INFORMATION PROVIDED PURSUANT TO ART. 13 OF REGULATION (EU) 679/2016 FOR THE PROCESSING OF
PERSONAL DATA OF NATURAL PERSONS

This information represents the concrete methods of management of the website in relation to the processing of
personal data of users who connect to it. The data processing is always carried out following the principles of
lawfulness, transparency and correctness and appropriate security measures are taken to ensure their protection.
Further and specific information on the processing of personal data may be obtained by sending a request to the Data Controller using the contact form.

Data controller

The owner of the processing of personal data of users who navigate on the site https://byflowerfarm.com is By Flower Farm (P.
iva ….) with registered office in Via spezia n. 20 – 20143 Milan. The holder of the treatment of the data can be contacted at the legal center or to the telephone number 0236593835, or for mail: info@byflowerfarm.com.

LEGAL BASIS

Contractual Basis

The processing of data for the “Contractual Purposes” is mandatory as it is necessary for the purposes of providing the services you have requested including the creation of user accounts, for these purposes it will not be necessary to expressly collect consent for the processing of personal data provided.

Legal basis

The provision of data for the “Purpose of Law” is also mandatory as required by applicable regulations such as compliance in tax matters or to defend the rights of the Owner or third parties in court and does not require the prior acquisition of the user’s consent.

Consensual basis

The processing of data for specific purposes such as, by way of example, newsletter subscription for Marketing
purposes or profiling activities is optional and is permitted only with your consent (which can be revoked at any time) without which it will not be possible for By Flower Farm to follow up on the services or requests made by the user.

Legitimate interest of the Owner

The Data Controller may process the data collected for its legitimate interest and within the limits provided by the
Regulations. The user may object at any time to the treatment for purposes of legitimate interest of the Owner and
subject to the limits imposed by the legislation.

TYPE OF PERSONAL DATA PROCESSED

In order to provide the services on the website, By Flower Farm collects and processes only “personal identification data” such as, for example, name, surname, delivery address, telephone number, e-mail. Cookies are small text files that can be sent and recorded on the user’s computer by the websites visited. For further details, please refer to the Cookie Policy on the website.

Additional data collected

The computer system on which the operation of this website is based acquires some personal data during its operation. These data are not collected to be associated with identified users, but by their nature through processing / association with data held by third parties could allow the identification of the user. This category of data includes, by way of example, the IP address, domain name, access time, parameters relating to the operating system used by the user, etc.). These data are collected for the sole purpose of obtaining statistical information on the use of the website and its proper functioning or for the detection of any computer crimes against the website.
By Flower Farm does not collect and does not process special categories of personal data, i.e. sensitive data, health data (including genetic or biometric data) and criminal data.

METHODS AND PURPOSES OF TREATMENT

The processing of personal data is necessary to manage the relationship with the users of the website, including the purchase of services. The data collected are processed by computer, telematics and paper and are protected by appropriate security measures to ensure confidentiality, integrity and recovery. In particular, organizational and
procedural measures are adopted (e.g. distribution of roles among the staff, persons in charge of processing both
internal and external) as well as technical measures (e.g. backup, antivirus, firewall).
The purposes for which we collect and process personal data are many, in any case we process the data provided
exclusively for the purposes strictly relevant to each service requested or used, in particular:

Customer Care: The Data Controller makes available to users of the website a support service (mainly provided through and live-chat, telephone, email) aimed at supporting its customers before, during and after the purchase of a service or to provide information on the activities carried out by us. In some cases in order to use the Customer Care service we may need to ask you for your personal information when this is necessary to respond to requests for clarification, information on purchases, deliveries, payments or handle complaints.

Newsletter subscription: our newsletter is a promotional/commercial communication sent to all those who request it by subscribing to the service. The data provided for subscription to the newsletter will be retained until we receive a request for cancellation from you using the “Unsubscribe” button, in which case we will delete your data from our database within 48 hours of the request for cancellation from the service. The sending of the newsletter will be done only after collecting your consent which will be the legal basis on which we will process your data.

Contact/Information Form: the data you give us using this service we use exclusively to give a precise feedback to what you requested and, for this purpose, it is not necessary to expressly collect consent. The data you give us will be kept for a period of 24 months and will then be deleted from our systems.

