SECTION I

INFORMATION ON THE PROCESSING OF PERSONAL DATA PURSUANT TO ARTICLES 13 AND 14 OF REGULATION (EU) 2016/679

Pursuant to Regulation (EU) 2016/679 on the protection of personal data, hereinafter also referred to as the “GDPR”, this page provides information on the processing of personal data relating to individuals who visit the OROGEL website (hereinafter also referred to as the “Website”) and access its content, or who otherwise contact OROGEL through its toll-free number or social media networks.

This information does not apply to other websites, pages or online services that may be accessed through hyperlinks (“links”) available on the Website.

1) DATA CONTROLLER

The Data Controller is OROGEL Società Cooperativa Agricola, registered with the Companies Register of Romagna – Forlì – Cesena and Rimini under registration and tax code no. 00800010407, with registered office at Via Dismano 2830, Cesena (FC), Italy, and certified email (PEC) address orogelcoop@pec.it.

Contact details: email privacy@orogel.it – telephone +39 0547 3771.

The Data Protection Officer (DPO) is STUDIO PACI & C. S.r.l., represented by its contact person Dr Luca Di Leo.

Contact details: email dpo@studiopaciecsrl.it – telephone +39 0541 1795431.

2) CATEGORIES OF DATA PROCESSED, PURPOSES AND LEGAL BASIS FOR PROCESSING

For the purposes of this Privacy Policy, “personal data” means any information relating to an identified or identifiable natural person, directly or indirectly (Article 4(1) GDPR); “data subject” means the natural person (Website user) to whom the data relates; and “processing” means any operation or set of operations performed on personal data or sets of personal data, whether or not by automated means (Article 4(2) GDPR).

The personal data processed by the Data Controller as a result of browsing the Website is described below.

a) Browsing data

The IT systems and software procedures used to operate the Website acquire, as part of their normal operation, certain personal data whose transmission is implicit in the use of Internet communication protocols.

This category of data includes the IP addresses or domain names of electronic devices (PCs, smartphones or tablets) used by Users, the URI/URL (Uniform Resource Identifier/Locator) addresses of the requested resources, the time of the request, the method used to submit the request to the server, the size of the file received in response, the numerical code indicating the status of the server response (successful, error, etc.), and other parameters relating to the data subject’s operating system and IT environment.

This data, which is necessary to browse the Website and access its content, is also processed by the Data Controller in order to:

obtain anonymous and aggregated statistical information on the use of the Website (most frequently visited pages, number of visitors by time of day or day, geographical areas from which visitors originate, etc.);

verify the proper accessibility and usability of the content provided through the Website;

prevent or combat potential cybercrime and fraudulent use of the functions available on the Website, including for the purpose of tracing and reconstructing security incidents.

For the purposes described above, the legal basis for processing by the Data Controller is the performance of pre-contractual measures taken at the request of the data subject or the performance of a contract to which the data subject is party, pursuant to Article 6(1)(b) GDPR.

b) Data collected through cookies and other tracking technologies

The Website uses session cookies, i.e. information sent by servers to Users’ devices that enables Users to access the available functions, makes browsing easier and faster and temporarily stores certain information and the pages visited (technical cookies).

The Website also uses other types of cookies that make it possible to monitor Users’ browsing behaviour and preferences (analytics and profiling cookies).

Full details of the data collected through cookies and how they are managed are provided in the dedicated notice available via the “Cookie Policy” link.

For the purposes described above, the legal basis for processing by the Data Controller is:

for technical cookies: the performance of pre-contractual measures taken at the request of the data subject or the performance of a contract to which the data subject is party, pursuant to Article 6(1)(b) GDPR;

for analytics and profiling cookies: the data subject’s consent to the processing of personal data pursuant to Article 6(1)(a) GDPR, given by clicking “accept all cookies” or by managing the available preferences by clicking “customise”, in accordance with the “Guidelines on cookies and other tracking tools” attached to Decision no. 231 of 10 June 2021 issued by the Italian Data Protection Authority (Garante per la Protezione dei Dati Personali).

c) Data provided by Users

Completing the forms available on the Website in order to:

a) send messages containing requests for information or assistance;

b) apply for a job;

c) be contacted after completing a product rating form;

d) subscribe to the newsletter and receive personalised commercial communications;

as well as recording a message on the voicemail service associated with the toll-free number shown in the section at the bottom of the Website homepage, entails the processing of personal data provided by Users.

