INFORMATION ON THE PROCESSING OF PERSONAL DATA pursuant to Articles 13 of Regulation (EU) 2016/679

This information is provided in compliance with the European General Data Protection Regulation EU 2016/679 (“GDPR”) and subsequent amendments and/or additions as well as with national legislation or regulations on the processing of personal data applicable from time to time (“Privacy Law”) to ensure that the processing of personal data is carried out in compliance with the rights and freedoms of individuals with particular regard to the protection of personal data.

The term “personal data” means any information relating to a natural person, identified or identifiable, even indirectly, with reference to any other information, including a personal identification number.

The term “processing” means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

The term “data subject” means the natural person to whom the personal data refers.

1. Data controller

General Beverage Srl – Registered office: Galleria del Corso, 1 – 20122 Milan tel. +39 0187 832305 – fax. +39 0187 461368 – VAT number 00645690454 – e-mail: info@iobevo.com  acts as Data Controller (“Controller” or “General Beverage”) of the data for the purposes referred to in paragraph 3.

The Data Controller can be contacted at the following email address: info@iobevo.com.

2. Sources and Type of data processed

The data processed by the Data Controller and collected directly from the website www.iosano.com may include personal information and contact information (name, surname, email, telephone number, address, role, company name, CV and professional data in the event of an application, and any other information voluntarily provided by the interested party).

3. Purpose and legal basis of the processing carried out by the Data Controller

The Data Controller may process the data subject's personal data for the following processing purposes:

1. Purposes strictly related and instrumental to the establishment and management of a contract to which the data subject is a party pursuant to art. 6, paragraph 1, letter b) of the GDPR. Providing personal data does not require consent, but is necessary to complete, execute, or continue the contractual relationship with the Data Controller.
2. Management of relationships with the data subject arising from their requests to use additional content offered on the Data Controller's website. Providing personal data is not mandatory, but refusal to provide it may make it impossible for the data subject to obtain the requested services and/or products and/or content, or receive the features, information, and promotional materials requested from the Data Controller. Providing personal data does not require consent since processing is necessary to perform a free contract to which the data subject is a party, as provided for in Article 6, paragraph 1, letter b) of the GDPR.
3. Through profiling cookies, if accepted by the user via a dedicated cookie banner, profiling activities are performed to analyze user interests and preferences in relation to the type of content downloaded from the site in order to implement targeted marketing activities. Providing data is optional, and its processing requires the data subject's consent.
4. Response to requests for information made by the data subject to the Data Controller. Providing personal data does not require consent since processing is necessary to implement pre-contractual measures adopted at the data subject's request pursuant to Art. 6, paragraph 1, letter b) of the GDPR.
5. Fulfillment of legal obligations, regulations, EU legislation, and provisions issued by authorities authorized by law or by supervisory and control bodies pursuant to Art. 6, paragraph 1, letter c) of the GDPR. Providing personal data for the purposes set out in this section is mandatory, and its processing does not require consent.
6. Anonymous business analysis purposes: to improve our business and services (e.g., measuring customer satisfaction with the quality of services provided and the Data Controller's activities, conducting market research and studies). Providing personal data is not mandatory, and its processing does not require consent due to the Data Controller's legitimate interest in conducting business analysis pursuant to Art. 6, paragraph 1, letter f) of the GDPR.
7. Marketing purposes for the promotion and sale of products and services similar to those already purchased by the data subject (soft spam) through commercial communications sent via email. Providing data is not mandatory, and their processing does not require consent due to the Data Controller's legitimate interest in conducting marketing activities towards its customers pursuant to Art. 6, paragraph 1, letter f) of the GDPR.
8. Own marketing purposes: using automated contact tools (such as unattended calls, email) or traditional contact tools (operated calls), directly or through third-party companies, regarding its products and services: i) transmitting and/or offering by telephone informational, commercial, advertising, and promotional materials, including personalized/specifically of interest based on information obtained from the activity referred to in point 3 above; ii) sending newsletters and invitations to events and initiatives. Providing your data is not mandatory, and its processing requires your consent, which you may give or withdraw for some of the aforementioned activities by writing to the email address below. Failure to provide your personal data will prevent you from receiving information about the products and/or services offered by the Data Controller. However, this will not impact your ability to browse the website or any existing contractual relationship with the Data Controller.
9. Management of the website(s) (statistical analysis). Providing personal data is not mandatory, and their processing does not require consent due to the existence of the Data Controller's legitimate interest in managing its website pursuant to Art. 6, paragraph 1, letter f) of the GDPR.
10. Personnel selection and recruitment activities. Providing personal data is not mandatory, but refusal to provide it may prevent the Data Controller from evaluating the data subject's professional profile for the purpose of establishing an employment relationship. The relevant processing does not require the data subject's consent for the implementation of pre-contractual measures adopted at the data subject's request pursuant to Art. 6, paragraph 1, letter b) of the GDPR.
11. Legal defense: if necessary to establish, exercise, or defend legal claims. Providing personal data is mandatory, and its processing does not require consent due to the existence of the Data Controller's legitimate interest pursuant to Art. 6, paragraph 1, letter f) of the GDPR.
12. The Data Controller will send marketing newsletters to the email address provided by the data subject in a dedicated section of the website. Providing data is optional, and their processing requires the consent , which is necessary to receive the Data Controller's newsletter.
13. Place and method of processing personal data 

In relation to the indicated purposes, the processing of personal data is carried out using manual, computerized, and electronic tools with logic strictly related to the purposes themselves and, in any case, in a way that guarantees the security and confidentiality of the data.

