Privacy Policy

The protection of the privacy of the Users of our website is an absolute priority for us.

Cannavacciuolo consulting srl unipersonale, pursuant to Articles 13 and 14 of EU Regulation 2016/679 (hereinafter “GDPR” or “Regulation”) and Legislative Decree 196/2003, as amended by Legislative Decree 101/2018 and subsequent amendments, wishes to inform Users about the purposes, legal bases, methods and retention periods of personal data processed through the website https://cannavacciuologroup.it/.

NB: These privacy notices are provided solely for the aforementioned websites and not for other websites that the user may access through links.

By connecting to the site and, where applicable, by providing personal data or expressing consent to its processing (when requested for specific purposes), the User declares that they are over 16 years old.

If the service is used by subjects under the age of majority, processing will take place exclusively within the limits necessary for managing the request, providing any requested service, and complying with applicable legal obligations. In such cases, the minor’s data must be provided by those exercising parental responsibility or by another authorized subject, who guarantees that they are authorized to communicate it to the Data Controller.

A) SUBJECTS INVOLVED IN DATA PROCESSING

The Data Controller is Cannavacciuolo consulting srl unipersonale, Tax ID 02404440030, with registered office at VIALE ACHILLE MARAZZA 4 – 28021 – BORGOMANERO (NO), Italy, certified email: cannavacciuoloconsultingsrl@legalmail.it.

The Data Protection Officer (DPO) is Studio Bagaini e Rillo – Viale Marazza 4, 28021 Borgomanero (NO), VAT ID 01699250039, and New Sistem S.r.l. – Viale Marazza 4, 28021 Borgomanero (NO), VAT ID 01622410031, represented by Rag. Maria Silvana Rillo, Tax ID RLLMSL61C46H632Y, appointed by the Data Controller for Cannavacciuolo consulting srl unipersonale.

With regard to processing related to the management of applications, even when referring to a specific entity within the Group, Cannavacciuolo consulting srl unipersonale processes candidates’ data together with companies or entities related to Chef Antonino Cannavacciuolo that are involved in the selection or potentially interested in future professional opportunities. For such processing, Cannavacciuolo consulting srl unipersonale and the aforementioned companies or entities act, where applicable, as joint controllers pursuant to Article 26 GDPR, jointly determining the purposes and essential methods of candidates’ data processing.

The complete and updated list of Data Processors and any authorized subjects is available at the Data Controller’s registered office, upon request.

For information and exercise of rights, the interested party may also write to: privacy@cannavacciuologroup.it

B) PERSONAL DATA SUBJECT TO PROCESSING

Through our website, the Data Controller (as well as any Data Processors) may collect and process the following personal data of Users:

Common personal data of the User, necessary to allow identification, request management, and possible execution of services or purchases: name and surname, email address, telephone number, billing and delivery addresses, tax data where necessary, data relating to orders or reservations, as well as additional data voluntarily provided by the User for assistance, information, or communication with the Data Controller.

Information relating to credit cards or other payment instruments used by the User to make payments will not be processed directly by the Data Controller, but by the authorized payment service provider, through specific and secure protocols. For further information on how such data is processed, the User is invited to consult the privacy policy of the selected payment service provider.

In relation to the “Work with Us” section and pages dedicated to applications, personal data of candidates may also be collected and processed, including personal and contact information, information contained in the curriculum vitae, professional and educational experiences, skills, any cover letter, availability, preferences regarding the position or place of work, as well as other information voluntarily transmitted by the interested party in the context of a spontaneous application or response to open positions. Such data are processed by Cannavacciuolo consulting srl unipersonale even when the application refers to a specific entity and may be archived and made available, to the extent necessary, to entities related to Chef Antonino Cannavacciuolo for which Cannavacciuolo consulting srl unipersonale acts as joint controller in managing selection processes.

