User Privacy Disclosure
Declaration of Joint Controllership of data processing. The following companies are joint controllers of the data processing pursuant to art. 26 of EU Regulation 2016/679.
- A. Loacker Spa/AG with offices in Via Gasterer 3, 39054 Auna di Sotto/Renon, Italy
- A. Loacker Konfekt GmbH with offices in Panzendorf 196, 9919 Heinfels, Austria
- Loacker Deutschland GmbH with offices in Obere Straße 7, 87700 Memmingen, Germany
- Loacker Moccaria Italia S.r.l. with offices in Via Gasterer 3, 39054 Auna di Sotto/Renon, Italy
- Loacker Moccaria International GmbH with offices in Panzendorf 196, 9919 Heinfels, Austria
The companies indicated as joint controllers of the processing of personal data of users who navigate and are registered to the websites (hereinafter, “Users”) provide here below the privacy disclosure pursuant to art. 13 of EU Regulation 2016/679 of 27 April 2016 (hereinafter “Regulation”).
which are property of the joint controllers of the data processing, will be used to allow:
- the operation of the “contact us” service, and therefore to authorize the joint controllers of the data processing to contact the User directly, following the User’s online completion and transmission of the relative form;
- the sending of newsletters, and with prior User consent, the sending of advertising and information materials and/or transmission of commercial communications, including interactive ones. The disclosures in that sense are specific for each newsletter subscribed;
- the operation of the “Career” service, and therefore to authorize the joint controllers of the data processing to contact the User directly, following the online completion and transmission of the relative form and transmission of their resume. The services of collection and management of resumes are performed by partner Cornerstone OnDemand;
- the participation in the Pastry Workshop of Loacker, and therefore to authorize the companies who are joint controllers of the data processing or an authorized party to contact the User following the online completion and transmission of the relative contact information form by said User.
The personal data of Users may be communicated to third parties to fulfill legal obligations, or to comply with orders from public authorities, or to exercise a right in court. It is also communicated to the companies of the Loacker Group indicated above for the execution of the same purpose for which it was collected, and to any external companies delegated for the aforementioned purposes.
The contents of the above listed websites and any services offered are reserved to subjects who have reached eighteen years of age. The joint controllers, therefore, do not collect personal data of minors under 18 years of age. Upon request of the Users, the joint controllers shall immediately cancel all personal data involuntarily collected relating to minors under 18 years of age.
1. Purpose of data processing and legal basis
The Users’ personal data will be lawfully processed by the joint controllers of the data processing, pursuant to art. 6 of the Regulation for the following purposes:
a) navigation of the websites, in relation to the possibility of acquiring User data, necessary at a technical level, such as the IP address, during navigation of the websites;
b) administrative-accounting purposes, namely to perform activities of an organizational, administrative, financial or accounting nature, such as internal organizational activities and activities functional to the fulfillment of contractual and pre-contractual obligations;
c) response to contact requests by the websites visitors;
d) legal obligations, namely to comply with obligations provided by law, from an authority, by regulation or by European legislation;
e) job selection, on the portal of partner, Cornerstone;
f) management of promotional events, competitions and prize games (that are always accompanied by specific disclosures and indications on the effective controllers of the data processing when different from the present general disclosure); the secondary profiling purposes will be accompanied by specific disclosures and specific, free and separate consents.
The provision of personal data for the purposes of the data processing indicated above is voluntary but necessary, since the lack of providing of data will make it impossible for the User to navigate on the websites, subscribe to websites where provided and use the services offered by the joint controllers of the data processing. With reference to the purposes in points (1/a and 1/c), the legal basis of the data processing is, in fact, the execution of the services provided through the websites and requested by the User (pursuant to article 6, paragraph 1, letter b of the Regulation); with reference to the optional purpose in points (1/e, 1/f) of the previous paragraph, the legal basis of the data processing is any consent freely expressed by the User (pursuant to article 6, paragraph 1, letter a of the Regulation); with reference to the purposes in points (1/b, 1/d) of the previous paragraph, the legal basis of the data processing is to fulfill the legal obligation which the controller of the data processing is subject to (pursuant to article 6, paragraph 1, letter c of the Regulation).
2. Further purpose of processing: marketing and newsletters (sending of advertising materials, direct sales and commercial communications)
With the Users’ free and optional consent, some personal data of the User (namely the name, surname, email address, shipping address, etc.) may be processed by joint controllers of the data processing, even for the purpose of marketing (sending of advertising materials, direct sales, commercial communication, statistical analysis and customer satisfaction), namely that the joint controllers of the data processing may contact the User by postal service, electronic mail, telephone (fixed and/or mobile, with automated calling or communication systems with and/or without intervention of an operator) and/or SMS to propose purchase of products and/or services to the User from joint controllers and/or third parties, present offers, promotions and business opportunities. In case of lack of consent, the possibility to subscribe to the websites will not be prejudiced in any way.
