1. Data Controller

The Data Controller isAzienda Agricola Badolato Nicola, with registered office at Via Sant’Agostino, 20 - 89841 Presinaci di Rombiolo (VV) | ITALY, VAT No.: 02244710790. For any request for clarification, exercise of rights or information regarding the protection of your personal data, you can contact the Data Controller in writing at the email address: info@oleificiobadolato.it or by calling +39 338 289 6313.

2. Types of Data Collected

The e-commerce application collects, directly or through third parties, various categories of personal data:

• Identification and contact data: First name, surname, telephone number, email address and postal address, provided voluntarily through the contact form or during the purchase process.
• Billing and payment data: Tax data and transaction details. Please note that sensitive payment card data are not stored on our servers but are processed directly by the integrated secure payment networks (PayPal/Stripe).
• Browsing data: IP addresses, device identifiers, browser information and website usage data collected through technical and analytics cookies.

3. Purposes and Legal Basis of Processing

Your personal data are processed exclusively for the following purposes:

• Performance of the sales contract (Art. 6.1.b GDPR): Order management, packing, home delivery of the oil purchased and processing of the related invoicing.
• Responding to user requests (Art. 6.1.b GDPR): Processing the data entered in the contact form (requests for information on products, orders or other questions) to provide you with appropriate assistance.
• Compliance with legal obligations (Art. 6.1.c GDPR): Compliance with civil, tax, accounting and security regulations imposed by the Italian State and the European Union.
• Legitimate interest of the Data Controller (Art. 6.1.f GDPR): Optimising website performance and preventing online fraud at checkout.

4. Processing Methods and Security Measures

Personal data are processed using electronic, online and paper-based tools, with procedures strictly related to the purposes indicated above. The Data Controller adopts appropriate technical and organisational security measures (including the use of the HTTPS protocol and encryption of communication channels) to prevent unauthorised access, loss, disclosure, alteration or unlawful destruction of your personal data.

5. Recipients and Disclosure of Data

The personal data collected will never be disclosed or sold to third parties for marketing purposes. To ensure the proper functioning of the service and the fulfilment of orders, data may be disclosed to third parties appointed, where necessary, as Data Processors pursuant to art. 28 of the GDPR:

• Transport companies and express couriers responsible for the physical delivery of our products.
• External tax, legal or accounting advisers for the fulfilment of legal obligations.
• IT service providers, web hosting and agencies responsible for the technical maintenance of the e-commerce infrastructure.

6. Data Retention Period

The User's personal data are kept for the time strictly necessary to fulfil the purposes for which they were collected. Specifically: data relating to commercial transactions and invoicing will be kept for a mandatory period of 10 years in accordance with current Italian civil and tax law; data entered in contact forms will be deleted or anonymised once the assistance and response procedures have been completed, and in any case no later than 12 months after submission.

7. Rights of the Data Subject

At any time, each User may exercise the rights provided for by articles 15-22 of EU Regulation 2016/679 by contacting the Data Controller directly. Specifically, you have the right to:

• Access your personal data and obtain a copy (Art. 15).
• Request the rectification of inaccurate data or the completion of incomplete data (Art. 16).
• Obtain the erasure of your data ("right to be forgotten") in the cases provided for by law (Art. 17).
• Request the restriction of processing in specific circumstances (Art. 18).
• Obtain the portability of your digital data in a structured, readable format (Art. 20).
• Object at any time to processing for reasons relating to your particular situation (Art. 21).

You also have the right to lodge a formal complaint with the competent national supervisory authority (Garante per la protezione dei dati personali - piazza Venezia n. 11, 00187, Rome, official website: www.garanteprivacy.it) if you believe that the processing infringes current legal provisions.