Privacy Policy Chatbot
INFORMATION NOTICE ON THE PROCESSING OF PERSONAL DATA
VIRTUAL ASSISTANT ‘CHATBOT’
According to Article 13 of Regulation (EU) 2016/679 (GDPR)
The ASSEGNATARI ASSOCIATI ARBOREA – SOCIETÀ COOPERATIVA AGRICOLA PER AZIONI – SOCIETÀ BENEFIT (hereinafter, “3A” or “Controller”) intends to provide the information referred to in Article 13 of Regulation (EU) 2016/679 (also known as the GDPR or General Data Protection Regulation) regarding the personal data processed through the Virtual Assistant “chatbot” available on the institutional website, for the purpose of offering users more structured informational support. It should be noted from the outset that users may always contact the Controller through the institutional communication channels.
1. Data Controller and Data Protection Officer
The Data Controller of personal data is ASSEGNATARI ASSOCIATI ARBOREA – SOCIETÀ COOPERATIVA AGRICOLA PER AZIONI – SOCIETÀ BENEFIT, with registered office at Strada 14 est bis – 09092 Arborea (OR).
The Controller can be contacted at the following address: pec: lattearborea@pec.it.
In order to better protect data subjects and in compliance with legal requirements, the Controller has appointed its own DPO, Data Protection Officer (or RPD, Data Protection Officer), who can be contacted at the following address: dpo@arborea.it
2. Data and/or information processed
2.1. Browsing Data:
The IT systems and software procedures used for the normal functioning of the network automatically collect certain personal data. These data are essential for the use of Internet communication protocols. Such data are collected as soon as browsing begins, regardless of whether the chatbot made available by the Controller is activated.
2.2. Data Automatically Collected by the Chatbot:
When a user interacts with the chatbot, data necessary for the system’s operation and for providing appropriate responses are automatically collected. These data do not include personal information as defined in Article 4 of the GDPR, as they do not directly or indirectly identify any natural person. The information handled is exclusively technical and functional in nature, such as, by way of example only: technical cookies related to the service activated by the user and the session ID generated at the start of the conversation with the chatbot (see Cookie Policy).
2.3. Data Provided Voluntarily:
If the user chooses to voluntarily provide personal data (for example, name, surname, email address, or telephone number) during the interaction with the chatbot, such data will be processed in accordance with the principles outlined in this notice, solely for the purpose of providing the service requested through the chatbot.
3. Purposes and Legal Bases of the Processing
3.1. Purpose
The Controller uses the data provided through the chatbot for the following purposes:
- to provide structured responses to the requests submitted, for example to obtain information about 3A products;
- to carry out aggregated statistical analyses on the functioning of the chatbot in order to implement possible improvements or enhancements to the service and to record the most frequent user requests;
- protection or safeguarding of its rights in non-judicial or judicial proceedings.
3.2. Legal Basis
The processing of data is intended to enable the user to make use of the chatbot, as requested [Art. 6(1)(f) of the GDPR], and to provide additional functionalities to the institutional website, with the goal of responding to users regarding the activities and products of 3A. Furthermore, the Controller may justify the processing of data for the protection of its own rights, in accordance with Art. 6(1)(f) of the GDPR.
4. Authorized Parties and Data Disclosure
The Controller will not disclose the data but will share it with authorized internal personnel, who will handle it in accordance with their responsibilities, and with professionals or service providers involved in delivering the chatbot service, solely to ensure its proper technical functioning. In addition, the data may be transmitted to the competent Authorities in the event of inspections or criminal investigations. If these recipients process the data on behalf of the Controller, they will be appointed as data processors through a specific contract or other legal act. Otherwise, they will be considered Independent Controllers or simple recipients of the information collected.
5. Transfer of data to a third country and/or an international organization
The Data Controller carries out data processing within the European Union. Specifically, the information provided is stored at the registered office.
6. Retention Criteria
The Controller manages the data provided only for the time strictly necessary to achieve the purposes specified in this notice. Consequently, if any personal data are present, they will be retained solely for the period that is strictly indispensable.
7. Nature of the provision of data and consequences of any failure to provide it
The use of the chatbot does not require the user to provide personal data. However, the user may decide to voluntarily share personal data during the interaction with the chatbot, and such sharing is entirely optional.
8. Source of the data
The data are obtained automatically following the data subject’s interaction or voluntarily provided by the data subject.
9. Your Rights
Regulation (EU) 2016/679 grants you, as a Data Subject, several rights, which you may exercise by contacting the Controller at the addresses indicated in point 1 of this notice. Among the rights you may exercise, provided that the conditions established by the applicable legislation are met (Arts. 15 et seq. GDPR), are the following:
- the right to know whether 3A is processing personal data concerning you and, if so, to access the data being processed and all related information;
- the right to rectification of inaccurate personal data concerning you and/or to the completion of incomplete data;
- the right to the erasure of personal data concerning you;
- the right to restriction of processing;
- the right to object to the processing;
- the right to the portability of the personal data concerning you.
In any case, you also have the right to lodge a formal complaint with the Data Protection Authority, following the procedures available on the official website of the Authority https://www.garanteprivacy.it
10. Absence of automated decision-making
3A does not adopt any automated decision-making process, including profiling as referred to in Article 22, paragraphs 1 and 4, of the GDPR.