PRIVACY NOTICE PURSUANT TO ARTICLE 13 OF EU REGULATION NO. 2016/679
- WEBSITE -
G.F. S.r.l., (VAT No.: 00123220352) (hereinafter “G.F.”), in the person of its current legal representative, with its registered office in Correggio (RE), Via Dell’Industria, 1 , in its capacity as Data Controller pursuant to Articles 4(7) and 24 of EU Regulation No. 2016/679 (GDPR), hereby informs you that, in accordance with Article 13 of the GDPR, your personal data described in Article 1 below will be processed for the purposes set out in Article 2 below.
1. Categories of personal data subject to processing.
1.1. In order to pursue the processing purposes described in Article 2, G.F. collects and processes your personal data as defined in Article 4(1) of the GDPR, known as ‘browsing data’ (e.g. IP address; domain name of the personal computer used) (hereinafter ‘personal data’), collected whilst you browse the website in question.
2. Purposes of processing and the relevant legal basis.
2.1. Your personal data is processed by G.F. for the following processing purpose:
a. Browsing the website in question.
In this regard, G.F. finally clarifies that the legal basis for the processing purpose referred to in Article 2.1(a) is set out in the following provision: Article 6(1)(f) of the GDPR. In accordance with Article 13(1)(d) of the GDPR, G.F. specifies that the legitimate interest pursued through the processing operation referred to in Article 2.1(a) consists, precisely, in enabling navigation on the website.
3. Retention period.
3.1. In accordance with Article 13(2)(a) of the GDPR, G.F. hereby informs you of the following retention period or timeframe, at the end of which your personal data will be subject to erasure, destruction or anonymisation: (i) for the purposes of the processing referred to in Article 2.1(a): for the duration of your browsing of the website.
4. Recipients.
4.1. In accordance with Article 13(1)(e) of the GDPR, G.F. hereby states that your personal data may be disclosed, where appropriate and necessary, to one or more recipients as defined in Article 4(9) of the GDPR, generally identified by category as follows: (i) for the purposes of processing set out in Article 2.1. point (a): persons authorised under Articles 4(10), 29 and 32(4) of the GDPR to process data on behalf of G.F.; consultants or companies of various kinds which provide services and/or perform tasks (including professional services) connected, even indirectly, to the fulfilment of the purpose in question (e.g. IT companies).
5. Transfer.
5.1. Your personal data may be stored in automated, partially automated and/or non-automated data files belonging to or otherwise attributable, even indirectly, to G.F., and located – as regards automated data files exclusively – potentially outside the European Economic Area (EEA): regarding this latter point, G.F. specifies that, pursuant to Article 13(1)(f) of the GDPR, the safeguard referred to in Chapter V of the GDPR consists of the adequacy decision pursuant to Article 45 of the GDPR.
6. Rights of the data subject.
6.1. In relation to your personal data, G.F. informs you that you may exercise the following rights, which may be subject to the restrictions set out in Articles 2-undecies and 2-duodecies of the Privacy Code: right of access under Article 15 of the GDPR: the right to obtain confirmation as to whether or not personal data are being processed, as well as the information referred to in Article 15 of the GDPR (e.g. purposes of processing, retention period); the right to rectification under Article 16 of the GDPR: the right to correct, update or supplement your personal data; the right to erasure under Article 17 of the GDPR: the right to obtain the erasure, destruction or anonymisation of your personal data, provided that the conditions set out in that Article are met; the right to restriction of processing under Article 18 of the GDPR: a right of a distinctly precautionary nature, aimed at obtaining the restriction of processing where the circumstances set out in Article 18 apply; the right to data portability under Article 20 of the GDPR: the right to obtain personal data, provided to the data controller, in a structured, commonly used and machine-readable format (and, where requested, to have it transmitted directly to another data controller), provided that the specific conditions set out in that article are met (e.g. legal basis of consent and/or the performance of a contract; personal data provided by the data subject); the right to object under Article 21 of the GDPR: the right to have a specific processing operation involving personal data permanently ceased; the right to lodge a complaint with the Supervisory Authority (i.e. the Italian Data Protection Authority) under Article 77 of the GDPR: the right to lodge a complaint where it is considered that the processing in question infringes national and EU legislation on the protection of personal data.
