INFORMATION ON THE PROCESSING OF PERSONAL DATA

(ex. article 13 Regulation (EU) 2016/679) – May 2021 edition

This information may undergo changes over time, also connected to the possible entry into force of new sector regulations, the updating or provision of new services or technological innovations, for which the visitor is invited to consult the site periodically.

This page describes the management methods of the website www.sacarraro.eu (the Site in the following information) with reference to the processing of personal data of users who consult it. This information is provided pursuant to European Regulation 679/2016 relating to the protection of natural persons with regard to the processing of personal data, as well as the free circulation of such data (hereinafter also Regulation) for users of the services of the our site, which are provided via the internet. The information is not valid for other websites that may be consulted through our links, for which the data controller is in no way responsible.

1. Identity of the data controller. The Data Controller is Sancarraro Srls, Via NL n. 6, 92010, Petrosino (TP), info@sancarraro.it, VAT number 02641850819.

2.Purpose of processing and legal basis

a) The personal data collected by the data controller are processed for registration on the Site upon request of the visitor. The legal basis is the execution of a contract pursuant to the Regulation art. 6 paragraph 1, letter b.

b) The personal data collected by the data controller are processed for the completion of purchase orders through the site. The legal basis is the execution of a contract pursuant to the Regulation art. 6 paragraph 1, letter b.

c) The data collected may be used, by way of example and not exhaustively, for the security of the site, for sending commercial information on the owner’s products and services, for the management of disputes, for the execution of the right of withdrawal and for the statistics of visits to the site for the pursuit of the legitimate interest of the owner pursuant to art. 6 paragraph 1, letter f of the Regulation.

3.Categories of personal data being processed. Processing of personal data means any operation or set of operations, carried out with or without the aid of automated processes and applied to personal data or sets of personal data, such as collection, recording, organisation, structuring, preservation, adaptation or modification, extraction, consultation, use, communication by transmission, dissemination or any other form of making available, comparison or interconnection, limitation, cancellation or destruction . In particular, the personal data processed through the Site are:

personal data provided voluntarily by the interested party.
navigation data: these are data that the computer systems and software procedures used to operate the Site acquire during their normal operation and whose transmission? implicit in the use of Internet communication protocols. This is information that is not collected to be associated with identified interested parties, but which by its very nature could, through processing and association with data held by third parties, allow users to be identified. This category of data includes the IP addresses or domain names of the computers used by users who connect to the Site, time of the request, method used to submit the request to the web server, size of the file obtained in response, etc.
The Site uses cookies whose policy is reported at the end of the page.

4. Treatment methods. The data processing occurs through the use of tools and procedures suitable to guarantee its security and confidentiality and can be carried out with the aid of IT means and paper supports.

5.Recipients or categories of recipients of personal data – Communication and dissemination
The personal data processed are not disclosed to indeterminate subjects in any way, including by making them available or consulting them. Personal data may be transmitted to one or more specific subjects, as specified below:

to subjects who can access the data pursuant to legal provisions, regulations or community legislation, within the limits established by such rules;
to subjects who need to access the data for purposes auxiliary to the execution of the processing purposes described in the “Purpose of the processing and legal basis” section, within the limits strictly necessary to carry out these purposes (for example: law firms, suppliers of IT products or applications, freight forwarders, tax consultants, etc.).

6.Period of retention of personal data. The data collected for the purpose referred to in point 2 above will be kept for the time strictly necessary to carry out the processing purpose according to the following methods.

Purpose 2.a: the registration data on the site will be managed and processed for one year from the last access to the site itself.
Purpose 2.b: the data relating to purchases made through the site will be kept for the period necessary to comply with legal requirements.

7.Rights of the interested party. The interested party, pursuant to art. 15 of the Regulation, you have the right to obtain confirmation as to whether or not data concerning you is being processed and in this case, you have the right to obtain a copy of the data and access to the data and the following information:

the purposes of the processing;
the categories of personal data in question;
the recipients or categories of recipients to whom the personal data have been or will be communicated, in particular if recipients are from third countries or international organisations;
when possible, the expected retention period of personal data or, if not? possible, the criteria used to determine this period;
all available information on the origin of the data if they are not collected from the interested party;
the existence of an automated decision-making process, including profiling.

Furthermore, the interested party has the right to:

obtain from the data controller the rectification of inaccurate personal data concerning him without unjustified delay (art. 16 of the Regulation);
obtain from the data controller the deletion (“right to be forgotten”) of personal data concerning him without unjustified delay (art. 17 of the Regulation);
obtain from the data controller the limitation of processing (art. 18 of the Regulation);
receive, if applicable, the personal data concerning him or her in a structured, commonly used and machine-readable format (art. 20 of the Regulation);
object at any time, for reasons related to your particular situation, to the processing of personal data (art. 21 of the Regulation);
revoke your consent at any time without prejudice to the lawfulness of the processing carried out before the revocation (art. 7 of the Regulation);
be informed of the existence of adequate guarantees, if personal data are transferred to a third country or to an international organization (art. 46 of the Regulation);
lodge a complaint with a supervisory authority (art. 77 of the Regulation);

To exercise these rights you can contact the Data Controller at the contact points indicated in the “1 Identity of the Data Controller” section.