Product purchase: the data you provide will be used to process your purchase orders and related activities (product delivery, invoicing, payment management and related activities, etc.). The finalization of the telematic contract of sale will therefore constitute the legal basis with which we will treat your personal data that will be kept for the time necessary to fulfill the obligations imposed by law in relation to the conduct of sales activities.

Account Registration: we will use your personal data to allow you to create your own reserved area on our website
which will allow you to make purchases, participate in the initiatives promoted for our customers, modify or integrate your data, view your activities (e.g. purchase history, orders in progress, etc.).

Work with us: when you send your data to the e-mail address info@byflowerfarm.com we will use these data (name and
surname, e-mail address) to carry out the necessary selection activities. Once the analysis of the application is over, the data collected will be kept for 24 months, after which it will be deleted from our database.

RECIPIENTS OF DATA

We communicate your personal data to third parties only when it is necessary and functional to the achievement of the purpose of treatment pursued according to the requested service, in any case, we proceed to the communication only after having informed and collected your consent to do so, where applicable. In general, the data collected through the individual services and for the purposes pursued in this statement may be disclosed to the following categories of persons:

Any Public Authority to which the faculty of access to the same is attributed by provisions of law;
Data processing and IT services companies (e.g. web hosting, data entry, management and maintenance of IT
infrastructures and services, web agency, etc.);
Companies and firms providing consultancy services in order to comply with legal provisions or to protect the legitimate interests of the Data Controller;
In particular, some specific services provided through our site also provide for the communication to other categories of subjects such as PayPal and companies that provide mailing services and send correspondence;
Some navigation data are collected by third parties such as social networks when the user decides to use the relevant interaction button and, in some cases, even without using the interaction service. The processing of such data is referred to the privacy policy of each third party. In any case, third party websites accessible from this site are under the responsibility of third parties. The Owner declines any responsibility regarding requests and/or supply of personal data to third party websites.

DATA TRANSFER TO OTHER COUNTRIES

Personal data collected through the website are stored and maintained within the national territory or in other countries of the European Union. Data is not transferred to non-EU countries or to International Organizations. If the user wishes information on the place where the data is stored, he can obtain it by making an express request to the Data Controller.

PERIOD OF DATA RETENTION

We keep, by adopting appropriate security measures, the data provided for the period necessary to achieve the purposes for which they were collected, in particular: data collected and processed to fulfill legal purposes are kept for the period provided for by the individual legal provision; the data collected in order to execute a contract for the sale of products are kept for the period necessary to cover the warranty period provided for by law and to fulfil all the obligations provided for by further regulations data collected at the time of opening a user account are kept until cancelled by the user; the data collected when the user subscribes to the newsletter are kept until the user decides to unsubscribe from the service.

The data collected when using the contact form are kept for 24 months.

Data collected upon voluntary contribution of the user (e.g. sending e-mails to the addresses indicated on the site) will be kept for the period of 24 months, after which they will be deleted.

PROFILING AND AUTOMATED DECISION-MAKING PROCESSES

By Flower Farm does not process data collected during navigation for the purpose of profiling the users of the website and does not adopt decision-making systems based solely on the automated processing of data.

NATURE OF DATA CONFERMENT
Compulsory conferment:
The provision of the requested data is always mandatory when it is necessary to execute a contract or to fulfill legal
purposes. In these cases, failure to provide the data will not allow the Owner to execute the requests received. To this end, the mandatory data entry fields in the forms on the website are marked with an asterisk.

Optional conferment:
Failure to provide optional data in the collection forms will not affect the obtaining of the requested service. The fields where it is optional to enter data are recognizable because they are not marked by the asterisk that marks the mandatory fields.

Voluntary sending:
When you voluntarily send an e-mail to one of the e-mail addresses indicated on our site, we acquire the sender’s
address and any other personal data you have entered in the missive and attachments. The e-mail boxes corresponding to the addresses indicated on our sites and any other e-mail box of By Flower Farm, do not have a personal nature even when they contain name and / or surname of a natural person. They belong to the Owner and have the primary purpose of allowing the effective performance of work activities within the company. By sending an e-mail to the e-mail addresses listed on the website you declare that you have read and accepted the conditions of treatment contained in this policy.

