Privacy Policy

Information pursuant to Article 13 EU Regulation 679/2016 on the processing of personal data

Users are informed that European Regulation 679/2016 (‘Regulation’) on the protection of natural persons with regard to the processing of personal data provides for the protection of natural persons with regard to the processing of personal data.

In accordance with the aforementioned legislation, the processing of personal data covered by this privacy policy carried out by Tenuta La Massa (‘Data Controller’) will be based on principles of fairness, lawfulness, transparency, relevance, and proportionality with respect to the purposes for which the data is collected, as well as the protection of your privacy and your rights.

Personal data processed

The Data Controller processes personal data relating to Customers who are natural persons, representatives of the Customer, Supplier or Third Parties, provided by the Customer/Supplier/Third Party or directly by the data subject (during direct or indirect contractual relationships, present or past, in the context of visits or business meetings, trade fairs, conferences, courses, seminars or other promotional events, past communications or previous meetings) or acquired from mailing lists provided at the time of registration, when the User expressly agrees to leave their email address in order to receive updates and newsletters.

No ‘special categories of personal data’ (as defined in Article 10 of EU Regulation 679/2016) will be processed by the data controller.

In particular, the data collected when requesting or ordering products via the e-commerce site are exclusively those necessary to fulfil your request or process your order and, if accepted, to receive updates on new products.

If the user wishes to subscribe to the newsletter in order to take advantage of special services and promotions for the purchase of products, a series of personal data is required, some of which is mandatory in order to provide the service, while other data is optional and necessary in order to participate in certain promotional initiatives.

Pursuant to Articles 13 and 14 of EU Regulation 679/2016, the Data Controller provides the following information.

Purpose of processing

Personal data will be processed for the following purposes:

1. a) provide the products and services covered by the contractual relationships in place between Tenuta La Massa and the Customer;
2. b) provide information and/or send communications relating to products and services, both during the pre-contractual phase for the formulation of a commercial offer and subsequently to receive any updates;
3. c) take care of all accounting and tax obligations relating to the contractual relationship that may be established with the Customer or Supplier;
4. d) sending information and/or offers on products and services provided by Tenuta La Massa that may be of interest to the actual or potential Customer, supplier, partner or third party, without this resulting in the transfer of personal data to third parties;
5. e) verify the quality of the products and services offered;
6. f) assess the quality of supplies and related services;
7. g) send communications and commercial and/or advertising information relating to its own products, services, events and initiatives;
8. h) credit protection;
9. i) carry out promotional, direct marketing and web marketing activities for those registered on the web platform, including through profiling and sending newsletters and targeted, personalised communications (by e-mail) based on user preferences;
10. j) organising promotional initiatives such as events and prize competitions in order to promote the Tenuta La Massa brand.

The legal basis for processing is constituted by

• legal obligations and contractual or pre-contractual requirements for the purposes referred to in points a), b) and c);
• legitimate interest of the data subject for the purposes referred to in points d), e), f), g), h) and j);
• consent of the data subject for the purposes referred to in points d), g) and i).

Treatment methods

The processing will be carried out mainly with the aid of electronic means and includes, in compliance with the limits and conditions set out in Articles 2, 3 and 4 of EU Regulation 679/2016, all operations or sets of operations provided for in the Regulation itself under the term ‘processing’, with the exception of disclosure or transfer to third parties. The methods of processing personal data involve the adoption of adequate security measures to protect the confidentiality, integrity and availability of data stored on computer or paper media. These measures have been assessed as appropriate following an analysis of all risks – evaluated considering the relative severity of the consequences and probability of occurrence – that affect the personal data processed and natural persons. Personal data will be stored for the period necessary to fulfil the purposes indicated above, in particular for:

• legal obligations, contractual commitments and in order to satisfy the legitimate interests of the data controller (preservation of know-how, maintenance of evidence relating to the quality of products and services), for at least ten years from the termination of any contractual relationship.
• For the management of events and newsletters, the personal data collected will be stored for a maximum of 5 years from the end of the initiative, unless there are legal or contractual obligations as referred to in the previous points.

The provision of data is:

• mandatory for the processing referred to in points a), b) and c) above; in this case, any refusal to provide such data could result in the failure or partial execution of the contract between the parties and/or the inability to formulate an offer for the service of interest.
• optional for the processing referred to in points d), e), f), g), h), i) and j) above; in this case, any refusal to provide such data, or any subsequent request for erasure or restriction of processing, will have no effect on compliance with contractual requirements, but may prevent you from receiving information about our services tailored to your needs in the future.

Communication and transfer of personal data

The personal data collected may be disclosed to other parties outside the Data Controller for the purposes listed above, in particular:

• In the event of a contractual relationship with the Customer or Supplier, the data necessary to fulfil legal obligations may be disclosed to tax and/or legal advisors, social security institutions, banks and insurance companies, IT support service providers, law firms or the Judicial Authority, solely for purposes related to the management of the contractual relationship and to comply with legal requirements.
• To carry out certain activities related to data processing for marketing purposes (direct marketing, sending newsletters, social media, etc.), subject to consent.

The parties to whom personal data will be disclosed will act as Data Processors, as independent Data Controllers or as parties authorised to process the data. Personal data will not be disclosed in any case. Personal data will not be transferred outside the European Union.

Contact details of the Data Controller

Il titolare del trattamento è:
Tenuta La Massa A.r.l.
Via Case Sparse n. 9 Greve in Chianti FI
0039 (0) 55 852722 – 0039 (0) 331 6168915
info@lamassa.com

Rights of the data subject

At any time, you may exercise your rights vis-à-vis the Data Controller, pursuant to Articles 15 (‘Rights of access by the data subject’), 16 (‘Right to rectification’), 17 (‘Right to erasure’), 18 (‘Right to restriction of processing’), 21 (‘Right to object and automated decision-making relating to natural persons’) and 22 (‘Automated decision-making relating to natural persons, including profiling’) of the Regulation – available at www.garanteprivacy.it and at this link by sending your request to the aforementioned address of the Data Controller, for the purpose of exercising the aforementioned rights of access. You may revoke your consent to the processing of your data in the same manner. You may also lodge a complaint about the processing of your personal data by the Company with the National Supervisory Authority, i.e. the Data Protection Authority (www.garanteprivacy.it). Registered users may decide to no longer receive newsletters and promotional communications.