PRIVACY POLICY AND COOKIE POLICY

PRIVACY POLICY AND COOKIE POLICY

This policy describes the procedures followed by COVA MONTENAPOLEONE SRL (hereinafter “ Cova ”, the “ Owner ” or the “ Company ”) in relation to the processing of personal data collected through the website http://shop.pasticceriacova.com (of followed the “ Site ”).

Unless otherwise specified, this policy also applies as information – pursuant to art. 13 of Regulation (EU) no. 2016/679 (hereinafter the “ GDPR ”) – provided to those who interact with the Site (hereinafter the “ User ”).

Detailed information on the processing of personal data is provided, where necessary, on the pages relating to the individual services offered through the Site. Such information is intended to define the limits and methods of processing of personal data for each service, on the basis of which the User may freely express his/her consent, where necessary, and authorize the collection of data and their subsequent processing.

DATA CONTROLLER. DATA PROCESSORS.

The Data Controller is Cova, with registered office in Via Pietro Cossa 2, 20122 Milan (MI), tel. +39 0276002750, e-mail privacy@covamilano.com . The updated list of any data controllers is available at the Data Controller's headquarters.

TYPES OF DATA PROCESSED.

The following may be collected and processed through the Site:

• navigation data;
• personal data provided voluntarily by the User through the contacts present within the Site.

COOKIES.

Cookies are small text files that the sites visited send to the user's terminal, where they are stored, to then be retransmitted to the same sites on the next visit. Cookies allow sites to function correctly and efficiently to improve the user experience, allowing the site to store information in the memory of your computer or other devices.
The Site uses technical cookies. These cookies, being of a technical nature, do not require the prior consent of the User to be installed and used.

In particular, the cookies used on the Site can be traced back to the following subcategories:

• navigation or session cookies, which guarantee normal navigation and use of the Site and to collect information anonymously on how users use the site and how many visitors the site has, where they come from, and the other sites they have visited. Since they are not stored on the user's computer, they disappear when the browser is closed;
• analytical cookies, such as those used by Google Analytics, which collect and analyse statistical information, through your computer and other devices, on the number of users of the site, or on the number of clicks on the page during their navigation, or which site the users come from and the pages they have visited;
• social widgets and plugins : some widgets and plugins made available by social networks may use their own cookies to facilitate interaction with the reference site;

Below are the third-party cookies installed on the Site. For each of them, there is a link to the relevant information on the processing of personal data carried out and on the methods for the possible deactivation of the cookies used. With regard to third-party cookies, the Data Controller has only the obligation to insert the link to the third-party site in this policy. Instead, it is the responsibility of this subject to provide information and indicate the methods for the possible consent and/or deactivation of cookies.

• Google Analytics: https://support.google.com/analytics/answer/6004245

Cookies can be disabled by the User by checking and/or modifying the browser settings based on the instructions made available by the relevant suppliers at the links listed below.

• Internet Explorer
• Mozilla Firefox
• Google Chrome
• Apple Safari

PURPOSE AND LEGAL BASIS OF THE PROCESSING

The personal data collected through the Site will be processed:

1. to manage requests for information forwarded by the User;
2. for sending commercial communications on products and services of the Company and/or third parties – including subsidiaries, parent companies and affiliates – operating in the confectionery and food sector, via e-mail, newsletter, SMS, MMS, fax or similar and/or via postal service or telephone calls with an operator;
3. to carry out profiling activities aimed at carrying out the activities referred to in the previous letter b);
4. for the execution of sales contracts to which you are a party or for the adoption of pre-contractual measures adopted at your request;
5. to fulfill legal obligations, including any administrative and accounting activities, connected to the sale;
6. in the context of the communication of data between companies with parent, controlled or associated companies, for administrative and accounting purposes, or connected to organizational activities - including those functional to the fulfillment of contractual and pre-contractual obligations - administrative, financial and accounting;
7. for sending communications aimed at the promotion and/or direct sale of products or services similar to those you have already purchased (so-called “ soft spamming ”), without prejudice to your right to object at any time.

The processing of personal data for the purpose under a) does not require the User's consent as the processing is necessary to fulfill specific requests of the interested party pursuant to art. 6, c. 1, lett. b) of the GDPR. The processing of personal data for the purposes under b), and c) requires the User's consent pursuant to art. 6, c. 1, lett. a) of the GDPR.

The processing of data for the purpose under d) does not require your consent as the processing is necessary for the fulfillment of specific contractual obligations, pursuant to art. 6, paragraph 1, letter b) of the GDPR. The processing of data for the purpose under f) does not require your consent as it is necessary to fulfill the legal obligations to which the Data Controller is subject, pursuant to art. 6, paragraph 1, letter c) of the GDPR. The processing of data for the purposes under f) and g) does not require your consent as it is necessary for the pursuit of the legitimate interest of the Data Controller, pursuant to art. 6, paragraph 1, letter f) of the GDPR.

