Privacy Policy

Notice on the Processing of Personal Data

Privacy Policy & Cookie Policy

Pursuant to Articles 13–14 of EU Regulation No. 679/2016 (GDPR) and Italian Legislative Decree 196/2003 as amended by Legislative Decree 101/2018

Version v2.2 — [DATE]

Table of Contents

Part A — Privacy Policy

Part B — Cookie Policy

Part A — Privacy Policy

1. Data Controllers and Processing Carried Out Under Joint Controllership

Depending on the service, brand and purpose pursued, personal data may be processed by one or more Gruppo Food companies acting as independent data controllers or, where they jointly determine the purposes and means of processing, as joint controllers pursuant to Art. 26 GDPR.

In particular:

  • Food S.r.l., with registered office at Via Mazzini n. 6, 43121 Parma (PR), Italy, VAT number 01756990345, email amministrazione@gruppofood.com, acts as data controller for data processed in connection with the editorial, commercial, administrative and digital activities of the services and brands it manages;
  • Food Labs S.r.l., with registered office at Via Mazzini n. 6, 43121 Parma (PR), Italy, and operating office at Via Giuseppe Pecchio n. 14, 20131 Milan (MI), Italy, VAT number 06094400964, acts as independent data controller for processing connected to its own services and projects, except where specifically indicated as carried out jointly with other Group companies;
  • Dalcò Edizioni S.r.l., with registered office at Via Mazzini n. 6, 43121 Parma (PR), Italy, VAT number 02841390343, acts as independent data controller for processing connected to its own editorial and commercial activities, except where specifically indicated as carried out jointly with other Group companies.

Processing carried out under joint controllership relates exclusively to activities for which two or more Group companies jointly determine the purposes and means of processing, such as, by way of example, the centralised management of certain commercial initiatives, Group events, shared digital platforms or common databases lawfully used for consistent purposes.

For such processing, the companies concerned have set out, by means of an internal agreement pursuant to Art. 26 GDPR, their respective responsibilities regarding the obligation to provide information, security, the handling of data subjects’ rights and mutual cooperation.

The essential terms of that agreement are available on request by writing to amministrazione@gruppofood.com.

The data subject may in any case exercise their rights against each controller or joint controller involved in the processing that concerns them.

2. Categories of Personal Data Processed

2.1 Identification and contact data

Personal data processed: first name, surname, professional title, role, company, email address, telephone numbers, username, company name, business sector, company size, relevant distribution channel, tax code and VAT number where required for contractual relationships or legal obligations.

2.2 Purchase and payment data

  • Information relating to the purchase of subscriptions, editorial products, advertising space, and participation in the Group’s events, awards and initiatives.
  • Subscription payments are processed through the PCI-DSS certified provider Stripe, to which the user is redirected at the time of payment. The Group does not acquire or store full payment card data. Its own systems retain only the information strictly necessary to manage the contractual relationship, such as the email address, billing postcode and the last four digits of the card used.

2.3 Usage and behavioural data

  • How the Group’s websites, apps and digital platforms are accessed and used.
  • Interactions with newsletters, digital magazines and editorial content (opens, clicks, reading time, sections visited).
  • Participation in the Group’s B2B community events, awards, webinars and initiatives.
  • Editorial preferences, stated professional interests, business sectors.
  • Browsing data, system logs and IP addresses (collected in truncated form where technically possible).
  • Data possibly generated through interaction with artificial intelligence tools made available by the Controller.

2.4 Social log-in data (where active)

  • Information from LinkedIn, Google or other social network accounts used to log in to Group services, within the limits of the privacy preferences set by the data subject.

2.5 Data received from third parties

  • Data communicated by other Group companies within the scope of the joint controllership agreement.
  • Data from publicly accessible sources: the Italian Business Register, professional registers, institutional websites, food and retail sector publications.
  • Data provided by industry business partners, on the basis of the notice given at the time of original collection and, where necessary, specific consent.

3. Purposes of Processing and Legal Bases

3.a) Management of contractual relationships

Collection and processing of data for the management of pre-contractual and contractual stages: provision of subscriptions and editorial services, including access to the Food Mobile App available on the App Store and Google Play; management of advertising campaigns; organisation of events, awards and conferences; invoicing and administrative obligations; responding to information requests; handling complaints.

Legal basis: Art. 6(1)(b) GDPR — performance of a contract. Providing the data marked as mandatory is necessary; failure to do so will make it impossible to proceed with the requested relationship.

3.b) Legal obligations

Fulfilment of obligations under applicable tax, accounting, employment and anti-money-laundering law, and sector-specific regulations applicable to publishing activity.

Legal basis: Art. 6(1)(c) GDPR — legal obligation.

