PRIVACY POLICY
Notice provided to users of the website pursuant to Article 13 of European Regulation No. 679/2016
This Privacy Policy describes how Pathos S.r.l., as Data Controller, processes the personal data of users who access the website https://www.crudiebollicine.com/ (hereinafter also the “Website”), customers and potential franchisees of the Controller, its suppliers, and job applicants.
This notice is provided pursuant to Article 13 of EU Regulation 679/2016 (General Data Protection Regulation – GDPR). It also complies with Recommendation No. 2/2001 adopted on 17 May 2001 by the European Data Protection Authorities, assembled in the Group established by Article 29 of Directive 95/46/EC, which set forth certain minimum requirements for online data collection, and in particular, the timing, manner, and nature of the information that Data Controllers must provide to users when they connect to web pages.
This document exclusively concerns the WEBSITE https://www.crudiebollicine.com/ and does not extend to any other websites that users may consult via links.
We recommend that you carefully read this Privacy Policy before browsing the WEBSITE and/or providing your personal data via the “Contact” form.
1 – WHO IS THE DATA CONTROLLER?
Pathos S.r.l. (Tax Code and VAT No. 06659420480), with registered office in Montespertoli (FI), Via Ribaldaccio No. 100, is the Data Controller (hereinafter also the “Company” or “LA PROSCIUTTERIA”).
2 – WHAT PERSONAL DATA DO WE PROCESS?
Depending on the nature of the relationship, the Company may collect various categories of personal data. Pursuant to Article 4 of EU Regulation No. 679/2016 (“GDPR”), personal data means any information relating to an identified or identifiable natural person.
2.1. Through the use of and interaction with the WEBSITE, the Company collects several categories of personal data of the data subject. Pathos will process personal data differently depending on whether the user is simply browsing the Website or accessing full functionalities by creating an account.
Specifically, Pathos processes the following data through the Website:
Data voluntarily provided by the User through interaction with the Website. This includes personal data entered in forms available on the Website:
Information requests about products and/or points of sale: the user provides an email address in order to receive a reply;
Franchise inquiries: personal data, contact details (email and phone), date of birth, registered office, financial availability for the initial investment, previous professional activities, known languages, and preferred geographic area;
Job applications: the form requires name, email, and CV. The CV may contain personal data (name, surname, email address, phone number, professional/work information, and sensitive data such as information required under Law 68/99). The Company will process such data assuming they refer to the applicant who submitted them. The applicant therefore indemnifies the Company against any claim or request for damages that may be brought by third parties whose personal data were entered unlawfully.
Data provided for product orders, either for in-store pickup or home delivery via third-party services. For in-store pickup, only name and phone number are required. For home delivery, the data are provided directly to the delivery platform, which acts as an independent Data Controller. Pathos will retain the customer’s name and email for its legitimate interests (see paragraph 4).
Browsing data: This refers to personal data collected automatically by the Website’s IT systems, whose transmission is implicit in internet communication protocols. Although collected for statistical purposes and not to identify users, such data could allow identification through processing and association with data held by third parties. These may include:
IP addresses, domain names, browsing data, and other information related to user interaction with the Website;
URI (Uniform Resource Identifier) addresses of requested resources, request time, method used, file size obtained in response, status code of the server response, and other parameters regarding the user’s operating system and IT environment;
Device/computer data (browser type, unique device code, language, OS, referring webpage);
Name of the Internet Service Provider (ISP).
Cookies: Please refer to the Cookie Policy available at: https://www.laprosciutteria.com/privacy-policy/.
2.2. With regard to customers and suppliers, the Company processes identification and contact data (name, surname, residential address, email address, phone number), necessary for the execution of contracts and related obligations.
3 – FOR WHAT PURPOSES DO WE PROCESS YOUR DATA?
3.1. Data collected through the WEBSITE are used for the following purposes:
Proper execution of services offered on the Website as described in the terms of use;
Processing of orders;
Sending of commercial communications regarding the Company’s products;
Responding to information requests;
Monitoring and analysis of aggregated or anonymized data to verify traffic and IT infrastructure usage, improve performance and system functionality, and resolve technical issues;
Compliance with legal obligations;
Establishing, exercising, or defending legal claims.
3.2. For customers and suppliers, personal data are processed exclusively for:
Proper and complete execution of contractual obligations;
Compliance with legal obligations, including tax requirements;
Establishing, exercising, or defending legal claims.
3.3. For job applicants, personal data are processed solely to assess the application and the possibility of establishing an employment or collaboration relationship.
4 – ON WHAT LEGAL BASES AND EXEMPTIONS DO WE PROCESS YOUR DATA?
Processing of personal data for the purposes above is lawful where one of the legal bases under Article 6(1) GDPR applies:
Art. 6(1)(b): performance of a contract or pre-contractual measures;
Art. 6(1)(c): compliance with legal obligations;
Art. 6(1)(f): legitimate interests of the Controller. In line with the GDPR, legitimate interests constitute a valid legal basis whenever the data subject can reasonably expect such processing without prejudicing their rights and freedoms. In particular, this includes informing the data subject via email about products of potential interest based on past purchases (pursuant also to Art. 130, paragraph 4 of Legislative Decree No. 196/2003). The data subject may at any time opt out by sending a request to: comunicazione@laprosciutteria.com.
Additionally, processing may be justified under exemptions in Article 9(2) GDPR, including:
Art. 9(2)(f): establishing, exercising, or defending legal claims;
Art. 9(2)(g): processing necessary for reasons of substantial public interest under EU or Member State law, such as recruitment, employment, and termination of employment relationships, pursuant to Art. 2-sexies(2)(dd) of the Italian Privacy Code.
A summary table linking purposes and legal bases is provided below 
