PRIVACY POLICY
Information provided to Users of the website pursuant to Article 13 of the European Regulation No. 679/2016
This Privacy Policy describes how Pathos srl, in its capacity as Data Controller, processes the personal data of users accessing the website https://www.laprosciutteria.com/ (hereinafter also referred to as the “Website”), as well as customers, potential franchisees, suppliers, and job applicants.
This Privacy Policy is provided pursuant to Article 13 of EU Regulation 679/2016 (General Data Protection Regulation – GDPR); it also complies with Recommendation No. 2/2001 adopted on 17 May 2001 by the European Data Protection Authorities gathered in the Working Party established under Article 29 of Directive 95/46/EC, which identified minimum requirements for the online collection of personal data, in particular the methods, timing, and nature of the information that data controllers must provide to users when they connect to web pages.
This document refers exclusively to the WEBSITE https://www.laprosciutteria.com/ and does not extend to other websites that users may consult via the Website.
We strongly recommend that you carefully read this Privacy Policy before browsing the Website and/or providing your personal data in the “contact” section forms.

1 – WHO IS THE DATA CONTROLLER?
Pathos srl (Tax Code and VAT No. 06659420480), with registered office in Montespertoli (FI), Via Ribaldaccio 100, is the Data Controller (hereinafter also referred to as the “Company” or “LA PROSCIUTTERIA”).

2 – WHAT PERSONAL DATA DO WE PROCESS?
Depending on the type of relationship, the Company may collect various categories of personal data. Pursuant to Article 4 of EU Regulation No. 679/2016 (“GDPR”), personal data means any information relating to an identified or identifiable natural person.
2.1. Data collected through the Website
Through the use and interaction with the Website, the Company collects various types of personal data. Please note that PATHOS will process such data differently depending on whether the user is simply browsing the Website or accessing its full features by creating an account.
Specifically, PATHOS may process:
Data voluntarily provided by the User via the Website forms, including:
To request simple information about products and/or sales outlets (email address required).
To request information about franchising: personal details, contact data (email and phone), date of birth, registered office, financial availability for initial investment, previous professional activities, languages spoken, geographical area of interest.
To submit a job application: name, email, and curriculum vitae. The CV may contain personal data such as name, surname, email address, phone number, professional and work details, as well as sensitive data (e.g., belonging to protected categories under Law 68/99). The Company assumes that these data refer to the applicant submitting them. Therefore, the applicant fully indemnifies the Company against any claims or disputes by third parties whose personal data have been processed unlawfully.
Data provided for placing an order for in-store collection or home delivery via third-party delivery services. For collection, only name and phone number are required. For home delivery, personal data are provided directly to the delivery platform, acting as an independent Data Controller. PATHOS will retain only the customer’s name and email for its legitimate interests (see paragraph 4).
Browsing data: these include data automatically collected by the Website’s IT systems, whose transmission is implicit in Internet communication protocols. Such data may include IP addresses, domain names, URI addresses, request times, request methods, file size, server response codes, operating system, browser type, device identifiers, language settings, ISP, and other technical parameters. Although collected anonymously, such data could allow user identification if combined with third-party data.
Cookies: for specific details on cookies and their processing, please refer to the dedicated Cookie Policy available at: https://www.laprosciutteria.com/privacy-policy/.
2.2. Data of clients and suppliers
For clients and suppliers, the Company processes identifying and contact details (name, surname, address, email, phone number) necessary for contractual performance and related obligations.

3 – FOR WHAT PURPOSES DO WE PROCESS YOUR DATA?
3.1. Website data are processed for:
Proper provision of Website services, as set out in the Terms of Use;
Order management and fulfilment;
Sending of commercial communications regarding the Company’s products;
Responding to information requests;
Monitoring and analysis (aggregated or anonymous) to verify traffic and improve system performance;
Compliance with legal obligations;
Establishment, exercise, or defence of legal claims.
3.2. Client and supplier data are processed for:
Full and correct performance of contractual obligations;
Fulfilment of legal obligations, including tax obligations;
Establishment, exercise, or defence of legal claims.
3.3. Job applicant data are processed solely to evaluate applications and potential employment or collaboration.