This data is used to respond to the different types of requests submitted and/or forms completed, or to allow Users to provide assessments, comments and/or feedback.

The legal basis for processing by the Data Controller is:

for the purposes referred to under points a), b) and c), the performance of pre-contractual measures taken at the request of the data subject or the performance of a contract to which the data subject is party, pursuant to Article 6(1)(b) GDPR and, where the data subject submits a job application, in accordance with Article 111-bis of Italian Legislative Decree no. 196/2003;

for the purpose referred to under point d), consent to processing pursuant to Article 6(1)(a) GDPR, given by the data subject by selecting the relevant box in the form used to submit data to the Data Controller.

The performance of pre-contractual measures taken at the request of the data subject pursuant to Article 6(1)(b) GDPR also constitutes the legal basis for the Data Controller’s processing of data left by the User on the voicemail service associated with the toll-free number shown in the section at the bottom of the Website homepage.

Further details concerning the processing of data provided by Users are available in Section II of this Privacy Policy.

d) Additional data collected by the Data Controller

Subscription to the newsletter, any request to receive personalised commercial communications, and interaction with Website pages that the User may also reach through social networks as a result of marketing campaigns promoted by the Data Controller and redirecting the User to a specific page (“landing page”), enable the Data Controller to collect additional data beyond that provided directly by Users.

Such data may include, for example, the date and time when emails containing newsletters and commercial communications are opened, content in which recipients show an interest and, consequently, the preferences they demonstrate.

This data is used to establish a relationship with Users aimed at strengthening Orogel’s identity and reputation and to send news and/or information selected on the basis of the preferences demonstrated by Users.

For the purposes described above, the legal basis for processing is consent pursuant to Article 6(1)(a) GDPR, given by the data subject by selecting the relevant boxes in the newsletter subscription form and in the request to receive personalised communications.

Further details concerning the processing of data provided by Users are available in Section II of this Privacy Policy.

3) OPTIONAL PROVISION OF DATA AND WITHDRAWAL OF CONSENT

With the exception of browsing data, which, as stated above, is collected automatically, the provision of personal data is always voluntary and optional. However, failure to provide such data may prevent Users from sending messages or requests for information or assistance, submitting complaints, or submitting unsolicited online applications for employment.

Consent to data processing, where required, is also optional, although it is necessary if the data subject wishes to subscribe to the newsletter and/or receive personalised commercial communications.

The data subject has the right to withdraw consent to processing for both marketing and profiling activities at any time. Consent may be withdrawn easily and free of charge by using the unsubscribe function provided at the bottom of the commercial communications received and/or in relation to profiling, or by sending a communication to privacy@orogel.it.

4) PERSONAL DATA OTHER THAN THAT REQUESTED IN CONTACT FORMS

Since the contact forms available on the Website contain free-text fields and, in some cases, allow files to be uploaded, Users are invited to check the personal data they intend to share and to avoid providing so-called special categories of personal data, i.e. data capable of revealing political opinions, religious or philosophical beliefs, health status, sex life or sexual orientation.

If the Data Controller considers that such data has been provided in error or is not necessary in order to respond to the request received, it will disregard and/or promptly delete such data.

5) PERSONAL DATA RELATING TO OTHER PERSONS (OTHER THAN THE DATA SUBJECT)

For the same reasons described above, contact forms and files submitted as attachments may contain personal data relating to other data subjects. Where a User decides to provide such data, the User assumes full responsibility for doing so, including by obtaining authorisation from the relevant data subject.