General Beverage will process the data subject's personal data exclusively with technical personnel authorized to do so, primarily using automated and computerized methods, designed to ensure the security and confidentiality of the data, in relation to the purposes for which it is processed, and to prevent unauthorized access to the data. General Beverage does not perform automated decision-making processes.

The collected data is processed at the offices of General Beverage and the service providers identified and appointed, where necessary, as data processors pursuant to Article 28 of the GDPR.

5. Retention of personal data

The data subject's personal data will be retained only for the time necessary to achieve the purposes for which they are collected, in compliance with the data minimization principle pursuant to Article 5.1.c) of the GDPR.

Specifically, regarding processing for marketing purposes, data will be processed and retained until the data subject withdraws their consent. In any case, the data subject may always request that the processing be interrupted or their data be deleted, as provided below.

The Data Controller may retain some data even after the termination of the relationship depending on the time necessary to manage specific contractual or legal obligations, as well as for administrative, fiscal and/or contributory purposes, for the period of time required by applicable laws and regulations, as well as for the time necessary to assert any rights in court.

In any case, the data is processed not only in compliance with current legislation, but also according to the confidentiality standards to which the Data Controller has always aspired.

Retention periods will vary depending on the type of data processed, but, in general, General Beverage refers to these criteria to determine the retention period:

• If there is a legal or contractual need to retain the data.
• If the data is necessary to provide your services.

6. Categories of subjects to whom the data may be communicated

The Data Controller may communicate the data subject's personal data to third parties in compliance with legal obligations and to service providers who will operate as independent Data Controllers or will be designated as Data Processors pursuant to Article 28 of the GDPR where they process data on behalf of the Data Controller and are essentially included in the following categories listed by way of example and not exhaustively:

• entities that provide banking services, including those involved in the management of payment systems;
• individuals, companies, associations, or professional firms that provide services or assistance and consultancy to the owners, with particular but not exclusive reference to accounting, administrative, legal, tax, financial, and commercial matters;
• business, marketing, legal partners, technical service providers and/or software platform providers, system administrators, hosting providers, IT companies, communications agencies;
• entities that carry out control, auditing and certification of the activities carried out;

The updated list of names of the entities to whom the personal data of the interested parties may be communicated and/or transferred is available from General Beverage by contacting us at: General Beverage Srl – Registered office: Galleria del Corso, 1 – 20122 Milan tel. +39 0187 832305 – fax. +39 0187 461368 – VAT number 00645690454 – e-mail: info@iobevo.com.

For descriptive and illustrative purposes, the following subjects are indicated:

Google Analytics

https://www.brevo.com/it/ for newsletter management

Google Drive

https://www.wpbot.pro/, informative chatbot

https://www.gravityforms.com/ and https://ninjaforms.com/ for form management

https://www.pipedrive.com/it for managing business contacts

7. Transfer of data outside the EU

Any transfer of data to third countries outside the EU for the purposes indicated in paragraphs 3 and 4 above may occur in compliance with the methods permitted by applicable law and, in particular, in accordance with the provisions of the GDPR: i) Art. 44 – General principle for data transfers; ii) Art. 45 – Transfer based on an adequacy decision; iii) Art. 46 – Transfer subject to adequate safeguards; iv) Art. 49 – Exceptions in specific situations.

8. Rights of the interested party

Pursuant to Articles 15-22 of the GDPR, data subjects are granted specific rights. Specifically, the data subject may obtain from the Data Controller: access, rectification, erasure, restriction of processing, withdrawal of consent, and data portability of their data. The data subject also has the right to object to processing for legitimate reasons and/or for commercial purposes.

The Data Controller undertakes to respond to the interested party as soon as possible after having verified their identity where necessary.

If the right to object is exercised, the Data Controller reserves the right not to follow up on the request, and therefore to continue processing, if there are compelling legitimate grounds for processing that prevail over the interests, rights, and freedoms of the data subject.

As for marketing purposes, the interested party who has given his or her consent remains entitled to:

• to request, at any time and free of charge, to receive communications exclusively through traditional contact methods such as operator calls;          
• To object, at any time and free of charge, to the processing of data for the aforementioned purposes. In this case, the right to object to data processing through automated contact methods (such as email and unattended telephone calls) extends to traditional contact methods (such as operator-assisted telephone calls);
• to object, at any time and free of charge, to the processing of data for the aforementioned purposes only in part, that is, by expressing a choice on the contact methods.

The above rights may be exercised by sending written communication to the Data Controller at the following email address: General Beverage Srl – Registered office: Galleria del Corso, 1 – 20122 Milan tel. +39 0187 832305 – fax. +39 0187 461368 – VAT number 00645690454 – email: info@iobevo.com

The interested party is informed that, pursuant to Article 12 of the GDPR, if the interested party's requests are manifestly unfounded or excessive, in particular because of their repetitive nature, the Data Controller may: a) charge a reasonable fee, taking into account the administrative costs of providing the information or communications or taking the requested action, or b) refuse to act on the request.

The interested party also has the right to lodge a complaint with the Italian Data Protection Authority.

9. Links to other websites

The site may contain links to other websites. However, once you use these links and leave this site, General Beverage has no control over those other websites. General Beverage cannot be held responsible for the protection and privacy of any information you provide while visiting such other sites. We recommend that you carefully read the privacy policy applicable to the site in question.

10. Changes to this privacy policy

General Beverage reserves the right to make changes to this policy at any time by notifying interested parties on this page. If you do not accept the changes made to this policy, you must cease using this site and may request that General Beverage remove your personal data.