Pursuant to art. 13 of EU Regulation no. 679 of 27 April 2016 (hereinafter the “GDPR”), GPA S.p.a. (hereinafter the “Company”) provides the following information regarding the processing of personal data (hereinafter the “Data”) of users of the website www.gpa-group.it (hereinafter the “Site”).
OWNER OF THE TREATMENT
The Data Controller of Website users is GPA S.p.a., with registered office in Via Molino Rosso 9/C – 40026 Imola (BO) Italy.
The Company can be contacted at the following addresses:
- by e-mail, at the address: email@example.com;
- by mail, to the following address: Via Molino Rosso 9/C – 40026 Imola (BO) Italy.
DATA SUBJECT TO PROCESSING
The Data processed may consist of identification data, location data, an online identifier or one or more characteristic elements of the physical, physiological, mental, economic, cultural or social identity suitable for making the interested party identified or identifiable, depending on the type of services requested.
In particular, the Data processed through the Site are as follows.
The computer systems and software procedures used to operate the site automatically acquire, during normal operation, some information relating to web browsing, the transmission of which is implicit in the use of internet communication protocols. This information is not collected to be associated with identified interested parties, but by their nature could, through associations and processing with data held by third parties, allow users or navigators to be identified. These Data are used for the sole purpose of obtaining anonymous statistical information on the use of the Site and to check its correct functioning, to identify anomalies and/or abuses, and are canceled immediately after processing. The Data could be used to ascertain responsibility in the event of hypothetical computer crimes against the Site or third parties.
Specific information is given in the sections of the website set up for particular services, which can also be accessed following registration, where data is requested from the user of the website.
Data collected through cookies
Browsing the Site involves receiving cookies, i.e. short strings of text that the websites visited send to the user’s browser (i.e. the program used to navigate), where they are memorized before being re-transmitted to the same websites during subsequent visits. While browsing a site, the user can also receive on his computer cookies from sites or web servers other than the one he is visiting (so-called “third-party” cookies). Specific information is given in the sections of the website set up for particular services, which can also be accessed following registration, where personal data is requested from the site user. It is possible to distinguish technical cookies, which allow the performance of activities strictly related to the functioning of the site and can be used freely, and profiling cookies, used in order to show the user advertising messages in line with the preferences expressed by the same during navigation and for which it is necessary to obtain the user’s consent. Through this site, the user’s browser can receive technical cookies but not profiling cookies.
The site uses technical navigation cookies, to memorize navigation preferences and improve navigation on the site, and analytical cookies (specifically Google Analytics provided by Google Inc. – hereinafter “Google”), which collect, in anonymous and aggregate form , statistical information on how users navigate, useful for understanding in which aspects it is possible to improve the website.
These are the cookies present:
|cb-enabled||This cookie is associated with a free script that displays a cookie alert notice on a website. It is used to record the moment in which the user rejected the alert, to prevent its reappearance on any other visits.||1 Week||Other|
|_ga||This cookie is installed by Google Analytics. The cookie is used to calculate visitors, session, campain data and keep track of the use of the site for the analytical report of the site itself. Cookies store information anonymously and randomly assign a unique numeric identifier to visitors.||2 Years||Analytical|
|_gid||This cookie is installed by Google Analytics. The cookie is used to store information regarding the use of the website by visitors and helps to create analytical reports on the functioning of the site: including data collected by number of visitors, the resource from which they come and the pages visited anonymously.||1 Day||Analytical|
|_gat||This cookie is installed by Google Universal Analytics to decrease the request rate in order to limit data collection on high traffic websites.||1 Minut||Performance|
|vuid||ID for Video||2 Years||Other|
|player||Player for Video||1 Year||Other|
|PHPSESSID||This cookie originates from PHP applications. The cookie is used to store and identify a unique user session ID, with the aim of managing the user session on the website. The cookie is a session cookie and is deleted when the browser windows are closed.||2 Days||Necessary|
The use of these cookies does not require the acquisition of the user’s consent, who can still decide to disable their use on their browser. Furthermore, Google Analytics cookies can be specifically rejected using the appropriate tool provided by Google: (v. https://support.google.com/analytics/answer/181881?hl=it&ref_topic=2919…).
