Disclosure pursuant to Article 13 of EU Regulation No. 2016/679 and national legislation on personal data protection (jointly, “Personal Data Protection Regulation”)

The present disclosure enables you, as a web user or customer, to discover how 3D Food S.r.l. shall process personal, contact and payment data you provide when browsing, subscribing to the newsletter, creating a personal account and/or purchasing a product (hereinafter, collectively referred to as “Personal Data”). You are required to read the present disclosure before submitting your Personal Data.

Identity and contact details of the Data Controller

3D Food S.r.l., with registered office in Parma, Via Madre Teresa di Calcutta 3/A, as data controller (hereinafter referred to as “3D Food” or “Data Controller”), belonging to Barilla Group, shall process Personal Data in compliance with the Personal Data Protection Regulation. You may find 3D Food contact details at: privacy-italy@barilla.com.

Contact details of the Data Protection Officer (“DPO”)

The Data Protection Officer appointed by the Data Controller may be contacted at the following e-mail address: dpo@barilla.com.

Purposes of processing and relevant legal bases

Personal Data shall be processed for the following purposes and legal bases:
a. browse the website, create personal accounts, manage product purchase, as well as respond to any requests, having its legal basis in the performance of a contract to which the data subject is a party;
b. only with prior consent that may be withdrawn at any time, store information relating to one or several payment methods to facilitate future purchases;
c. only with prior consent collected on the website and confirmed upon reception of the relevant confirmation e-mail, which may be withdrawn at any time, send commercial and marketing communications or BluRhapsody newsletter relating to 3D Food products, services, events, initiatives etc.;
d. fulfil specific obligations provided for by laws or regulations (for example, accounting, administrative and tax obligations) applying to 3D Food;
e. protect the interests and rights of 3D Food and/or Barilla Group in judicial and/or extrajudicial proceedings (as legitimate interest of the Data Controller).

Processing methods

Personal Data shall be processed mainly in automated form based on logics that are strictly related to the aforementioned purposes, through databases, electronic platforms managed by 3D Food or by third parties appointed for the purpose and, in any case, in such a way as to ensure security and confidentiality of Personal Data. Processing of Personal Data may include any type of operation, including data collecting, consulting, processing, modifying, selecting, extracting, comparing, using, interconnecting, blocking, communicating, transferring, erasing and destroying.
3D Food has assessed the level of security as adequate, taking into account the risks that may result from the loss, destruction, modification, unauthorised disclosure, accidental or unlawful access, misuse or alteration of Personal Data. Namely, 3D Food has implemented security measures that are appropriate to the risks and stores Personal Data on servers located in Europe by means of a state-of-the-art daily back-up system.

Supply of Personal Data

Supply of Personal Data required when purchasing products is necessary for purchase management and, in the absence thereof, 3D Food shall not process the order. On the other hand, supply of Personal Data for other purposes shall be optional.

Personal Data retention periods

Personal Data shall be stored for the time periods described below depending on the relevant individual purposes:

• for website browsing, Personal Data collected through cookies, shall be stored for time periods that are specifically indicated in the Cookie Policy to which reference is expressly made;
• for purchase management, for 10 years from time of purchase;
• for account creation and management, for 5 years from the latest login or from account closure;
• for storage of payment method data to facilitate subsequent purchases, until consent is withdrawn or the personal account is deactivated, as envisaged at the previous point;
• for commercial and marketing communications or BluRhapsody newsletter, until consent is withdrawn or the user objects to the processing or for 24 months from the time of the last renewal of consent. This is without prejudice to the data subject’s right to withdraw consent or to object to processing at any time, by contacting the Data Controller, after which personal data processed for marketing purposes shall be erased;
• for fulfilment of specific obligations provided for by laws or regulations, for the time that is strictly necessary to complete the relevant activities (e.g. 10 years for tax obligations);
• for protection of the interests and rights of 3D Food and/or the companies belonging to Barilla Group in and/or out of court, for the time that is strictly necessary for the aforementioned purpose and therefore until such time as the Data Controller is obliged to retain the data for protection in court and to communicate said data to competent Authorities and, in any case, not beyond the applicable statute of limitations.