6.2. In addition to the rights described in Article 6.1 above, G.F. wishes to point out that, where possible and relevant, you have the right to exercise, on the one hand, the (sub)right provided for in Article 19 of the GDPR (“The data controller shall inform each recipient to whom the personal data have been disclosed of any rectification, erasure or restriction of processing carried out in accordance with Article 16, Article 17(1) and Article 18, unless this proves impossible or involves a disproportionate effort. The controller shall inform the data subject of such recipients if the data subject so requests”), which is to be regarded as connected to and linked with the exercise of one or more rights regulated by Articles 16, 17 and 18 of the GDPR; on the other hand, the data controller specifies that, where possible and relevant, the right provided for in Article 22(1) of the GDPR (“‘The data subject shall have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her’), subject to the exceptions set out in paragraph 2 below.
6.3. In accordance with Article 12(1) of the GDPR, G.F. undertakes to provide the information referred to in Articles 15 to 22 and 34 of the GDPR in a concise, transparent, intelligible and easily accessible form, using clear and plain language: such information shall be provided in writing or by other means, including electronic means, or, at the data subject’s request, orally, provided that the data subject’s identity is verified by other means.
6.4. In accordance with Article 12(3) of the GDPR, G.F. hereby informs you that it undertakes to provide information regarding the action taken in response to a request under Articles 15 to 22 of the GDPR without undue delay and, in any event, no later than one month from receipt of the request; this time limit may be extended by two months if necessary, taking into account the complexity and number of requests (in which case, G.F. undertakes to inform you of such an extension and the reasons for the delay within one month of receiving the request).
6.5. The rights described above (with the exception of the right under Article 77 of the GDPR) may be exercised using the contact details set out in Article 7 below.
7. Contact details.
7.1. G.F. can be contacted at the following address: info@gfgarden.it
7.2. The Data Protection Officer (DPO) pursuant to Article 37 of the GDPR, appointed by G.F., can be contacted at the following address: dpo.gf@gfgarden.it
Correggio (RE), 23 February 2026 (date of last update).
G.F. S.r.l.
(represented by its current legal representative)
NOTICE PURSUANT TO ARTICLE 13 OF EU REGULATION NO. 2016/679
– CUSTOMER –
G.F. S.r.l., (VAT No.: 00123220352) (hereinafter “G.F.”), represented by its current legal representative, with its registered office in Correggio (RE), Via Dell’Industria, 1 , in its capacity as Data Controller pursuant to Articles 4(7) and 24 of EU Regulation No. 2016/679 (GDPR), hereby informs you, in accordance with Article 13 of the GDPR, that the personal data described in more detail in Article 1 below will be processed for the purposes set out in Article 2.
1. Categories of data subject to processing.
1.1. G.F. collects and processes, for the purposes of processing set out in Article 2, personal data as defined in Article 4(1) of the GDPR, namely so-called ‘identifying’ data (e.g. first name; surname; tax identification number; address of residence/domicile/abode) and so-called ‘financial’ data (e.g. bank or postal account) (hereinafter “personal data”), including any non-personal data as defined in Article 3(1) of EU Regulation No 2018/1807 (e.g. VAT number) that can be traced, directly or indirectly, to a customer, including any associated workforce consisting of employees or similar personnel.
2. Purposes of processing and legal basis.
2.1. Personal data is processed by G.F. for the following purpose:
a. The performance of a pre-contractual measure (e.g. a quotation) and/or a contractual relationship, including any related and consequent regulatory and administrative obligations.
In accordance with Article 13(2)(e) of the GDPR, G.F. specifies that any failure to provide the requested personal data may result in the inability to fully and correctly fulfil the processing purpose described in Article 2.1(a). In this regard, G.F. specifies that the legal basis for the purpose of processing described in Article 2.1(a) is set out in the following legal provisions: Article 6(1)(b) and (c) of the GDPR.