RIGHTS OF THE INTERESTED PARTY

At any time you can exercise the rights that the Regulation (EU) No. 679/2016 recognizes you. In particular, you will be able to exercise, by contacting the Data Controller or the Data Processor (it is possible to have a list of the appointed External Managers by making a specific request to the Data Controller):

Right of Access (art. 15).
You will be able to obtain confirmation from the data controller as to whether or not personal data concerning you are being processed and, if so, obtain a copy of the data being processed;
Right of Rectification (art. 16). You may obtain the rectification (i.e., modification, integration or updating) of inaccurate personal data concerning you, in case of inaccuracy, incompleteness or obsolescence;

Right to Erasure (art. 17) (c.d. Right to Oblivion). You can obtain the cancellation of your personal data. The holder of the treatment will provide the cancellation of the same without undue delay provided that there is one of the reasons listed in that art. 17;

Right to Limit Processing (art. 18). As data subject, you have the right to obtain the limitation of processing when one of the hypotheses listed in art. 18 applies;

Right of Opposition (art. 21). You have the right to object at any time to the processing of personal data concerning you for reasons related to your particular situation and if the conditions provided for in art. 21 apply;

Right to Data Portability (Art. 20). You have the right to receive in a structured, commonly used and machine-readable format the personal data concerning you provided to a Data Controller and you have the right to transmit such data to another Data Controller without hindrance from the Data Controller to whom you provided them if the conditions listed in Art. 20 apply;

Right to Withdraw Consent. You have the right to revoke your consent in relation to all processing that is based on it. To exercise this right, without this circumstance affecting the lawfulness of the treatment until that moment based on the consent given, you can at any time write to info@byflowerfarm.com;

Right to complain to the Guarantor. Where necessary, you may lodge a complaint with the competent Supervisory
Authority for the protection of the rights guaranteed to you by Legislative Decree 196/2003 and European Regulation
679/2016 (www.garanteprivacy.it).

CHANGES TO THE PRIVACY POLICY

The Data Controller reserves the right to make changes to this privacy policy at any time by advertising it to visitors of the website on this page. Users are invited to consult this page often, taking as reference the date of last modification indicated at the bottom.

Information on the use of cookies

This Cookie Policy has the specific purpose of illustrating the types of cookies on the site https://byflowerfarm.com, the
purposes and methods of use of the same and to provide information on how the user can deny, even at a later time, consent and / or change, at any time and easily, the options relating to the use of cookies by the Site.
This information on the use of cookies on the Website is provided to the user in implementation of the provision of the Guarantor for the protection of personal data of 8 May 2014 “Identification of the simplified procedures for the
information and the acquisition of consent for the use of cookies”, the clarifications regarding the implementation of the legislation on cookies of 2015 and in compliance with Article 13 of EU Regulation 2016/679 on the protection of personal data.

The information is prepared and updated by By FLower Farm (P. iva ….), manager of the website and owner of the processing of personal data connected to it, with registered office in Via Spezia n. 20 – 20143 Milan – Italy -. Any further request regarding the use of cookies on this website can be sent to the e-mail address info@byflowerfarm.com.
You can use the same address at any time to exercise the rights that Regulation 679/20016 gives you as a data subject (art. 15 et seq. of the Regulation, as well as to request an updated list of any Data Processors designated).

WHAT ARE COOKIES?

Cookies are small text strings that a website (so-called “first party”) can send, during navigation, to the browser in use on your device (be it a PC, a notebook, a smartphone, a tablet; they are usually stored directly on the browser used for navigation). While browsing the site, the user may also receive on his terminal cookies that are sent by different websites (so-called “third parties”), on which may reside some elements (such as, for example, images, maps, sounds, specific links, etc. …) on the site that the user is visiting.

HOW MANY TYPES OF COOKIES ARE THERE?

There are two basic macro-categories, with different characteristics: technical cookies and profiling cookies. Technical cookies are generally necessary for the proper functioning of the website and to allow a better browsing experience, without them you may not be able to view the pages correctly or use certain services or features.

