Privacy policy

To the Data Subject,
HENDERSON S.R.L., as Data Controller under art. no. 13 of European Regulation no. 679/2016 “General Data Protection Regulation (GDPR)” (hereinafter referred to as the EU Regulation) concerning personal data processing, wishes to inform you how your personal data will be processed.
The regulations require anyone processing personal data to inform the data subject about the data that will be processed and the methods of the processing, which must always be lawful, correct and transparent, to ensure confidentiality and protect the data subject’s rights.
Note that the phrase “data processing” refers to any operation or series of operations concerning the collection, registration, organisation, storage, consultation, processing, editing, selection, extraction, comparison, use, linking, freezing, communication, disclosure, or destruction of the data.

1. The Data Controller
The Data Controller is HENDERSON S.R.L. of Via Venezia, 56 – 35010 Vigonza (PD), tax code and VAT number 02005720285, and may be contacted as follows: telephone 049/502652, e-mail: privacy@hendersonbaracco.com.

2. Nature of the data processed, purposes and legal basis of processing
Nature of the data processed. Note that, in relation to the purposes of the processing listed below, the only data processed will be “ordinary personal data” such as, for example:

• identifying information (name, surname, address, postal code, town, province or state, country)
Purposes of the processing. Your personal data will be processed for the following purposes:
A. responding to your request to make a purchase on our website, and therefore set up your own personal account, by filling in the form provided on this page;
B. managing pre-contractual and contractual relations;
C. fulfilling legal obligations;
D. marketing: to send you advertising material, for direct sales, to conduct market surveys and for the purposes of commercial and promotional communications;
Legal basis of processing. Your personal data, collected for the purposes identified in points 2A-2B and 2C, will be processed for the fulfilment of a contract to which the data subject is a party, the execution of pre-contractual measures adopted in response to this party's request (art.6., para.1 lett. b of the EU Regulation), or to fulfil a legal objection binding upon the Data Controller (art.6. para.1 lett. c of the EU Regulation).
Your personal data may lawfully be processed for the purposes identified in point 2D of this notice only with your specific, separate, express, documented and entirely optional prior consent (art. 6. para.1 lett. a of the EU Regulation).
You may revoke your consent at any time, without affecting the lawfulness of processing which has already taken place with your consent prior to revocation (art.7 para.3 of the EU Regulation)
Moreover, the data subject is informed that under art. 21 of the EU Regulation, the data subject is entitled to object at any time to the processing of his or her personal data for direct marketing purposes (including profiling), and that if the data subject objects to such processing, his or her personal data may no longer be processed for these purposes.
Please note: on the basis of our company’s principle of ensuring the utmost transparency in relations with data subjects, we wish to inform you that if you decide to consent to point 2D (marketing), you must be informed of, and perfectly aware of, the fact that your data will be processed specifically for commercial, advertising, promotional and marketing purposes in the broadest sense, such as:
1. sending advertising material and information of a promotional nature (such as our newsletter);
2. sending commercial information in printed, automated or electronic form, and specifically by ordinary post, e-mail, telephone (such as calls, WhatsApp messages, text messages and multi-media messages), fax, and any other information channel (such as web sites and mobile apps);
3. sending you invitations to events and meetings for informative and promotional purposes;
4. sending updates regarding promotional initiatives or technical innovations, assistance and/or surveys of our customers’ satisfaction, quality management.

3. Recipients of the data and processing methods
Your personal data will be processed on the basis of the principles of correctness, fairness and transparency, and may be processed in printed form or using electronic aids, by the company’s employees authorised or appointed to process personal data or by external parties appointed to perform specific tasks on behalf of the Data Controller, acting as Data Processors under art. 28 of the EU Regulation, by effect of our letter of appointment, which will require them to maintain the confidentiality and security of the personal data processed and to adopt appropriate security measures to prevent data loss, unlawful or incorrect use and unauthorised access in compliance with current personal data protection legislation.
For brevity’s sake, a detailed list of these persons is made available to you in the offices of the Data Controller.
Your personal data will not be disclosed or transferred to a third country or to any kind of international organisation, and will not be provided to any third party unless required under the law or the contract.