2.2. Personal data is processed by G.F. for the following processing purpose:
b. Where necessary, the exercise or defence of a right or interest (including a claim for payment), including in court proceedings.
In accordance with Article 13(1)(d) of the GDPR, G.F. specifies that the legitimate interest pursued through the processing purpose referred to in Article 2.2(b) consists in protecting, defending or asserting rights or interests (including credit claims), including in court proceedings: in this regard, G.F. specifies, in accordance with paragraph 1.3) of Provision No. 146 of 5 June 2019 signed by the Data Protection Authority, that, for this purpose, the matter must involve ongoing litigation or a pre-litigation situation. In this regard, G.F. finally clarifies that the legal basis for the processing purpose referred to in Article 2.2(b) is set out in the following legislative provision: Article 6(1)(f) of the GDPR.
3. Retention period.
3.1. In accordance with Article 13(2)(a) of the GDPR, G.F. sets out the following retention periods/time limits, at the end of which personal data will be subject to erasure, destruction or anonymisation: (i) for the fulfilment of the processing purpose referred to in Article 2.1. point (a): 1 year, starting from the definitive conclusion of a pre-contractual measure (which may be extended in order to comply with a regulatory obligation (including one that has subsequently arisen) or to assert or defend a right, including in court proceedings), should this not have resulted in a contractual relationship with G.F.: should the latter scenario occur, G.F. also specifies that personal data will be retained for 10 years pursuant to Articles 2220 and 2946 of the Italian Civil Code, commencing from the definitive termination of the relevant contractual relationship, which may be extended in order to comply with a regulatory obligation (including one that has arisen subsequently) or to assert or defend a right, including in court proceedings; (ii) for the purposes of processing referred to in Article 2.2. point (b): for the time necessary to protect a right or interest, including in court proceedings; this time limit may be extended to 10 years from the definitive conclusion of the litigation (see, by analogy, the document ‘National Archiving System – Guidelines for the Selection and Disposal of Documents’, issued by the Italian Revenue Agency).
4. Recipients.
4.1. In accordance with Article 13(1)(e) of the GDPR, G.F. states that personal data may be disclosed, where appropriate and necessary, to one or more recipients as defined in Article 4(9) of the GDPR, broadly categorised as follows: (i) for the purposes of processing set out in Articles 2.1. and 2.2.: parties authorised by G.F. to process data; consultants/companies of various kinds providing services connected, even indirectly, to the processing purposes in question (e.g. ICT companies; tax and/or legal advisers); subsidiaries or affiliated companies of G.F.
5. Transfer.
5.1. Personal data are/may be stored in automated, partially automated or non-automated databases belonging to or otherwise attributable, even indirectly, to G.F., and located within the European Economic Area (EEA). In the event that data is stored in fully or partially automated data files potentially outside the EEA, G.F. hereby states that, in accordance with Article 13(1)(f) of the GDPR, it will comply with the safeguards set out in Chapter V of the GDPR.
6. Rights of the data subject.
6.1. With regard solely to personal data, G.F. hereby informs you of your right to exercise the following rights, which may be subject to the restrictions set out in Articles 2-undecies and 2-duodecies of the Privacy Code: the right of access under Article 15 of the GDPR: the right to obtain confirmation as to whether or not personal data concerning the data subject are being processed, as well as the information referred to in Article 15 of the GDPR (e.g. purposes of processing, retention period); the right to rectification under Article 16 of the GDPR: the right to correct, update or supplement personal data; the right to erasure under Article 17 of the GDPR: the right to obtain the erasure, destruction or anonymisation of personal data, provided that the conditions set out in that Article are met; the right to restriction of processing under Article 18 of the GDPR: a right of a distinctly precautionary nature, aimed at obtaining the restriction of processing where the circumstances governed by Article 18 itself apply; the right to data portability under Article 20 of the GDPR: the right to obtain personal data, provided to G.F., in a structured, commonly used and machine-readable format (and, where requested, to have it transmitted directly to another data controller), where the specific conditions set out in that article are met (e.g. legal basis of consent and/or the performance of a contract; personal data provided by the data subject); the right to object under Article 21 of the GDPR: the right to obtain the permanent cessation of a specific processing operation involving personal data; the right to lodge a complaint with the Supervisory Authority (i.e. the Italian Data Protection Authority) under Article 77 of the GDPR: the right to lodge a complaint where it is considered that the processing in question infringes national and EU legislation on the protection of personal data.
