Survey Privacy Policy

Privacy Policy art. 13 and 14 of EU Regulation 2016/679

Dear Data subject,
pursuant to art. 13 and 14 of the 2016/679 European Regulation concerning the protection of individuals with regard to the processing of personal data, as well as the free circulation of such data (hereinafter, “GDPR”), Mirnagreen Srl, as Data Controller, intends provide you with the following information:

Data Controller
Mirnagreen Srl
Via Ipazia 2 c/o NOI Techpark 39100 Bolzano (Italy)
Tel: +39 0471 – 1551951
Mail: info@mirnagreen.com
PEC: mirnagreen@pec.it
Website: https://www.mirnagreen.com/
P.IVA 02375570229
(hereinafter also the “Data Controller”)

Purpose of the processing and legal bases
Personal data will be processed for the pursuit of the purposes and with the legal bases indicated below:
1. The processing is carried out for the collection of the data necessary to request the delivery of the product. The legal basis for the indicated purpose is represented by the need for processing for the conclusion and correct execution of the contract of which the data subject is a party and / or for the execution of pre-contractual measures adopted at the request of the data subject, as foreseen. from art. 6 par. 1 letter b) of the GDPR;
2. send e-mails and / or newsletters and communications relating to the products, services, activities offered and promoted by the data controller, of the same type previously used by the data subject, except for the refusal of processing by the same, which can be opposed at any time; the legal basis for this type of processing is represented by the legitimate interest of the Data Controller as provided for in Article 6 par. 1 letter f) of the GDPR.
3. periodically send, via remote communication technologies (mail, telephone, sms, whatsapp, social network), newsletters and marketing communications on products, services, activities offered and promoted by the Data Controller; the legal basis is represented by consent as required by art. 6 par. 1 letter a) of EU Regulation 2016/679;
4. carry out satisfaction questionnaires and market research to develop and improve our range of products, services and activities proposed by the data controller and their partner; the legal basis is represented by consent as required by art. 6 par. 1 letter a) of the 2016/679 EU Regulation;
5. to fulfill the obligations established by law, by a regulation, by community legislation or by an order of the Authority; the legal basis for this type of processing is represented by Article 6 paragraph 1 letter c)
6. ascertain, exercise or defend a right in court; the legal basis for this type of processing is represented by the legitimate interest of the Data Controller as provided for in Article 6 par. 1 letter f).

Data type
The data necessary for the pursuit of the purposes described above will be collected and processed, such as:
– identification data (name, surname)
– data relating to the shipment (address)
– contact details (email and telephone)
– data relating to knowledge of the product (how the product became known, data relating to the intake of the product and its continuation, willingness to provide information on the state of health, willingness to participate in the tests of new products,
– other information requested in the registration form
(hereinafter, the “Data”).

Refusal to provide data
The provision of data is necessary as any refusal to provide them could make it impossible to receive the products and services requested by the data subject from the data controller.
The provision of data for processing that require consent is optional, failure to provide it will not make it impossible to use the products / services offered by the Data Controller. Even in the event of consent, the data subject will still have the right to subsequently object, in whole or in part, to the processing of their personal data for the purposes set out above, by simply making a request to the Data Controller at the addresses indicated above.

Data source
The Data will be provided by you or collected from third parties.
Processing methods
In accordance with the provisions of art. 5 of the Regulation, the Personal Data processed will be:
(i) processed in a lawful, correct and transparent manner towards the data subject;
(ii) collected and recorded for specific, explicit and legitimate purposes, and subsequently processed in terms compatible with those purposes;
(iii) adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed;
(iv) accurate and, if necessary, updated;
(v) processed in such a way as to guarantee an adequate level of security;
(vi) kept in a form that allows the identification of the data subject for a period of time not exceeding the achievement of the purposes for which they are processed.
The data processing will be carried out both with manual and / or IT and telematic tools with organization and processing logics strictly related to the purposes themselves and in any case in such a way as to guarantee the security, integrity and confidentiality of the data in compliance with the organizational and physical measures. and logic provided for by the provisions in force.

Data communication scope
Personal data may be communicated to the subjects authorized to process, as well as to external data processors appointed by the Data Controller (the complete list of external managers is available from the Data Controller), responsible for managing the aforementioned purposes. As part of the pursuit of the aforementioned purposes, the data may be disclosed to other subjects acting as independent data controllers (by way of example and not limited to the couriers for the delivery of products).

Data dissemination
Personal data will not be disseminated.
Data transfer abroad
For the purposes indicated above, personal data will be processed within the European Economic Area (EEA). Should they be transferred to Third Countries, in the absence of an adequacy decision by the European Commission, the provisions of the applicable legislation on the transfer of Personal Data to third countries will be respected, such as the Standard Contractual Clauses provided by the European Commission.

Data retention
In general, personal data will be kept for the time strictly necessary to pursue the purposes for which they were collected and processed, including the retention period provided for by the applicable legislation and, in any case, for a maximum period of 10 years from the termination. of the relationship between the Data Controller and an data subject, for a maximum period of 2 years or until revocation for the purposes in which his consent is required, without prejudice to the possible need for the Data Controller to defend his own right in court.
Rights of data subject
Pursuant to art. from 15 and following of EU Regulation 2016/679, the data subject may, according to the methods and within the limits established by current legislation, exercise the following rights:
• request confirmation of the existence of personal data concerning him (right of access);
• know its origin;
• receive intelligible comunication;
• have information about the logic, methods and purposes of the processing;
• request the updating, rectification, integration, cancellation, transformation into anonymous form, blocking of data processed in violation of the law, including those no longer necessary for the pursuit of the purposes for which they were collected;
• as well as, more generally, to exercise all the rights recognized by the current provisions of the law.

The exercise of rights may take place by sending a request that must be addressed without any formalities to the Data Controller at the addresses indicated above.
Before providing an answer, the Data Controller may need to identify the data subject, by requesting to provide a copy of his identity document.
Written feedback will be provided without undue delay and, in any case, no later than one month from receipt of the request.

Complaint
In the event that the data subject believes that the processing of their personal data violates the provisions of the GDPR, they have the right to lodge a complaint with the Supervisory Authority, pursuant to art. 77 of the GDPR itself, as well as appealing to the judicial authority.
Text updated at xx/06/2022
Version 1.0