INFORMATION ON THE PROCESSING OF PERSONAL DATA

pursuant to Article 13 of Regulation (EU) 679/2016 (the “GDPR”)

This page describes the features of the processing of personal data of users (the “Users”) of the website https://www.oltree.it/ (the “Site”).

The information on this page does NOT apply to third-party sites, apps and content of any kind, even if accessible from the Site by clicking on links therein.

In such cases, the data protection provisions of such third parties may apply, which may differ from these and which we advise you to consult before disclosing any data.

1 Data controller

For the purposes of this policy (the “Policy”), the data controller is Oltree S.r.l., with registered office in Viale Giuseppe Mazzini, 8, 41058 (MO), tax code and VAT number 04019200361 (“Oltree” or the “Controller”).

If you have any doubts about how the Controller processes personal data, you can always contact Oltree:

to the e-mail address amministrazioneltree.it;
at viale Giuseppe Mazzini, 8, 41058 (MO).

2 Methods of data collection and categories of data processed

Navigation data automatically collected by the Site: access and navigation data

Whenever Users access the Site, the computer systems and software procedures used to operate the Site acquire, in the course of their normal operation, access and navigation data (e.g. information on the browser used by the User, pages visited, date, time and duration of each visit, as well as other parameters relating to the User’s operating system and computer environment – the “Navigation Data”).

Data communicated by Users: registration and contact data

Through the appropriate sections of the Site (e.g. the registration form, contact form, payment form), Users can register on the Site, request to contact Oltree and finalise payment transactions through the Site, by entering the following personal data: first name, last name, email address, telephone number, date of birth, address of residence or domicile and billing address (the “Provided Data”).

Navigation Data and Provided Data, jointly referred to as Personal Data.

Cookies

The Site uses computer techniques for the direct acquisition of personal data identifying the User consisting of “strings of code”: “cookies”.

For all information on the cookies active on the Site and the related processing of personal data and their characteristics click here !

3 Purpose and legal basis of the processing

Navigation Data will be used:

in order to monitor the proper functioning of the Site;
in an anonymous and aggregate form, for statistical purposes related to understanding how the Site is used by Users, to improve ease of access and increase its attractiveness; and
to detect any technical problems as soon as possible.

These processing operations find their legal basis in the legitimate interest of the Controller in the improvement of its digital services, and are compatible with the position of the data subjects since: (a) monitoring the operation of the Site and the statistical data related to its use does not involve direct identification; and (b) the Controller’s interest reasonably appears to be also that of the Users, who will thus be able to benefit from an increasingly high-performance and optimized Site.

The Provided Data by Users will be used exclusively for:

allow the User to register on the Site;
allow the purchase of products through the Site;
to respond to any requests that Users may make with regard to Oltree’s products;
enable the Controller to fulfil its legal obligations;
guarantee the right of defense of the Controller in judicial or arbitration proceedings in respect of any disputes relating to the performance of contracts concluded with the Controller;

The legal basis for the processing of such Data are: (a) the need to perform contractual and pre-contractual obligations at the request of the data subject or activities; (b) to comply with the related legal obligations incumbent on the Controller; and (c) the legitimate interest of the Controller in the defense of legal claims. Legitimate interest which, in balancing the interests of the parties, does not imply a violation of the rights and freedoms of the User, judicial defense being a right guaranteed by the legal system.

With the exception of the Data whose provision is only optional when registering on the Site, any refusal by the User to provide the remaining Data will make it impossible for the Controller to complete the User’s registration on the Site and allow the User to purchase its products.

send by e-mail, communications of a commercial, promotional and advertising nature relating exclusively to the products offered by Oltree through the Site or products similar to those already purchased or used by the User (so-called soft spam).

The legal basis of the processing for soft spam purposes is the legitimate interest of the Controller to keep its customers informed and updated on the offer of new products from time to time available on the Site, as well as on promotions and/or initiatives promoted by Oltree. This legitimate interest is balanced and compatible with the position of the data subjects as it is reasonable to assume that those who purchase an Oltree branded product through the Site are interested and expect to receive updates on Oltree’s products.