6.2. In addition to the rights described in Article 6.1 above, G.F. specifies that, in relation solely to personal data, where possible and relevant, the right exists to exercise, on the one hand, the (sub)right provided for in Article 19 of the GDPR (“The data controller shall inform each recipient to whom the personal data have been disclosed of any rectification, erasure or restriction of processing carried out in accordance with Article 16, Article 17(1) and Article 18, unless this proves impossible or involves a disproportionate effort. The controller shall inform the data subject of those recipients if the data subject so requests”), which is to be regarded as connected to and linked with the exercise of one or more rights regulated by Articles 16, 17 and 18 of the GDPR; on the other hand, G.F. specifies that, in relation solely to the personal data described in Article 1 above, the right provided for in Article 22(1) of the GDPR may be exercised, where possible and relevant: (“‘The data subject shall have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her’), subject to the exceptions set out in paragraph 2 below.
6.3. In accordance with Article 12(1) of the GDPR, G.F. undertakes to provide the information referred to in Articles 15 to 22 and 34 of the GDPR in a concise, transparent, intelligible and easily accessible form, using clear and plain language: such information shall be provided in writing or by other means, including electronic means, or, at the data subject’s request, orally, provided that the data subject’s identity is verified by other means.
6.4. In accordance with Article 12(3) of the GDPR, G.F. hereby informs you that it undertakes to provide information regarding the action taken in response to a request under Articles 15 to 22 of the GDPR without undue delay and, in any event, no later than one month from receipt of the request; this time limit may be extended by two months if necessary, taking into account the complexity and number of requests (in which case, G.F. undertakes to inform the data subject of such an extension and the reasons for the delay within one month of receiving the request).
6.5. The rights described above (with the exception of the right under Article 77 of the GDPR) may be exercised using the contact details set out in Article 7 below.
7. Contact details.
7.1. G.F. can be contacted at the following address: info@gfgarden.it
7.2. The Data Protection Officer (DPO) pursuant to Article 37 of the GDPR, appointed by G.F., may be contacted at the following address: dpo.gf@gfgarden.it
Correggio (RE), 7 February 2026 (date of last update).
G.F. S.r.l.
(represented by its current legal representative)
NOTICE PURSUANT TO ARTICLE 13 OF EU REGULATION NO. 2016/679
– SUPPLIER/CONSULTANT/PROFESSIONAL –
G.F. S.r.l., (VAT No.: 00123220352) (hereinafter “G.F.”), represented by its current legal representative, with its registered office in Correggio (RE), Via Dell’Industria, 1 , in its capacity as Data Controller pursuant to Articles 4(7) and 24 of EU Regulation No. 2016/679 (GDPR), hereby informs you, in accordance with Article 13 of the GDPR, that the personal data described in more detail in Article 1 below will be processed for the purposes set out in Article 2.
1. Categories of data subject to processing.
1.1. G.F. collects and processes, for the purposes of processing set out in Article 2, personal data as defined in Article 4(1) of the GDPR, namely so-called ‘identifying’ data (e.g. first name; surname; tax identification number; address of residence/domicile/abode) and so-called ‘financial’ data (e.g. bank or postal account) (hereinafter “personal data”), including any non-personal data as defined in Article 3(1) of EU Regulation No 2018/1807 (e.g. VAT number) that can be traced, directly or indirectly, to a supplier/consultant/professional, including any associated workforce consisting of employees or similar personnel.
2. Purposes of processing and legal basis.
2.1. Personal data is processed by G.F. for the following purpose:
a. The performance of a pre-contractual measure (e.g. a quotation) and/or a contractual relationship, including any related and consequent regulatory and administrative obligations.
