Privacy Policy

Pursuant to Legislative Decree 196/2003 and Regulation (EU) 2016/679 (hereinafter the “Regulation”), this page describes the methods of processing personal data of users who consult the website of Oleificio Cooperativo di Ostuni Soc. Coop. which is accessible electronically at the following address:
We inform the user that following consultation of this website, data relating to identified or identifiable persons may be processed.

This information does not concern other websites, pages or online services which can be reached through hypertext links published on the website.

Identity of the Controller
The data controller is Oleificio Cooperativo di Ostuni Soc. Coop., with registered office in Ostuni (BR) 72017 – Corso Mazzini no. 210 (Email:, PEC:, Tel .: +39 0831/340070).


Source of the data and type of data collected
Oleificio Cooperativo di Ostuni Soc. Coop. collects personal data voluntarily provided by users:

  1. at the time of registration on the website or when the aforementioned users perform a transaction through the website, as well as other personal data associated with order processing. The aforementioned data may, by way of non-exhaustive example, include: Title, first name and surname, company name, VAT number (if necessary), date of birth, gender, e-mail address, username and password, shipping and billing address (including postcode, city and country), telephone and fax number, type and quantity of products ordered, order date, order fulfillment status, date and time of service delivery, order value, currency, payment information (number and expiration date of the credit card), requests for returns or offers by the user.
  2. related to the use of the Website by the user, for example: IP address, the products displayed and those present in the cart; if the user arrives at the Website via a reference page or a link present in a promotional e-mail or advertisement on another website which redirects to the website of Oleificio Cooperativo di Ostuni Soc. Coop. the company can also collect information on the referral page and on the promotional e-mail or targeted advertising together with the user’s IP address to analyse the effectiveness of marketing operations (overall “usage data”).
  3. at the time of sending a message using the forms prepared for the request for contact, for requesting a quote or the contact addresses on the site

The optional and voluntary sending of messages to the contact addresses, as well as the filling-in and forwarding of the forms present on the site, entails the acquisition of the contact details of the sender, which are necessary to provide feedback, as well as all the personal data included in the communications.

The data provided will be used with IT and electronic tools for the sole purpose of providing the service requested and, for this reason, will be kept exclusively for the period in which it will be active.

Purpose of the processing
Depending on the type of processing to be carried out, the Data Controller uses:

  1. Transaction data to process orders, manage payments, communicate with the user about the order, manage returns, provide assistance to customers and allow product collection. They will also be used to acquire pre-contractual data and information; to exchange information aimed at the execution of the contractual relationship, including pre- and post-contractual activities; to make requests or fulfill requests received; to manage accounting and tax obligations;
  2. the personal data of the Data Subject may also be processed for marketing and commercial promotion purposes, for market research and surveys with regards to Services/Products which the Data Controller may process automatically, in the following ways: e-mail; SMS; telephone contact and can be carried out if the interested party has not revoked their consent to the use of the data;
  3. to provide feedback to any communications, requests for information and/or services provided by users using the appropriate forms or using the address(es) in the contact section;
  4. for profiling purposes (e.g. automated analysis and/or forecasting of personal preferences and user interests);
  5. Finally, the data will be used to manage and control risks, to prevent possible fraud, insolvency or default; to prevent and manage possible litigation, to take legal action if needed.

Legal basis of processing
With reference to the purposes indicated in the previous paragraph, the legal basis of the processing is, with respect to the point:

  • the need to execute a contract of which the data subject is a party or pre-contractual measure adopted at the request of the data subject;
  • The consent given by the data subject;
  • the need to execute a contract of which the data subject is a party or pre-contractual measure adopted at the request of the data subject;
  • the consent given by the data subject for the specific purpose.
  • the need to pursue the legitimate interest of the data controller (in particular regarding the prevention of fraud and insolvency).

Cookies and other tracking systems
In order to make our services as efficient and simple to use as possible, this Website uses cookies. Therefore, when visiting the website, a minimum amount of information is entered into the User’s device, such as small text files called “cookies”, which are saved in the User’s Web browser directory. There are different types of cookies, but essentially the main purpose of a cookie is to make the website work more effectively and to enable certain features.

Cookies are used to improve the User’s global navigation.

For more information on the cookies used by this website, you can view the cookie policy at the following link.


