Privacy Policy

Pursuant to Article 13 of Regulation (EU) 679/2016 (hereinafter the “GDPR”), we wish to inform you that the personal data of all individuals who, as users, access and make use of this Website (hereinafter, respectively, the “User” and the “Website”) will be processed by Sperlari S.r.l., Via Milano 16, 26100 Cremona, Tax Code and VAT No. 01350470199 (hereinafter the “Company”), in its capacity as Data Controller (hereinafter also the “Controller”), by manual, paper-based, electronic or digital means.

In its capacity as Data Controller, the Company stores Users’ personal data on a dedicated cloud server located in Europe and carries out all other processing activities through specifically appointed personnel, or through any external contractors engaged for maintenance operations. The database is accessible only to authorized parties and through procedures that ensure its protection and confidentiality, thanks to the adoption of security measures designed to prevent data loss, unlawful or improper use, and unauthorized access.

Once these periods have expired, all data will be deleted or anonymised, except for any data that must be retained for a longer period pursuant to statutory obligations. Should the User wish to obtain further information regarding the retention periods applicable to their data for a specific processing purpose, they may submit a request to the DPO using the email address provided under Article 4 below.

In particular, the Company may collect and use the following data:

Data that may be provided and/or acquired when the User interacts with the Company:

• Personal contact details (for example, first name, last name, physical address, tax and banking information, telephone number, email address, and any information the User provides regarding third parties);
• User profile information (for example, name, IP address, access ID, username, password and/or security question and answer, and other registration‑related information);
• Employment‑related information (for example, data provided when submitting an online job application or during the hiring process, résumé, cover letter, professional training, professional qualifications, and any other information provided for the purposes of the selection and hiring process);
• Order‑ and product‑related information (for example, details of products the User searches for and orders online or at retail stores, the date and time of such searches, etc.);
• Information describing the User’s characteristics and preferences (for example, age or age range, gender, preferences, date of birth, geographic location, preferred products, hobbies and interests, lifestyle information, etc.);
• User feedback information (for example, information, comments, suggestions, and testimonials voluntarily shared by the User with the Company based on their experience with the Company’s products or services);
• Information relating to content and posts generated by the User (photos, videos, personal stories, or similar content that the User creates or shares with the Company through websites, applications, fan pages, etc.);
• Information regarding allergic reactions and/or other health‑related events occurring in connection with the use of the Company’s products.

Automatically collected data:
The Company may collect data regarding the User’s use of the Company’s websites. Such data is collected automatically through the use of various technologies, including cookies. For information on the use of cookies and the choices available to the User, reference is made to the document available at the link: https://sperlari.it/cookie-policy/.

Data received and collected from other sources:
The Company may obtain information, including personal data, from third parties and from sources other than the Company’s website, such as business partners or advertisers. The Company will combine and process the information and data collected in accordance with this Privacy Notice, the Cookie Policy available at the link above, and the provisions of the GDPR.

Data received from social media and/or advertising partners:
The Company may collaborate with social media platforms and digital advertising partners to facilitate the User’s access to their account (for example, by using the User’s Facebook account) and/or to display advertising for the Company’s products on other websites and social media platforms. In all cases, the Company undertakes to collect and use only the data strictly necessary for the purposes of the processing.

Users’ personal data are collected and processed by the Company for the following purposes:

i. management of any participation in prize promotions, loyalty programs, or other forms of incentive initiatives, including for the purpose of fulfilling contractual obligations undertaken;

ii. any sending of informational, commercial, advertising and/or promotional material relating to the Company’s products through “automated” contact systems (such as SMS and/or email and/or WhatsApp);

iii. collection of data and information in general, and possibly regarding consumer preferences and tendencies, in order to carry out market research and/or obtain a detailed consumer profile, so as to provide an increasingly efficient and personalized promotional and/or advertising information service; the activities relating to this purpose may be carried out through automated means;

iv. administrative and/or accounting purposes;

v. handling of the request(s) submitted by the User to Customer Service.

The Company uses Users’ data in accordance with the choices that the User has freely exercised through their consent at the time of collection or afterwards. In some cases, data may also be processed without the User’s express consent – pursuant to Article 6 of the GDPR – for example, to fulfil contractual obligations or comply with a legal obligation to which the Company is subject, or when the Company has a legitimate interest.

i. the provision of certain types of data is necessary if you intend to participate in any prize promotions, loyalty programs, or other forms of incentive initiatives;

ii. failure to provide such data does not affect the proper use of the Website, but it makes it impossible for the User to participate in the aforementioned activities and/or to follow up on any winnings.

For the pursuit of the purpose referred to in Art. 6, point (ii), of this Privacy Notice:

i. the provision of certain types of data is necessary if you intend to receive informational, commercial, advertising and/or promotional materials relating to the Company’s products through “automated” contact systems and/or via operator-assisted phone calls or regular mail;

ii. failure to provide such data does not affect the proper use of the Website, but it makes it impossible for the User to receive the aforesaid materials in the indicated ways.

For the pursuit of the purpose referred to in Art. 6, point (iii), of this Privacy Notice:

i. the provision of certain types of data is necessary if you intend to allow the Company to create increasingly detailed consumer profiles, in order to offer an increasingly efficient and personalized promotional and/or advertising information service;

ii. failure to provide such data does not affect the proper use of the Website, but it makes it impossible for the User to benefit from a promotional and/or advertising information service based on their preferences and tendencies.

For the pursuit of the purpose referred to in Art. 6, point (iv), of this Privacy Notice:

i. the provision of certain types of data is mandatory in order to allow the Company to fulfil its contractual obligations and/or its statutory administrative‑accounting obligations;

ii. failure to provide such data may affect the proper use of certain services offered by the Website.