Technical cookies can be further distinguished in:
navigation or session cookies, which ensure the normal navigation and use of the website (allowing, for example, to
make a purchase or authenticate to access restricted areas);

analytics cookies, assimilated to technical cookies only when used directly by the site manager to collect information, in aggregate form, on the number of users and how they visit the site. functionality cookies, which allow the user to navigate according to a series of selected criteria (for example, language, products selected for purchase) in order to improve the service provided to the same.

Profiling cookies are more sophisticated, have the task of profiling the user and are used to send advertisements in line with the preferences expressed by the same during its navigation.

WHAT COOKIES DOES THIS SITE USE?

We use both “first party” and “third party” technical cookies to ensure that our website functions correctly. Some of these cookies cannot be disabled as they are strictly necessary for the website to function, all other cookies can be enabled/disabled at any time from the cookie tracking and management console.

In particular, we use Google Analytics which is a web analysis service provided by Google (Google Inc.) through the
release on the user’s terminal of special cookies that are used for the sole purpose of obtaining statistical information on the use of the site that we have made anonymous by masking significant portions of the IP address. These cookies may be sent by the provider of the tool, but are only used for purposes related to the site. On this website, as mentioned above, we make use of the function of anonymization of the IP address of users provided by Google and we have accepted the Data Processing Amendment (Google Analytics Data Processing Amendment v20130906) made available by Google Analytics and whereby Google agrees to process the data according to the requests of the client (the owner of this site) and not to share it with additional services unless the client itself requests it, through the settings of the services.

If you prefer that Google Analytics does not use the data collected, you can change the configuration of each browser differently. It is described in the help menu of your browser, which will allow you to know how to change your choices regarding cookies. Google Analytics cookies can also be rejected by following the procedure indicated by Google (https://tools.google.com/dlpage/gaoptout?hl=it).

Personal data collected: Cookies and navigation data. Place of data processing: USA – Privacy Policy
We may at any time activate services that also use “third party” profiling cookies that help make advertising more
effective. We may activate Remarketing campaigns where, following the collection of certain information while you are browsing the site, we will then be able to exploit this information to propose targeted advertising based on the interests shown in previous navigation of our website. You can enable/disable these cookies at any time from the cookie tracking and management console.

HOW DO I BLOCK OR DELETE COOKIES?

Each user can set their terminal’s browser to accept or reject all cookies or to display a warning each time a cookie is proposed, in order to decide whether to accept it or not. The user can, in any case, set the default configuration and disable cookies (i.e. block them permanently), setting the highest level of protection. The modalities to block or delete cookies from one’s own device vary according to the type of terminal and according to the type of browser used. If you use a fixed device (PC, notebook, and similar) you must intervene on the browser settings:

• Internet Explorer
• Chrome
• Firefox
• Safari: If you use a mobile device (smartphone or tablet) to browse the site, you need to change your terminal settings
• Apple
• Android
• Blackberries

To delete cookies from the Internet browser of your smartphone/tablet, you may also need to refer to the user manual of your device.Interaction with social networks and external platforms interaction services with social networks and external websites allow you to interact with social networks, or other external platforms, directly from the pages of the site.

Interactions and information acquired by the site, in these cases, are subject to the privacy settings of the user relating to each social network or external website. If a service for interaction with social networks is installed, it is possible that, even if users do not use the service, it collects traffic data relating to the pages where it is installed. The social buttons used by our site are simple “links” that refer to the accounts of the Owner on the social networks represented. Using these buttons are therefore not installed third-party cookies.

CONSENT TO THE USE OF COOKIES

The user of the website consents to the use of cookies by clicking on the “OK” button on the information banner,
closing the banner or continuing to browse the site in any way. Subsequently and at any time the user can disable the cookies for which he/she has previously given consent from the cookie detection and management console.

CHANGES TO THE COOKIE POLICY
The Data Controller reserves the right to make changes to this cookie policy at any time by advertising it to visitors to the website on this page. Users are invited to consult this page often, taking as reference the date of last modification indicated at the bottom.

Last revision date 11/05/2021