Information pursuant to Article 13 of EU Regulation 2016/679, known as GDPR

This page describes the management methods of the site regarding the processing of personal data of users who consult it. This notice (or "privacy policy") is provided pursuant to Article 13 of EU Regulation 2016/679, European Regulation on the Protection of Personal Data (hereinafter, "Regulation" or "GDPR") to those who interact with the web services of the site www.burlottispedizioni.it

The information is provided only for the site www.burlottispedizioni.it and not for other websites that the user may consult via links.

1. DATA CONTROLLER

The Data Controller, pursuant to Articles 4 and 24 of EU Regulation 2016/679, is BURLOTTI SPEDIZIONI SPA, located at Via Aria Libera, 86 – 25047 Darfo Boario Terme (BS)

2. PERSONAL DATA SUBJECT TO PROCESSING

"personal data": any information concerning an identified or identifiable natural person ("data subject"); a natural person is considered identifiable who can be identified, directly or indirectly, with particular reference to an identifier such as a name, an identification number, location data, an online identifier, or one or more specific elements of their physical, physiological, genetic, mental, economic, cultural, or social identity.

A- Browsing data

The information systems and software procedures set up for the proper functioning of the Site acquire, during their normal operation, some personal data whose transmission is implicit in browsing websites. This information is not collected to be associated with identified data subjects; however, by their very nature, they could, through processing and associations with data held by third parties, allow for the identification of users. This category of data includes IP addresses or domain names of the computers and terminals used by users, the addresses in URI/URL notation (Uniform Resource Identifier/Locator) of the requested resources, the time of the request, the method used to submit the request to the server, the size of the file obtained in response, the numerical code indicating the status of the response given by the server (successful, error, etc.), and other parameters related to the user's operating system and computing environment.

B- Data provided voluntarily by the interested party

The optional, explicit, and voluntary sending of emails to the addresses indicated on this site involves the acquisition of the sender's address, necessary to respond to requests, as well as any other personal data included in the message (request for contact or information).
Aside from what is specified for navigation data, the user is free to provide personal data to request the sending of informational material or other communications. Failure to provide such data may result in the inability to obtain what has been requested.

C- Cookies

For more information about the cookies used by this website, please see the cookie policy available on the website.

3. PURPOSE AND LEGAL BASIS OF PROCESSING. DATA RETENTION PERIOD

The data collected will be processed for the following purposes:
Browsing the website: allowing you to navigate our website and other digital platforms.
The legal basis for processing is Article 6 paragraph 1 letter f): Legitimate interest.
Data retention period: until the duration of the browsing session. For browsing, please see the cookie policy.

Data collection through the contact form: allowing you to obtain information about our services, in our 'Work with us' section for example.
The legal basis for processing is Article 6(1)(b): execution of pre-contractual measures taken at the request of the data subject.
Data retention period: 1 year for contacts

4. METHODS OF TREATMENT

The processing of data will be carried out in both automated and manual forms, with logics strictly related to the indicated purposes and in any case in a way that guarantees the security and confidentiality of the data itself, by subjects specifically authorized for this purpose. Such data will be retained, as specified in the above point, for the time strictly necessary to provide you with the requested services and will in any case be deleted following your request, except for further retention obligations provided by law.

5. ANY RECIPIENTS AND ANY CATEGORIES OF RECIPIENTS OF PERSONAL DATA

Personal data may be communicated to third parties who carry out activities necessary for the provision of the services offered by the Site, who will process the data as data processors (art. 28 of Reg. EU 2016/679) and/or as natural persons acting under the authority of the Data Controller and the Processor (art. 29 of Reg. EU 2016/679), acting under the authority of the Data Controller and the Processor. Specifically, the data will be processed by:
• entities that provide services for the management of the information system and telecommunications networks; including email, newsletters, and website management; freelancers, firms, or companies within the framework of assistance and consulting relationships;
• competent authorities for compliance with legal obligations and/or provisions of public bodies, upon request.
The list of Data Processors is available at the company's headquarters.

6. TRANSFER OF PERSONAL DATA TO A THIRD COUNTRY AND/OR AN INTERNATIONAL ORGANIZATION

No personal data is transferred to a third country outside the European Union or to International Organizations. Any transfers will, however, take place based on an adequacy decision by the Commission or, in the case of transfers referred to in Articles 46, 47 or 49, second paragraph of the European Regulation EU/2016/679 (GDPR), based on appropriate and suitable safeguards.

7. RIGHTS OF THE DATA SUBJECT

Pursuant to Articles 15 et seq. of the GDPR, the data subject has the right to request the Data Controller:
- access to their personal data;
- rectification or deletion of the same or restriction of processing concerning them;
- objection to processing;
- data portability as per Article 20 cited;
- if the processing is based on Article 6, paragraph 1, letter a), or on Article 9, paragraph 2, letter a), cited, the revocation of consent at any time without affecting the lawfulness of processing based on consent given before the revocation.
Without prejudice to any other administrative or judicial remedy, the data subject who believes that the processing concerning them violates the GDPR has the right to lodge a complaint with the Data Protection Authority according to the procedures described on the website www.garanteprivacy.it. (Article 77 cited).
To exercise the above rights, the data subject may contact the Data Controller at the contact details indicated in point 1 of this notice.

8. UPDATES

This privacy policy may be subject to changes and/or additions following any subsequent regulatory changes and/or additions, the updating or provision of new services, or technological innovations that have occurred.