Privacy Policy
Dear Customer, In compliance with the obligations set forth in the European Privacy Regulation EU/2016/679 (GDPR), we hereby inform you that Borgata SRL—registered office at Via Farini 21, 40124 Bologna (BO); certified email (PEC) borgata@pec.it; VAT No. and Tax Code 03380951206; registered with the Bologna Business Register (REA No. BO 514779)—acting as the Data Controller, will process your personal data. This includes data that has been, or may be, provided or communicated to us—either by you or by other parties—during the course of the relationship with our organization.
The processing of data—whether freely provided by you or collected by other means—will be carried out in compliance with applicable privacy regulations; it will be based on principles of fairness, lawfulness, and transparency, and conducted in observance of principles regarding relevance, completeness, and data minimization (non-excessiveness).
Data will be collected and recorded solely for the purposes set out in point 1) and will be retained for such purposes for a period not exceeding 10 years from collection for administrative and accounting purposes, and not exceeding 24 months from collection for marketing purposes.
1. Therefore, pursuant to Article 13 of the European Privacy Regulation EU/2016/679 (GDPR), we inform you that the data you provide will be processed for the following purposes:
For the proper conduct of institutional activities and/or activities provided for in the company’s objects;
For requirements related to the conclusion of contracts and assignments, their execution, any subsequent amendments or variations, and any obligations arising from their fulfillment; For operational, organizational, administrative, tax, financial, insurance, and accounting purposes related to the established contractual and/or pre-contractual relationship;
To comply with any obligations set forth by laws, regulations, or EU legislation;
For the recording, management, and storage of access logs regarding the company website, the corporate information system, and company premises;
For access control, corporate security, and video surveillance purposes;
To monitor the delivery of products/services and the status of supplier relationships, as well as to analyze and manage risks associated with the contractual relationship;
For traditional marketing activities such as sending brochures, catalogs, and commercial and/or technical documentation via postal mail, and making operator-assisted phone calls (subject to obtaining your explicit consent);
For marketing activities using automated or similar tools, such as email, instant messaging, chat, and automated (non-operator) phone calls (subject to obtaining your explicit consent);
For online marketing, web marketing, and web advertising activities (subject to obtaining your explicit consent); and for profiling activities and/or the management of automated decision-making processes (subject to obtaining your explicit consent).
2. Il trattamento sarà effettuato in maniera parzialmente automatizzata e potrà consistere nelle seguenti operazioni:
- Raccolta, registrazione, organizzazione e conservazione;
- Consultazione e utilizzo;
- Selezione, estrazione, raffronto;
- Interconnessione.
Il trattamento sarà effettuato sia con l’utilizzo di supporti cartacei che con l’ausilio di strumenti elettronici, informatici e telematici idonei a garantire la sicurezza e la riservatezza dei dati stessi in conformità a quanto stabilito dall’art. 32) del Regolamento Europeo Privacy UE/2016/679 (GDPR).
Nello svolgimento delle operazioni di trattamento saranno, comunque, sempre adottate tutte le misure tecniche, informatiche, organizzative, logistiche e procedurali di sicurezza, in modo che sia garantito il livello minimo di protezione dei dati previsto dalla legge. Le metodologie su menzionate, applicate per il trattamento, garantiranno l’accesso ai dati ai soli soggetti specificati ai punti 4) e 5).
2. Processing will be carried out in a partially automated manner and may consist of the following operations:
Collection, recording, organization, and storage;
Consultation and use;
Selection, extraction, and comparison;
Interconnection.
Processing will be carried out using both paper-based records and electronic, IT, and telecommunications tools capable of ensuring the security and confidentiality of the data, in compliance with Article 32 of the European Privacy Regulation EU/2016/679 (GDPR).
In carrying out processing operations, all technical, IT, organizational, logistical, and procedural security measures will be adopted to ensure the minimum level of data protection required by law. The aforementioned processing methods will ensure that access to the data is restricted to the parties specified in points 4) and 5).
3. The provision of data is:
Essential—and does not require your consent—for all personal data necessary for the proper establishment, management, and continuation of the commercial and/or contractual relationship;
Optional for data requiring consent.
Any refusal—even if legitimate—to provide all or part of the aforementioned data could compromise the smooth conduct of the relationship with our organization; specifically, regarding personal data defined as mandatory and essential, it could make it impossible for us to carry out normal business operations and properly provide the requested products/services.
The parties or categories of parties who may become aware of the data, or to whom the data may be disclosed, are as follows:
Legal Representative of the Data Controller;
Data Processors (Customer Support, Marketing);
Persons authorized to process data.
Personal data may also be disseminated, but only in aggregated, anonymous form and for statistical purposes.
5. Should the processing involve personal data classified as “special categories of data” (i.e., data revealing racial or ethnic origin, religious, philosophical, or other beliefs, political opinions, membership in political parties, trade unions, or associations/organizations of a religious, philosophical, political, or trade-union nature, as well as data concerning health status and sexual life), such processing shall be carried out within the limits set by the General Authorizations of the Data Protection Authority, in accordance with the procedures laid down in Legislative Decree no. 196/03 (as amended by Legislative Decree no. 101/2018), and for purposes strictly necessary for the proper conduct of business activities, operations related to the provision of products/services, and the fulfillment of contractual obligations and/or legal or regulatory requirements.
In such cases, the parties or categories of parties who may become aware of the sensitive data, or to whom the data may be disclosed, are as follows:
Legal Representative of the Data Controller;
Designated Data Processors/Authorized Personnel.
6. Furthermore, personal data may be disclosed to public bodies, law enforcement agencies, or other public and private entities, but solely for the purpose of complying with legal, regulatory, or EU obligations. The data in question shall not be disclosed to parties other than those specified in this notice, and data revealing the data subject’s health status shall under no circumstances be disseminated.
7. Data may be processed and transferred—for the purposes set out in point 1) and in the manner described in point 2)—to entities located in countries within the European Union and/or outside the European Union, based on an Adequacy Decision by the European Commission.
8. In any event, you may at any time request from the Legal Representative of the Data Controller a copy of your personal data, information regarding the location where your personal data is processed, and an updated list containing the identifying details of all Data Processors and System Administrators authorized to process your data.
9. You may freely withdraw your consent at any time—without cost or prejudice to the lawfulness of processing carried out up to that point—and exercise the following rights vis-à-vis the Data Controller, as provided for by the European Privacy Regulation (EU) 2016/679 and Legislative Decree 196/03 (as amended by Legislative Decree no. 101/2018):
Access
Rectification
Erasure
Objection
Borgata SRL