8. Obligation or right to provide data. The Site provides visitors with a series of services without the need to request any personal data or information. However, some services require the mandatory provision of data for the execution of the contract. Failure to provide them will make it impossible to establish or continue the relationship, to the extent that such data is necessary for the execution of the contract.

9. Cookie policy 

Notice on the Processing of Personal Data collected through this website
Last revised: 31/08/2026

1. Introduction and regulatory references
This notice describes the processing of personal data collected through this website, including data acquired by means of cookies, tracking technologies and - where present - contact forms, restricted areas, financial transactions and any other features that may be active on the site.
This notice is addressed to anyone who accesses or uses this website, describing how the user’s personal data is collected, used and protected, as well as the rights granted by law.
These provisions do not concern other websites, pages or online services accessible through external links that may be present on the site, in respect of which you are invited to consult the relevant privacy notices.
This notice is provided in compliance with the principal national and international regulations on the protection of personal data, including:

• Regulation (EU) 2016/679 (GDPR) and Directive 2002/58/EC, known as the ePrivacy Directive
• Other regulations that may be applicable.

2. Who manages your data and how can you contact us?
Your personal data is processed by:
Sancarraro Srls
Via Olanda 6, 91020 Petrosino (TP)
info@sancarraro.it
VAT ID: IT02641850819

For any information concerning the processing of personal data or to exercise the rights granted by law, data subjects may contact the Data Controller.

3. On what legal bases do we process your data?
The processing of personal data collected through this site (including data collected by means of cookies, similar technologies, contact forms, restricted areas, financial transactions and any other features that may be active on the site) is based on one or more of the following legal bases:

1. Performance of pre-contractual or contractual measures: where processing is necessary to respond to user requests, provide requested services and, where the site so provides, manage orders, accounts or contractual relationships.
2. Compliance with legal obligations: where processing is necessary to comply with tax, accounting, administrative or security obligations or with requests from the authorities.

The Data Controller may also process the necessary data on the basis of its own legitimate interest, pursuing interests consisting in the security of the site, the prevention of abuse and fraud and the protection of its rights in legal proceedings. The user may in any case object to the processing in accordance with the applicable legislation, in the cases provided for by Article 21 GDPR.

For non-essential cookies and tracking tools - such as those for non-anonymized analytics, profiling or marketing - the processing is based on the user’s consent in the jurisdictions where such consent is required by the applicable legislation. The related methods of giving, managing and withdrawing it are described in the Cookie Policy.

Failure to accept or the withdrawal of consent may limit certain features or services of the site.

The provision of data supplied directly by the user is generally optional, except for any data indicated as mandatory in the individual forms or where it is required by a legal or contractual obligation or is necessary to perform a contract or pre-contractual measures requested by the user; in such cases, failure to provide it may make it impossible to follow up on the request or to deliver the service. Technical navigation data is in any case collected automatically and is necessary for the functioning of the site.

4. What data do we collect when you visit the site?
While browsing this site, the following data may be collected, including by means of cookies and similar technologies such as pixel tags, web beacons, local storage and equivalent technologies, namely:

• Navigation and technical data: information such as IP address, device identifiers, data relating to the operating system and browser, requested URLs, connection times, technical logs, technical preferences, and usage data collected through cookies and tracking technologies (pixel tags, web beacons, local storage and equivalent tools).

• Identifying data provided voluntarily: information entered in the digital forms on the site (e.g. first name, last name, e-mail, telephone) and/or provided by sending e-mails or through other contact channels, used to respond to requests, provide services and any consultations.

• Data relating to purchases, payments and financial transactions: collected only if the site offers paid services and handled with specific security precautions. The Data Controller does not retain the full details of payment instruments, except where otherwise indicated. Transaction data is processed to manage the purchase, fulfill accounting and tax obligations, prevent fraud and protect the Data Controller’s rights.

• Data relating to user registration and login for restricted areas and dedicated features.

5. How do we process your data, how do we protect it and how long do we keep it?
The personal data collected through this site is processed mainly by electronic and digital means in accordance with the principles of lawfulness, fairness, data minimization, integrity and confidentiality.

