Privacy Policy

Website Privacy Policy

Information Notice for Website Users

This Privacy Policy is provided pursuant to Article 13 of Regulation (EU) 2016/679 on the protection of personal data ("General Data Protection Regulation" or "GDPR") to all users who access this website (hereinafter the "Website"), www.biscotticavanna.com, owned and operated by FORNERIA ARTIGIANA CAVANNA S.R.L.

The purpose of this Privacy Policy is to explain how the personal data of users who visit the Website and/or use the services and features available through it (such as the newsletter subscription service and contact forms) are collected and processed.

This Privacy Policy applies exclusively to this Website owned by FORNERIA ARTIGIANA CAVANNA S.R.L. and does not apply to any third-party websites that may be accessed through links available on the Website.

Users are invited to read this Privacy Policy carefully before submitting any personal information or completing any electronic forms available on the Website.

Identity of the Data Controller

The Data Controller is FORNERIA ARTIGIANA CAVANNA S.R.L., represented by its legal representative pro tempore, with its registered office and principal place of business at:

Via Gatto, 9

12020 Villar San Costanzo (CN)

Italy

The Data Controller may be contacted by email at info@biscotticavanna.com or by regular mail at the above address.

The Data Controller is committed to ensuring the security, confidentiality and protection of all personal data processed at every stage of the processing activities. Personal data are processed in accordance with the principles of lawfulness, fairness, transparency, data minimisation and purpose limitation, in full compliance with the GDPR.

Categories of Personal Data Processed

The Website processes the following categories of personal data.

Browsing Data

The computer systems and software procedures used to operate this Website automatically acquire certain personal data during their normal operation. The transmission of such data is inherent in the use of Internet communication protocols.

This information is not collected in order to identify users directly; however, due to its nature, it could allow users to be identified through processing and association with data held by third parties.

Such data include, by way of example:

IP addresses or domain names of users' devices;

URI (Uniform Resource Identifier) addresses of requested resources;

the date and time of each request;

the method used to submit the request to the server;

the size of the file returned;

the numerical status code indicating the server response (successful, error, etc.);

information relating to the user's operating system and IT environment.

These data are processed solely for the purpose of obtaining anonymous statistical information on Website usage, ensuring the proper functioning of the Website, detecting anomalies or misuse, and are deleted after processing.

Where required by law, such data may also be used to ascertain liability in the event of cybercrime committed against the Website or third parties.

Data Voluntarily Provided by Users

FORNERIA ARTIGIANA CAVANNA S.R.L. also collects personal data voluntarily provided by users when requesting products or services available through the Website, including, for example:

first name;

last name;

email address;

and any additional information voluntarily provided through contact forms or newsletter subscription forms.

Specific privacy notices may be provided on individual pages dedicated to particular services.

FORNERIA ARTIGIANA CAVANNA S.R.L. processes such data in accordance with applicable data protection legislation, assuming that the information relates either to the user or to third parties who have expressly authorised the user to provide their personal data based on an appropriate legal basis.

In such cases, the user acts as an independent data controller with respect to the personal data of such third parties and assumes full legal responsibility for the lawfulness of the disclosure, fully indemnifying FORNERIA ARTIGIANA CAVANNA S.R.L. against any claims, complaints, requests for compensation or liabilities arising from the unlawful processing of personal data through the use of the Website.

Cookies

This Website uses cookies and similar technologies to ensure the proper functioning of its pages, improve the browsing experience, analyse Website usage and, subject to the user's consent where required, provide personalised content and communications.

Cookies are small text files stored on the user's device while browsing the Website. They enable the Website to recognise the user's device during subsequent visits and to remember certain preferences and settings.

The Website uses the following categories of cookies:

Strictly Necessary Cookies

These cookies are essential for the proper operation of the Website and enable, for example, browsing, shopping cart management, access to restricted areas, user authentication, website security and the completion of purchases. These cookies do not require the user's consent.

Preference (Functional) Cookies

These cookies allow the Website to remember the user's preferences, such as language, country or other browsing settings, in order to provide a more personalised browsing experience. Where required by applicable law, the use of these cookies is subject to the user's consent.

Analytics Cookies

These cookies collect statistical information, in aggregated or pseudonymised form, about how users interact with the Website. They help improve the Website's performance, functionality and content. Analytics cookies may be provided directly by the Data Controller or by third-party providers, such as Google Analytics or equivalent services, in accordance with applicable law and the user's consent preferences.

Marketing and Profiling Cookies

Where used, these cookies are intended to deliver personalised advertising and marketing content, measure the effectiveness of advertising campaigns and display advertisements that are more relevant to the user's interests. These cookies are installed only with the user's prior explicit consent.

When users first visit the Website, they are presented with a dedicated cookie banner that allows them to accept, reject or customise the use of non-essential cookies. Users may modify or withdraw their consent at any time through the cookie management tool available on the Website.

For detailed information about the individual cookies used, their duration, purposes and any third parties involved in the processing of personal data, please refer to the Cookie Policy available on the Website.

