Owner and Data Controller of personal data
TOSCO S.A.
c/o James Levin - Rue Jean-Jacques Rousseau 4 - 1800 Vevey - SWITZERLAND
Types of Data Collected
The types of personal data that the tosco.coffee website collects directly or through third parties include: Trackers; Usage data; Personal data.
Unless otherwise specified, all Data requested by the tosco.coffee website is mandatory and failure to provide such Data may make it impossible to provide the Services offered by the tosco.coffee website. Where the tosco.coffee website specifies that certain Data is not mandatory, Users are free not to provide such Data without any consequences on the availability or functioning of the Service.
Users who have doubts about the mandatory Personal Data are invited to contact the Owner. Any use of Cookies – or other tracking tools – by the tosco.coffee website or by the owners of third-party services used by the tosco.coffee website is intended to provide the Service requested by the User, in addition to the other purposes described in this document and in the Cookie Policy, if available.
Method and place of data processing
Treatment methods
TOSCO S.A. takes appropriate security measures to prevent unauthorised access, disclosure, modification or destruction of the Data.
Data processing is carried out using computers or IT tools, following procedures and organisational methods closely related to the purposes indicated. In addition to TOSCO S.A., the Data may be accessible, in certain cases, to certain categories of persons in charge of operating the tosco.coffee website (administration, sales, marketing, legal department, system administration) or to external parties (such as third-party technical service providers, courier services, hosting providers, IT companies, communication agencies) designated, where applicable, as Data Processors by TOSCO S.A.. The updated list of these parties may be requested at any time from TOSCO S.A.
Legal basis for processing
Article 6(1)(e) of the General Data Protection Regulation (GDPR) This data processing falls within the scope of the public authority vested in the CNIL pursuant to the General Data Protection Regulation and the amended Data Protection Act.
The processing of Personal Data by TOSCO S.A. is based:
either on consent in all cases where the User himself/herself provides his/her Personal Data. His/her consent may of course be withdrawn at any time;
or on the legitimate interest of TOSCO S.A., such as audience measurement. In such cases, the User has a right to object.
Place of treatment
The Data is processed at the headquarters of TOSCO S.A. and in all other locations where the parties responsible for processing are located.
Depending on the User's location, data transfers may involve the transfer of the User's Data to a country other than their own. To learn more about where this transferred Data is processed, Users can consult the section containing details on the processing of Personal Data.
Users also have the right to know the legal basis for Data transfers to a country outside the European Union or to any international organisation governed by public international law or established by two or more countries, such as the UN, as well as the security measures taken by TOSCO S.A. to safeguard their Data.
If such a transfer takes place, Users can find out more by consulting the relevant sections of this document or by contacting TOSCO S.A. using the information provided in the contact section.
Storage time
Personal Data is processed and stored for as long as required for the purpose for which it was collected.
Consequently:
Personal Data collected for purposes related to the performance of a contract between TOSCO S.A. and the User shall be retained until the contract has been fully performed.
Personal Data collected for the purposes of TOSCO S.A.'s legitimate interests shall be retained for as long as necessary to fulfil those purposes. Users may find specific information regarding the legitimate interests pursued by TOSCO S.A. in the relevant sections of this document or by contacting TOSCO S.A..
TOSCO S.A. may be authorised to retain Personal Data for longer whenever the User has given their consent to such processing, as long as that consent is not withdrawn. In addition, TOSCO S.A. may be obliged to retain Personal Data for longer whenever this is required for the fulfilment of a legal obligation or by order of an authority.
Once the retention period has expired, Personal Data will be deleted. Consequently, the right of access, the right to erasure, the right to rectification and the right to data portability cannot be exercised after the retention period has expired.
Purposes of processing
User Data is collected to enable TOSCO S.A. to provide its Service, fulfil its obligations, respond to law enforcement requests, protect its rights and interests (or those of its Users or third parties), detect any malicious or fraudulent activity, and for the following purposes: Analysis and audience measurement. For specific information on the Personal Data used for each purpose, the User may consult the section ‘Detailed information on the processing of Personal Data’.
Detailed information on the processing of Personal Data
FORM
By filling in the contact form with their Data, the User authorises the use of this information by the tosco.coffee website for the purposes of responding to requests for information, quotes or any other requests as indicated in the form header.
Personal data processed: email address; telephone number; surname; first name.
Data collection is limited to the strict minimum.
Each form clearly indicates the data that is strictly necessary for the purpose of contacting the User.
Legal basis for processing: Consent.