4 – WHAT ARE THE LEGAL BASES FOR PROCESSING?
Processing is lawful where it falls under one of the legal bases provided by Article 6(1) GDPR:
(b) performance of a contract or pre-contractual measures;
(c) compliance with legal obligations;
(f) legitimate interests pursued by the Controller (e.g., sending information about products of interest, based on past purchases, under Article 130(4) of Legislative Decree No. 196/2003). The data subject may object at any time by emailing comunicazione@laprosciutteria.com.
For special categories of data (Article 9 GDPR), processing may also occur under:
(f) establishment, exercise, or defence of legal claims;
(g) reasons of substantial public interest under EU or Member State law (e.g., employment obligations).

5 – HOW ARE YOUR DATA PROCESSED?
Data are mainly processed electronically, but paper-based processing may also occur. In both cases, the Company applies high standards of data protection in compliance with paragraph 6 below.

6 – HOW ARE YOUR DATA PROTECTED?
The Company implements technical and organisational security measures in accordance with Article 32 GDPR to prevent misuse, unlawful access, or loss of data.

7 – WHO MAY ACCESS OR RECEIVE YOUR DATA?
Your data may be accessed or communicated to:
Third-party companies or individuals acting as external Data Processors;
Third-party delivery platforms (independent Controllers) for product delivery;
Technical staff for hardware/software maintenance, couriers for order delivery;
Employees and collaborators of the Controller, duly authorised;
Authorities under applicable laws and regulations.
The updated list of Data Processors is available on request at comunicazione@laprosciutteria.com.

8 – IS THE PROVISION OF DATA MANDATORY?
The provision of personal data depends on the type of processing:
Mandatory for orders and contractual relationships (name, surname, email, phone, delivery address, billing data). Failure to provide may result in non-performance.
Mandatory email address for information requests.
Cookies: please refer to the Cookie Policy.
Browsing data are automatically collected by the system.

9 – HOW LONG ARE YOUR DATA RETAINED?
Data are stored for the period necessary to fulfil the above purposes, in compliance with Article 5(1)(e) GDPR:
10 years after contract termination (or as required by law);
Email addresses for commercial communications: until objection is expressed;
Email addresses for information requests: until the request is fulfilled;
CVs: for one year after receipt.

10 – CAN DATA BE TRANSFERRED OUTSIDE THE EEA?
Yes. Some data may be transferred to IT service providers outside the European Economic Area (EEA). In such cases, all legal safeguards will be implemented (adequacy decision, Standard Contractual Clauses, etc.).

11 – WHAT RIGHTS DO YOU HAVE?
Under Articles 15–21 GDPR, you may exercise the following rights free of charge at any time:
Right of Access;
Right to Rectification;
Right to Erasure (“Right to be Forgotten”);
Right to Restriction of Processing;
Right to Notification;
Right to Data Portability;
Right to Object;
Right to Withdraw Consent.
You may exercise these rights by contacting PATHOS (see contact details below). You also have the right to lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it).

12 – SOCIAL NETWORK INTERACTIONS
The Website incorporates social network plugins and/or buttons, allowing easy content sharing. Such interactions are subject to the user’s privacy settings on the respective platforms.
Users are advised to log out of their social accounts before browsing the Website to prevent data linking. For details, see each platform’s Privacy Policy.

13 – CONTACT DETAILS
Pathos srl
Registered office: Via Ribaldaccio 100, Montespertoli (FI), Italy
Email: comunicazione@laprosciutteria.com
Certified Email (PEC): pathos.srl@arubapec.it

14 – CHANGES TO THIS PRIVACY POLICY
This Privacy Policy may be modified or updated at any time. Changes will be published on www.laprosciutteria.com and will become binding upon publication. Users are invited to regularly check this section for the most recent version.