Gummy Industries S.r.l., with a registered office in Viale Venezia 20, 25123 – Brescia (BS), as Data Controller, protects the personal data provided by you while browsing and using this site, by ensuring confidentiality and compliance with applicable legislation and guarantees the necessary level of protection against any event that might put them at risk of being breached. According to Article 13 of the General Data Protection Regulation of the European Union (GDPR), Gummy Industries informs you that your personal data collected through this website will be processed using computer and/or telematic tools for the purposes indicated below in this policy.

1. TYPES OF PERSONAL DATA BEIN PROCESSED
The computer systems and software procedures used to operate this website acquire, during their normal operation, some personal data whose transmission is implicit in the Internet communication protocols’ use. Accordingly, by way of example, the following personal data may be processed:

• Browsing Data: This category of data includes IP addresses or domain names of computers and terminals used by users, addresses in URI/URL (Uniform Resource Identifier/Locator) notation, the time of the request, the method used to send the request to the server, the size of the file obtained in response, the numerical code indicating the status of the response given by the server (successful, error, etc.) and other parameters related to the user’s operating system and computing environment.

These data, which are necessary for the use of the web services, are also processed to:

-Obtain statistical information about the use of the services (most visited pages, number of visitors by time slot or day, geographical areas of origin, etc.);

-Monitor the proper functioning of the services on offer.

• Data provided by the user: such as the personal information you provide through the “click this week” form to subscribe to the newsletter. The optional sending of such a request, by filling in and sending the form on this website, implies the acquisition of your personal data, for details of which please refer to the specific information available at the following link: https://substack.com/privacy
• Cookies and other tracking systems: for details about the cookies used by this website, please refer to the extended COOKIE POLICY at the following link: https://gummyindustries.com/en/cookie-policy/

2. PURPOSE AND LEGAL BASIS OF PROCESSING
Your personal data will be processed for the following purposes:
a) To enable the access and use of this website, as well as to carry out the maintenance and technical support necessary for its proper functioning;
b) To allow the Data Controller to respond to your newsletter subscription request submitted through this site. The legal basis for the processing referred to in point (a) of this paragraph is the following: Art. 6.1(f) GDPR: the processing is necessary for the purposes of pursuing the legitimate interests of the controller or of a third party.

For the legal basis of the processing referred to in point (b) of this paragraph, please refer to what is contained in the dedicated policy available at the above link.

3. PROCESSING MODALITIES
Personal data objects of the processing are collected directly by the Data Controller or by third parties expressly authorized by the Data Controller or are communicated by the Data Controller to such third parties for the purposes indicated in point 2.

The processing of personal data is mainly carried out with the help of computer tools by people inside and outside the company of the Data Controller duly authorized and instructed for this purpose, in a manner, and by appropriate means to ensure the security and confidentiality of such data, in accordance with the provisions of the GDPR.

The Data Controller carries out regular checks to ensure that personal data not necessary for the processing and its purposes are not collected, filed, or stored, as listed in point no. 2 of this policy.

4. PERSONAL DATA RECIPIENTS
Personal data processed for the purposes set out in point 2 of this policy may be disclosed:

• To duly authorized internal parties of the Data Controller’s organization for the parts of the processing within their respective competence;
• To external parties who act as data processors on behalf of Gummy Industries, such as:
  -information societies and IT support companies;
  -IT infrastructure and solution providers;
  -web service providers;

The communication concerns the categories of personal data whose transmission to the aforementioned third parties is necessary to carry out the activities and for the purposes indicated in this policy.

An up-to-date list of Data Processors and Authorized Persons is kept at the Data Controller’s office and is available upon request by sending an e-mail to privacy@gummyindustries.com

Your consent is not required for the communication processing of your personal data described in this paragraph, since the same will be carried out for the performance of obligations arising from your request(s).

Your personal data may be disclosed to public bodies, institutions, and authorities acting as autonomous Data Controllers in accordance with applicable laws or to comply with mandatory provisions.
Under no circumstances will your personal data be disclosed to other categories of third parties (other than those mentioned above) and will not be subject to dissemination operations.

5. EXTRA EU/EEA TRANSFER 
The Data Controller will not transfer your personal data abroad (the term “abroad” is to be understood as any country not part of the European Economic Area). The management and storage of your personal data will occur on servers of the Data Controller and/or third-party companies duly appointed as Data Processors, located within the European Union. Except for the transfers described in the preceding paragraphs, some of your personal information resulting from the use of cookies and other tracking tools will be shared with recipients that may be located outside the European Economic Area. The Data Controller ensures that your personal data is processed by such recipients following applicable data protection legislation. Such transfers may be based on an adequacy decision or standard contractual clauses approved by the European Commission. You can request more information about this at: privacy@gummyindustries.com

6. DATA RETENTION
Your personal data will be processed by the Data Controller for the time necessary to achieve the purposes for which they were collected, as indicated in point 2 of this policy.

Concerning the purpose stated in point 2 letter a), browsing data will not be stored on the Owner’s systems for more than seven (7) days (except in the case of the need to investigate crimes by the judicial authority).

For details on the conditions of storage of personal data concerning you referred to in point 2(b), please refer to what is contained in the specific information available at the links above.

Once the above time limits have expired, the Data Controller will delete the data concerning you.

Where there are specific legal requirements, longer retention periods may apply, or if the Data Controller is required to do so by any governmental authority or for any other reason to protect your rights or the rights of the Data Controller.

7. YOUR RIGHTS
Under EU Regulation 2016/679, you have the right to:

• obtain confirmation of the processing of your personal data carried out by the Data Controller;
  access to and know the origin of your personal data (if your personal data is not collected directly from you but from third parties), the purposes of the processing, the Data Subjects to whom the data are communicated (recipients), the data retention period, or failing that, the criteria for determining it;
• obtain the rectification of your personal data;
• obtain the deletion of your personal data from the Data Controller’s databases if they are no longer necessary for the purposes for which they were collected or if the processing is unlawful, and in the other cases referred to in Article 17 of the GDPR;
• limit the processing of your personal data e.g. where its accuracy is disputed, for the period necessary for the controller to verify its accuracy, and in all other cases referred to in Article 18 of the GDPR;
• receive the personal data concerning you in electronic form to be able to communicate them to another Data Controller (portability).

You may exercise your rights by writing to the Controller at: privacy@gummyindustries.com.

The Data Controller shall act promptly and within one month of receiving the request at the latest. This period may be extended by two months. In this case, the Data Controller will always inform you within thirty days of the reasons for the extension.

8. COMPLAINT
You have the right to lodge a complaint to the Data Protection Authority. In the event that you reside in another member state, or if the violation of personal data protection regulations occurs in an EU country other than the one where Gummy Industries S.r.l. is based, you are required to complain to the competent authority responsible for overseeing compliance with data protection laws in that respective country.

Filing the Complaint shall not prevent any other legal action.

9. CHANGES TO THIS PRIVACY POLICY
The Data Controller reserves the right to make changes to this Privacy Policy at any time by notifying users on this website. Therefore, please check this page often, and refer to the last revision date at the bottom of the document. You may request the Data Controller to delete your personal data if you do not agree with the changes made to this Privacy Policy. Unless otherwise stated, the previous Privacy Policy will continue to apply to personal data collected up to that point in time.