PRIVACY POLICY

Identity and contact details of the Data Controller

The Data Controller is Fondazione Barilla (hereinafter “Fondazione Barilla” or “Controller”), with its registered office in Parma at Via Madre Teresa di Calcutta 3/4 – 43122, info@fondazionebarilla.com.

Fondazione Barilla will process your Personal Data in accordance with Regulation (EU) 679/2016 and with the Italian legislation concerning the protection of personal data (hereinafter “Privacy Legislation”).

What Personal Data we process and how we gather them

When you browse the Website and/or access certain sections of the Website, this may entail the gathering and subsequent further processing of your Personal Data by Fondazione Barilla. When connecting to the Site, the computer systems and software procedures used to operate it automatically and indirectly administer and/or acquire certain information (including but not limited to cookies, as specified in the “Cookie Policy”, IP addresses, domain names of the computers used by users who connect to the Site, addresses of the requested resources in URL notation, the time of the request to the server).

Any requests you make for information or services may entail the gathering and subsequent further processing of your Personal Data (such as your given name, surname, postal or email address, password, etc.).

In particular, your Personal Data may also be gathered when you complete online forms on the Website. Should you send a request via the online forms on the Website, the provision of certain Personal Data is required for Fondazione Barilla to fulfill your requirements as part of the Website’s features. The relevant required fields of the registration form are marked with an asterisk or are otherwise noted as mandatory. The provision of Personal Data not marked with an asterisk or otherwise noted as mandatory is purely optional and the lack of, partial or incorrect provision of the said Personal Data will not result in any consequences. Conversely, the lack of, partial or incorrect provision of the Personal Data marked with an asterisk or otherwise noted as mandatory will make it impossible to provide the service you have requested. Should you not complete one or more of the mandatory Personal Data fields, a Fondazione Barilla error message will appear with a list of the missing mandatory Personal Data.

Purposes and legal basis for the processing of your Personal Data

Your Personal Data will be processed for the following purposes only with your consent to the processing, which may be revoked at any time in the manner indicated from time to time by the Data Controller when requesting your consent:

1. Handling of and response to your requests

You may decide to give your consent to the processing of your Personal Data for the handling and response by Fondazione Barilla to your requests in relation to Fondazione Barilla products and initiatives, advertising, or the Website. In relation to this purpose, your consent is required when you send a request. Should you decide not to give consent to the processing of your Personal Data for the said purposes, it will not be possible to continue sending your request.

In addition, even should you not give your consent, Fondazione Barilla may process your Personal Data for the following purposes:

1. handling and fulfillment of the obligations provided for by law (in terms of accounting, administration, tax, etc.);
2. should processing be required for the performance of a contract to which, as the data subject, you are party or in order to take steps at your request prior to entering into a contract;
3. handling of objections and any disputes (over the legitimate interest of the Data Controller).

How we process your Personal Data

The processing of your Personal Data may include any type of operation, including gathering, recording, organization, storage, consultation, processing, amendment, selection, extraction, comparison, use, interconnection, blocking, communication, deletion and destruction.

Your Personal Data will be processed mainly in automated form but also on paper, by means strictly related to the relevant purposes, using databases, electronic platforms managed by Fondazione Barilla or by third parties appointed for that purpose as external data processors and/or integrated computer systems belonging to Fondazione Barilla and the aforementioned third parties and/or websites and/or apps owned or used by Fondazione Barilla.

The Data Controller has assessed the level of security as adequate, taking into account the risks that may arise from loss, destruction, modification, unauthorized disclosure, accidental or illegal access, misuse or alteration of your Personal Data. In particular:

• it has adopted safety measures proportional to the risk;
• it saves your Personal Data on servers located in Europe. In any event, the servers are subject to an advanced daily backup system.

Where we process your Personal Data

Your Personal Data are mainly processed at the offices of the Data Controller and in the places where the Data Processors are located. For further information, contact the Data Controller at the addresses indicated in the “Identity and contact details of the Data Controller” section.

How long we keep your Personal Data

In order to comply with the principles of necessity and proportionality of processing, the Data Controller has identified different retention periods for the Personal Data in relation to the individual purposes:

• for the purpose of handling and responding to your requests in relation to Fondazione Barilla products and initiatives, advertising, or the Website, your Personal Data will be retained for the period strictly necessary to process your request and, in any event, for no more than 18 months;
• for the purpose of handling and fulfillment of the obligations provided for by law (in terms of accounting, administration, tax, etc.), your Personal Data will be retained for the period strictly necessary for that purpose;
• for the purpose of handling objections and any disputes, your Personal Data will be retained for the period strictly necessary for that purpose and, in any event, for no longer than the applicable limitation periods.

