Pravila zaštite privatnosti

www.risogallo.it

Pursuant to artt. 13 and ss. General Data Protection Regulation no. 2016/679 (“GDPR”)

Introduction

Dear User,

When you access and browse this website (hereinafter referred to as the “Website”), certain personal data about you is collected, stored and managed (hereinafter referred to as “processed”) through the device you are using. This includes the analysis and storage of your IP address, browsing data, “cookies” and other onlineidentifiers, such as “pixels”.

In light of these processing activities and to comply with the applicable regulations governing the protection, confidentiality and security of your data, Riso Gallo S.p.A. sets out below the purposes and methods ofprocessing in its capacity as Data Controller.

Data Controller

The processing of personal data resulting from access to and interaction with the Website will be carried out by Riso Gallo S.p.A., acting as Data Controller, with registered office in Robbio (PV), Viale Riccardo Preve 4, Tax ID 07509770587, and VAT number 01407630183.

Riso Gallo S.p.A. can be contacted:

- by writing and e-mail to privacy@risogallo.it

- by ordinary mail to the address indicated above

Categories of data processed

The categories of data processed are as follows:

- technical information regarding the User and the devices used, for the purpose of navigating the Website (*)

- additional information regarding browsing activity on the Website, including “online identifiers” (cookies, pixels, tracking elements, etc.), also for the purpose of user profiling

- personal identification and contact data such as, for example, first name, last name, email address, physical address, and phone number, when using the Website’s features (*)

- billing data, such as Tax ID, VAT number, or other tax information necessary for billing the requested
products and services (*)

- additional data in the event of the implementation of new features

Consequences of failure to provide data

Providing the personal data marked as mandatory (*) is necessary to achieve the relevant purposes. Failure to provide such data will make it impossible to proceed with the related processing.
Providing other personal data is optional. Failure to provide this additional data may result in an inability to access certain functions or features of the website. Regarding marketing and profiling purposes, as well as “online identifiers” that are not strictly technical, consent to processing personal data is optional. There is no legal or contractual obligation for the User to provide this data or to consent to its processing for these purposes.

Purposes, Legal Bases, and Data Retention Periods

In the list below, the Data Controller details the specific purposes for which personal data is processed, along with the relevant legal basis for each purpose and the maximum data retention period, if the latter can be specified precisely - if not, the retention criteria on which the relevant technological tool was based are indicated.

1. Purpose: providing navigation features for the Website, its pages, and its content
   
   Legal Basis: 6 (1) (b), in order to take steps at the request of the User prior to entering into a contract
   
   Data retention: for the duration of the User’s visit to the Website, up to a maximum of 24 months
   
   
2. Purpose: registration and access to the member area by the User
   
   Legal Basis: 6 (1) (b), in order to take steps at the request of the User prior to entering into a contract and for contractual activities
   
   Data retention: until the User requests the deletion of your account or exercises any other right granted by applicable law
   
   
3. Purpose: management of e-commerce purchases, including subsequent product handling and delivery, returns, and refunds
   
   Legal Basis: 6 (1) (b), in order to take steps at the request of the User prior to entering into a contract and for contractual activities
   
   Data retention: for up to 10 years after the User has been removed from the eCommerce platform
   
   
4. Purpose: processing and storage of personal data for the purpose of maintaining accounting records and complying with accounting, tax, and administrative obligations
   
   Legal Basis: 6 (1) (c), for compliance with a legal obligation to which the Data Controller is subject
   
   Data retention: for up to 10 years from the end of the contractual relationship or interaction with the User (Art. 2220 of the Italian Civil Code), unless a different retention period is provided for by the applicable law.
   
   
5. Purpose: feedback to contact requests or information requests submitted by the User
   
   Legal Basis: 6 (1) (f), for the purpose of the legitimate interests pursued by the Data Controller in maintaining contacts with those who use the Website
   
   Data retention: until the end of the relationship with the User, and for a maximum of 10 years thereafter
   
   
6. Purpose: sending commercial communications to the User
   
   Legal Basis: 6 (1) (a), based on the consent given by the User
   
   Data retention: Until the User withdraws their consent
   
   
7. Purpose: to allow the User to participate in surveys, polls, market research, and, more generally, statistical surveys conducted by the Data Controller or third parties
   
   Legal Basis: 6 (1) (a), based on the consent given by the User
   
   Data retention: until the User withdraws their consent
   
   
8. Purpose: handling unsolicited enquiries from Users of the Website by sending communications
   
   Legal Basis: 6 (1) (b), in order to take steps at the request of the User prior to entering into a contract
   
   Data retention: for a maximum period of 12 months from the end of the selection process, unless further retention is necessary or the User has given their consent.
   