In accordance with Article 13(2)(e) of the GDPR, G.F. specifies that any failure to provide the requested personal data may result in the inability to fully and correctly fulfil the processing purpose described in Article 2.1(a). In this regard, G.F. specifies that the legal basis for the purpose of processing described in Article 2.1(a) is set out in the following legal provisions: Article 6(1)(b) and (c) of the GDPR.
2.2. Personal data is processed by G.F. for the following processing purpose:
b. Where necessary, the exercise or defence of a right or interest (including a claim for payment), including in court proceedings.
In accordance with Article 13(1)(d) of the GDPR, G.F. specifies that the legitimate interest pursued through the processing purpose referred to in Article 2.2(b) consists in protecting, defending or asserting rights or interests (including credit claims), including in court proceedings: in this regard, G.F. specifies, in accordance with paragraph 1.3) of Provision No. 146 of 5 June 2019 signed by the Data Protection Authority, that, for this purpose, the matter must involve ongoing litigation or a pre-litigation situation. In this regard, G.F. finally clarifies that the legal basis for the processing purpose referred to in Article 2.2(b) is set out in the following legislative provision: Article 6(1)(f) of the GDPR.
3. Retention period.
3.1. In accordance with Article 13(2)(a) of the GDPR, G.F. sets out the following retention periods/time limits, at the end of which personal data will be subject to erasure, destruction or anonymisation: (i) for the fulfilment of the processing purpose referred to in Article 2.1. point (a): 1 year, starting from the definitive conclusion of a pre-contractual measure (which may be extended in order to comply with a regulatory obligation (including one that has subsequently arisen) or to assert or defend a right, including in court proceedings), should this not have resulted in a contractual relationship with G.F.: should the latter scenario occur, G.F. also specifies that personal data will be retained for 10 years pursuant to Articles 2220 and 2946 of the Italian Civil Code, commencing from the definitive termination of the relevant contractual relationship, which may be extended in order to comply with a regulatory obligation (including one that has arisen subsequently) or to assert or defend a right, including in court proceedings; (ii) for the purposes of processing referred to in Article 2.2. point (b): for the time necessary to protect a right or interest, including in court proceedings; this time limit may be extended to 10 years from the definitive conclusion of the litigation (see, by analogy, the document ‘National Archiving System – Guidelines for the Selection and Disposal of Documents’, issued by the Italian Revenue Agency).
4. Recipients.
4.1. In accordance with Article 13(1)(e) of the GDPR, G.F. states that personal data may be disclosed, where appropriate and necessary, to one or more recipients as defined in Article 4(9) of the GDPR, broadly categorised as follows: (i) for the purposes of processing set out in Articles 2.1. and 2.2.: parties authorised by G.F. to process data; consultants/companies of various kinds providing services connected, even indirectly, to the processing purposes in question (e.g. ICT companies; tax and/or legal advisers); subsidiaries or affiliated companies of G.F.
5. Transfer.
5.1. Personal data are/may be stored in automated, partially automated or non-automated databases belonging to or otherwise attributable, even indirectly, to G.F., and located within the European Economic Area (EEA). In the event that data is stored in fully or partially automated data files potentially outside the EEA, G.F. hereby states that, in accordance with Article 13(1)(f) of the GDPR, it will comply with the safeguards set out in Chapter V of the GDPR.
6. Rights of the data subject.
6.1. With regard solely to personal data, G.F. hereby informs you of your right to exercise the following rights, which may be subject to the restrictions set out in Articles 2-undecies and 2-duodecies of the Privacy Code: the right of access under Article 15 of the GDPR: the right to obtain confirmation as to whether or not personal data concerning the data subject are being processed, as well as the information referred to in Article 15 of the GDPR (e.g. purposes of processing, retention period); the right to rectification under Article 16 of the GDPR: the right to correct, update or supplement personal data; the right to erasure under Article 17 of the GDPR: the right to obtain the erasure, destruction or anonymisation of personal data, provided that the conditions set out in that Article are met; the right to restriction of processing under Article 18 of the GDPR: a right of a distinctly precautionary nature, aimed at obtaining the restriction of processing where the circumstances governed by Article 18 itself apply; the right to data portability under Article 20 of the GDPR: the right to obtain personal data, provided to G.F., in a structured, commonly used and machine-readable format (and, where requested, to have it transmitted directly to another data controller), where the specific conditions set out in that article are met (e.g. legal basis of consent and/or the performance of a contract; personal data provided by the data subject); the right to object under Article 21 of the GDPR: the right to obtain the permanent cessation of a specific processing operation involving personal data; the right to lodge a complaint with the Supervisory Authority (i.e. the Italian Data Protection Authority) under Article 77 of the GDPR: the right to lodge a complaint where it is considered that the processing in question infringes national and EU legislation on the protection of personal data.
