This notice explains who processes the User’s personal data, how it is processed, which data is collected, and what rights Users have and how they can exercise them. If the User requires clarification or believes that the information provided in this notice is insufficient, they are invited to contact: info@glugulp.com

What is meant by personal data? Personal data refers to any information relating to an identifiable natural person. An email address is personal data. The content of a message, if it reveals information about a person, is personal data, as is a floor plan of one’s home if it is sent to the Data Controller in order to request a quotation.

What does it mean to process data? The legal definition of processing includes any operation or set of operations performed on data, such as collection, recording, organization, storage, consultation, processing, modification, selection, extraction, comparison, use, interconnection, blocking, communication, dissemination, deletion, and destruction of data. In practice, therefore, anything that can be done with a user’s data constitutes processing. Even collecting or reading data, for example consulting it, is considered processing.

Why are personal data important for the data subject? Personal data indicates who the data subject is and what they do. Since the data belongs to the data subject, it is therefore important to them. Precisely because it is “their” data, the data subject has the right to decide whether to allow third parties — including this website — to process it, and to know how such processing takes place.

The Data Controller is the entity that makes decisions about how personal data is processed. This includes, among other things, deciding which precautions should be taken to protect the data, where it should be stored (for example on servers or in the cloud), which data should be requested from the user, which data should be processed and for what purpose, whether and to whom the data should be disclosed, how to manage relations with users and their rights, whom to appoint as collaborators, processors or authorized personnel for the processing of data, and which instructions should be given to such collaborators. Since the Data Controller plays a very important role in the processing of personal data, Users are hereby informed that the Data Controller is:

Glugulp S.r.l.
Registered Office: G. Lanfranchi, 15 – 25036 Palazzolo sull’Oglio (BS), Italy
Email: info@glugulp.com
Tax Code / VAT No.: 03988870162
Certified Email (PEC): vinecosrl@pec.it
Website: https://www.glugulp.com

Furthermore, for certain ancillary functions, Glugulp may rely on internal personnel authorized to process data (also referred to as authorized staff) or external parties, usually acting as data processors (such as the website developer and manager), or, depending on the circumstances, as independent data controllers or joint controllers.

The data is communicated to internal parties of the Data Controller (employees) who collaborate in the operational and administrative management of the service.

The data may also be communicated in compliance with legal obligations, in the event of a request from a public authority (for example a request from a Court, tax inspections, etc.).

Furthermore, the data is communicated to the hosting service provider, the newsletter service provider, third-party providers managing cookies installed through the website (see the relevant policy), and social networks in the event that widgets or functions such as “like”, “share”, etc. are integrated into the website.

It is important to know that Glugulp can manage and control only the data stored and processed within its own system. Data transferred or communicated to third parties will be processed independently by those third parties, according to their own privacy policies. In any case, if Glugulp ceases the processing of a user’s personal data, it will notify the parties to whom such data has been communicated of this termination. However, Glugulp cannot guarantee that those parties will also cease processing the data.

Glugulp processes Users’ personal data at its registered office and in cloud systems located within the European Union.

Depending on the nature of the information, the following categories of data may be processed:

• Contact data: email address, telephone number

• Identification data: name, surname, date of birth

• Third-party identification data: name, telephone number, email address

• Content data: the content of communications sent by the User through the website forms

• Browsing data

• Shipping data (of the customer or third parties)

• Payment data

Glugulp processes Users’ data for the following purposes:

1. Responding to requests sent by the User (information requests, exercise of rights, etc.): this consists of responding to contacts made by the customer/user (via email or other forms of contact).
Legal basis: performance of the service requested by the user in the communication (for example, the exercise of a right).
Retention period: ten years (commercial correspondence retention obligation).
Data processed: contact data, identification data, and other data depending on the content of the request (for example, information contained in the text of the request may refer to individuals and therefore constitutes personal data).

2. Creation of a contact database:
Glugulp creates a database of contacts received through forms on the website. The database is used as a backup copy of the addresses from which communications have been received.
Legal basis: legitimate interest of the Data Controller in retaining contact data (considered to prevail over opposing interests, as it ensures the availability of the data to Glugulp and, given the low sensitivity and limited significance of such data, does not prejudice the User).
Retention period: until a request for deletion is made (see the clause regarding the exercise of rights) by sending an email to info@glugulp.com.
Data processed: email address, identification data, content data.

3. Creation and management of a user account
Data processed: identification data, contact data.
Legal basis: performance of the contract.
Retention period: until the account is deleted by the user.

4. Age verification for purchasers.
Since the products sold are alcoholic beverages, they may only be sold to persons of legal age. Therefore, before proceeding with the sale, the Data Controller verifies that the date of birth entered corresponds to a person who is legally an adult.
Data processed: date of birth.
Legal basis: compliance with a legal obligation.
Retention period: the verification is immediate; however, the data remains stored in the user’s profile and in the company CRM.

5. Management of purchases and shipping of purchased products.
Purchases may also be made as a guest user, meaning that creating an account is not required.
Data processed: identification data, contact data, shipping data, payment data.
Legal basis: performance of the contract.
Retention period: until the expiry of the withdrawal period; accounting documentation is retained for ten years for tax purposes.

6. Gift card purchase
Data processed: amount, third-party identification data, user identification data, and any message.
Legal basis: performance of the contract.
Retention period: until the gift card is used (or, at the latest, until the expiration of the gift card’s validity).

7. Provision of the Club G! service.
This is a free loyalty program that provides access to certain benefits (see the regulations on the website).
Data processed: identification data, contact data, purchase data.
Legal basis: performance of the contract.
Retention period: until the user exceeds the annual value thresholds; therefore, the minimum duration is one year from the delivery date.