Audience analysis and measurement
The services contained in this section enable TOSCO S.A. to monitor and analyse web traffic and track changes in user behaviour.
Google Analytics (Google LLC)
Google Analytics is a web analytics service provided by Google LLC (‘Google’). Google uses the collected data to track and analyse the use of this Application, to prepare reports on its activities and share them with other Google services. Google may use the collected data to contextualise and personalise the advertisements of its own advertising network. This integration of Google Analytics makes your IP address anonymous. Users' IP addresses are actually shortened within the Member States of the European Union or other States party to the Agreement on the European Economic Area. Only in exceptional cases is the full IP address transmitted to the Google server and shortened in the United States.
Personal data processed: Usage data; Trackers.
Place of treatment:
United States of America – Privacy policy – Withdrawal option;
Ireland – Privacy policy – Withdrawal option.
User Rights
Users may exercise certain rights regarding their Data processed by TOSCO S.A..
In particular, Users have the right to do the following:
Withdraw their consent at any time. Users have the right to withdraw their consent if they have already given their consent to the processing of their Personal Data.
Object to the processing of their Data. Users have the right to object to the processing of their Data if the processing is carried out on a legal basis other than consent. Details are provided in the corresponding section below. In this regard, the User must specify the processing for which they object to the management of their Personal Data, and the reasons for their request.
Access their Data. Users have the right to know whether the Data is being processed by TOSCO S.A., to obtain information on certain aspects of the processing and to obtain a copy of the Data being processed.
Verify and obtain rectification. Users have the right to verify the accuracy of their Data and to request that it be updated or corrected.
Restrict the processing of their Data. Users have the right, under certain conditions, to restrict the processing of their Data. In this case, TOSCO S.A. will process their Data only for storage purposes.
Have their Personal Data deleted or erased. Users have the right, under certain conditions, to obtain the erasure of their Data from TOSCO S.A.
Retrieve their Data and transfer it to another data controller. Users have the right to retrieve their Data in a structured, commonly used and machine-readable format and, if technically feasible, to transmit it to another data controller without hindrance of any kind. This provision applies, provided that the Data is processed by automated means and that the processing is based on the User's consent, on a contract to which the User is a party or on pre-contractual obligations.
Information concerning the right to object to processing
When Personal Data is processed in the public interest, in the exercise of an official authority vested in TOSCO S.A. or for the purposes of the legitimate interests pursued by it, Users may object to such processing by providing a reason related to their particular situation that justifies such objection.
However, Users should be aware that if their Personal Data is processed for direct marketing purposes, they may object to such processing at any time without justification. To find out whether TOSCO S.A. processes Personal Data for direct marketing purposes, Users may refer to the relevant sections of this document.
How to exercise these rights
Any request to exercise the User's rights may be addressed to TOSCO S.A. using the contact details provided in this document. These requests may be exercised free of charge and will be reviewed by TOSCO S.A. as soon as possible and always within one month.
Cookie Policy
This document informs Users about the technologies that enable the tosco.coffee website to achieve the purposes described below. These technologies allow TOSCO S.A. to access and store information (using a cookie, for example) or use resources (by running a script, for example) on a User's device when they interact with this website.
For the sake of simplicity, all these technologies are defined as ‘Trackers’ in this document, unless there is a reason to differentiate between them.
For example, although Cookies can be used on both web and mobile browsers, it would be inaccurate to refer to Cookies in the context of mobile applications as they are browser-based trackers. For this reason, in this document, the term Cookies is only used when it is specifically intended to refer to this specific type of Tracker.
Some of the purposes for which Trackers are used may require the User's consent. Once consent has been given, it can be freely withdrawn at any time by following the instructions provided in this document.
This website uses Trackers managed directly by TOSCO S.A. (known as ‘first-party’ Trackers) and Trackers that enable services provided by a third party (known as ‘third-party’ Trackers). Unless otherwise specified herein, third-party providers may access the Trackers they manage themselves.
The validity and expiry periods of Cookies and other similar Trackers may vary depending on the lifetime set by TOSCO S.A. or the relevant provider. Some expire at the end of the User's browsing session.
In addition to what is specified in the descriptions of each of the categories below, Users can find more specific and up-to-date information regarding the description of the lifetime and any other useful information – such as the presence of other Trackers – in the privacy policies of the respective third-party providers, linked to, or by contacting TOSCO S.A.
