PRIVACY POLICY
1. INTRODUCTION
Birrificio del Ducato may process your personal data in various situations, in particular when:
- you visit one of its websites or social media profile,
- you make a purchase at the shop or on the webshop,
- you subscribe to the newsletter,
- you visit its sites and offices,
- you participate in an event that it organizes or of which it is a commercial partner,
- you participate in a contest that it organizes,
- you represent (or are) a supplier, a customer (bars, restaurants, etc.), or a business partner,
- you are applying for a position.
With this policy, Birrificio del Ducato wishes to specify the rules and principles that it applies in the processing of your personal data.
“Processing” means any operation or set of operations applied to personal data, regardless of the process used (such as collection, recording, organization, structuring, storage, adaptation or modification, consultation, use, dissemination, etc.).
This policy complies with European regulations on the protection of personal data, and in particular Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (hereinafter, the “GDPR“).
2. DATA CONTROLLER
Birrificio del Ducato, with registered office at [strada argine, 43 – 43019 – Soragna (PR)], under company number [02389170347], is data controller within the meaning of the GDPR.
3. CATEGORIES OF PERSONAL DATA PROCESSED
The categories of personal data that may be processed by Birrificio del Ducato are as follows:
categorieS | Non-exhaustive list of examples |
Identification Information |
Surname, first name, date of birth, languages, postal address, email address, telephone number, photos / videos, ... |
|---|---|
Navigation information |
IP address, page(s) viewed, how often, at what time,... |
Financial Information |
Account number, payment method, banking institution, remuneration, ... |
Working Life Information |
Position, place of work, studies, training, career path, etc. |
Private Life Information |
Participation in an event or competition, orders on the webshop, visits to the brewery, etc. |
Correspondence |
Emails, letters, online forms, ... |
Birrificio del Ducato processes only personal data that is adequate, relevant and necessary for the purposes for which it is processed, and ensures that it is accurate and, if necessary, updated.
4. PURPOSES AND LEGAL BASIS
The processing of personal data is carried out for various legitimate purposes listed in the table in Appendix 1, which specifies the legal basis on which each of these purposes is based.
5. CATEGORIES OF RECIPIENTS
Birrificio del Ducato may use subcontractors for the processing of certain data, such as data storage, data management and data analysis providers. Birrificio del Ducato requires them to comply with all applicable laws and regulations concerning data protection and privacy, including the GDPR. A contract is always concluded between Birrificio del Ducato and each subcontractor for this purpose.
Birrificio del Ducato is part of the international group Duvel Moortgat, with registered office at Breendonk-Dorp 58, 2870 Puurs, registered in the register of legal entities in Antwerp, county of Mechelen, under company number 0400.764.903. Personal data may be transferred to other group entities and subcontractors located in a country of the European Union or outside the European Union. In the event of a transfer to a country outside the European Union, special measures are put in place to ensure the protection and security of this data.
Birrificio del Ducato takes appropriate technical and organizational measures to ensure adequate security of personal data and its protection against unauthorized or unlawful processing, as well as against unintentional loss, destruction and damage. The subcontractors used by Birrificio del Ducato for the processing of personal data provide sufficient guarantees as to the implementation of these measures.
7. HOW LONG WE STORE YOUR DATA
Birrificio del Ducato retains personal data for no longer than is necessary for each purpose. For more details, you can consult the table in Appendix 1.
8. RIGHT OF DATA SUBJECTS
Data subjects have the right, under the conditions set out in the GDPR, to:
- request from Birrificio del Ducato access to the personal data concerning them, their rectification or deletion, or a restriction of their processing;
- receive their personal data in a structured, commonly used and machine-readable format,
- transmit this data to another controller without hindrance from Birrificio del Ducato;
- object to the processing of personal data concerning them;
- lodge a complaint with a supervisory authority if they consider that the processing of personal data concerning them constitutes a violation of the GDPR.