8. Provision of the newsletter service
Data processed: contact data.
Legal basis: consent of the data subject (also expressed by entering their address in the relevant field).
Retention period: until consent is withdrawn.
Frequency: three times per week.

Data is provided directly by the User by completing the forms available on the website.

All requested data is mandatory. Failure to provide such data will make it impossible to perform the requested service(purchase, account creation, newsletter subscription, or response to a contact request). Additionally, there may be optional data that arises naturally during the drafting of a communication (for example, the information written in the message text). With regard to such data, it is not possible to distinguish between mandatory and optional data, as it results naturally from the act of composing the communication.

Glugulp may contact Users in the following ways:

• Emails, phone calls, messages, or other communications related to operational matters or responses to requests. These communications are necessary for the proper management of the relationship with the User.

• Promotional emails, if the User has subscribed to the newsletter.

Users are beneficiaries of a number of rights.

Rights to information regarding:

• the categories of data being processed (see points no. 2 and 5);

• the origin of the data, that is, knowing from where the service obtained the data (see point no. 7);

• the purposes of the data processing, namely for what purposes the data is processed (see point no. 6);

• the identity of the Data Controller and any Data Processors (see point no. 3);

• the recipients to whom the data is communicated (see point no. 3/a);

• the data retention period and processing duration (see point no. 6);

• the right to lodge a complaint with the Data Protection Authority through the following link: https://www.garanteprivacy.it/web/garante-privacy-en/home_en

• the existence or absence of profiling processes;

• the legal basis of the processing (see point no. 6).

There are also rights that are not merely informational but operational in nature. These rights are of various kinds. In summary:

The data subject has the right to obtain a copy of the data they have provided. If the data has been processed by automated means and on the basis of their consent or a contract, the user may request—where technically feasible—that the data be transmitted to the data subject themselves or to another Data Controller (data portability), provided that this operation does not infringe the rights (and data) of other persons.
In this specific case, such right cannot be exercised with regard to communications containing third-party data, trade secrets, or otherwise protected content. In such cases, the data subject may instead request the deletion of the data, unless the law requires the Data Controller to retain it (for example in the case of commercial correspondence).

If the personal data is inaccurate or incomplete, the data subject may request that it be corrected or completed, providing appropriate instructions. If the Data Controller must verify the accuracy of the contested data, the data subject may in the meantime obtain the restriction of the processing of the contested data (restriction means that the data is only stored and no further processing takes place, unless with the specific consent of the data subject or if necessary to establish, exercise, or defend a legal claim).

If personal data is no longer necessary for the purposes for which it was collected or otherwise processed, the data subject may request its deletion. However, if the data is required by the data subject to exercise a right in legal proceedings, the data subject may request the restriction of processing (that is, storage only).

If the processing is unlawful because the data is processed without the data subject’s consent, without a legitimate interest of the Data Controller, without a contract requiring such processing, or without a legal obligation requiring such processing, the data subject may request deletion or restriction of the data.

Procedure for exercising rights: Users may exercise their rights by sending an email to info@glugulp.com. The Data Controller must respond within thirty days (this period may be extended by an additional two months, but in such a case the Data Controller must inform the user of the delay and provide the reasons for it).

The Data Controller may refuse, if justified, to comply with the user’s request (such refusal must be communicated to the user within one month) only in the case of manifestly unfounded or repetitive requests. In such cases, the refusal must be properly justified. In any event, the user may contact the Data Protection Authority (“Garante Privacy”) (see the link below) or a competent court.

The Data Controller must respond using the same communication channel (email, telephone, etc.) used by the user for the request, unless the user specifically requests a response through a different channel. If the request is made from an email address different from the one associated with the user’s account, the requester must prove that they are the data subject.

If the Data Controller has doubts regarding the identity of the person submitting the request or exercising one of the rights listed, the Controller may request additional information to verify the requester’s identity. In the case of a request sent from an email address different from the one associated with the account, the requester must prove that they are the data subject.

Requests and responses are free of charge, unless they are repetitive. In such cases, the Data Controller may charge the actual costs incurred in responding (such as personnel costs, material costs, etc.).

In any case, the data subject may contact the Data Protection Authority
(https://www.garanteprivacy.it/web/garante-privacy-en/home_en) or the competent judicial authority in order to exercise their rights.

Users are required to provide truthful data.

It is the User’s responsibility to inform the Data Controller of any changes to personal data previously provided. Furthermore, where the system allows it, Users are responsible for not providing excessive data. For example, if a form requests the entry of optional data (normally indicated with an asterisk), it is recommended to provide such data only if deemed necessary. Similarly, when writing a message through the service, Users are advised to avoid explicit references to identifiable individuals unless strictly necessary.

In the event that one or more of the following events occur with regard to Users’ data — unauthorized access, theft, loss, destruction, disclosure, or modification (so-called Data breach) — Glugulp, without prejudice to the urgent technical measures to be implemented in order to stop the event (as far as possible) and limit its harmful effects, undertakes to:

• restore the service as quickly as possible and in an efficient manner, recovering the data available from the most recent useful backup performed;

• inform Users, either directly if circumstances allow, or in a general manner (for example by means of a notice on the website homepage or through a communication sent to all users, including those for whom no data incident has occurred), about the type of event, the time at which it occurred, and the measures adopted (without providing excessive technical detail in order not to facilitate potential new attacks) to reduce the damage and prevent similar future incidents, as well as the measures and precautions that the User should adopt in order to reduce the likelihood of further incidents and limit the consequences of those that have already occurred.