PRIVACY POLICY

Information document pursuant to Art. 13 of the EU Regulation 2016/697 (GDPR)

In accordance with Art. 13 of the General Data Protection Regulation (GDPR) and in relation to personal data that our Company BERNARDI s.r.l. shall be provided and therefore process, we would like to provide you with the following information.

With reference to the above mentioned Regulation:

1. BERNARDI s.r.l. shall be considered the Owner (i.e. Data Processor) in respect to the provided data.
2. In case you are a physical entity (individual or professional business enterprise), you will be considered as Data Subject (i.e. Interested Party) and your data shall be treated in the manner stated below. You  shall also be entitled to assert the rights described hereunder.
3. If you are a juridical person (company, body, etc.), you shall NOT be considered as Data Subject (i.e. Interested Party), and your data shall not be considered as Personal Data. Therefore,  the aforementioned Regulation shall not apply to their processing.
4. In any case, your directors/representatives/employees/collaborators/executives, whose data may accidentally be conferred or disclosed, these being in contact with the Data Owner for business purposes, shall be considered  as Data Subject (i.e. Interested Party) and their data shall be processed as described hereunder. You therefore undertake to provide the a.m. information to your representatives/employees/collaborators/executives, whose personal data might accidentally be sent/supplied to the Data Processor, in virtue of the relationship they have with him.

1) Data Processor

As stated above, the Data Processor shall be the company BERNARDI s.r.l., with head-office in 12020 Villar San Costanzo (Cuneo), Via Caduti sul Don, nr.1, Italian Fiscal Code and VAT Identification number 01751680040, contactable at the following e-mail address info@essense.coffee

The Data Processor shall process and treat your data according to the principles contained in the EU General Data Protection Regulation (GDPR – 2016/679), as per Legislative Decree 196/2003 and Legislative Decree 101/2018, that is within  the principles  of lawfulness, transparency, limited scope and storage, data minimizing rule, accuracy, integrity and confidentiality.

2) Data Processing Purposes

The personal data supplied to the Data Processor by any Data Subject (i.e. Interested Party) shall be processed for institutional purposes and in particular for:

1. a) Answering questions sent by the user (hereby also called Data Subject or Interested Party), through suitable contact means;
2. b) Supplying budgetary estimates to the Data Subject or Interested Party’s inquiries sent through suitable contact means;
3. c) Sending CVs or requests of cooperation to the Data Processor;
4. d) Complying with any obligation under law or regulations, EU Rules, or Authorities’ decrees;
5. e) Exercising the Data Processor’s rights and interests, as well as connected to any third party, such as the right of direct marketing and defence;
6. f) Sending commercial information or advertising brochure about products or services offered by the Data Processor (through e-mail, by means of newsletters, phone calls or additional contact channels supplied); getting in touch with the Data Subject in respect to customized offers or events, as well as in respect to the evaluation of the appreciation degree about services and products

3) Juridical Fundamentals of the Data Processing

The juridical fundamentals for processing and treatment are the following:

As to the purposes described as per the previous points 2a), 2b), 2c), 2d) and 2e):

• Processing is necessary for complying with contracts in which the Data Subject is part, and in any case complying with any requirement sent by the Data Subject (even including pre-contractual measures);
• Processing is necessary for complying with any obligation under laws, or required by the Authorities;
• Processing is necessary in order to pursue rightful interests of the Data Processor or of a third party (such as, defense or direct marketing).

As regards the purposes stated in point 2f):

• The Data Subject’s consent.

4) Compulsory or Optional Nature of the Personal Data Supply

Providing the data marked with an asterisk is compulsory: failing to submit them, shall prevent the Data Processor to comply with the Data Subject’s requests.

The supply of data which are not marked with an asterisk is optional: failing to submit them, shall not prevent the Data Processor to comply with the Data Subject’s requests.

The consent to treatment for the purposes described in point 2f) is optional: failing to give consent, however, shall imply the impossibility to send the Data Subject (i.e. Interested Party), newsletters, commercial information and advertising brochure connected with the products offered by the Data Processor or by any additional company related to him, but the Data Subject shall be entitled  to receive what he/she requires for the other stated purposes.

5) Data Subject’s Rights

The Data Subject (i.e. Interested Party) is entitled to:

• Access to his/her own personal Data stored by the Data Processor;
• Require any amendment and/or cancellation (so called, “right of erasure”);
• Require their restriction or oppose the treatment;
• Require the data portability;
• Oppose treatment and processing, under the conditions set forth by Art. 21 GDPR;
• Submit a complaint to the Supervisory Authority.

The Data Subject may revoke his/her consent to treatment and processing at any time, without prejudice to the lawfulness of the treatment based on his/her consent before revoking.

6) Communication with the Receivers, Transfer to Third Countries and Disclosure

The data acquired through our site shall not be disclosed.

The data are sent to to the receivers  within an extent strictly necessary to comply with the aforementioned purposes.

The categories of the receivers are the following:

• Subjects authorized by the Data Processor;
• Any third Party, appointed by the Data Processor in relation to  the treatment and processing, or responsible people duly appointed by him (ex art. 28 GDPR), by means of a suitable contract;
• Any company being part of the same business group or in some way related to the Data Processor;
• Further subjects (either public or private), to whom the data disclosure shall be necessary to comply with the obligations by law, fulfil the contract, meet with the Data Subject’s requirements, comply with orders  by Authorities or defend interests of the Data Processor or of a third party under the law.

The Data Processor shall transfer the Data neither to a country outside the European Union, nor to an international organisation, except and solely for the transmission of newsletters, the use of that service being supplied from a country outside the European Union (nevertheless, that service complies with the “Privacy Shield” rule, thus assuring an adequate level of protection).

7) Data Storage Time

The Data Processor shall store data for the time necessary to fulfil the purposes mentioned above.

In any case, the Data Processor engages to avoid storing data beyond the time necessary to comply with the above mentioned purposes or with additional law rules.

8) Amendments to this Information Privacy Document

The Data Processor shall reserve the faculty to partly or fully amend the content of this Policy Information document, and/or owing to any modification of the Privacy Regulation.

Any up-dated version shall be published on the site by the Data Processor, and from that time on that version shall be considered binding under every respect. The Data Subject is therefore required to visit this section on our site to check if any modification is added.