6) DATA RETENTION PERIOD

In accordance with the storage limitation principle set out in Article 5 GDPR, data is retained only for as long as strictly necessary to achieve the purposes described above.

In particular:

for activities carried out in performance of a contract or pre-contractual measures taken at the request of the data subject pursuant to Article 6(1)(b) GDPR, data is retained for the duration of the contract or for the time required to perform the pre-contractual measures and is subsequently deleted within a maximum period of 6 months;

for marketing activities carried out on the basis of the data subject’s consent pursuant to Article 6(1)(a) GDPR, data is retained until consent is withdrawn, using the methods indicated in the communications received;

for profiling activities, contact details are retained until consent is withdrawn, while data relating to demonstrated interests is retained for 12 months, after which it will be anonymised and used for aggregated statistical purposes.

This retention period was determined on the basis of a data protection impact assessment carried out pursuant to Article 35 of Regulation (EU) 2016/679, taking into account the Data Controller’s interest in assessing customer appreciation of its products and the effectiveness of activities aimed at increasing such appreciation.

The Data Controller nevertheless reserves the right to retain data for longer than the periods indicated above where necessary to establish and/or defend its rights in legal proceedings, for example in the event of complaints. In such cases, retention periods will be determined by the relevant requirements for legal defence and may correspond to the limitation and forfeiture periods provided for by law.

7) RECIPIENTS OF PERSONAL DATA

Personal data is generally processed by persons expressly authorised by the Data Controller, who may act either under its authority as persons authorised to process personal data or on its behalf and in accordance with its documented instructions as external data processors.

The entities acting as data processors pursuant to Article 28 GDPR and therefore receiving personal data processed through the Website include Linxs S.r.l., provider of development and maintenance services for the Website’s technology platform, and DIennea S.r.l., provider of web marketing services through the MagNews platform.

A complete list of other service providers acting as data processors pursuant to Article 28 GDPR may be requested from the Data Controller using the contact details provided above.

Certain data, including data collected through cookies, is also processed by entities that may act either as data processors — for example, for data collection through forms, such as Facebook — or as independent data controllers as a result of the use of their services, such as Google in connection with reCAPTCHA.

A list of these entities is available in the Website’s Cookie Policy, accessible via the “Cookie Policy” link.

8) SECURITY OF PROCESSING

The personal data processed is protected by specific technical and organisational security measures designed to ensure, on an ongoing basis, confidentiality, integrity and availability, as well as the ability to restore the availability of and access to data promptly in the event of a physical or technical incident.

These measures also address the risks of accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed.

Data transmitted via the Website is protected using SSL encryption of the communication channel. Completion of the contact forms available on the Website is protected by Google reCAPTCHA, which distinguishes between human and automated access in order to prevent automated systems (“bots”) from simulating data submissions intended to compromise the functionality of the Website.

9) TRANSFERS OF DATA TO COUNTRIES OUTSIDE THE EU

As a general rule, the personal data processed is not transferred to countries outside the EU. However, the use of certain types of analytics cookies may result in a transfer to countries outside the EU where the provider is able to re-identify the User.

Orogel implements additional measures to reduce the possibility of User re-identification and to limit the use of personal data to what is actually necessary for the purposes pursued, in accordance with the data minimisation principle.

The use of non-anonymised analytics cookies or profiling cookies, for which the data subject’s consent is required, may also result in transfers to countries outside the EU. Users are therefore invited to consult the privacy policies of the third parties that manage these types of cookies. A list of these parties is provided in the dedicated Cookie Policy available via the “Cookie Policy” link.

Mechanisms designed to safeguard Users in the event of transfers of personal data to countries outside the EU include the existence of an adequacy decision concerning the third country, specific safeguards provided through international agreements, the adoption of specific Standard Contractual Clauses issued by the European Commission, and the adoption of additional safeguards in accordance with EDPB (European Data Protection Board) Recommendation No. 1/2020.