4. Data storage time
Your personal data will be stored only as long as required for processing, in compliance with the principle of limitation of storage under the EU Regulation, and/or for as long as necessary to fulfil obligations under the law or the contract, or until the data subject revokes his or her specific consent, and therefore
- obtain from the controller confirmation as to whether or not personal data concerning you are being processed, and, where that is the case, to access the personal data (referred to as the right to access);
- with reference to the purposes identified in points 2A-2B-2C, the data will be stored for no longer than necessary to achieve the purposes for which they are processed, and/or for the amount of time strictly necessary to fulfil our obligations under the law and the contract;
- with reference to the purposes identified in point 2D, data processed for marketing purposes will be stored for no longer than 24 months following collection.
An annual check of the data is conducted to ensure that the declared storage times are not exceeded and to ensure that the data can be erased if no longer required for the specified purposes.

5. Consequences of refusal to provide data
The personal data identified in points 2A-2B-2C of this notice are necessary, and without these items of data it will be impossible to proceed with registration (creation of your personal account) and to fulfil our obligations under the contract and the law.
The personal data identified in point 2D, on the other hand, are optional; refusal to supply these data will have no consequences, and will in no way affect your request to proceed with registration or our ability to fulfil our obligations under the contract and the law. You may therefore decide not to provide any data, or to deny us the right to process the data you have already provided at any time in the future.

6. Rights of the data subject
As the data subject, you enjoy the rights listed in articles 15 through 22 of the EU Regulation, which are reported below; specifically, you have the right to:
- obtain information on the purposes of the processing, the categories of personal data concerned, the recipients or categories of recipient to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organisations, the envisaged period for which the personal data will be stored or the criteria used to determine that period; where the personal data are not collected from the data subject, any available information as to their source;
- obtain rectification of personal data concerning you (referred to as the right to rectification);
- obtain erasure of personal data concerning you (referred to as the right to be forgotten);
- obtain restriction of processing (referred to as the right to restriction of processing);
- obtain data portability, that is, receive the personal data concerning you in a structured, commonly used and machine-readable format and transmit those data to another controller without hindrance (referred to as the right to data portability);
- object to processing at any time (referred to as the right to object). The data subject is specifically informed, as required by art. 21 of the EU Regulation, that if the personal data are processed for direct marketing purposes (including profiling), the data subject has the right to object at any time to processing of personal data concerning him or her for these purposes, and if the data subject objects to processing for direct marketing purposes, the personal data may no longer be processed for these purposes;
- be informed of (and to object to) the existence of an automated decision-making process regarding physical persons, including profiling;
- revoke consent at any time without affecting the lawfulness of processing based on consent prior to the revocation;
- lodge a complaint with a supervisory authority (Garante per la Protezione dei Dati Personali - Personal Data Protection Authority).
Note that the data subject’s rights may be subject to conditions or limitations. The right to data portability, for example, may not always apply, depending on the specific circumstances of the processing.
As another example, if you decide to object to the processing of your data, the Data Controller is entitled to assess your request, and decide not to accept it in the presence of legitimate reasons why it is necessary to proceed with processing which prevail over your interests, rights and freedom. .

7. How to exercise your rights
You may exercise your rights clearly and explicitly at any time, without any formalities whatsoever, by sending:
- a letter to the undersigned company by registered mail with return receipt;
- an e-mail to the address: privacy@hendersonbaracco.com.
Or by contacting the Data Controller directly at the number: + telephone 049/502652

8. Minors
The offer made by the Data Controller regarding the relationship in existence with you does not involve intentional acquisition of personal information on minors. If information on minors is involuntarily recorded, the Data Controller will promptly erase it in response to the Data Subject’s request or report.

9. Persons Appointed/Authorised to Process - Data Processors
Below please find some information we need to provide to you, not only to fulfil legal requirements but because transparency and correct behaviour in relation to Data Subjects is an essential part of our way of doing business.

Persons Appointed/Authorised to Process. An updated list of Persons Appointed/Authorised to Process the data is kept in the Data Controller’s offices.

Data Processors.
For brevity’s sake, a complete list of these persons is available in our offices.