In case of consent, the User may revoke the consent at any time by making a request to the controller of the data processing, using the method indicated below in paragraph 5.
The User may also easily oppose further reception of promotional communications and newsletters via email by clicking on the link provided to revoke the consent, which is present in every promotional email and newsletter. Once consent has been revoked, the joint controllers (or single owners, if that is the case) shall send the User an email message to confirm that consent has been revoked. When Users intend to revoke their consent to receiving promotional communications via telephone, continuing, however, to receive promotional communications via email, or vice versa, they are asked to send a request to the joint controllers or single owner, using the method indicated below in paragraph 5.
The joint controllers inform that, following the exercise of the right to object to the sending of promotional communications and newsletters via email, it is possible that, for technical and operational reasons (e.g. formation of contact lists already completed shortly before receiving the opposition request) the User may continue to receive further promotional messages and newsletters. Should the User continue to receive promotional messages and newsletters after 24 hours have passed since the exercise of the right to object, the User is requested to inform the joint controllers of the problem by using the contacts indicated below in paragraph 5.
3. Data processing method and data storage period
The joint controllers will process the personal data of Users utilizing manual and computer instruments, with logic strictly related to the same purposes and, in a way that guarantees the security and privacy of the data.
The personal data of the website Users will be held for the time strictly necessary to fulfill the primary purposes illustrated in paragraph 1, or as necessary for the protection in civil law of the interests of both the Users and the joint controllers. In cases referred to in paragraph 2, the personal data of the Users shall be held for the time strictly necessary to fulfill the purposes set out in the same and, in any case, in the limits referred to in the Regulation.
4. Scope of communication and dissemination of data
Employees and/or collaborators of the joint controllers, responsible for the management of the websites, may become acquainted with the personal User data. These subjects, who are formally appointed by the joint controllers as “persons in charge of the processing”, will process the User data exclusively for the purposes indicated in the present disclosure and in compliance with the previsions of the Regulation.
Third parties who may process the personal data on behalf of the joint controllers may also become acquainted with the personal User data as “External Data Processors”, such as, for example, suppliers of computer and logistics services for the operation of the websites, providers of outsourcing and cloud computing services, professionals and consultants.
Users have the right to obtain a list of any parties responsible for data processing appointed by the joint controllers by making a request using the method indicated in paragraph 5 below.
5. User’s Rights
Users may exercise the rights guaranteed to them by the Regulation by contacting the joint controllers or the single controller after completion of the following form, sent in the following ways:
- return receipt certified mail to the head offices of each of the joint controllers of the data processing, even individually;
- email to address email@example.com; it will be the responsibility of the controller who has been contacted to forward the User’s request to the others.
The Data Protection Officer (DPO) appointed by A. Loacker Spa/AG in accordance with article 37 of the Regulation can be contacted at the company’s registered office or via the email address firstname.lastname@example.org .
Website users, as parties to the data processing, have the right to:
a) Obtain access, update, correction or, if they wish, intregration of the data;
b) request and obtain the cancellation, transformation into anonymous form or the block of the data processed in violation of law, including data for which retention is not necessary relative to the purposes for which the data was collected and processed;
c) obtain certification that the operations referred to in letters a) and b) have been brought to the attention, even with regard to their content, of those to whom the data has been communicated or disseminated, unless this requirement proves impossible or involves a manifestly disproportionate effort compared with the right that is to be protected.
d) revoke consent at any time, when the data processing is based on their consent;
e) data portability (right to receive all the personal data pertaining to them in a structured, commonly used and machine-readable format), the right to restriction of processing of the personal data and the right to erasure (“right to be forgotten");
i. in full or in part, for legitimate reasons, to the processing of personal data pertaining to them, although relevant to the purpose of its collection;
ii. in full or in part, to the processing of personal data pertaining to them for the purpose of sending advertising materials or direct sales, or the execution of market research or commercial communications;
iii. at any time, when the personal data is processed for purposes of direct marketing, to the processing of their data for that purpose, including profiling, to the extent that it is connected to that direct marketing.
g) lodge a complaint with a Supervisory Authority (in the member country in which they usually live, work or in the member country where the alleged violation has taken place) when they believe that the processing pertaining to them violates the Regulation. The Italian data protection authority is the Garante Privacy, with office in Piazza Venezia no. 11, 00187 - Rome (http://www.garanteprivacy.it/).