PRIVACY POLICY FOR SUBJECTS IN THE D.O.P. FONTINA CHEESE CHAIN - MEMBERS, BREEDERS, PRODUCERS, RIPENERS AND PACKAGERS, CUSTOMERS AND SUPPLIERS OF THE CONSORTIUM

made to data subjects pursuant to Article 13, EU Regulation 2016/679 on the protection of natural persons with regard to the processing of personal data and the free movement of such data

 This information is provided by CONSORZIO PRODUTTORI E TUTELA DELLA D.O.P. FONTINA, with registered office at Reg. Borgnalle, 10/L - 11100 Aosta, Tel. 0165.44091, Fax 0165.262159, info@fontina-dop.it, PEC: consorzioproduttorifontina@pcert.it, legally represented by Barmaz Andrea, VAT No. 00035050079 in compliance with the provisions of EU Regulation No. 2016/679 (hereinafter, for brevity, also “the Regulation” or GDPR), containing provisions for the protection of persons and other subjects with regard to the processing of personal data.

1. Data controller

The personal data of the physical persons (personal data, address, company name when corresponding to the personal data of the physical person, VAT number, fiscal code, telephone number, e-mail address, PEC address, bank data), which must or may be collected and processed for the overall management and execution of the relationships of various kinds between the Subjects of the Fontina PDO Cheese chain, the clients, the suppliers and the Consortium, also in the pre-contractual stages or in the pursuit of the latter's legitimate interests, are processed for the purposes described below by the CONSORTIUM OF PRODUCERS AND PROTECTION OF THE D.O.P. FONTINA as Data Controller.

The data controller wishes to inform you that European Regulation No. 679 of 27 April 2016 on the processing of personal data provides for the protection of individuals with regard to the processing of personal data; in accordance with Article 13 of EU Regulation 2016/679, we therefore invite you to read this information notice made public by the CONSORZIO PRODUTTORI E TUTELA DELLA D.O.P. FONTINA.

2. Purpose of processing and principles of lawfulness

In relation to the management of pre-contractual and contractual phases, aimed at the pursuit of the legitimate interest of the Controller or relating to compliance with the law or regulations (principles of lawfulness), the CONSORZIO PRODUTTORI E TUTELA DELLA D.O.P. FONTINA processes

• personal data of members: company name, name and surname if it corresponds to personal data, address, postcode of residence, municipality of residence, bank details (IBAN), copy of identity card;
• personal data of seasoners: company name, first name and surname if corresponding to the personal data, address, postcode of residence, municipality of residence, telephone number, e-mail address, PEC address, bank data (IBAN);
• personal data of producers (dairies or alpine pastures): company name, first name and surname if corresponding to personal data, address, postcode of residence, municipality of residence, C.T.F., copy of identity card - univocal code Consorzio Tutela Fontina, bank details (IBAN).
• personal data of visitors, maintenance technicians, consultants at the Consortium's premises: name and surname, address, municipality and postcode where the company is based, telephone number, e-mail address, PEC address, bank details (IBAN);
• personal data of suppliers of goods and services and/or customers of the Consortium with whom a contract is concluded or to whom information is requested or released for the purpose of the possible conclusion of a supply or sales contract (contract management and pre-contractual measures): name and surname, address, municipality and postcode where the company resides, telephone number, e-mail address, PEC address, bank details (IBAN).

Processing is carried out for the exclusive and relevant purposes of:

1. overall management of the fulfilments relating to members, seasoners and producers in relation to the Consortium's aims and object, listed in Article 4 of the Statute to which explicit reference is made.
2. execution of pre-contractual and contractual measures for the purchase or sale of goods and services (suppliers and customers);
3. fulfilment of any other obligations under national or EU laws, regulations, directives, etc.

All processing carried out by the Controller shall be deemed lawful insofar as it is based on its legitimate interest, on its obligations under pre-contractual or contractual measures, or insofar as it is carried out in compliance with regulatory obligations.

3. Treatment modalities

The aforementioned personal data will be processed, in compliance with the provisions of art. 32 of the Regulation and confidentiality obligations, using computerised and manual tools and will not be subject to any automated decision-making process, including profiling. The CONSORZIO PRODUTTORI E TUTELA DELLA D.O.P. FONTINA has implemented appropriate technical and organisational measures in order to maintain the integrity and security, as well as prevent the destruction, loss, accidental or unlawful alteration, unauthorised disclosure of, or access to, the Personal Data processed, transmitted, stored, in line with Article 32 of Regulation (EU) 2016/679.

Personal data will be processed in hard copy, computerised and telematic form (communication via email) and entered into the relevant databases (folders) which can only be accessed, by means of an authorisation profile and authentication credentials, by persons authorised to process them (employees of the Consortium). Data processing may be carried out by third parties, authorised and identified as data processors who, pursuant to Article 28 of the Regulation, provide specific professional, processing, administrative or instrumental services necessary for the performance of contracts and for the achievement of the above purposes. All data processing operations are carried out by staff duly trained to ensure compliance with the regulatory principles and the integrity, confidentiality and continuous availability of personal data.