By way of derogation from these safeguards, as provided for under Article 49 GDPR, where there is no contract to which the data subject is party, consent may be relied upon for such transfers.

10) RIGHTS OF DATA SUBJECTS

As data subjects whose personal data is processed, Users may exercise the rights granted by the GDPR (Articles 15 et seq.), subject to the conditions set out therein, including the right to:

request access to, rectification or erasure of their personal data from the Data Controller;

object to the processing of their personal data and withdraw consent, where consent constitutes the legal basis for processing;

request restriction of processing;

exercise the right to data portability;

lodge a complaint with the Supervisory Authority (Garante per la Protezione dei Dati Personali – Italian Data Protection Authority).

For further information and to exercise the rights granted by the GDPR, Users may contact the Data Controller or the DPO using the contact details provided above.

The website of the Supervisory Authority (Garante per la Protezione dei Dati Personali) is:
https://www.garanteprivacy.it/home/docweb/-/docweb-display/docweb/4535524

SECTION II

SPECIFIC INFORMATION ON THE PROCESSING OF PERSONAL DATA PROVIDED BY USERS

RATE A PRODUCT

Using the form displayed in the thank-you message after completing and submitting a product rating form (“Rate a Product”), Users may provide their identification and contact details in order to receive feedback from Orogel regarding the rating they have submitted.

Providing this data is not mandatory. It may be used to provide further information about the product rated, such as suggestions on how to use it as an ingredient in other recipes, or, from Orogel’s perspective, to understand the reasons for a rating below 10, as Orogel has an interest in assessing customer satisfaction in order to offer products that fully meet their needs.

Further information concerning:

a) the legal basis for this processing activity;

b) the period for which the Data Controller retains the data; and

c) the rights of Users as data subjects

is available in Section I of this Privacy Policy above.

TOLL-FREE NUMBER

The toll-free number displayed in the footer, i.e. the section at the bottom of the Website homepage, is intended to make it easier for Users to contact Orogel to request information, advice and/or suggestions concerning Orogel products.

The number may also be used to submit reports, comments or complaints.

When calling this number, Users are asked to leave a voicemail message containing the information required for Orogel to contact them or handle any report and/or complaint.

Even where no message is recorded or no data is provided, the Data Controller collects the date and time of the call and the telephone number associated with the device from which the data subject called.

Data voluntarily provided and/or otherwise collected by the Data Controller is subsequently processed to respond to voicemail messages or, where the data subject has not left a message, to contact the data subject in order to determine whether they have any needs that were not explicitly communicated.

Following prior notice, conversations with an operator, particularly those relating to the handling of complaints, may be recorded where necessary for the establishment or defence of the Data Controller’s legal rights in judicial proceedings.

For the purposes described above, the legal basis for processing by the Data Controller is the performance of pre-contractual measures or a contract pursuant to Article 6(1)(b) GDPR.

A further legal basis is compliance with a legal obligation pursuant to Article 6(1)(c) GDPR in connection with legal defence in the event of a complaint or dispute.

Further information concerning the contact details of the Data Controller and DPO, the data retention period, recipients and data subjects’ rights is available in Section I of the Website Privacy Policy.

CONTACTS

When using the “Contacts” form, Users are asked to provide identification data (first and last name) and contact details (email address), as well as their province and a telephone number, although the latter is optional.

Users are also asked to state the reason for contacting Orogel in the “message” field and, when completing the form dedicated to consumers or Food Service customers, to select the relevant area of interest in order to receive a tailored response.