   
9. Purpose: analysis of Website usage statistics and improvement of the Website’s features through technologies that involve data processing in accordance with Directive 2002/58/EC
   
   Legal Basis: 6 (1) (a), based on the consent given by the User
   
   Data retention: until the expiration of the online identifier linked to the User that is retained for the longest period, unless the User requires erasure or anonymization
   

    

10. Purpose: analysis of Website usage statistics and improvement of the Website’s features, to which Directive 2002/58/EC does not apply due to their specific technical functioning

    Legal Basis: 6 (1) (f), for the purpose of the legitimate interests pursued by the Data controller, aimed at improving its products and services
    
    Data retention: for the period strictly necessary to fully anonymize the personal data processed
    
    
11. Purpose: newsletter subscription and subsequent management of related communications
    
    Legal Basis: 6 (1) (a), based on the consent given by the User
    
    Data retention: until the User requests cancellation, given the time to process the request
    
    
12. Purpose: sending commercial communications and information to the User regarding news, promotions, and offers related to the products or services covered by the transaction, or to similar products and services (“Soft Spam”)
    
    Legal Basis: 6 (1) (a), for the pursuit of the Data Controller’s legitimate interests pursuant to and within the limits set forth in Article 130 of the Italian Legislative Decree no 196/2003 (“Codice Privacy”), and subsequent amendments
    
    Data retention: until the User exercises the right to object, as communicated in accordance with the procedures established by the Data Controller, and in any case for a maximum of 24 months from the last purchase of products or services.
    
    
13. Purpose: analysis of the User preferences and consumer behaviors, with the aim of offering personalized promotions and services (“Profiling purposes”)
    
    Legal Basis: 6 (1) (a), based on the consent given by the User
    
    Data retention: 1 year and 24 days, unless the User withdraws their consent.
    
    

Further information regarding how personal data are processed

If the User wants to obtain further information regarding the balancing of the legitimate interests pursued by the Data Controller and their fundamental rights and freedoms, they may contact the Data Controller at the contact details provided above. They have the right to receive a response as soon as possible and, in any case, within the time limits established by law.

In the event of a dispute with the User or with third parties, and in case of an audit by the relevant Authorities, the retention period may be extended until the expiration of the last applicable statute of limitations.

Personal data will not be disclosed in any way, except with the express and prior consent of the User and within the limits provided by law.

Automated decision-making

The processing of personal data through automated decision-making may be carried out in accordance with applicable law, and in particular pursuant to Article 22, paragraphs 1 and 4, of the GDPR, for direct marketing purposes based on the profiling of the User regarding their preferences and consumer behaviors.

In any case, such processing will not result in a legal effect concerning the User or significantly affecting them, unless specific informed consent has been obtained and in any event in compliance with legal limits, including pursuant to Directive 2002/58/EC (“ePrivacy Directive”).

Transfer of personal data outside the European Economic Area

Personal data will be transferred to countries outside the European Economic Area for technical reasons, to entities based in countries recognized as “adequate” by the European Commission - including those participating in the “EU-US Data Privacy Framework” - or to entities that have entered into the Standard Contractual Clauses in their current form as approved by the European Commission.

Rights of the User

The User may, at any time, exercise the rights provided for in European Regulation No. 2016/679. In particular, the User has the right:

- to access their personal data

- to obtain the rectification or erasure of such data or the restriction of processing

- to object to processing, where permitted

- to obtain data portability, where applicable

- to withdraw consent: such withdrawal does not affect the lawfulness of processing carried out based on consent given prior to the withdrawal

- to lodge a complaint with the relevant Supervisory Authority: in Italy, it is the Italian Data Protection
Authority (www.gpdp.it).

The rights listed above may be exercised by sending a request to the Data Controller’s contact information, as indicated above, and specifically to the email address in the “Data Controller” section.

 

***

What are cookies and other tools used by the Website

Cookies are small text files that are transmitted from the Website to the devices of users who visit it, and which are then sent back to the Website during subsequent visits; they may have different characteristics and be used for various purposes, both by the Website owner and by third parties that provide technical services to the Website owner or directly to the User.

The Website uses various types of cookies, in compliance with the “Guidelines on cookies and other tracking tools” issued by the Italian Data Protection Authority (General Provision no. 231 on 10 th June, 2021.

In this regard, cookies can be divided into “first-party” cookies, if installed directly by the Website owner, and “third-party” cookies, where they involve access to features and services offered by other parties.

Some of the cookies used by this Website are “technical” cookies - they are automatically installed when you open the Website - and therefore do not require your consent. Technical cookies are divided into session cookies, which are deleted from your device when the browser and/or browser tab is closed, and persistent cookies, which remain in the device’s memory even after the Website is closed.

The Website also uses cookies - both first-party and third-party - classified as “profiling” cookies with the User’s consent: these are used to personalize and improve the User experience.
Additional elements classified by the GDPR as “online identifiers” are also implemented, and they enable the analysis and monitoring of the Website’s functionality and allow the User to access specific services.

Details of the tools used

A complete and specific list of the cookies used by the Website, including both first-party and third-party cookies, may be requested from the Data Controller.

How to manage cookie settings

The Data Controller has implemented a cookie banner, which provides a tool for selecting and managing cookie settings both upon the User’s first visit and at any time thereafter.

The User may also refer to the following websites for further information:

• www.youronlinechoices.com

• www.allaboutcookies.org

The User can always disable all cookies by adjusting their browser settings; however, it should be noted that changing these settings may render the Website unusable if cookies essential for the provision of our services are blocked.

Additionally, please note that each browser has different settings for disabling cookies. Links to instructions for the most common browsers are as follows:

• Apple Safari 

• Google Chrome

• Microsoft Edge

• Mozilla Firefox

• Opera

Last update on: 4 th March, 2026