1. INTRODUCTION

When you browse our website or use our services, we collect information and personal data about you. For this reason, in compliance with the provisions of EU Regulation no. 679/2016 (hereinafter "RGPD") and any implementation laws, we have created this document (hereinafter "Privacy Policy") in order to describe what personal data we collect, the purposes and methods of treatment of the same and the measures security that we adopt to protect them.

This Privacy Policy constitutes the information to interested parties issued pursuant to the applicable legislation on personal data protection and has been drawn up in accordance with Recommendation no. 2/2001, adopted on May 17, 2001 by the Working Group for the Protection of Personal Data - Art. 29 in relation to the minimum requirements for online data collection in the European Union. Furthermore, we inform you that this Privacy Policy applies only to the website www.tenutacarobbio.com (hereinafter, the "Site") and our services (hereinafter, the "Services") and does not apply to third party websites. parties possibly recalled via links or banners within the Site.

2. SOURCE OF DATA AND PURPOSE OF DATA PROCESSING

NAVIGATION DATA

The computer systems used to operate the Services acquire, during their normal operation, some of your personal data whose transmission is implicit in the use of Internet communication protocols. This information is not collected for the purpose of identifying you, but could lead to your identification if, for example, it is combined with data held by third parties. This category of data includes the IP address and domain name of your computer, the addresses in the Uniform Resource Identifier (URI) notation of the requested resources, the time of the request, the method used to submit the request to the server, the size of the file obtained in response, the numerical code indicating the status of the response given by the server and other parameters relating to your operating system. We use this data for the sole purpose of obtaining anonymous statistical information on the use of the Services and to check their correct functioning. We delete the data collected in this way immediately after their processing. The data could be used to ascertain responsibility in case of computer crimes committed against the Services.

INFORMATION PROVIDED IN THE SITE FORMS

Browsing our Site does not require the creation of a personal account. In other parts of the site it is possible to fill in a contact form and request or provide information. In such cases, the data processed are only those provided by the user, such as the name, surname, email address and any personal data included in the text of the message.

Should you collect, process and communicate information referring to third parties, you will have to do so in accordance with the provisions of the Regulation and, therefore, you will have to give them prior information on the processing and, if necessary, you will have to collect their free and express consent before carrying out the processing .

PURPOSE OF THE TREATMENT

Providing us with the above information is necessary to be able to send a request and to enable us to respond to that request. Your refusal to provide them would limit your browsing on our Site and prevent you from using our Services.

INFORMATION COLLECTED THROUGH COOKIES AND OTHER TECHNOLOGIES

Cookies are small files sent by websites visited by users and stored on the device used to access those sites. When users visit the same site again, the browser reads the cookies stored on the device and retransmits the information to the site that originally created the cookies. Our Site also uses different types of cookies and other technologies for reading and storing information on the user's device in order, for example, to perform statistical analysis, customize and facilitate the browsing experience of users and, with the consent of the user, offer you advertising based on your interests. We do not use cookies that have the ability to launch programs on your devices or send viruses to them, or that still allow you to establish control over your devices.

In accordance with the provisions of the provision of 8 May 2014 of the Guarantor for the protection of personal data, we inform you that this information also represents the extension of the short banner already displayed when connecting to the Site. In particular, our Services adopt:

1. technical cookies, which are necessary for the functioning of the Site, including the provision of the Services offered by them. This category of cookies includes analytics, session and functionality cookies, used by the owner to, for example, collect information, in aggregate form, on the number of users and how they visit the site, to save your preferences. navigation, such as language, or to recognize the user who returns to the site;

2. profiling cookies, aimed at creating profiles relating to the user and used in order to send and show advertising messages in line with the preferences expressed by the user while browsing.

The above cookies can be:

1. temporary, when they are automatically deleted at the end of the connection;

2. permanent, when they remain stored on the user's hard drive, unless the user deletes them;

Cookies can be first-party, as they are set and managed directly by the site manager or third-party when managed by parties other than the site manager.

While the user's consent is not required for the use of technical cookies, for the use of profiling cookies your optional consent is always required and the user can choose which profiling cookies to give consent to.

It is possible to manage and disable cookies directly from the browser settings:

Internet Explorer

Google Chrome

Safari

Firefox

or through the portal www.youronlinechoices.com/it

Below is the table with the cookies used by our Services.

