Privacy Policy of Taverna Flavia

Further Information for Users in the European Union

This section applies to all Users in the European Union, in accordance with the General Data Protection Regulation (“GDPR”) and, for such Users, supersedes any other differing or conflicting information contained in the privacy policy. Further details regarding the categories of Data processed, the purposes of processing, the categories of recipients of Personal Data, if any, and further information on Personal Data can be found in the section “Detailed information on the processing of Personal Data” within this document.

Legal basis of processing

The Owner may process Personal Data relating to the User if one of the following applies:

• the User has given consent for one or more specific purposes;
• processing is necessary for the performance of a contract with the User and/or for pre-contractual obligations thereof;
• processing is necessary for compliance with a legal obligation to which the Owner is subject;
• processing is carried out in the public interest or in the exercise of official authority vested in the Owner;
• processing is necessary for the purposes of the legitimate interests pursued by the Owner or by a third party.

It is always possible to ask the Owner to clarify the concrete legal basis that applies to each processing and, in particular, to specify whether the processing is required by law, by a contract, or necessary to enter into a contract.

Further information on retention time

Unless otherwise indicated in this document, Personal Data is processed and stored for the time required by the purpose for which it was collected and may be stored for a longer period due to any legal obligations or on the basis of Users’ consent.

Therefore:

• Personal Data collected for purposes related to the performance of a contract between the Owner and the User shall be retained until such contract has been fully performed.
• Personal Data collected for the purposes of the Owner’s legitimate interests shall be retained until such interests are satisfied. The User may obtain further information regarding the legitimate interests pursued by the Owner in the relevant sections of this document or by contacting the Owner.

Where processing is based on the User’s consent, the Owner may retain Personal Data for a longer period until such consent is withdrawn. Furthermore, the Owner may be obliged to retain Personal Data for a longer period in order to comply with a legal obligation or by order of an authority.

At the end of the retention period, the Personal Data will be deleted. Therefore, upon expiration of this period, the right of access, erasure, rectification, and the right to data portability can no longer be exercised.

Users’ Rights under the General Data Protection Regulation (GDPR)

Users may exercise certain rights regarding their Data processed by the Owner.

In particular, within the limits provided by law, the User has the right to:

• withdraw consent at any time. The User may withdraw consent to the processing of their Personal Data previously given.
• object to the processing of their Data. The User may object to the processing of their Data when it is carried out on a legal basis other than consent.
• access their Data. The User has the right to obtain information about the Data processed by the Owner, about certain aspects of the processing, and to receive a copy of the Data processed.
• verify and seek rectification. The User may verify the accuracy of their Data and request that it be updated or corrected.
• obtain restriction of processing. The User may request the restriction of the processing of their Data. In this case, the Owner will not process the Data for any purpose other than storing it.
• obtain the erasure or removal of their Personal Data. The User may request the deletion of their Data by the Owner.
• receive their Data and have it transferred to another controller. The User has the right to receive their Data in a structured, commonly used and machine-readable format and, where technically feasible, to obtain its transfer to another controller without hindrance.
• lodge a complaint. The User may lodge a complaint with the competent data protection supervisory authority or bring an action in court.

Users have the right to obtain information regarding the legal basis for transfers of Data abroad, including to any international organization governed by public international law or set up by two or more countries—such as the UN—as well as regarding the security measures adopted by the Owner to protect their Data.

Details about the right to object

Where Personal Data is processed for a public interest, in the exercise of official authority vested in the Owner, or for the purposes of the legitimate interests pursued by the Owner, Users have the right to object to such processing on grounds relating to their particular situation.

Users are informed that, where their Data is processed for direct marketing purposes, they may object to such processing at any time, free of charge and without providing any justification. Should Users object to processing for direct marketing purposes, the Personal Data will no longer be processed for such purposes. To determine whether the Owner is processing Data for direct marketing purposes, Users may refer to the relevant sections of this document.

How to exercise these rights

Any requests to exercise the User’s rights may be directed to the Owner through the contact details provided in this document. Such requests are free of charge and the Owner will respond as soon as possible and, in any case, within one month, providing the User with all information required by law. Any rectifications, erasures, or restrictions of processing will be communicated by the Owner to each of the recipients, if any, to whom the Personal Data has been disclosed, unless this proves impossible or involves a disproportionate effort. The Owner will inform the User about such recipients if the User requests it.