Data recipients
The personal data processed by the Data Controller will not be disclosed, or will not be disseminated to indeterminate subjects, in any possible form, including that of their availability or simple consultation. On the other hand, they may be communicated to the workers who work for the Data Controller, or to persons authorised to process the data as they operate under the authority of the data controller. In this regard, Oleificio Cooperativo di Ostuni Soc. Coop. has appointed third-party service providers in connection with the operation of the website, such as hosting service providers, marketing and website service providers, IT maintenance service providers, shipping services and VAT verification services, as well as service providers who allow other functions which the user can use at their discretion to be integrated into the website. These service providers, designated as Data Processors, are provided with only the personal data they need to supply the corresponding services and are not allowed to use or disclose the personal data of the data subjects for other purposes, without the prior authorisation of the data subject.

They may be communicated, to the extent strictly necessary, to the subjects who for purposes of fulfilling orders or other requests or services related to the transaction or the contractual relationship with the Controller, must provide goods and/or perform services on behalf of the Controller.

Finally, they may be communicated to the persons entitled to access them under the provisions of the law, regulations, and community regulations.

In particular, based on the roles and tasks performed, some workers have been entitled to process personal data, within the limits of their competences and in accordance with the instructions given to them by the Controller.

Data transfer
The Data Controller does not transfer personal data to third countries or international organisations. However, they reserve the right to use cloud services; in this case, the service providers will be selected from among those who provide adequate guarantees, as required by art. 46 GDPR 679/16.


Data storage
The Data Controller retains and processes personal data for the time necessary to fulfill the purposes indicated. Subsequently, personal data will be stored —and not processed further — for the time established by the current provisions on civil and fiscal matters.

In particular, they will be kept for the entire duration of your registration and in any case no later than a maximum period of 12 (twelve) months of inactivity, or if, within that period, the Services and/or products purchased are not associated with the registry itself.

In the case of data provided to the Data Controller for the purposes of profiling, these will be kept for 12 months, unless the consent given is revoked.

In the case of data supplied for purposes of commercial promotion for services other than those already acquired by the data subject, for which they have initially given their consent, these will be kept for 24 months, unless the consent given is revoked.

In the case of data provided to the Data Controller for the purposes of profiling, these will be kept for 12 months, unless the consent given is revoked.

It should also be added that, in the event that a user provides the Controller with unsolicited or personal data or personal data which are unnecessary for the purpose of performing the requested service or for the provision of a closely connected service, Oleificio Cooperativo di Ostuni Soc. Coop. cannot be considered the controller of these data, and will provide for their deletion as soon as possible.


Rights of the data subject
In relation to the data which is subject to the processing referred to in this privacy policy, the data subject has the right to:

  • ask the Data Controller to access their personal data and information relating to them (art. 15 of the GDPR); the rectification of inaccurate data or the integration of incomplete data (art. 16 of the GDPR); the deletion of their personal data (if one of the conditions indicated in art. 17, par. 1 of the GDPR applies and in compliance with the exceptions provided in paragraph 3 of the same article); the limitation of the processing of their personal data (in the event of one of the hypotheses indicated in art. 18, par. 1 of the GDPR);
  • request and obtain from the Data Controller – in cases where the legal basis of the processing is the contract or consent, and the processing is carried out by automated means – their personal data in a structured and machine-readable format, also for the purpose of communicating such data to another data controller (so-called right to the portability of personal data – art. 20 of the GDPR);
  • object to the processing of their personal data at any time in the event of particular situations affecting them (art. 21 of the GDPR);
  • withdraw consent at any time, limited to cases where the processing is based on their consent for one or more specific purposes. Processing based on the person’s consent and carried out prior to the revocation of the processing, however, preserves its lawfulness (art. 7, par. 3 of the GDPR).

The specific application is presented by contacting the Data Controller via registered email at, by email at or by registered letter with return receipt to Ostuni (BR) 72017 – Corso Mazzini no. 210.

If the data subject considers that the processing of their data is in violation of the provisions of the Regulation, they may lodge a complaint with a supervisory authority (Authority for the protection of personal data –, as provided for by art. 77 of the GDPR, or take the appropriate judicial action (art. 79 of the GDPR).

Refusal to provide data
Data subjects cannot refuse to give the Data Controller the personal data which are necessary to comply with the laws which regulate commercial transactions and taxation.

The provision of further personal data may be necessary to improve the quality and efficiency of the transaction.

Therefore, the refusal to supply the data required by law will prevent the fulfillment of orders. The additional data indicated in the paragraph “Sources of data and types of data collected” are provided on a voluntary basis; however, if the data subect decides not to provide the data requested, Oleificio Cooperativo di Ostuni Soc. Coop. may not be able to provide the services, allow the transaction to be completed via the website or process the order.

Automated decision-making processes
The Data Controller does not carry out processing which consists of automated decision-making processes on the data of individuals, except with regard to those data subjects who consent to the processing of data for marketing and profiling purposes.


Follow us


Product has been added to cart

View Cart