Activities strictly necessary for the operation of the tosco.coffee website and the provision of the Service
The tosco.coffee website uses so-called ‘technical’ cookies and other similar trackers to carry out activities that are strictly necessary for the operation or provision of the Service.
First-party trackers
PHPSESSID: PHP Session. Storage duration: session (until the window is closed);
consentement_rgpd: Cookie for saving user preferences regarding cookies. Storage duration: 30 days.
Other activities involving the use of Trackers
Third-party trackers
Audience analysis and measurement: Google Analytics (Google LLC)
Google Analytics is a web analytics service provided by Google LLC (‘Google’). Google uses the collected data to track and analyse the use of this Application, to prepare reports on its activities and share them with other Google services. Google may use the collected data to contextualise and personalise the advertisements of its own advertising network. This integration of Google Analytics makes your IP address anonymous. Users' IP addresses are actually shortened within the Member States of the European Union or other States party to the Agreement on the European Economic Area. Only in exceptional cases is the full IP address transmitted to the Google server and shortened in the United States.
Personal data processed: Usage data; Trackers.
Place of treatment:
United States of America – Privacy policy – Withdrawal option;
Ireland – Privacy policy – Withdrawal option.
How to manage preferences and give or withdraw consent
There are various ways to manage preferences relating to Trackers and to give and withdraw consent, where applicable:
Users can manage preferences relating to Trackers directly in their own device settings, for example by preventing the use or storage of Trackers.
In addition, whenever the use of Trackers is based on consent, Users can give or withdraw that consent by setting their preferences in the cookie notification, or by updating those preferences accordingly using the appropriate consent preference widget, where available.
It is also possible, through the browser or device features, to delete previously stored Trackers, including those used to remember the User's initial consent. Other Trackers in the browser's local memory can be deleted by clearing the browsing history.
With regard to third-party Trackers, Users can manage their preferences and withdraw their consent via the associated withdrawal link (if applicable), using the method indicated in the third party's privacy policy or by contacting the third party.
Accessing settings for Trackers
Users can, for example, find information on how to manage cookies in the most commonly used browsers at the following addresses:
Google Chrome
Mozilla Firefox
Apple Safari
Microsoft Internet Explorer
Microsoft Edge
Opera
Users may also manage certain categories of Trackers used on mobile applications by disabling the appropriate device settings, such as the device's advertising settings for mobile devices or general tracking settings (Users may open the device settings and search for the appropriate setting).
Definitions and legal references
Personal data (or Data)
Any information that, directly, indirectly or in conjunction with other information – including a personal identification number – enables the identification or identifiability of a natural person.
Usage data
Information collected automatically by the tosco.coffee website (or by third-party services employed by the tosco.coffee website), which may include the IP addresses or domain names of the computers used by Users who use the tosco.coffee website, the URI (Uniform Resource Identifier) addresses, the time of the request, the method used to submit the request to the server, the size of the file received in response, the numerical code indicating the status of the server's response (successful result, error, etc.), the country of origin, the characteristics of the browser and operating system used by the User, various details relating to the time per visit (e.g. time spent on each page on the website) and details relating to the path followed on the website with special reference to the sequence of pages visited, and other parameters relating to the User's operating system or IT environment.
User
The person using the tosco.coffee website who, unless otherwise specified, corresponds to the natural person to whom the Personal Data refers.
Subcontractor (or Data Controller)
The natural or legal person, public authority, agency or any other body that processes Personal Data on behalf of the Data Controller, as described in this privacy policy.
Data controller (or Owner)
The natural or legal person, public authority, agency or any other body which, alone or jointly with others, determines the purposes and means of the processing of Personal Data, including the security measures concerning the operation and use of the tosco.coffee website. Unless otherwise specified, the Data Controller is the Owner of the tosco.coffee website.
Service
The service provided by this website as described in the relevant terms and conditions (if any) and on this website/application.
European Union (or EU)
Unless otherwise specified, all references in this document to the European Union include all current Member States of the European Union and the European Economic Area.
Cookie
Cookies are trackers consisting of small sets of data stored in the User's browser.
Trackers
A Tracker refers to any technology – for example, Cookies, unique identifiers, web beacons, embedded scripts, electronic tags and digital fingerprints – that enables the tracking of Users, for example by accessing or storing information on the User's device.
Legal information
This privacy policy has been prepared in accordance with the provisions of several laws, including Article 13/14 of European Regulation 2016/679 (General Data Protection Regulation). This privacy policy applies solely to this website, unless otherwise specified herein.
Privacy policy update date: 15th January 2016