More specifically:

• by selecting “Where to find our products”, the personal data provided is processed to provide information, based on the province indicated, about the city in which Orogel products can be found, or to respond to requests and/or reports included in the message;
• by selecting “Allergen information”, the personal data provided is processed to provide information about products and/or their ingredients that may cause allergic reactions, disorders or adverse effects in susceptible individuals. In such cases, the data subject is asked not to specify the reasons for the request, thereby avoiding the provision of health-related data. If such data is provided, it will be deleted immediately by the Data Controller as it is not necessary in order to provide the requested information;
• by selecting “Careers”, the personal data provided is processed to provide the information requested in the message. To apply for a job, however, the data subject may use the dedicated form available in the “Work with us” section on the Website homepage, where a specific privacy notice concerning the data requested and processed by Orogel for this purpose is available;
• by selecting “Reports”, the personal data provided, together with any other information included in the message, is processed to respond to the data subject or contact them to obtain further details necessary to address the report, which may constitute a complaint;
• by selecting “Other”, the personal data provided is processed to respond to any requests included in the message.

Further information concerning a) the legal basis for this processing activity, b) the period for which the Data Controller retains the data and c) the rights of Users as data subjects is available in Section I of this Privacy Policy above.

NEWSLETTER SUBSCRIPTION – MARKETING ACTIVITIES

By entering the personal data (identification and contact details) requested in the “Subscribe to our newsletter” form, the User declares that they have read this Privacy Policy, that they are over 16 years of age and that they consent, on an optional basis, to the processing of their personal data for marketing purposes.

In addition to the data provided by the User, the Data Controller also collects the date and time the form was submitted, the page from which the User arrived and the IP address of the device used to record consent.

The data provided and otherwise collected by the Data Controller is used to send periodic email communications containing tips on how to use Orogel products and/or recipes, as well as information about new products, events and promotions for marketing purposes.

Further information concerning a) the legal basis for this processing activity, b) the period for which the Data Controller retains the data and c) the rights of Users as data subjects is available in Section I of this Privacy Policy above.

NEWSLETTER SUBSCRIPTION – PROFILING ACTIVITIES

By entering the personal data (identification and contact details) requested in the “Subscribe to our newsletter” form and also selecting the box “I would like to receive personalised communications from Orogel based on my interests”, the User declares that they have read this Privacy Policy, that they are over 16 years of age and that they consent, on an optional basis, to the processing of their personal data for profiling purposes.

In addition to the data provided by the User, the Data Controller also collects the date and time the form was submitted, the page from which the User arrived and the IP address of the device used to record consent.

On the basis of the specific consent given for profiling activities, the Data Controller also collects data and information capable of revealing consumption habits and lifestyles based on the preferences demonstrated by the User when interacting with Website pages and with the content of communications received from the Data Controller.

When combined, this data contributes to defining the User’s profile by assigning the User to clusters, i.e. groups of Users differentiated according to the preferences they have demonstrated. This enables Users to receive personalised communications based on the profile to which they belong.

Further information concerning a) the legal basis for this processing activity, b) the period for which the Data Controller retains the data and c) the rights of Users as data subjects is available in Section I of this Privacy Policy above.

WORK WITH US FORM

By completing and submitting the “Work with us” form, the User provides personal data and other information relating to them in order to submit an unsolicited application for a potential job opportunity.

The information requested, particularly educational qualifications, language and IT skills and previous work experience, enables the Data Controller to assess the applicant’s professional skills and aptitudes.

The data subject is also asked to attach their CV and to provide other data falling within so-called “special categories”, such as membership of protected employment categories. Such data is processed in accordance with Article 9 GDPR and the principles of strict necessity and relevance.

Further information concerning a) the legal basis for this processing activity, b) the period for which the Data Controller retains the data and c) the rights of Users as data subjects is available in Section I of this Privacy Policy above.

CHEF IN LINEA

When using the “Contacts” form available in the “Chef in Linea” section, Users are asked to provide identification data (first and last name) and contact details (email address), as well as their province and a telephone number, although the latter is optional.

Users are also asked to state the reason for contacting Orogel in the “message” field and to select their business sector in order to receive a tailored response.

Further information concerning a) the legal basis for this processing activity, b) the period for which the Data Controller retains the data and c) the rights of Users as data subjects is available in Section I of this Privacy Policy above.

Rev. 21/04/2023