Nature / Type and name / Duration

First party cookie / Session technician - pll_language / 1 year

First party cookie / Session technician - displayCookieConsent / 1 year

Third party cookie / Session technician - _ga / 2 years

The Services may contain applications and materials ("API") that use data taken from your accounts opened on social networks such as Facebook, Linkedin, Google+ etc. For example, an API can be created that allows you to post comments directly on the social network you are subscribed to. When you use an API of this type, your personal data is transmitted to the social network site. These data are governed by the privacy policy of this social network. An API may also be created that allows you to obtain information and content relating to you, your friends, your user ID and other types of content taken from the social network used. This information and content will not be acquired, unless you have given your consent on the social network site. If such consent is given, the aforementioned information will be used in accordance with this Privacy Policy and the API rules of this social network.

3. DATA PROCESSING METHODS AND DATA STORAGE

We process your personal data both in paper form and through the help of electronic tools and always in compliance with the security requirements required by applicable legislation. Our security measures include contractual instruments with any contractor (e.g. service providers) or agent in order to ensure the protection of the security and confidentiality of your personal data in accordance with the provisions dictated by the applicable legislation on personal data protection.

We keep your personal data to the extent that this is necessary to fulfill the requested service and to comply with the obligations imposed by laws or regulations, to protect our rights, to prevent fraud or to apply this Privacy Policy. With reference to marketing activities, we keep your personal data for a period of two years from registration.

4. SCOPE OF COMMUNICATION

INTERNAL AND EXTERNAL COMMUNICATION OF PERSONAL DATA

Your personal data will be processed only by subjects previously appointed in charge of processing or responsible. In particular, your data may be disclosed to the following categories of external subjects: professional and / or technical service providers, legitimate recipients in accordance with the law. The recipients of the data act as owners, managers or agents according to the applicable legislation. Should we be involved in a reorganization, acquisition or sale of our company or parts of it, we will communicate your data to the third parties involved in the procedure.

Any third party that in the context of this procedure is the recipient of your data may use them within the limits established by this Privacy Policy. To receive the updated list of managers, as well as the list of recipients of your personal data, contact us by sending us an email to the following address: info@tenutacarobbio.com

TRANSFER OF DATA ABROAD

Your personal data may be transferred by us outside of Italy to third party recipients established within the European Union. This transfer is free as each country of the European Union guarantees an adequate level of data protection. We may also transfer your data to third countries, not belonging to the European Union, which do not guarantee the same level of data protection. In this case, we inform you that the transfer to third countries will always take place in accordance with the provisions of the GDPR, through the adoption of measures necessary to guarantee the security of the data being transferred, for example by signing the Standard Contractual Clauses of the EU.

5. RIGHTS OF THE INTERESTED PARTY

At any time you can exercise the rights recognized in light of the GDPR, as follows:

• Request for access to your personal data: you have the right to obtain from the data controller confirmation as to whether or not personal data concerning him are being processed and, in this case, access. Access implies the availability of some information, including the purposes of the processing, the categories of personal data processed and the recipients to whom the data is communicated. However, there is no absolute right of access and the interest of other individuals may limit your right of access. You also have the right to obtain a copy of the personal data being processed. For further copies, a fee may be applied.

• Rectification of your personal data: you have the right to obtain the correction of inaccurate personal data concerning you, as well as to obtain the integration of incomplete personal data, including by providing a supplementary declaration.

• Deletion of your personal data: the right to obtain from the data controller the deletion of personal data concerning him without undue delay and the data controller is obliged to delete personal data without undue delay if certain circumstances exist, including the no need for the data with respect to the purposes for which it was collected or the withdrawal of consent.

• Limitation of the processing of your personal data: in limited circumstances - including in the event of a dispute as to the accuracy of the data - you have the right to request the limitation of the processing of personal data concerning you.

• Data portability: you have the right to receive in a structured format, commonly used and readable by an automatic device, the personal data concerning you provided to a data controller and you have the right to transmit such data to another data controller without impediments by the data controller to whom he provided them if the processing is based on consent and is carried out by automatic means.

• Opposition to processing: you have the right to object to the processing of personal data concerning you at any time, for reasons connected with your particular situation.

The right to lodge a complaint with the competent supervisory authority (the Guarantor for the protection of personal data) remains unaffected.

To exercise these rights, please contact us using the contact details identified below.

6. HOLDER OF THE TREATMENT

The Site and Services are managed by Società Agricola Carobbio srl, Via San Martino in Cecione, 26 50022 Panzano in Chianti (Florence), email: info@tenutacarobbio.com acting as the data controller.