3.c) Sending newsletters, editorial updates and informational communications

Personal data may be processed to send thematic newsletters, editorial updates, invitations to initiatives, informational communications and content relating to the Group’s brands and activities.

Such communications are sent in compliance with applicable data protection and electronic communications law and, depending on the relationship with the data subject and the characteristics of the channel used, on the basis of:

  • performance of a contract or pre-contractual measures, to the extent the communication is strictly necessary for the service requested by the data subject;
  • the controller’s legitimate interest, where permitted by law and following an assessment balancing the controller’s interest against the data subject’s rights and freedoms;
  • the data subject’s consent, where required by applicable law.

The applicable legal basis depends on the actual relationship with the data subject, the channel used and the sector regulations in force, and is determined by the controller before each processing activity begins.

The data subject may object or withdraw any consent given at any time, using the unsubscribe link included in every newsletter or by writing to amministrazione@gruppofood.com.

3.d) Group direct marketing (with consent)

Subject to specific, freely given consent, sending of promotional and commercial communications relating to the Group’s products and services by automated means (email, SMS, push notifications) and traditional means (telephone with an operator, postal mail).

Legal basis: Art. 6(1)(a) GDPR — free, specific, informed, unambiguous and documented consent. Withdrawal does not affect the lawfulness of processing carried out prior to withdrawal.

3.e) Profiling and commercial personalisation (with consent)

Subject to specific consent, personal data may be processed for profiling activities aimed at:

  • grouping data subjects into homogeneous clusters or segments based on professional interests, interactions with content, participation in initiatives or relationship history;
  • personalising content, offers, invitations or commercial communications;
  • improving the relevance of proposals and reducing non-relevant communications.

Profiling activities do not result in decisions based solely on automated processing that produce legal effects or similarly significantly affect the data subject within the meaning of Art. 22 GDPR.

The main consequences of profiling may consist in a different selection of the content shown or communications sent, in the priority given to certain topics, sectors or initiatives, and in placing the data subject within commercial or editorial segments of interest.

Consent to profiling is separate from any other consents and may be withdrawn at any time.

Legal basis: Art. 6(1)(a) GDPR — specific, freely given consent, revocable at any time.

3.f) Statistical analysis and market research

Processing of data in aggregate and, where possible, anonymised form, to analyse how services are used, develop new editorial products and conduct market research in the food and retail sector.

Legal basis: Art. 6(1)(f) GDPR — legitimate interest in improving editorial products and in sector research. The data subject may object pursuant to Art. 21 GDPR by writing to amministrazione@gruppofood.com.

3.g) Aggregate analysis, development and improvement of products and services

The controller may process data in aggregate, statistical, anonymised or, where necessary, pseudonymised form, for purposes of analysis, development, testing, security, maintenance and innovation of editorial and digital products, service performance measurement and improvement of the user experience.

These activities are not aimed at the individual profiling of the data subject for commercial purposes, except as may be provided for in Section 3.e on the basis of the relevant consent.

Where, in specific cases, it becomes necessary to use identifiable personal data for development, testing or validation projects, such use will comply with the principles of data minimisation, purpose limitation and proportionality, as well as any further technical and organisational measures deemed appropriate.

3.h) Changes in Group ownership or organisation

Over time, Gruppo Food may be affected by changes to its ownership or organisational structure, including, by way of example, changes to corporate structure, internal reorganisations, the entry of new shareholders, transfers of shareholdings, mergers, demergers, contributions or other transactions affecting how activities are organised.

In such circumstances, personal data processed in connection with the activities concerned may be disclosed or transferred, to the extent strictly necessary and in compliance with applicable law, to parties involved in the organisational change, including:

  • companies or entities taking over the ownership or management of the activities to which the data relates;
  • legal, tax, financial and technical advisors engaged to assess or carry out the transaction, bound by confidentiality obligations;
  • Group companies in their various present and future configurations.

The transfer takes place exclusively for purposes compatible with the original purposes of the processing or in cases permitted by law, adopting appropriate confidentiality, minimisation and security measures.

This Notice constitutes advance disclosure pursuant to Arts. 13 and 14 GDPR: data subjects are hereby informed of the possibility that changes may occur to the Group’s ownership or organisational structure, and that such changes may affect who acts as controller of their personal data.

Should such changes result in a change of data controller or a substantial change in how processing is carried out, data subjects will be informed pursuant to Arts. 13 and 14 GDPR through the available communication channels, without the need to collect new consent for purposes that remain unchanged.

4. Recipients of Data

4.1 Group companies

Personal data may be disclosed to other Gruppo Food companies to the extent strictly necessary to pursue the purposes set out in this Notice.

Depending on the processing actually carried out, such companies act as independent controllers, joint controllers pursuant to Art. 26 GDPR, or, where applicable, processors pursuant to Art. 28 GDPR.