Appropriate technical and organizational measures are adopted to prevent unauthorized access, loss, alteration or unauthorized disclosure of data, including:

• Encryption of communications (https): communications between your browser and the site are protected by HTTPS encryption, a measure aimed at reducing the risk of interception or manipulation of the data transmitted during browsing;
• Periodic backups: data is copied and stored periodically to protect it from any accidental loss or technical incidents;

Data is retained according to the following timeframes:

• Cookie preferences and consents: retained for 180 days, as set out in the Cookie Policy on this site.
• Navigation and technical data: retained for the time strictly necessary for security purposes and, as a rule, no longer than 12 months, after which it is deleted or anonymized, save for longer periods imposed by legal obligations or by the need to establish, exercise or defend a right in legal proceedings.
• Data connected to any contractual relationships established with the Data Controller: where they exist, it is retained for the duration of the relationship and, thereafter, for the time required by the applicable legal obligations (for example in accounting and tax matters).
• Data entered through forms or specific requests: retained for the time necessary to respond to the request and to fulfill the related purpose, and thereafter for any period required by legal obligations.

6. Who can receive your data?
The following may access the personal data collected through this site, within the limits of their respective responsibilities and purposes:

• Authorized internal persons designated by the Data Controller, duly instructed on privacy and security matters;
• Suppliers and third parties appointed as Data Processors (for example: technical providers and IT services, site maintenance, e-mail providers, consultants, where applicable);
• Third parties that provide services integrated into the site (e.g. fonts, maps, image display), which may process technical data as independent controllers in accordance with their own notices (in which case please also consult the individual notices of such third parties);
• Competent public authorities and supervisory bodies, within the limits imposed by law or in order to comply with requests from the judicial authority;

The updated list of external recipients can be made available on request by writing to the Data Controller’s contact details.

7. Where can your data be transferred?
The personal data collected through this site is processed, as a rule, in the country where the Data Controller is established and at the service providers it uses. Where data is transferred or made accessible outside the relevant territory under the applicable legislation, the transfer takes place by means of one of the mechanisms it permits, including adequacy decisions, appropriate or suitable safeguards and, where applicable, derogations or other conditions provided for by the applicable legislation. For transfers subject to the GDPR, the relevant territory is the European Union / European Economic Area and, in particular, the EU-U.S. Data Privacy Framework, limited to certified organizations, and the Standard Contractual Clauses adopted by the European Commission are relevant. Information on the applicable mechanism and, where provided for, a copy of the relevant safeguards, possibly redacted in the confidential parts, may be requested at the Data Controller’s contact details.

8. What are your rights regarding the data collected?
The user, under the applicable legislation, has the right to:

• Obtain confirmation as to whether or not personal data concerning them is being processed and, if so, obtain access to that data and the related information (right of access).
• Request the rectification, updating or erasure of data that is inaccurate or no longer necessary (right to rectification and erasure).
• Request the restriction of processing or object, for reasons connected with your particular situation, to processing based on the Data Controller’s legitimate interest, subject to the existence of the conditions provided for by Article 21 GDPR.
• Receive, in the cases and under the conditions provided for by the applicable legislation, the personal data concerning you in the format required by it and obtain its transmission to another controller or provider; for the EU/EEA and the UK, the right concerns the data you have provided, the format is structured, commonly used and machine-readable and direct transmission is carried out where technically feasible (right to data portability).
• Withdraw at any time any consent given, without affecting the lawfulness of processing based on consent carried out before the withdrawal (for example for the sending of commercial communications or newsletters, where active).
• Withdraw the consent given to the use of non-essential cookies and to the processing of data collected through tracking tools.
• Report any irregularities or abuses to the competent supervisory authorities.

In Italy, the rights concerning the personal data of deceased persons may be exercised, within the limits of Article 2-terdecies of the Privacy Code, by anyone who has a personal interest, acts to protect the data subject as an agent or invokes family reasons worthy of protection.

To exercise these rights, it is sufficient to send a request to the Data Controller’s contact details. The Data Controller will respond without undue delay and within the time limits provided for by the applicable legislation. For requests subject to the GDPR or the UK GDPR, a response is provided within the ordinary period of one month, calculated in accordance with the applicable legislation; that period may be extended by a further two months, taking into account the complexity and number of the requests, and the data subject is informed of the extension and the related reasons within the ordinary period.

9. How is minors’ data processed?
The protection of minors is a fundamental priority.

This site is not directed at minors and does not intentionally collect their data through its forms. Where, in the context of a request or query, the user provides personal data relating to third parties - including any minors - they must ensure that they are authorized to do so; such data will be processed within the limits and for the purposes of the request, in compliance with the applicable legislation. For requests for rectification, restriction or erasure, you may write to the Data Controller’s contact details.

10. How can you make reports or complaints to the authorities?
If you believe that the processing of your personal data through this site does not comply with the applicable legislation, you may lodge a complaint free of charge, pursuant to Article 77 of the GDPR, with the competent authorities indicated below, in accordance with the applicable legislation:

• the competent supervisory authority for the protection of personal data;
• the Italian Data Protection Authority (Garante per la protezione dei dati personali, Italy);

11. How do we inform you of changes to this notice?
This notice is subject to periodic revision to reflect regulatory changes or modifications to the services offered through the site. Any significant change will be communicated through this page.
Last revised: 31/08/2026