4. Data retention period

CONSORZIO PRODUTTORI E TUTELA DELLA D.O.P. FONTINA points out that, in compliance with the principles of lawfulness, purpose limitation and data minimisation, pursuant to art. 5 of the Regulation, all personal data collected and processed for the pursuit of the indicated purposes will be retained for the entire duration of the contractual and non-contractual relations between the interested parties and the Consortium, from the moment they are issued and until the expiry of the terms imposed by law for the retention, for example, of tax documents for the provision of services offered by the Consortium.

The term of the retention period is quantified at the conclusion of each contract entered into between the Data Controller and the data subject. The data will be processed for a period of time that is further and exclusively necessary to allow the Data Controller to fulfil its retention obligations for tax purposes or for other purposes provided for by law or regulation or because it is necessary for the settlement of any disputes that may arise between the parties, if longer than the termination or conclusion of the contract.

5. Scope of data communication

The personal data of Consortium members, producers, maturers and packagers are published, for transparency purposes, on the website at https://www.fontina-dop.it/consorzio/consorziati/.

The lists are updated by the Consortium on an annual basis.

The same personal data may be transferred, communicated or brought to the knowledge of:

• other members, producers, seasoners and packagers,
• website visitors https://www.fontina-dop.it/ (actors in the Fontina PDO cheese chain),
• president, director and employees of the Consortium,
• president, vice-president, councillors and mayors of the consortium's board of directors,
• consultants external to the Consortium (e.g. for supervisory or monitoring activities),
• authorised control and certification bodies or organisations (e.g. Experimental Zooprophylactic Institute of Piedmont, Liguria and Valle d'Aosta, CSQA - Publicly Controlled Certification Body),
• external companies (retailers, large-scale distribution companies, etc.).
• Professional firms providing legal advice on litigation management,
• Professional firms for administrative-accounting and tax advice to the Consortium,
• Companies, firms or professionals for insolvency management and debt recovery,
• Professional firms or individual professionals for the processing of annual production evaluation data,

• Banking institutions for the management of receipts and payments;
• Forwarders, couriers, transporters;

Personal data will be processed by the entities listed above in full compliance with Regulation 2016/679 and in their capacity as data processors (art. 28 GDPR) appointed by the Consortium itself or as autonomous data controllers.

The list of data processors who may process your personal data is available, in an updated form, upon request at the following e-mail address info@fontina-dop.it or PEC address: consorzioproduttorifontina@pcert.it

6. Rights under Articles 15, 16, 17 18, 20, 21 and 22 of EU REG. 2016/679

 We would like to inform you that, as a data subject, you have, in addition to the right to lodge a complaint with the supervisory authority, the rights listed below, which you may assert by addressing a specific request to the data controller.

• 15 - Right of access. The data subject shall have the right to obtain from the controller confirmation as to whether or not personal data relating to him or her are being processed and, if so, to obtain access to the personal data and information concerning the processing;
• 16 - Right of rectification. The data subject shall have the right to obtain from the data controller the rectification of inaccurate, outdated or otherwise inaccurate personal data concerning him/her without undue delay. Bearing in mind the purposes of the processing, the data subject shall have the right to obtain the integration of incomplete personal data, also by providing a supplementary declaration;
• 17 - Right to erasure (right to be forgotten). The data subject shall have the right to obtain from the controller the erasure of personal data concerning him/her without undue delay, and the controller shall be obliged to erase the personal data without undue delay insofar as they are not processed in compliance with the law and, therefore, must be retained until the end of the period prescribed for their storage;
• 18 - Right to restriction of processing. The data subject shall have the right to obtain from the controller the restriction of processing when one of the following cases occurs:
  • the data subject contests the accuracy of the personal data. Processing will be restricted for the period necessary for the data controller to verify the accuracy of such personal data and to restore their correctness;
  • the processing is unlawful and the data subject objects to the deletion of the personal data and requests instead that their use be restricted;
  • although the data controller no longer needs them for the purposes of processing, the personal data are necessary for the establishment, exercise or defence of a legal claim;
  • the data subject has objected to the processing pursuant to Article 21(1), pending verification as to whether the data controller's legitimate reasons prevail over those of the data subject.
• 20 - Right to data portability. The data subject has the right to receive in a structured, commonly used and machine-readable format the personal data concerning him/her that he/she has provided to a data controller and has the right to transmit those data to another data controller without hindrance from the controller to whom he/she provided them. When exercising his or her data portability rights, the data subject has the right to obtain the direct transmission of personal data from one controller to another, if technically feasible;
• 21 - Right to object. The data subject shall have the right to object at any time, on grounds relating to his or her particular situation, to the processing of personal data concerning him or her pursuant to Article 6(1)(e) or (f), including profiling on the basis of those provisions;
• 22 - Right not to be subject to automated decision-making, including profiling. The data subject shall have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or significantly affects him or her in a similar way.

7. Data transfer outside the EU

On the date of publication of this information, the Consortium declares that your data will not be transferred to third countries belonging or not belonging to the European Union or to which there are no specific adequacy decisions (Article 25, paragraph 6, of Directive 95/46/EC). The same will reside solely within the national territory.

Download information in PDF