DATA PROVISION AND CONSEQUENCES IN CASE OF FAILURE TO PROVIDE DATA

The provision of personal data for the purposes under a), b) and c) is optional and failure to provide them will result, as the only consequence, in the impossibility for the Data Controller to manage and process the requests of the interested party, to send commercial communications, and to carry out the indicated activities.

The provision of data for the purposes under d) and e) is necessary to fulfill the legal and contractual obligations of the interested party and the Data Controller. The provision of data for the purpose under f) is necessary to pursue the legitimate interests of the Company indicated above. In all these cases, failure to provide data will make it impossible for the Company to follow up on your purchase request and manage your contractual relationship.

RECIPIENTS OR CATEGORIES OF RECIPIENTS

Personal data may be made accessible, brought to the attention of or communicated to the following subjects, who will be appointed by, as appropriate, as managers or persons in charge:

• companies of the group to which the Data Controller belongs (parent companies, subsidiaries, affiliates), employees and/or collaborators in any capacity of the Data Controller and/or of companies of the group to which the Data Controller belongs;
• public or private entities, natural or legal persons, which the Data Controller uses to carry out activities instrumental to achieving the aforementioned purpose or to which the Data Controller is required to communicate personal data, pursuant to legal or contractual obligations;
• Commercial partners of the Owner, located outside the European Union.

In any case, personal data will not be disclosed.

RETENTION PERIOD

The data will be retained for a maximum period of time equal to the limitation period of the rights enforceable by the Data Controller, as applicable from time to time. In the case of processing for marketing purposes, the data will be retained for a maximum period of 24 months; for profiling purposes, the data will be retained for a maximum period of 12 months.

RIGHTS OF ACCESS, DELETION, LIMITATION AND PORTABILITY

Interested parties are granted the rights set forth in Articles 15 to 20 of the GDPR. By way of example, each interested party may:

1. obtain confirmation as to whether or not personal data concerning him or her is being processed;
2. where processing is ongoing, obtain access to the personal data and information relating to the processing as well as request a copy of the personal data;
3. obtain the rectification of inaccurate personal data and the integration of incomplete personal data;
4. obtain, if one of the conditions set out in art. 17 of the GDPR exists, the deletion of personal data concerning him/her;
5. obtain, in the cases provided for by art. 18 of the GDPR, the limitation of processing;
6. receive personal data concerning him or her in a structured, commonly used and machine-readable format and request their transmission to another controller, if technically feasible.

RIGHT TO OBJECT.

Each interested party has the right to object at any time to the processing of his/her personal data carried out for the pursuit of a legitimate interest of the Data Controllers. In the event of objection, his/her personal data will no longer be processed, unless there are legitimate reasons to proceed with the processing that prevail over the interests, rights and freedoms of the interested party or for the establishment, exercise or defense of a right in court.

RIGHT TO WITHDRAW CONSENT.

In the event that consent is required for the processing of personal data, each interested party may also revoke the consent already given at any time, without prejudice to the lawfulness of the processing based on the consent given before the revocation. Consent may be revoked by writing an email to the address

RIGHT TO OBJECT AND REVOKE CONSENT IN RELATION TO THE PROCESSING CARRIED OUT FOR MARKETING PURPOSES.

With reference to the processing of personal data for the purposes under b) and g), each interested party may revoke at any time any consent given or oppose their processing by writing an email to privacy@covamilano.com . The opposition to the processing exercised through these methods also extends to the sending of commercial communications by post or telephone calls with an operator, without prejudice to the possibility of exercising this right in part, for example by objecting only to the processing carried out through automated communication systems. In the event of transfer and/or communication of data to third parties, the Company will be responsible for communicating the revocation of consent or opposition to the processing to the third parties to whom your personal data have been communicated.

RIGHT TO LODGE A COMPLAINT WITH THE GUARANTOR.

Furthermore, each interested party may lodge a complaint with the Guarantor for the Protection of Personal Data in the event that he or she believes that his or her rights under the GDPR have been violated, according to the methods indicated on the Guarantor's website accessible at the address: www.garanteprivacy.it .

UPDATES.

This Privacy Policy will be subject to updates. The Owner therefore invites Users who wish to know the methods of processing of personal data collected through the Site to periodically visit this page.

Having read and understood the information on the processing of my personal data:

• I consent to the processing of my personal data for the sending of commercial communications on products and services of the Company and/or third parties referred to in letter b)
• I consent to the processing of my personal data for the performance of profiling activities aimed at sending commercial communications on products and services of the Company and/or third parties referred to in letter c)