This communication is made available to you – also pursuant to art. 13 of the European Regulation 2016/679 on the protection of personal data (“Regulation” or “GDPR”) and Legislative Decree 30/06/2003 no. 196 (“Privacy Code”), as amended and supplemented by Legislative Decree 101/2018, and subsequent amendments and additions – by Aromatica s.r.l. with registered office in Gorgonzola MI, in its capacity as Data Controller of your personal data.

The purpose of this Information Notice is to inform you about the way in which your personal data will be processed.

Type of data processed

The website offers content of an informative and, at times, interactive nature. While browsing the site, Aromatica s.r.l. may, therefore, acquire information about the visitor in the following ways:

Navigation data

The computer systems and software procedures used to operate this website acquire, during their normal operation, certain personal data whose transmission is implicit in the use of Internet communication protocols. This category of data includes: IP addresses, the type of browser used, the operating system, the domain name and addresses of websites from which access was made, information on the pages visited by users within the site, the time of access, the length of time spent on the individual page, internal path analysis and other parameters relating to the user’s operating system and computer environment.

Further categories of data

These are all those personal data provided by the visitor through the site, for example:

• Filling out a form through which to request information on the goods offered and/or a contact request
• Writing to the e-mail addresses indicated on our website to request information
• By accessing a restricted area and/or a service
• Filling in a form to receive our newsletter and marketing communications Purpose of processing, the data provided are processed for the following purposes:
• To provide the good and/or service requested by the user, to manage the contracts finalised by the user, to carry out the relevant administrative, accounting, fiscal and legal fulfilments, and to process the requests forwarded by the user. The processing operations carried out for these purposes are necessary for the fulfilment of contractual obligations or as requested by the data subject, and do not require a specific consent.
• To measure the user experience of our platforms, products and services we offer and to ensure the correct functioning of the web pages and their content. The processing carried out for these purposes is based on a legitimate interest of the Data Controller
• Send commercial communications relating to promotions and/or offers, in the interest of the Controller; processing for these purposes is carried out with the specific consent provided by the user

Sharing and transfer of personal data

The data collected by Aromatica s.r.l. will only be shared for the purposes listed above; we will not share or transfer your personal data to third parties other than those listed in this Privacy Policy. In the course of our activities and exclusively for the same purposes as those listed in this Privacy Policy, your personal data may be transferred to the following categories of recipients:

• The company staff
• Service providers, (e.g. IT system providers, cloud service providers, database providers and consultants)
• Public Administrations for legal purposes
• Any public and/or private entity to which it may be necessary to communicate your personal data in connection with the above-mentioned purposes

The updated list of Data Processors is available at the Data Controller’s registered office and will be provided upon written request. Aromatica s.r.l. may need to transfer your personal data to countries outside the European Union/European Common Area (EEA), to so-called “third countries”. Such transfers to third countries may include all of the above processing activities.

This Privacy Policy also applies in the case of data transfer to third countries where the level of data protection differs from that in the European Union: any transfer of personal data to third parties will only be carried out after informing you and, where required, after receiving your consent.

Any transfer of data to countries other than those for which the European Commission has taken an adequacy decision shall take place on the basis of agreements using standard contractual clauses adopted by the European Commission or other appropriate guarantees in accordance with applicable law.

Personal Data Protection

Aromatica s.r.l. has implemented appropriate technical and organisational measures to provide an adequate level of security and confidentiality for personal data.

These measures take into account:

• State-of-the-art technology
• Costs of implementation
• Nature of the data
• The risk of treatment

The purpose is to protect them from accidental or unlawful destruction or alteration, accidental loss, unauthorised disclosure or access, and other forms of unlawful processing. Moreover, when handling your personal data, Aromatica s.r.l.:

• Collects and processes personal data that are adequate, relevant and not excessive, as required to fulfil the above purposes
• It ensures that these personal data remain up-to-date and accurate.

Data retention periods

Without prejudice to your right to object to the processing of your personal data and/or request its deletion, Aromatica s.r.l. will retain your personal data only for as long as is necessary to achieve the purpose for which it was collected and received, or to comply with legal or regulatory requirements.

When this period expires, your personal data will be removed from Aromatica’s active systems. Your statutory rights associated with the personal data that Aromatica s.r.l. processes are:

• Right to rectification. You may obtain rectification of personal data concerning you or communicated to us by you. Aromatica s.r.l. makes reasonable efforts to ensure that the personal data in its possession is accurate, complete, up-to-date and relevant, based on the most recent information available
• Right to limitation. You may obtain a restriction on the processing of your personal data if:

1. You challenge the accuracy of your personal data during the period in which Aromatica s.r.l. must verify its accuracy
2. The processing is unlawful and you request a restriction of the processing or deletion of your personal data
3. There is no longer any need for Aromatica s.r.l. to retain your personal data, but you need it to ascertain, exercise or defend your rights in court, or
4. You object to the processing while Aromatica s.r.l. checks whether its legitimate reasons prevail over yours

• Right of access. You may request from Aromatica s.r.l., information on the personal data stored about you, including information on what categories of personal data Aromatica s.r.l. owns or controls, for what purpose they are used, where they were collected (if not directly from you), and to whom they may have been disclosed
• Right to portability. Following your request, Aromatica s.r.l. will transfer your personal data to another data controller, if technically possible, provided that the processing is based on your consent or is necessary for the performance of a contract
• Deletion right. You may obtain from Aromatica s.r.l. the deletion of your personal data if:

1. Personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed
2. You have the right to object to further processing of your personal data and exercise this right to object
3. Personal data have been unlawfully processed
4. You object to the processing while Aromatica s.r.l. checks whether its legitimate reasons prevail over yours
5. Unless the processing is necessary because of legal or statutory obligations or for the establishment, exercise or defence of legal claims

• Right to object. You may object to the processing of your personal data at any time, provided that the processing is not based on your consent but on the legitimate interests of Aromatica s.r.l. or third parties. In such cases, Aromatica s.r.l. will no longer process your personal data unless you can demonstrate compelling legitimate grounds, an overriding interest in the processing or the establishment, or the exercise or defence of a legal claim. Should you object to the processing, please state whether you wish to delete your personal data or to restrict its processing.
• Right to lodge a complaint. In the event of an alleged violation of applicable privacy laws, you may file a complaint with the competent authorities in your country or in the place where the alleged violation occurred. Changes to this Privacy Policy Any future changes or additions to the processing of personal data as described in this Privacy Policy will be notified through the usual communication channels used by Aromatica s.r.l. (e.g. through the website).

Data Controller and Data Protection Contact Person

To exercise your rights under Articles 15 et seq. of the GDPR, you may contact the Data Controller, Aromatica s.r.l. with registered office in Gorgonzola (MI). The Contact Person for the protection of personal data is the Administration Office, E-mail info@zaffy.it