The user can set his browser in such a way as to be warned of the presence of cookies and decide whether or not to accept a specific cookie or to automatically reject all cookies. Below are the references on how to manage the activation and deactivation of cookies for the main browsers:
Apple Safari: https://support.apple.com/kb/PH19214?locale=it_IT
Microsoft Internet Explorer e Microsoft: Edge: https://support.microsoft.com/it-it/help/17442/windows-internet-explore…
- Data provided voluntarily by the user
The optional, explicit and voluntary sending of e-mails (through the Info&Contacts section or Send your profile or the Info form or in any case through the addresses indicated on the website www.gpa-group.it) involves the subsequent acquisition of the sender’s address, necessary to respond to requests, as well as any other personal data included in the request”.
LEGAL BASIS, NATURE AND PURPOSE OF THE TREATMENT
The Data of the users of the Site will be processed for the following purposes:
- allow navigation of the Site, including as regards the management of the security of the same;
- allow the provision of the services made available by the Company;
- fulfill any obligations established by applicable laws, regulations or community legislation, or satisfy requests from the authorities;
- for the elaboration of statistics, without it being possible to trace the identity of the interested party;
- send newsletters and communications for direct marketing purposes, in relation to products also supplied by the other companies of the GPA Group;
The legal basis of the processing of Data for the purposes referred to in point 1) is the art. 6.1 f) of the GDPR, i.e. the Company’s legitimate interest in the Website functioning correctly.
The legal basis of the processing of Data for the purposes referred to in point 2) is the art. 6.1.b) GDPR, i.e. the processing is necessary for the execution of a contract of which the interested party is a party or for the execution of pre-contractual measures adopted at the request of the same.
The legal basis of the processing of Data for the purposes referred to in point 3) is the art. 6.1.c) GDPR, i.e. the processing is necessary to fulfill a legal obligation to which the data controller is subject.
The provision of Data for the purposes referred to in points 1), 2) and 3) is optional, but failure to provide it would make it impossible to activate the requested services.
Instead, the treatment referred to in point 4) does not involve the possibility of identifying the interested parties and, therefore, can be freely carried out by the Company. In any case, the initial processing of the Data, used to derive the statistical indicator, is based on art. 6.1.f GDPR, i.e. the Company’s legitimate interest in processing statistics relating to its operations.
The legal basis of the processing of Data for the purposes referred to in points 5) is the art. 6.1.a) GDPR, i.e. the express consent of the interested party to the processing of their data. This consent is optional and the user is free to revoke it at any time without any consequences, other than the fact that he will no longer receive marketing communications . The previously granted consents can be revoked by following the indications in the “Rights of the interested parties” section.
Data may be shared with:
- subjects who typically act as data controllers pursuant to art. 28 GDPR, i.e. subjects who cooperate with the Company for the pursuit of the aforementioned purposes;
- subjects, bodies or authorities to whom it is mandatory to communicate the Data by virtue of provisions of the law or orders of the authorities;
- persons authorized by the Company, pursuant to art. 29 GDPR, to the processing of data necessary to carry out activities strictly related to the provision of services, which have an adequate legal obligation of confidentiality.
As regards the possible transfer of Data to countries not belonging to the European Economic Area, the treatment will take place according to one of the methods permitted by current law. It is possible to obtain further information, upon request, from the Company at the contacts indicated above.
The Data will be kept for the time strictly necessary to achieve the purposes of the processing, applying the principles of minimization and proportionality. In any case:
- as regards the treatments carried out for the provision of services, the Company will keep the Data for the period of time foreseen and permitted by the Italian legislation for the protection of its interests (Article 2946 of the Italian Civil Code and subsequent amendments);
- as for the Data processed to fulfill legal obligations, the same will be kept until the time required by the specific obligation or applicable law.
Further information regarding the data retention period and the criteria used to determine this period can be requested by sending a written request to the Company at the addresses indicated above.
RIGHTS OF INTERESTED PARTIES
Pursuant to articles 15 ff. GDPR, the interested party has the right to ask the Company for access to their Data, the rectification or cancellation of the same or to oppose their treatment, request the limitation of treatment in the cases provided for by art. 18 GDPR, as well as to obtain the Data concerning him in a structured format, commonly used and readable by automatic device, in the cases provided for by art. 20 GDPR.
Requests must be sent in writing to the Company at the addresses indicated above.
In any case, the interested party always has the right to lodge a complaint with the competent supervisory authority, i.e. the Guarantor for the Protection of Personal Data, pursuant to art. 77 GDPR, if you believe that the processing of your data is contrary to the legislation in force.