Purposes of Processing

Users' personal data are processed for the following purposes:

to ensure the technical operation, security and proper functioning of the Website and its content;

to analyse Website traffic and generate statistical information regarding the use of the Website;

to provide the products and/or services requested by the user;

to process and manage orders and contracts entered into with users;

to fulfil administrative, accounting, tax and legal obligations;

to respond to requests, enquiries or communications submitted by users through the Website.

The provision of personal data is voluntary. However, failure to provide the data required to process an order or respond to a request may prevent the Data Controller from providing the requested products, services or assistance. Likewise, disabling certain cookies may affect the proper functioning of specific features of the Website.

Legal Basis for Processing

Personal data are processed on one or more of the following legal bases, in accordance with Article 6 of the GDPR:

the performance of a contract to which the data subject is a party or the implementation of pre-contractual measures requested by the data subject;

compliance with legal obligations to which the Data Controller is subject;

the legitimate interests pursued by the Data Controller, including ensuring the security and proper functioning of the Website;

the data subject's consent, where required by applicable law, including for the use of non-essential cookies and the subscription to newsletters or other marketing communications.

Where processing is necessary for the performance of a contract or to respond to a user's request, the user's consent is not required.

Methods of Processing

Personal data are processed in accordance with the principles of lawfulness, fairness, transparency, purpose limitation, data minimisation, accuracy, integrity and confidentiality established by the GDPR.

Processing is carried out mainly by electronic and automated means, although paper-based processing may also be used where necessary. Appropriate technical and organisational security measures are implemented to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access.

The Website is hosted on the Shopify platform. Further information regarding Shopify's processing of personal data is available in Shopify's Consumer Privacy Policy.

Recipients of Personal Data

Personal data will not be disclosed to the public.

However, they may be communicated, where necessary for the purposes described above, to:

employees and authorised personnel of the Data Controller;

IT service providers and cloud hosting providers;

payment service providers;

shipping and logistics companies;

professional advisers, including accountants, auditors and legal consultants;

public authorities or supervisory bodies where disclosure is required by law.

All recipients process personal data in accordance with applicable data protection legislation and, where required, have been appointed as Data Processors pursuant to Article 28 of the GDPR.

International Data Transfers

As a general rule, the Data Controller does not intentionally transfer personal data outside the European Economic Area (EEA).

However, some service providers used to operate the Website (such as cloud hosting, payment, analytics or email service providers) may process personal data in countries outside the EEA. In such cases, personal data are transferred only where appropriate safeguards have been implemented in accordance with Articles 44 to 49 of the GDPR, including, where applicable, the European Commission's Standard Contractual Clauses or other legally recognised transfer mechanisms.

Data Retention

Personal data are retained only for as long as necessary to fulfil the purposes for which they were collected and, in any event, for the periods required by applicable law.

In particular:

data relating to orders and purchases are retained for the period required to comply with legal, accounting and tax obligations;

data submitted through contact forms are retained for the time necessary to process and respond to the user's request;

data processed for marketing purposes are retained until the user withdraws consent or exercises the right to object;

technical and statistical data are retained in accordance with the retention periods applicable to the relevant services and technologies used by the Website.

Once the applicable retention period has expired, personal data will be securely deleted or anonymised, unless further retention is required by law or for the establishment, exercise or defence of legal claims.

Data Subject Rights

In accordance with Articles 15 to 22 of the GDPR, users may exercise the following rights at any time in relation to their personal data:

1. the right to obtain confirmation as to whether personal data concerning them are being processed and, where that is the case, to access such data;
2. the right to request the rectification of inaccurate or incomplete personal data;
3. the right to request the erasure of personal data where the conditions set out in Article 17 of the GDPR apply;
4. the right to request the restriction of processing in the cases provided for by Article 18 of the GDPR;
5. the right to receive their personal data in a structured, commonly used and machine-readable format and to transmit those data to another controller (data portability);
6. the right to object, at any time, to the processing of personal data based on the Data Controller's legitimate interests or for direct marketing purposes;
7. the right not to be subject to a decision based solely on automated processing, including profiling, where applicable.

Where processing is based on consent, users have the right to withdraw their consent at any time without affecting the lawfulness of any processing carried out before such withdrawal.

To exercise any of these rights, request further information, or raise any concerns regarding the processing of personal data, users may contact the Data Controller by email at:

in@biscotticavanna.com

Please specify the subject of your request to facilitate its handling.

Users also have the right to lodge a complaint with the competent supervisory authority. In Italy, this authority is the **Italian Data Protection Authority (Garante per la Protezione dei Dati Personali)**, should they believe that the processing of their personal data infringes applicable data protection laws.

---

Changes to this Privacy Policy

This Privacy Policy may be amended or updated from time to time, including to reflect changes in applicable legislation, regulatory requirements or the services offered through the Website.

The most recent version of this Privacy Policy will always be available in the Privacy section of [www.biscotticavanna.com](https://www.biscotticavanna.com).

Users are encouraged to review this Privacy Policy periodically to remain informed about how their personal data are collected, used and protected.