For the pursuit of the purpose referred to in Art. 6, point (v), of this Privacy Notice:

i. the provision of certain types of data is necessary if you intend to enable Customer Service to properly follow up on the request submitted by the User. In the request submitted to Customer Service, the User must not include sensitive data, such as those relating to health status (e.g., any allergies or conditions such as, by way of example, diabetes, celiac disease…), ethnicity, religious faith, sexual orientation, political opinions, trade union membership, or other personal confidential aspects. Should the User include such data, they will be immediately deleted.

ii. failure to provide such data does not affect the proper use of the Website, but it makes it impossible for the User to receive a satisfactory response to their needs and requests from Customer Service. The inclusion of sensitive data in the request could invalidate and prevent the handling of the submitted request.

i. the provision of consent is not required, since the legal basis of the processing is founded on a legitimate interest of the Company (Art. 6, para. 1, lett. f) GDPR) or on the fulfilment of contractual obligations (Art. 6, para. 1, lett. b) GDPR) or legal obligations (Art. 6, para. 1, lett. c) GDPR);

ii. access to the related services will take place upon the simple provision of the relevant data.

For the pursuit of the purposes referred to in Art. 6, points (ii) and (iii), of this Privacy Notice:

i. the provision of consent is optional, and the User is given the possibility to make a choice at the time of registration or subsequently. However, should the User wish to access the related services, they must provide their consent;

ii. the legal basis of the processing is therefore consent (Art. 6, para. 1, lett. a) GDPR);

iii. the failure to provide consent does not, in any case, prejudice the User’s ability to participate in any prize promotions, loyalty programs or other forms of incentive initiatives, by providing the Company with the data necessary for such purposes.

The data will also be disclosed to PROMOSERVICE – PARMA S.R.L., with registered office in Viale Mentana 92, 43121 Parma (PR), Tax Code and VAT No. 01864090343, REA Parma: 183805. PROMOSERVICE – PARMA S.R.L., appointed as Data Processor, will process the User’s data for purposes related to the management of the consumer service, strictly to the extent necessary to handle Users’ requests, and will proceed to delete the data once such requests have been fulfilled, as well as for the purposes referred to in point 6, (v), of this Privacy Notice, in full compliance with the instructions provided by the Company.

The data will also be disclosed to SALESFORCE.COM ITALY S.R.L., with registered office in Piazza Filippo Meda 5, 20121 Milan (MI), Tax Code and VAT No. 04959160963, REA: 1785731. SALESFORCE.COM ITALY S.R.L., appointed as Data Processor, will process the User’s data for Customer Relationship Management (CRM) activities, aimed at managing and improving customer relations, analysing preferences and purchasing behaviour, personalising communications and commercial offers, as well as for the purposes referred to in point 6, (ii) and (iii), of this Privacy Notice, in full compliance with the instructions provided by the Company.

The User’s data, provided in connection with promotional activities carried out by one of the Company’s brands, may also be disclosed to the other brands of the group operating in the same product categories, for the promotion of their respective products and services. Such data disclosure will be limited to the European territory and carried out in compliance with applicable legislation.

The User’s data will not be disseminated.

For the complete list of data processors appointed for the purposes referred to in point 6 of this Privacy Notice, the User may send a request to the following email address: [email image in original text].

The User’s data may also be disclosed for legal purposes in order to cooperate with law enforcement authorities and for other legal reasons. In particular, data sharing may occur in connection with legal proceedings, compensation claims, investigations, orders or injunctions, the exercise of legal rights, security reasons or similar circumstances.

In accordance with what is permitted by law, the Company may share (or receive) Users’ data in the event of an acquisition, merger, transfer, reorganization, insolvency proceedings, including bankruptcy, or other similar events involving Sperlari S.r.l. The Company will adopt all necessary measures to ensure that the data are handled and processed in compliance with this Privacy Notice and the GDPR.

In particular, the User has the right to:

• access the personal data concerning them and obtain all information regarding the related processing as listed by the GDPR, as well as obtain a copy of such data;
• obtain the rectification and, respectively, the completion of inaccurate or incomplete data;
• obtain the erasure of their data in the cases provided for by Article 17 of the GDPR;
• obtain the restriction of processing in the cases provided for by Article 18 of the GDPR;
• receive their personal data from the Data Controller in a structured, commonly used and machine‑readable format, and transmit such data to another data controller (so‑called portability);
• object to the processing of personal data concerning them carried out by automated means, including profiling;
• withdraw their consent to the processing of personal data at any time, with effect for the future;
• lodge a complaint with the supervisory authority regarding the processing of data concerning them, pursuant to Article 77 of the GDPR.

For information and clarifications regarding the processing, the User may contact the Data Protection Officer, indicated in point 3 above, at the following address: dpo@sperlari.it

The Company processes personal data in individual cases for the purpose of carrying out direct advertising. If the User does not wish to receive any advertising, they have the right to object at any time to the processing of personal data concerning them for such purposes; this also applies to profiling, insofar as it is related to such direct advertising.

The Company will no longer process the data for direct advertising purposes if the User objects to their processing for these purposes.

Registration is permitted only to Users who are of legal age or to Users who have reached 16 years of age, or the different minimum age established by subsequent amendments and/or additions to the GDPR made by Italian law.

Where the minor is below the age provided for by the applicable legal provisions, registration is permitted only if and to the extent that consent is given or authorised by the holder of parental responsibility.

The Company also encourages the registration of the holders of parental responsibility of underage registered Users, thereby allowing them to benefit from the same services and to remain informed at all times about the initiatives made available by the Company to minors, while also verifying their consistency with their own expectations and educational models and approaches. In any case, for services requiring mandatory consent, minors are prohibited from providing such consent, and the Company will not proceed with the relevant service unless consent is given by the holder of parental responsibility.