The data are subject to both paper and electronic and/or automated processing.
The controller takes appropriate security measures to prevent unauthorised access, disclosure, modification or destruction of personal data.

LEGAL BASIS FOR PROCESSING

The data subject has given consent for one or more specific purposes

• In some jurisdictions, the controller may be authorised to process personal data without the data subject’s consent or another of the legal bases specified below, as long as the data subject does not object to such processing. However, this does not apply if the processing of personal data is regulated by European data protection legislation.
• Processing is necessary for the performance of a contract and/or the performance of pre-contractual measures
• Processing is necessary for compliance with a legal obligation to which the controller is subject
• Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller
• Processing is necessary for the pursuit of the legitimate interest of the data controller or of third parties

However, it is always possible to request the controller to clarify the concrete legal basis of each processing operation and in particular to specify whether the processing is based on law, provided for by a contract or necessary for the conclusion of a contract.

PLACE OF PROCESSING

Data are processed and stored at the premises of the data controller (on paper and/or electronic media) and in any other place where the parties involved in the processing are located (e.g. on servers located within the European Union).
The data subject has the right to obtain information about the legal basis for the transfer of data outside the European Union or to an international organisation under public international law or consisting of two or more countries, such as the UN, as well as about the security measures taken by the data controller to protect the data.
Should one of the transfers just described take place, the data subject may refer to the respective sections of this document and/or request information from the controller by contacting him at the contact details given herein.

RETENTION PERIOD

Data are processed and kept for the time required by the purposes for which they were collected.

Data collected for purposes related to the performance of a contract will be retained until the performance of that contract is completed.
Data collected for purposes related to the legitimate interest of the data controller will be retained until that interest is fulfilled.

Where processing is based on consent, the controller may retain personal data for longer until such consent is withdrawn. Furthermore, the controller may be obliged to retain the data for a longer period in compliance with a legal obligation or by order of an authority.
At the end of the retention period, the personal data will be deleted. Therefore, upon expiration of this period, the right of access, deletion, rectification and the right to portability can no longer be exercised.

PURPOSES OF DATA PROCESSING

Personal data are processed for the purposes set out below:

SERVICE PURPOSES

This purpose includes the use, for internal use only, of data collected and/or produced by the owner (e.g. photos and videos, emails and documents) as well as the sending of informative, organisational, accounting and commercial communications strictly related to the service.

• Provision of services and performance of contracts
  The provision of the data required to provide the services requested is not obligatory by law, but refusal to provide such data will make it impossible to fulfil the request.
• Fulfilment of legal obligations Required by law, regulation, EU legislation or an order from the Authority.
• Holder’s rights Such as exercising the right of defence in court.

DIRECT AND INDIRECT MARKETING AND PROFILING

This means that data, collected and/or produced by the owner, can be subject to analysis and profiling in order to provide a better experience for the person concerned. Communications are more relevant and it becomes possible to receive dedicated promotions and information.
Personal data, only with explicit consent, are processed for the purposes indicated below:

• Promotional communications: forwarding communications to the interested party by carrying out activities functional to the promotion and sale of products and services of the owner or third parties through letters, telephone, internet and other communication systems.
• Disclosure of personal data: disclose data collected and/or produced by the data controller (e.g. photos, videos, and other personal information) on online and offline communication channels (e.g. print, email, websites and social networks) for information, promotional, marketing purposes.

RIGHTS OF THE DATA SUBJECT

The data subject is entitled to exercise certain rights with respect to his or her own data:

• Revocation of consent at any time: Withdraw consent to the processing of their personal data previously given.
• Opposition to processing: The data subject may object to the processing of his or her data when it is done on a juridical basis other than consent.
• Access to data subject to processing: The data subject has the right to obtain information on the personal data processed by the data controller, on certain aspects of the processing, and to receive a copy of the processed data.
• Verification and rectification: The data subject may verify the correctness of his or her data and request that it be updated or corrected.
• Limitation of processing: When certain conditions are met, the data subject may request the restriction of the processing of his or her data. In this case, the data controller will not process the data for any purpose other than its preservation.
• Deletion: When certain conditions are met, you may request the deletion of your data.
• Receipt or transfer: Receive your data in paper or digital format and, where technically feasible, have it transferred unimpeded to another data controller. Transfer is applicable when data is processed by digital/automated means and the processing is based on consent, a contract to which you are a party or contractual measures related thereto.
• Proposing a complaint: Propose a complaint to the data protection supervisory authority or take legal action.

DETAILS OF THE RIGHT TO OBJECT

Where personal data are processed in the public interest, in the exercise of official authority vested in the controller or in pursuit of a legitimate interest of the controller, the data subject has the right to object to the processing on grounds relating to his or her particular situation.
The data subject should note that if his or her data were processed for direct marketing purposes, he or she may object to the processing without giving any reasons. In order to find out whether the data controller processes data for direct marketing purposes, the data subject may use the contact methods indicated within this.

HOW TO EXERCISE RIGHTS

To exercise your rights, you can address a request to the contact details of the holder indicated in this document. Requests are filed free of charge and processed by the holder as quickly as possible, in any case within 30 days at the latest.

FURTHER INFORMATION ON TREATMENT

• Defence in court
  The personal data of the data subject may be used by the data controller in legal proceedings or in the preparatory stages of such proceedings in order to defend against abuse in the use of applications and related services by the data subject. The data subject declares that he/she is aware that the data controller may be obliged to disclose the data by order of public authorities.
• Specific information
  Upon request, in addition to the information contained in this privacy policy, the data controller may provide the data subject with additional and contextual information regarding specific services, or the collection and processing of personal data.
• System logs and maintenance
  For operation and maintenance purposes, applications used by the owner, and any third-party services used by it, may collect system logs, i.e. files that record interactions and may also contain personal data (e.g. IP address).
• Information not contained in this policy
  Further information in relation to the processing of personal data may be requested at any time from the data controller using the contact details.
• Changes to this privacy policy
  The data controller reserves the right to make changes to this privacy policy at any time by informing the data subjects online and, where technically and legally feasible, by sending a notification via one of the contact details held by the data controller. Therefore, please consult this page regularly, referring to the date of last modification indicated at the top of this page.

If the changes affect processing whose legal basis is consent, the data controller will collect the data subject’s consent again, if necessary.

LEGAL REFERENCES

This privacy policy is drafted on the basis of multiple legal regulations, including Articles 13 and 14 of Regulation (EU) 2016/679.