Privacy Policy and Personal Data Processing

General information

This Privacy Policy describes how the personal data of users who visit and use the website www.olioamabile.com are processed, pursuant to Regulation (EU) 2016/679 (GDPR) and the applicable Italian legislation on the protection of personal data.

Personal data are processed in accordance with the principles of lawfulness, fairness, transparency, data minimisation and security, solely for specified purposes connected with the services requested by the user or, where required, on the basis of specific consent.

Data Controller

The Data Controller is Amabile Farm of Stefano Amabile, with registered office at Via Roma, 159/C - 91022 Castelvetrano (TP) - SICILIA, VAT number: 02482810815 - Cod. Fisc. MBLSFN78R21C286C. For privacy-related requests or to exercise your rights, you can write to info@olioamabile.it or use the Contact page.

What data we process and for what purposes

The data processed depend on how the user uses the website and on the services requested. The main categories of processing are described below.

Browsing and website security

The IT systems and software procedures used to operate the website automatically acquire certain technical data necessary for its operation, such as the IP address, date and time of the request, requested resource, information about the browser and device, as well as technical data relating to the session. This information is used to ensure the operation and security of the website, prevent abuse and obtain aggregate technical statistics. The legal basis is the legitimate interest of the Data Controller in ensuring the security, continuity and proper operation of the services.

Registration and account management

When the user creates an account, the data provided during registration and any data subsequently added to the profile are processed, such as first name, last name, email address, contact details, shipping and billing addresses and preferences relating to website services. The password is managed and stored in protected form according to the technical measures adopted by the system. Processing is necessary to create and manage the account and to provide the services requested by the user.

Orders and online purchases

To manage an order, including one placed as a guest, the data necessary to conclude and perform the purchase are processed, together with the data required for shipping, service communications and any administrative and tax obligations: for example first name, last name, email, contact details, shipping and billing addresses and any other data requested during checkout.

The legal basis is the performance of a contract or pre-contractual measures requested by the user and, for data that must be retained or disclosed by law, compliance with legal obligations. Data required for an order are not automatically used for promotional purposes: any marketing or profiling activity requires a separate legal basis and, where required, the user's consent.

Requests via the Contact page

When the user voluntarily sends a message through the Contact page, the data entered in the form are processed, such as name, email address, subject and message content, solely to manage and respond to the request. The legal basis is the performance of pre-contractual measures requested by the data subject or, depending on the nature of the request, the legitimate interest of the Data Controller in managing communications received.

Reviews and user-submitted content

If the user submits a product review or other content available on the website, data such as name, email address, review content and technical data such as the IP address may be processed, as necessary for management, moderation, security and abuse prevention. The email address is not made public.

Newsletter and promotional communications

Subscription to the newsletter is optional and is based on the user's consent. The data required for the service, in particular the email address and any first and last name, may be transmitted to MailChimp, used to manage and send communications. Consent may be withdrawn at any time using the unsubscribe link contained in the emails or by contacting the Data Controller.

Meta Pixel and profiling tools

The website uses Meta Pixel (Facebook), a tool that may process data relating to browsing and actions performed on the website for advertising measurement, attribution and retargeting activities. Where these activities require the use of cookies or other non-essential tracking technologies, processing is based on the user's consent and must be activated only after the corresponding choice has been made. Further information is available in the Cookie Policy.

Legal basis for processing

Depending on the purpose, processing may be based on:

• performance of a contract or pre-contractual measures, for accounts, orders, purchases and user requests;
• legal obligations, in particular for administrative, tax and accounting requirements;
• consent, for newsletters, marketing and profiling tools where required;
• legitimate interest, for security, abuse prevention, protection of rights and technical management of the website, while respecting the rights and freedoms of the data subject.

Provision of data

Providing the data marked as mandatory in the forms is necessary to supply the requested service. Failure to provide such data may prevent account creation, order processing, shipping or a response to a request. Data requested for newsletters and promotional purposes are optional, and refusal to provide consent does not prevent purchases or the use of essential website services.

Recipients and parties that may process the data

Data may be processed by the Data Controller and authorised persons, as well as by external providers strictly necessary for the provision of services, including the hosting provider Aruba S.p.A., email and newsletter service providers, couriers and logistics operators, providers of payment systems selected by the user, consultants and technical providers. Data may also be disclosed to public authorities where required by law.

Personal data are not sold to third parties.

Transfers of data outside the European Economic Area

Some digital service providers may involve the processing of data in countries outside the European Economic Area. Where this occurs, the transfer must be carried out in compliance with Articles 44 and following of the GDPR, using the instruments and safeguards provided for by the applicable legislation.

Retention periods

Data are retained only for the time necessary for the purposes for which they were collected and, in particular:

• account data are retained until the account is deleted or closed, subject to any legal retention obligations;
• data relating to orders and administrative and tax obligations are retained for the periods required by applicable law;
• newsletter data are retained until consent is withdrawn or the user unsubscribes, except for any data required to document the request;
• messages sent through the Contact page are retained for the time necessary to handle the request and, as a rule, for no longer than 24 months unless further retention is necessary;
• technical and security data, as well as data relating to reviews or submitted content, are retained for the time necessary for the relevant purposes and to protect the rights of the Data Controller;
• the duration of cookies and other tracking technologies is indicated in the Cookie Policy and in the settings of the relevant providers.

Rights of the data subject

Where provided for by the GDPR, the data subject may exercise the rights set out in Articles 15-22, including:

• access to personal data and obtaining a copy;
• rectification and updating of inaccurate or incomplete data;
• erasure of data, where the relevant conditions are met;
• restriction of processing;
• data portability, where applicable;
• objection to processing in the cases provided for by law;
• withdrawal of consent at any time, without affecting the lawfulness of processing carried out before withdrawal.

To exercise these rights, you can write to info@olioamabile.it or use the Contact page. The data subject also has the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali).

Cookies and other tracking technologies

The website uses technical and session cookies that are necessary for the operation of its services. Any non-essential cookies or tracking technologies, including those used for measurement, marketing or profiling, are governed by the specific Cookie Policy, which provides further information on the technologies used and how preferences can be managed.

Processing methods and security

Processing is carried out mainly using IT and telematic tools. Appropriate technical and organisational measures are adopted to reduce the risks of data loss, unauthorised access, unlawful use or unauthorised disclosure.

Updates to this Privacy Policy

This Privacy Policy may be updated in the event of regulatory, technical or organisational changes or when the services and processing activities carried out through the website change. The date of the latest revision is shown at the beginning of this page.