For processing carried out under joint controllership, disclosure takes place within the limits of the applicable joint controllership agreement. For processing carried out by individual Group companies for their own purposes, each company acts within the limits of its own role and responsibilities.

4.2 Suppliers and technical partners (Processors under Art. 28 GDPR)

  • Cloud infrastructure and hosting providers (including AWS EMEA)
  • CRM and customer relationship management providers (Salesforce)
  • Administrative and accounting management providers (SAP Business One)
  • Email marketing and newsletter management providers
  • Digital payment providers (Stripe, Eventbrite)
  • Analytics and performance measurement providers
  • Selected communication agencies and editorial partners
  • Law firms, accountants and consultants

4.3 Authorities and institutional bodies

  • Judicial, tax and supervisory authorities, in cases provided for by law.
  • Social security and insurance bodies, for legal obligations.

5. Retention Periods

Personal data is retained for a period no longer than necessary for the purposes for which it is collected and processed, taking into account legal obligations, administrative requirements, the management of relationships with data subjects and any need to establish, exercise or defend a legal claim.

Data category / Purpose Retention period
Contractual, administrative, tax and accounting data For the duration of the relationship and, thereafter, for the period required by applicable law.
Data relating to contact requests, leads and prospects Maximum period of 24 months from the last qualified interaction, subject to any further retention based on a different legal basis.
Data relating to newsletters and informational communications Until objection, unsubscription, withdrawal of consent or, in the absence of further qualified interactions, for a maximum period of 24 months.
Data used for profiling activities Maximum period of 12 months, subject to earlier withdrawal of consent.
Data relating to participation in events, webinars, awards and initiatives The time necessary to manage the initiative and related obligations, and in any case no more than 24 months from its conclusion for contact and participation data not connected to contractual or legal obligations.
Browsing data and technical logs Periods consistent with the technical and security purpose pursued, as documented in the Records of Processing Activities.
Data processed for statistical or research purposes Preferably in aggregate or anonymised form; where not anonymised, no longer than the terms provided for the original purpose.

“Qualified interaction” means a positive and documentable act by the data subject, such as, by way of example, a request, a registration, participation in an initiative, an expression of interest or an equivalent action capable of demonstrating a current relationship with the controller. The mere automatic opening of an email or a technical event is not, in itself, considered sufficient.

6. Transfer of Data Outside the European Union

Personal data is processed predominantly within the territory of the European Union.

Where, for technical or operational reasons, it becomes necessary to use suppliers located outside the European Union or involving access from third countries, the processing and any transfer will comply with the safeguards set out in Chapter V GDPR, in particular through:

  • adequacy decisions adopted by the European Commission pursuant to Art. 45 GDPR;
  • standard contractual clauses adopted by the European Commission pursuant to Art. 46 GDPR;
  • other appropriate safeguards or derogations applicable in cases provided for by law.

The main categories of suppliers that may involve processing or access from non-EU/EEA countries, and the transfer mechanism applicable, are set out in an updated list made available to data subjects.

The role of the supplier depends on the specific service and the applicable contract; on request, the controller provides specific information on the relevant processing.

7. Artificial Intelligence and Automated Decision-Making

The Group may use software tools, including those based on artificial intelligence techniques, to support editorial, organisational and analytical activities, content classification, operational assistance and the development of digital services.

Where such tools involve the processing of personal data, their use complies with the principles of lawfulness, fairness, transparency, minimisation, security and purpose limitation.

Where necessary in relation to the type of tool used, further specific information will be provided and appropriate organisational, contractual and technical measures will be adopted.

8. Changes in Group Ownership or Organisation

For information on the processing of personal data in the event of changes to the Group’s ownership or organisational structure, please refer to Section 3.h.

9. Data Subjects’ Rights

Pursuant to Arts. 15–22 of EU Regulation 2016/679, the data subject has the right to:

  • Access (Art. 15): obtain confirmation of the existence of processing and receive a copy of it.
  • Rectification (Art. 16): obtain the correction of inaccurate data or the completion of incomplete data.
  • Erasure — the “right to be forgotten” (Art. 17): obtain the erasure of data in the cases provided for by law.
  • Restriction (Art. 18): obtain the restriction of processing in the cases provided for.
  • Portability (Art. 20): receive the data in a structured, machine-readable format; request its transmission to another controller (limited to data processed on a contractual or consent basis).
  • Objection (Art. 21): object to processing based on legitimate interest. Objection to processing for direct marketing purposes is always upheld with immediate effect. For other purposes based on legitimate interest, the controller will carry out a balancing assessment and may not uphold the objection where overriding legitimate grounds exist.
  • Withdrawal of consent: withdraw, at any time, consent given for profiling, marketing or other purposes based on consent, without prejudice to the lawfulness of processing carried out before the withdrawal. Withdrawal takes effect from receipt of the request, subject to the technical time needed to update the relevant systems.
  • Automated decision-making (Art. 22): not be subject to decisions based solely on automated processing with significant effects; obtain human intervention, express one’s own view and contest the decision.
  • Complaint (Art. 77): lodge a complaint with the Italian Data Protection Authority (Garante per la Protezione dei Dati Personali) (www.garanteprivacy.it).