6.2. In addition to the rights described in Article 6.1 above, G.F. specifies that, in relation solely to personal data, where possible and relevant, the right exists to exercise, on the one hand, the (sub)right provided for in Article 19 of the GDPR (“The data controller shall inform each recipient to whom the personal data have been disclosed of any rectification, erasure or restriction of processing carried out in accordance with Article 16, Article 17(1) and Article 18, unless this proves impossible or involves a disproportionate effort. The controller shall inform the data subject of those recipients if the data subject so requests”), which is to be regarded as connected to and linked with the exercise of one or more rights regulated by Articles 16, 17 and 18 of the GDPR; on the other hand, G.F. specifies that, in relation solely to the personal data described in Article 1 above, the right provided for in Article 22(1) of the GDPR may be exercised, where possible and relevant: (“‘The data subject shall have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her’), subject to the exceptions set out in paragraph 2 below.
6.3. In accordance with Article 12(1) of the GDPR, G.F. undertakes to provide the information referred to in Articles 15 to 22 and 34 of the GDPR in a concise, transparent, intelligible and easily accessible form, using clear and plain language: such information shall be provided in writing or by other means, including electronic means, or, at the data subject’s request, orally, provided that the data subject’s identity is verified by other means.
6.4. In accordance with Article 12(3) of the GDPR, G.F. hereby informs you that it undertakes to provide information regarding the action taken in response to a request under Articles 15 to 22 of the GDPR without undue delay and, in any event, no later than one month from receipt of the request; this time limit may be extended by two months if necessary, taking into account the complexity and number of requests (in which case, G.F. undertakes to inform the data subject of such an extension and the reasons for the delay within one month of receiving the request).
6.5. The rights described above (with the exception of the right under Article 77 of the GDPR) may be exercised using the contact details set out in Article 7 below.
7. Contact details.
7.1. G.F. can be contacted at the following address: info@gfgarden.it
7.2. The Data Protection Officer (DPO) pursuant to Article 37 of the GDPR, appointed by G.F., may be contacted at the following address: dpo.gf@gfgarden.it
Correggio (RE), 7 February 2026 (date of last update).
G.F. S.r.l.
(represented by its current legal representative)
NOTICE PURSUANT TO ARTICLES 13 AND 14 OF EU REGULATION NO. 2016/679
– APPLICANT –
G.F. S.r.l., (VAT No.: 00123220352) (hereinafter “G.F.”), represented by its current legal representative, with registered office at Via Dell’Industria , 1, Correggio (RE), acting as Data Controller pursuant to Articles 4(7) and 24 of EU Regulation No. 2016/679 (GDPR), hereby informs you, in accordance with Articles 13 and 14 of the GDPR, that your personal data described in Article 1 below will be processed for the purposes set out in Article 2.