Candidates are requested not to include in their curriculum vitae or application special category data pursuant to Article 9 GDPR, such as data relating to health, religious or philosophical beliefs, political opinions, union membership, or other data not relevant to the selection, unless such information is strictly necessary in relation to the specific position or required by applicable regulations.

C) PURPOSES, LEGAL BASIS, AND MANDATORY OR OPTIONAL NATURE OF PROCESSING

The purposes for which the data mentioned above are processed by the Data Controller are as follows:

To enable navigation, correct technical operation of the website, cybersecurity, and maintenance of web services;
To manage requests for information, contact, or assistance sent by the User via email, telephone, forms, or other contact channels indicated on the site;
To manage applications submitted through the “Work with Us” section, including spontaneous applications and responses to open positions, with personnel research and selection activities, profile evaluation, contact with the candidate, organization of any interviews, and archiving of the application with entities related to Chef Antonino Cannavacciuolo for which Cannavacciuolo consulting srl unipersonale acts as joint controller, also regarding future professional opportunities consistent with the candidate’s profile;
To allow consultation of the informational content of the site relating to the Group, its history, brands, sustainability, events, news, and business initiatives;
To redirect the User, where requested, to linked websites or platforms dedicated to specific services, such as accommodation facilities, restaurants, online shops, reservations, or purchase of products and gift cards, with the understanding that such services may be governed by autonomous privacy notices from their respective data controllers;
To send newsletters, promotional communications, or updates relating to Group activities, where the service is available and subject to User consent when required;
To process aggregate statistics or analysis of website use and manage tracking tools or non-technical cookies, subject to User consent when required by applicable regulations;
To comply with legal or regulatory obligations or orders from the Authority and to protect, including in court proceedings, the rights of the Data Controller.

For the purposes indicated in items 1 and 4, the legal basis is the legitimate interest of the Data Controller to ensure the operation, security, and use of the website and related content, pursuant to Article 6, paragraph 1, letter (f) GDPR, as well as compliance with any technical or security obligations provided by applicable regulations.

For the purpose indicated in item 2, the legal basis is the execution of pre-contractual measures adopted at the User’s request or, depending on the content of the request, the legitimate interest of the Data Controller to respond to communications received, pursuant to Article 6, paragraph 1, letters (b) and (f) GDPR.

For the purpose indicated in item 3, the legal basis is the execution of pre-contractual measures adopted at the interested party’s request, pursuant to Article 6, paragraph 1, letter (b) GDPR, and, where necessary, the legitimate interest of the Data Controller in the efficient management of selection processes and the protection of its rights, pursuant to Article 6, paragraph 1, letter (f) GDPR. Any processing of special category data provided by the candidate, if relevant and necessary, may take place within the limits allowed by Article 9 GDPR and applicable labor law.

For the purpose indicated in item 5, the legal basis is the legitimate interest of the Data Controller to enable connection with services and platforms related to the Group, pursuant to Article 6, paragraph 1, letter (f) GDPR. Processing carried out on the destination websites or platforms is governed by their respective privacy policies.

For the purposes indicated in items 6 and 7, the legal basis is the free, specific, informed, and unambiguous consent of the User, pursuant to Article 6, paragraph 1, letter (a) GDPR, when required by applicable regulations. Consent is optional and may be revoked at any time.

For the purposes indicated in items 1 and 4, the provision of technical navigation data is necessary to enable access and correct operation of the website; without it, navigation may not be possible or may be compromised.

For the purpose indicated in item 2, the provision of data is optional; however, without the necessary data, the Data Controller may not be able to provide a response to the User’s request.

For the purpose indicated in item 3, the provision of data is necessary to enable the Data Controller to evaluate the application and manage the selection process; failure to provide essential data may make it impossible to evaluate the profile or contact the candidate. The provision of information beyond what is necessary is optional.

For the purpose indicated in item 5, the provision of data is generally limited to technical navigation data necessary for redirection or access to linked services; any additional data will be processed according to the privacy policies of destination websites or platforms.