The provision of the above-mentioned Personal Data is necessary as they are indispensable for the performance of the purposes for which they are processed.

analysing the User’s behaviour while browsing the Site, as well as the User’s purchase data and preferences in order to develop reference clusters of Users purchasing products through the Site (profiling);
carry out marketing activities by sending newsletters concerning the Controller’s products and/or generic offers to all Users; and
carry out customized marketing activities with respect to the clusters of Users processed as a result of the Profiling activity.

The legal basis for such processing is the User’s consent given via the box at the end of this notice.

Failure to consent to the use of the data referred to in (vii), (viii) and (iv) will not affect the performance of a contract or the taking of pre-contractual measures at the request of the User. The consent given may be revoked at any time by the data subject in a manner similar to that provided for its provision, without prejudice to the lawfulness of the processing based on the consent prior to the revocation.

4 Recipients of Personal Data

Personal Data will be communicated to and may be known by: (i) employees and/or collaborators in any capacity of Oltree, duly instructed and/or designated to the processing; (ii) partner companies or in any way affiliated to the Controller for the fulfilment of the above purposes; as well as (iii) third parties who provide ancillary or instrumental services to the activities of Oltree, such as those related to the development, delivery, maintenance and operational management of the Site, specifically appointed as data processors.

A list of the persons appointed as responsible parties can be requested from the Controller via the contact addresses indicated in this Policy.

5 Place of processing and transfer abroad of Personal Data

Users’ Data will be processed at Oltree’s premises and Data will be stored on servers and/or archives located within the European Union or in countries that provide adequate guarantees of personal data protection. The Data may be transferred to third countries if the service providers used by the Controller are located outside the European Union (for example, cloud service providers).

In the case of transfers of Data outside the European Union, the Controller will adopt the appropriate safeguards set out in Article 46 of the GDPR and, specifically, the Standard Clauses prepared by the European Commission for the transfer of personal data outside the European Union.

6 Processing methods, security measures and period of retention of Personal Data

Personal Data will be processed either in paper form or by electronic, digital or automated means, using systems that ensure their protection, security and confidentiality.

The Controller has also adopted specific and adequate logical, legal, organisational and technical security measures to prevent the loss of Personal Data, unlawful or unauthorised use thereof and unauthorised access thereto.

Navigation Data – which do not allow the identification of Users – do not persist for more than 1 (one) week and are deleted immediately after their aggregation (except in the event of the need to ascertain criminal offences by the competent Judicial Authority).

The Provided Data will be processed for the purpose of soft spam in a form that allows the identification of the User for only as long as is strictly necessary to achieve the purposes for which they were collected and, in particular, for a period of 6 (six) months from the last communication sent to the User.

The Provided Data will be kept for longer periods of time where necessary: (i) to execute contractual/pre-contractual measures and for the duration of the eventual collaboration with the Controller; (ii) to fulfil statutory and/or legal obligations; as well as (iii) to ensure the judicial protection of the Controller’s rights, in compliance with the ordinary limitation periods.

The Provided Data processed for the purposes set forth in (vii), (viii) and (ix) of Section 3 shall be retained for a maximum period of 24 (twenty-four) months after subscription or, if applicable, since the last interaction with the newsletter content.

7 User rights

Users, as data subjects (i.e., subjects to whom the Data refer), are holders of rights conferred by the GDPR. In particular, pursuant to Articles 12-23 of the GDPR, data subjects have the right to request and obtain, at any time, access to their personal data, information on the processing carried out, rectification and/or updating of personal data, erasure and minimization of data processing. They also have the right to object to the processing, to request data portability (i.e. to receive personal data in a structured, machine-readable format) and to request not to be subject to decisions based solely on automated processing (including profiling). Finally, data subjects, where they have given their consent, always have the right to withdraw their consent at any time (this, in any case, will not affect the lawfulness of processing carried out on the basis of the consent given before the revocation) and to lodge a complaint with a supervisory authority (in Italy: the Garante per la Protezione dei Dati Personali).

The above rights may be exercised at any time by simple request to Oltree, to be transmitted:

by e-mail, to the e-mail address amministrazioneltree.it ;
by mail, to the address Viale Giuseppe Mazzini, 8, 41058 (MO).

For further information or clarification of the rights mentioned, please contact Oltree at the same contact details.

* * * * * * *

Oltree may amend this notice to adapt it to future expansions or changes to the Site.

Information updated on 05/30/2023.

Privacy Policy