1. Categories of data subject to processing.
1.1. G.F. may collect and process, for the purpose of carrying out the processing described in Article 2, the following information relating to you, contained primarily within your curriculum vitae (CV) submitted to or received by G.F. by any direct or indirect means (e.g. unsolicited application; physical delivery to premises associated with G.F.; an internal referral by an employee or similar staff member of G.F. or of companies directly or indirectly linked to it) or obtained or inferred from further documentation provided, including on an unsolicited basis: (i) personal data as defined in Article 4(1) of the GDPR (e.g. first name; surname; residential address/domicile/place of residence; photograph; professional and educational background) (hereinafter ‘personal data’); (ii) where necessary, so-called special categories of personal data pursuant to Article 9(1) of the GDPR (with the exception of any genetic data you may have pursuant to Article 4(13) of the GDPR, in accordance with paragraph 1.4.1.) letter d) of Provision No. 146 of 5 June 2019 signed by the Italian Data Protection Authority [web doc. No. 9124510]), which may be contained in your CV and/or provided by you to G.F. (e.g. membership of a so-called protected category) (hereinafter “so-called special categories of personal data”). In accordance with Article 14(2)(f) of the GDPR, G.F. specifies that the source of the personal information described above may, where applicable, derive from parties other than G.F.
2. Purposes of processing and the relevant legal basis.
2.1. Your personal data and, where necessary, your so-called ‘special categories of personal data’ are/may be processed by G.F. for the following processing purpose:
a. Recruitment, selection and assessment of a candidate for an employment relationship or similar arrangement.
In accordance with Article 13(2)(e) of the GDPR, G.F. hereby states that any failure to provide (even partially, where necessary) your personal data and, where necessary, your so-called special categories of personal data may, in certain circumstances, make it impossible for G.F. to carry out, correctly and fully, the processing purpose referred to in Article 2.1(a).
In this regard, G.F. specifies that the legal basis for the processing purpose referred to in Article 2.1(a) is set out in the following regulatory provisions: Article 6(1)(b) and (c) of the GDPR, in respect of your personal data; Article 9(2)(b) of the GDPR, Provision No. 146 of 5 June 2019 issued by the Italian Data Protection Authority (to be read in conjunction with Article 21(5) of Legislative Decree No. 101 of 10 August 2018), Article 113 of the amended Legislative Decree No. 196/2003 (Privacy Code), Article 8 of Law No. 300/1970 (Workers’ Statute), in respect of your so-called ‘special categories’ of personal data.
3. Retention period.
3.1. In accordance with Article 13(2)(a) of the GDPR (and, where applicable, in accordance with Article 14(2)(a) of the GDPR), G.F. hereby informs you of the following retention periods/time limits, at the end of which your personal data and any so-called ‘special categories’ of personal data will be subject to erasure, destruction or anonymisation: (i) for the purposes of processing referred to in Article 2.1(a): in the event of a successful outcome to the selection process: 10 years pursuant to Article 2946 of the Italian Civil Code, commencing from the definitive termination of the employment relationship or similar arrangement assigned by G.F., a period which may be extended in order to comply with a regulatory obligation (including one that has subsequently arisen) or to assert or defend a right or interest, including in court proceedings; in the event of an unsuccessful outcome of the selection process: generally, 1 year, commencing from the date on which G.F. notifies you of the unsuccessful outcome (including in the form of so-called ‘silence’ or ‘refusal’, following a reasonable period of time having elapsed since the last job interview conducted by G.F. in relation to the position for which you applied) of the selection process in which you chose to participate: upon expiry of this period, G.F. reserves the right to ask you, in accordance with Recommendation CM/Rec (2015)5 of the Committee of Ministers to Member States, for your consent to the further (but predetermined) retention of your CV, in anticipation of future job opportunities.
4. Recipients.
4.1. In accordance with Article 13(1)(e) of the GDPR (and, where applicable, in accordance with Article 14(1)(e) of the GDPR), G.F. hereby informs you that your personal data and any so-called ‘special categories’ of personal data may be disclosed, where appropriate and necessary, to one or more recipients pursuant to Article 4(9) of the GDPR, identified, in general terms, by category as follows: (i) for the purposes of processing referred to in Article 2.1. point (a): so-called authorised parties pursuant to Articles 4(10), 29 and 32(4) of the GDPR for processing by G.F.; subsidiaries/affiliates of G.F., in accordance with Recital 48 of the GDPR; consultants/companies of various kinds and forms that provide services directly or indirectly related to the full fulfilment of the processing purpose referred to in Article 2.1(a).