For the purposes indicated in items 6 and 7, the provision of data and consent are optional: without them, the User will not receive promotional communications and non-technical cookies or tracking tools based on consent will not be used.

D) RECIPIENTS

Data processed through this website, exclusively for the purposes indicated above, may be communicated to subjects authorized to process data, information technology, management, administrative, accounting, tax, logistics, payment, marketing, assistance, and application management service providers, as well as to consultants and professionals, where necessary and within the limits of their respective purposes. With specific reference to applications, data may be shared and archived with companies or entities related to Chef Antonino Cannavacciuolo involved in the selection or potentially interested in future professional opportunities, for which Cannavacciuolo consulting srl unipersonale acts, where applicable, as joint controller. Such subjects act, as appropriate, as joint controllers, Data Processors, independent controllers, or authorized subjects.

When provided by applicable regulations, data may also be communicated to public authorities, entities, or subjects legally entitled to receive them, such as the competent Police Headquarters and the Ministry of Interior – Public Security Department, only in cases and limits provided by law.

E) TRANSFERS

Personal data will not be transferred to third countries or international organizations, except where necessary for the use of suppliers or services located outside the European Economic Area. In such cases, the transfer will be made in compliance with Articles 44 et seq. GDPR, based on adequacy decisions of the European Commission, standard contractual clauses, or other appropriate safeguards provided by GDPR.

F) DATA RETENTION

Personal data collected or processed through this website will be processed in compliance with the principles of Article 5 GDPR (lawfulness, fairness, and transparency; purpose limitation; data minimization; accuracy; storage limitation; integrity and confidentiality; accountability) using paper or digital methods, exclusively for the pursuit of the purposes indicated above.

Personal data will be retained for a period of time no longer than strictly necessary to achieve the purposes indicated, unless further retention is required by current regulations or permitted by the legitimate interest of the Data Controller or for proven legal reasons.

For the purposes indicated in items 1 and 4, technical navigation data will be retained for the time strictly necessary for the operation, security, and maintenance of the website, except for further retention necessary for the ascertainment of responsibility in case of computer crimes or Authority requests.

For the purpose indicated in item 2, data will be retained for the time necessary to manage and respond to the User’s request and, where necessary, for the further period allowed by applicable regulations to protect the rights of the Data Controller.

For the purpose indicated in item 3, candidates’ data will be retained by Cannavacciuolo consulting srl unipersonale and, where necessary, by entities related to Chef Antonino Cannavacciuolo involved or potentially interested in the application, for the entire duration of the selection procedure and, in case of failure to establish an employment relationship, for a maximum period of 24 months from receipt of the application or from the last update voluntarily transmitted by the candidate, in order to evaluate the profile for future professional opportunities. After this period, data will be deleted or anonymized, except for deletion requests or opposition from the interested party and except for further retention of only the data necessary for the ascertainment, exercise, or defense of a right of the Data Controller or joint controllers.

For the purposes indicated in items 6 and 7, data will be retained until consent is revoked or, if earlier, until the specific purpose for which they were collected is achieved, provided that the further period necessary to document the management of consent or the request is retained.

Once the retention period has expired, personal data will be deleted or anonymized in such a way as to prevent the re-identification of the User. Information systems used to manage collected data are configured, where possible, to minimize data use when not necessary to achieve the pursued purpose.

G) YOUR RIGHTS

The Data Controller informs the User that, in cases and within the limits provided by GDPR, the interested party may exercise the rights of access to personal data (Article 15), rectification (Article 16), erasure (Article 17), restriction of processing (Article 18), data portability (Article 20), opposition to processing (Article 21), and revocation of any consent given, without prejudice to the lawfulness of processing carried out before revocation.

Requests can be directed to the “SUBJECTS INVOLVED IN DATA PROCESSING” by sending a registered letter to the Data Controller’s registered office, or by writing to the email address: privacy@cannavacciuologroup.it. The interested party also has the right to lodge a complaint with the Data Protection Authority or to seek recourse to competent courts.