9. DO YOU HAVE ANY QUESTIONS?
If you have any questions about this Privacy Policy or your rights, you can send a request for information via the following link: https://login.mission-rgpd.com/moovapps/easysite/workplace/demande-droit?token=UkhWMlpXdz0%3D&lg=en
ANNEX 1
Purposes and sub-purposes | Legal basis | Data concerned | Retention period |
|---|---|---|---|
Recruitment Management Receive and analyze applications/CVs Contact Candidates Arrange interviews Negotiate terms |
Legitimate interest (to recruit staff for the company) |
Identity information Financial Information Private Life Information Working Life Information Correspondence |
As a general rule, for a maximum period of 2 years from the end of the recruitment period |
Management of customers (bars, restaurants, etc.), suppliers and business partners Negotiate contracts with contact persons Monitor contracts and ensure compliance |
Negotiation/performance of a contract | Financial Information Private Life Information Working Life Information Correspondence |
As a general rule, for a maximum period of 5 years from the end of the negotiation period/contract |
Accounting management Management of invoices and other accounting documents |
Legal Obligation |
Identity information Financial Information Private Life Information Working Life Information |
As a general rule, for a period of 10 years |
Pre-Litigation & Litigation Management Management of pre-litigation and litigation with customers, suppliers, business partners, consumers, etc. |
Legitimate interest (to defend the interests of the company) |
Identity information Financial Information Private Life Information Working Life Information Correspondence |
As a general rule, for a maximum period of 5 years from the end of the (pre)litigation |
Website Management Follow up on requests submitted via the contact form Manage strictly necessary and functional cookies Manage optional cookies (marketing and statistics) | Performance of a contract Performance of a contract Consent | Identity information Private Life Information Working Life Information Correspondence Navigation information Navigation information | As a general rule, for the period necessary to process the request and maximum for 5 years after See cookie policy See cookie policy |
Shops management (online and physical) Track orders Follow up on claims/special requests |
Performance of a contract | Identity information Private Life Information Working Life Information Correspondence | As a general rule, for the period necessary to process the order and maximum for 5 years after If the data subject has created an account: for as long as the data subject does not delete this account |
Brewery tour Management Register bookings Organize visits Survey satisfaction |
Legitimate interest (to promote the company and products) | Identity information Private Life Information Working Life Information Correspondence |
As a general rule, during the period necessary for the organization of the visit and maximum for 5 years after If the data subject has created an account: for as long as the data subject does not delete this account |
Events and Activations Management Register participants Ensure that things are running smoothly Survey satisfaction |
Legitimate interest (to promote the company and products) |
Identity information Private Life Information Correspondence |
As a general rule, for the period necessary for the organization of the event/activation and maximum for 5 years after |
Security Management Ensure the security of company buildings and assets through video surveillance |
Legitimate interest (to ensure security) |
Identity information |
As a general rule, for 1 month from the date of the video |
Online Contest Management & Activations Notify the winner and send them the prize |
Performance of a contract |
Identity information Private Life Information Correspondence |
As a general rule, for the period necessary for the organization of the competition/activation and maximum for 5 years after |
Communication Management Send the newsletter for products/services that are not similar to products/services already ordered Send the newsletter for products/services similar to products/services already ordered Communicate about new products in the company (e.g. a new beer, a new partnership, etc.) Share visual content (photos/videos) Interact with followers on social media | Consent Legitimate interest (to promote the company's news) Legitimate interest (to promote the company's news) Performance of a contract when it is the subject of a contract Legitimate interest (to share content with which the company is actively associated) in the cases referred to in Article 9.2 (e) of the GDPR Consent in other cases Legitimate interest (to promote the company's news) | Identity information Identity information Identity information Working Life Information Identity information Identity information Private Life Information Correspondence | For the duration of the consent As long as the person does not object to the processing For the website: lifetime of the website or post For social media: lifetime of the account or post During the term of the contract or consent, and not more than: For the website: lifetime of the website or post For social media: lifetime of the account or post During the lifetime of the account |
Management of personal data Management of personal data Dealing with data subject requests Generate aggregated statistics | Legal obligation (GDPR) Legitimate interest (to understand customers and consumers) | Identity information Correspondence Identity information Navigation information Private Life Information Working Life Information | As a general rule, for the period necessary to process the request and for a maximum of 5 years after As a general rule, deletion when the data subject has not had any further interactions with the company for a period of at least 6 months |