Recipients of Personal Data

Your Personal Data may be shared with the entities described below (hereinafter referred to as “Recipients”):

• Entities who typically act as data processors such as individuals, companies (including companies belonging to Barilla Group) or professional firms that provide IT infrastructure or carry out marketing activities on behalf of the Controller;
• Individuals authorised by 3D Food to process Personal Data to carry out activities that are strictly related to purposes indicated above, who have committed themselves to ensuring confidentiality or have adequate legal obligation of confidentiality (e.g. employees of the Data Controller);
• Barilla Group companies for internal administrative purposes;
• Entities who are in charge of shipping and delivering purchased products;
• Entities or authorities to which it is mandatory to communicate your Personal Data for fulfilment of obligations provided for by laws or regulations or in compliance with orders issued by such authorities.

Transfers of Personal Data

Should Personal Data be transferred to Third Countries outside the European Economic Area, the Data Controller shall inform you that transfer will be made using one of the methods envisaged by Articles 44 et seq. of EU Regulation no. 2016/679, such as, for example, adoption of Standard Clauses approved by the European Commission, selection of entities that are part of international programmes for free circulation of data or that operate in countries deemed as safe by the European Commission, in compliance with Recommendations 01/2020 adopted on 10th November 2020 by the European Data Protection Board. Alternatively, transfers may be necessary based on one of the exemptions set out in Article 49 of EU Regulation no. 2016/679, e.g. with the informed consent of the data subject or to perform a contract concluded between the data subject and the Data Controller or pre-contractual measures taken at the request of the data subject, or a contract concluded between the Data Controller and another natural or legal person for the benefit of the data subject, or for important reasons of public interest or to establish, exercise or defend a right in court or, also, to protect the vital interests of the data subject or of other persons in case the data subject is physically or legally incapable of giving consent. Further information may be requested to 3D Food at the following address: privacy-italy@barilla.com.

Rights of the data subject

You may exercise the rights envisaged by the Data Protection Regulation by sending an email to privacy-italy@barilla.com or by contacting the Data Controller at contact details indicated in the paragraph “Identity and contact details of the Data Controller and type of Personal Data processed”.
Namely, you shall be entitled to:

1. obtain from the Data Controller confirmation of the existence of Personal Data, even if not yet recorded, and the relevant communication in intelligible form, as well as access to Personal Data (you shall obtain a copy of it) and to the relevant information (including processing purposes, the classes and origin of Personal Data, the classes of recipients to whom it has been or may be communicated, the retention period, where possible, the rights that may be exercised);
2. obtain from the Data Controller rectification of Personal Data and integration of incomplete Personal Data;
3. obtain from the Data Controller erasure of Personal Data without undue delay, inter alia, when Personal Data is no longer necessary in relation to the purposes for which it was processed or legal basis for processing no longer subsists;
4. obtain from the Data Controller transformation into an anonymous form or blocking of Personal Data processed in breach of the law, including that of which conservation is not necessary, depending on the purposes for which Personal Data was collected or subsequently processed;
5. obtain from the Data Controller restriction of processing of Personal Data, inter alia, when you challenge its accuracy or object to its processing, for the time period required for the relevant verifications;
6. receive Personal Data in a structured, commonly used and machine-readable format, as well as transmit or, if technically feasible, obtain direct transmission of Personal Data to another data controller without let or hindrance, in cases where processing is made by automated means and is based on your consent or is necessary for the performance of a contract to which you are a party;
7. object, at any time and on grounds relating to your specific situation, to processing of your Personal Data that is necessary for the purposes of pursuing a legitimate interest of the controller or a third party. In this case, the controller shall refrain from any further processing of your Personal Data, unless the controller proves the existence of compelling legitimate grounds prevailing over your interests, rights or freedoms, or processing is necessary for the establishment, exercise or defence of legal claims;
8. withdraw any consents given.

Furthermore, if you believe that processing of your Personal Data infringes the Data Protection Regulation, you may lodge a complaint with the Data Protection Authority of the State where you reside, where your place of work is located or where the alleged violation has occurred, and you may also apply to the same Data Protection Authority to request information regarding the exercise of your rights under the Data Protection Regulation; or you may lodge an appeal with the Judicial Authority.