Who are the recipients of your Personal Data

Your Personal Data may be communicated to and processed by:

(i) legal or natural persons acting as external data processors, carrying out outsourced activities, appointed by Fondazione Barilla or by Fondazione Barilla’s external processors (including persons entrusted with assistance, communication, marketing, advertising, promotions and sales of products and/or services as well as advertisers, advertising agencies, IT service providers, site managers, electronic platform managers, partners, credit institutions, professional firms);

(ii) employees and/or associates of the Data Controller (including system administrators) who, operating under the direct authority of the latter, will be authorized to process your Personal Data; and

(iii) employees and/or associates of external data processors (including system administrators) who, operating under the direct authority of the external data processors, will be authorized to process your Personal Data.

Your Personal Data will not be disclosed to third parties except in the event that your Personal Data are communicated by Fondazione Barilla to consultants in order to protect their rights, nor disseminated. In the event that you have entered Personal Data in your nickname and/or have also associated your image therewith, Personal Data may however be disseminated via the Website or Social Media.

Transfer of your Personal Data outside the European Economic Area

Your Personal Data will not be transferred outside the European Economic Area, i.e. outside the European Union and Iceland, Norway and Liechtenstein.

Children

Children aged under 16 years must not provide information or Personal Data to Fondazione Barilla without the consent of the holders of parental responsibility for them. Should such consent not be provided, it will not be possible to register the child on the Website. Fondazione Barilla invites all holders of parental responsibility for children to inform them about the safe and responsible use of the Internet and the Web and to follow the procedures indicated during registration on the Website concerning the registration on the Website of subjects aged under 16 years.

Identity and contact details of the Data Processors

The full list of those responsible for the processing of the Personal Data can be consulted by contacting the Data Controller via the details indicated in the “Identity and contact details of the Data Controller” section.

 Your rights with regard to the processing of your Personal Data

The Privacy Policy grants you various rights, as the data subject. In particular, you are entitled to:

1. obtain from the Data Controller confirmation of the existence of your Personal Data or otherwise, even if not yet saved, and their communication in an intelligible form as well as access to your Personal Data (by obtaining a copy) and related information (including the purposes of the processing, the categories and origin of the Personal Data, the categories of recipients to whom they have been or may be communicated, the retention period (when possible), the rights that can be exercised);
2. obtain from the Data Controller the rectification of your Personal Data and the addition to incomplete Personal Data pertaining to you;
3. delete your profile from the Website and, in any event, to obtain from the Data Controller the deletion of your Personal Data without undue delay, for example when the Personal Data are no longer necessary with respect to the purposes for which they were processed or there is no longer a legal basis for the processing thereof;
4. obtain from the Data Controller the transformation into an anonymous form or blocking of Personal Data pertaining to you that have been processed illegally, including when it is not necessary to retain the data in relation to the purposes for which it was gathered or subsequently processed;
5. obtain from the Data Controller the limitation of the processing of your Personal Data, for example should you dispute its accuracy or have objected to the processing, for the period necessary for the respective checks;
6. receive your Personal Data in a structured, commonly used and machine-readable format and to transmit or, if technically feasible, obtain the direct transmission of your Personal Data to another Data Controller without hindrance, in cases where the processing is carried out by automated means and is based on your consent or is necessary for the performance of a contract to which you are a party;
7. withdraw consent to the processing of your Personal Data for any of the purposes for which it has been given.

You are entitled to exercise your rights vis-à-vis Fondazione Barilla by accessing the section that includes the contact details for the Website, by emailing info@fondazionebarilla.com, or by sending Fondazione Barilla a letter by regular mail to the address indicated in the “Identity and contact details of the Data Controller” section.

In addition, in the event that you believe that the processing of your Personal Data breaches Privacy Legislation, you may lodge a complaint with the Data Protection Authority in the State where you reside, where your place of work is located or where the alleged breach has occurred. You may also contact the said Authority to request information regarding the exercise of your rights under the Privacy Legislation.

The right to object to the processing of your Personal Data

At any time and for reasons related to your specific circumstances, you are entitled to object to the processing of your Personal Data (including profiling) as necessary to pursue the legitimate interest of the Data Controller or of third parties. In such a case, the Data Controller should no longer process the Personal Data unless the Controller demonstrates compelling legitimate grounds which override your interests, rights and freedoms or are necessary for the establishment, exercise or defense of legal claims.

Without prejudice to your right to withdraw consent to processing for marketing and profiling purposes, you are entitled to object to the processing of your Personal Data for direct marketing purposes, including profiling, to the extent that it is connected to such direct marketing, by accessing the “Contact Us” section of the Site or by emailing info@fondazionebarilla.com. Should you object to the processing of your Personal Data for direct marketing purposes, the Data Controller may no longer process the Data for the said purposes.