5. Transfer.
5.1. Your personal data and any so-called ‘special categories’ of personal data are/will be stored in automated, partially automated or non-automated data files belonging to, or in any way attributable to, including indirectly, G.F., and located within the European Economic Area (EEA). In the event that data is stored in fully or partially automated data files potentially outside the EEA, G.F. hereby states that, in accordance with Article 13(1)(f) of the GDPR, it will comply with the safeguards set out in Chapter V of the GDPR.
6. Rights of the data subject.
6.1. In relation to your data described in Article 1 above, G.F. informs you that you may exercise the following rights, which may be subject to the restrictions set out in Articles 2-undecies and 2-duodecies of the Privacy Code: the right of access under Article 15 of the GDPR: the right to obtain confirmation as to whether or not personal data concerning the data subject are being processed, as well as the information referred to in Article 15 of the GDPR (e.g. purposes of processing, retention period); the right to rectification under Article 16 of the GDPR: the right to correct, update or supplement personal data; the right to erasure under Article 17 of the GDPR: the right to obtain the erasure, destruction or anonymisation of personal data, provided that the conditions set out in that Article are met; the right to restriction of processing under Article 18 of the GDPR: a right of a distinctly precautionary nature, aimed at obtaining the restriction of processing where the circumstances set out in Article 18 apply; the right to data portability under Article 20 of the GDPR: the right to obtain personal data provided to G.F. in a structured, commonly used and machine-readable format (and, where requested, to have it transmitted directly to another data controller), provided that the specific conditions set out in that article are met (e.g. legal basis of consent and/or the performance of a contract; personal data provided by the data subject); the right to object under Article 21 of the GDPR: the right to have a specific processing operation involving personal data permanently ceased; the right to lodge a complaint with the Supervisory Authority (i.e. the Italian Data Protection Authority) under Article 77 of the GDPR: the right to lodge a complaint where it is considered that the processing in question infringes national and EU legislation on the protection of personal data.
6.2. In addition to the rights described in Article 6.1 above, G.F. specifies that, in relation to your data described in Article 1 above, you have the right, where possible and relevant, to exercise, on the one hand, the (sub)right provided for in Article 19 of the GDPR (“The data controller shall inform each recipient to whom the personal data have been disclosed of any rectification, erasure or restriction of processing carried out in accordance with Article 16, Article 17(1) and Article 18, unless this proves impossible or involves a disproportionate effort. The controller shall inform the data subject of those recipients if the data subject so requests”), which is to be regarded as connected to and linked with the exercise of one or more rights regulated by Articles 16, 17 and 18 of the GDPR; on the other hand, G.F. specifies that, in relation to your data described in Article 1 above, you have the right, where possible and relevant, to exercise the right provided for in Article 22(1) of the GDPR (“‘The data subject shall have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her’), subject to the exceptions set out in paragraph 2 below.
6.3. In accordance with Article 12(1) of the GDPR, G.F. undertakes to provide the information referred to in Articles 15 to 22 and 34 of the GDPR in a concise, transparent, intelligible and easily accessible form, using clear and plain language: such information shall be provided in writing or by other means, including electronic means, or, at the data subject’s request, orally, provided that the data subject’s identity is verified by other means.
6.4. In accordance with Article 12(3) of the GDPR, G.F. hereby informs you that it undertakes to provide information regarding the action taken in response to a request under Articles 15 to 22 of the GDPR without undue delay and, in any event, no later than one month from receipt of the request; this time limit may be extended by two months if necessary, taking into account the complexity and number of requests (in which case, G.F. undertakes to inform the data subject of such an extension and the reasons for the delay within one month of receiving the request).
6.5. The rights described above (with the exception of the right under Article 77 of the GDPR) may be exercised using the contact details set out in Article 7 below.
7. Contact details.
7.1. G.F. can be contacted at the following address: info@gfgarden.it
7.2. The Data Protection Officer (DPO) pursuant to Article 37 of the GDPR, appointed by G.F., may be contacted at the following address: dpo.gf@gfgarden.it
Correggio (RE), 7 February 2026 (date of last update).
G.F. S.r.l.
(represented by its current legal representative)