Requests should be sent to:

The Controller responds within 30 days of receipt. In cases of particular complexity, this period may be extended by a further 60 days, with notice given to the data subject within the first 30 days.

10. Security Measures

The Controller adopts technical and organisational measures appropriate to ensure a level of security proportionate to the risk, in compliance with Art. 32 of EU Regulation 2016/679.

11. Updates to This Notice

The Controller reserves the right to amend this Notice to reflect regulatory changes, changes in the purposes of processing, or corporate reorganisation.

Changes are published on the website with an indication of the update date. For substantial changes, the Controller will notify data subjects through a dedicated newsletter with a visible information box.

The version in force is always the one available on the website at the time of consultation.

12. Contacts

For information on the processing of personal data or to exercise the rights set out in Arts. 15–22 GDPR, the data subject may contact:

Food S.r.l. — Via Mazzini n. 6, 43121 Parma (PR), Italy — VAT number 01756990345

Privacy email: amministrazione@gruppofood.com

Depending on the processing actually carried out, Food Labs S.r.l. and Dalcò Edizioni S.r.l. may also be involved, as independent controllers or joint controllers, as set out in Section 1 of this Notice.

Italian Data Protection Authority (Garante per la Protezione dei Dati Personali): Piazza di Monte Citorio 121, 00186 Rome, Italy — www.garanteprivacy.it

Part B — Cookie Policy

13. What Cookies Are

A cookie is a small text file that a website sends to the user’s browser and which is stored on the device used to browse the Internet. Cookies make it possible to uniquely identify the browser or to save information or settings in the browser in order to personalise the browsing experience.

The Gruppo Food websites (italianfood.net, foodweb.it and related sites, hereinafter the “Sites”) use cookies in compliance with Art. 122 of Legislative Decree 196/2003, ePrivacy Directive 2002/58/EC, and the Italian Data Protection Authority’s Guidelines on cookies of 10 June 2021.

14. Types of Cookies Used

Cookies and other tracking tools may be classified by duration, purpose and origin. The Gruppo Food Sites may use the following categories.

14.1 Technical cookies

Technical cookies are necessary for the Sites to function correctly and to provide the services requested by the user. This category includes, by way of example, cookies necessary for navigation, authentication, session management, storing preferences and security. These cookies do not require the user’s prior consent, without prejudice to the obligation to provide notice.

14.2 Analytics cookies

The Sites may use analytics cookies or tools to collect statistical information on the use of services, measure performance, understand browsing patterns and improve structure, content and functionality.

Where required, such tools are configured to reduce their identifying capability and are used in compliance with applicable law and the guidance of the Data Protection Authority. Where an analytics tool cannot be treated as a technical cookie under applicable law, it will only be used with the user’s prior consent.

14.3 Profiling and advertising cookies

Profiling or advertising cookies may be used to analyse the user’s preferences, interests or browsing habits and to display more relevant content or promotional communications, both on and off the Sites. The use of such cookies requires the user’s prior consent.

14.4 List of cookies and tools used

Detailed information on the cookies and other tools actually used on the Sites, including name, provider, purpose, duration, category, first- or third-party nature, legal basis and pre-consent blocking status, is set out in a dedicated cookie table made available through the banner or the preference management panel.

The cookie table relates to each individual site and is updated whenever scripts, providers or the related processing purposes change.

15. Third-Party Cookies

Some pages of the Group’s Sites may contain content, features or components provided by third parties, such as social media, commenting services, video players, analytics tools, maps, advertising services or other integrated services.

Whether cookies or other identifiers are actually installed by third parties depends on the content present on individual pages, the technical configuration adopted and the preferences expressed by the user through the banner or the consent management panel.

For further information on the characteristics and processing carried out by third parties, the user may consult their respective privacy and cookie notices, accessible through the links provided in the cookie table or in the dedicated sections of the site.

16. Managing and Withdrawing Cookie Consent

The user may manage, change or withdraw their cookie and other tracking tool preferences at any time through the banner or the preference management panel available on the Sites.

User preferences are recorded through a dedicated Consent Management Platform. The user may change or withdraw previously given consent at any time via the “Cookie Settings” link in the site footer.

The user may also intervene through their browser settings or through any opt-out tools made available by individual third-party providers, it being understood that disabling certain technical or functional cookies may affect the correct functioning of certain sections or features of the Sites.