CONTENTS

S Cask Limited (hereinafter referred to as the “Company“) is the Data Controller pursuant to Articles 4 and 24 of EU Regulation no. 2016/679 dated 27 April 2016 concerning the protection of individuals with regard to processing their personal data (hereafter the “EU Data Protection Regulation“) regarding users’ personal information collected and processed on the website www.scaskworld.com  (the “Site“).

Personal data processing means any operation or set of operations, carried out with or without the aid of automated processes and applied to personal data or sets of personal information, even if not registered in a database, such as the collection, recording, organisation, structuring, storage, processing, selection, blocking, adaptation or modification, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, elimination or destruction thereof.

The data shall be processed manually and/or with the support of IT or electronic means for the following purposes.

 

Identity and the contact details of the Data Controller.

The identification and contact details of the Data Controller follow:

S Cask Limited

Company number 12936767

Registered office address:17 Grosvenor Street, Mayfair, London, England, W1K 4QG

Registered Officer: Alessandro Bleve.

The contact details allowing the user to quickly contact S Cask Limited and communicate directly and effectively with the same, including e-mail address are:

Tel.  …………………………

Fax ………………………….

e-mail: ………………………

 

Main purposes for the processing personal data .

Through the Site, customers of the SAMAROLI brand or users of the Site may use various information services on casks and products related to the world of whisky and rum of excellence.

In the “Available Casks” online section, offers for the sale of rum and/or whisky casks and investment methods are published. Users interested in a particular offer/investment can fill out an online form requesting S Cask Limited to contact them to obtain specific information about the investment.

The ‘My Stock’ section of the Site is an area reserved for users who have purchased casks. In this online section, the owner of the purchased casks can benefit from a series of information services relating to the performance of their investment and the diversification of its financial value over time.

In the “Auction” section of the Site, auctions organised by third parties for the sale of barrels are published, for reference purposes only. It is not possible to participate in auctions directly from the Site. S Cask Limited is not the organiser of said auctions, nor is it the data controller of the participants’ personal data. It merely provides links connecting the interested user to the websites of the providers of external auction services.

In the ‘Trips’ section of the Site a number of travel programmes organised by third-party providers exclusively for customers are published and listed. Users interested in a particular travel programme can fill out an online form requesting S Cask Limited to contact them providing specific information. S Cask Limited is not the organiser of the travel programmes/trips or travels, nor is it the data controller of the personal data of the participants, since it merely providers the information requested by the interested party and possibly putting the customer in contact with the organisers. The user may not in this section interact with other users or customers of the Site.

In the “Events” section of the Site a series of events – held or to be held – of interest to the world of spirits are published and listed. Said events are organised by third-party suppliers and reserved exclusively for customers. In this section – which is purely informative – no personal data is collected, nor is it possible to interact with other users or customers of the Site.

In the “Friends” section of the Site information and contact details of whisky/rum bars in the world that resell SAMAROLI brand products are published and listed. This section – purely informative – does not collect personal data nor is it possible to interact with other users or customers of the Site.

In the “SCafè” section of the Site information and contact details of SAMAROLI whisky/rum bars worldwide are published and listed. In this section – purely informative – no personal data is collected nor is it possible to interact with other users or customers of the Site.

In the “News” section of the Site a series of news of interest to the world of spirits are displayed. In this section – purely informative – no personal data is collected, nor is it possible to interact with other users or customers of the Site.

In the “S Cask Experience” section of the Site, users can take a virtual 3D trip to the premises and warehouses of S Cask Limited in Scotland. In this purely entertainment web section, no personal data is collected.

A.1 Purpose to allow user’s registration on S Cask online.

Accessing and browsing the Site where the Company offers its services is free, but the possibility of benefiting from the aforementioned services is allowed only following the Data Subject’s registration. Users and clients must be registered online to access specific pages of the Site reserved to registered users (for example: the “My Stock” area). The registration process is handled by the persons in charge of S Cask Limited. Upon the user’s or client’s registration request via email, the name, surname and email address of the data subject are collected by S Cask Limited for the specific purpose of setting up an account (login and password) for the requiring user/client. Once created, the account is managed exclusively by the data subject, who shall change the password originally created by S Cask Limited and shall be qualified at that point to browse the entire Site.

Therefore, further primary purposes of the processing are represented by the need to allow the completion of the above registration procedure via email and the creation of an account and to allow the Site administrators to generate accounts, including client IDs, activation codes, passwords and similar authentication credentials as created within the registration process. These primary purposes of processing the data subject’s personal information also include providing technical assistance and managing commercial and/or contractual requests sent to the Company.

The legal basis of the processing, in these cases, is represented by the following: processing is necessary for the performance of the activities agreed between S cask Limited and the client/user in relation to the services offered or to take steps at the request of the data subject.

The categories of personal information processed are represented by common personal data.

A.2 Purpose to provide users of the Site with the requested services and/or information on third parties’ services.

Users’ personal data are further processed to let S Cask Limited provide the services, such as hosting the reserved area “MyStock” and providing the services named “Available Casks” and “Trips” as detailed above (and also considering that users fill out online forms to send requests).

The legal basis of the processing, in these cases, is represented by the following: processing is necessary for the performance of the activities agreed between S cask Limited and the client/user in relation to the services offered or to take steps at the request of the data subject.

The categories of personal information processed are represented by common personal data.

A.3 Purpose to provide users with information on S Cask World / Club via Newsletter.

As part of the information services, users may receive a periodical newsletter sent by S Cask Limited to update clients on new auctions organized by third parties; news casks available, events or trips exclusively reserved to members of S Cask Club or S Cask World, general information on spirits, etc.

The legal basis of the processing, in these cases, is represented by the following: consent provided by the data subject.

The categories of personal information processed are represented by common personal data.

 

B. Scope of communication and disclosure of personal data for primary processing purposes. 

S Cask Limited shall communicate personal data to the following external recipients:

1. to third party service providers to whom communication is necessary for the performance of the services offered via the web Site such as: third party providers of the services in the reserved areas of the Site named “Auction”, “Trips”, “Available Casks”, “Events”; suppliers in the ICT services sector for installation, assistance and maintenance of IT for systems and services functionally connected and necessary for the performance of the services offered via the web Site; subjects that carry out archival activities for the documentation relating to the relationships with the Data Subject; subjects that provide services for the management of the Company’s electronic platforms; subjects that carry out activities of control, revision and certification of the activities carried out by the Company; persons, companies or professional firms, which provide assistance, advice or collaboration to the Company in accounting, administrative, legal, tax and financial matters;
2. to other internal personnel and persons authorised to the processing forming part of the Company’s organisational chart, based on roles or functions and/or specific internal company procedures. Personal data will be made accessible only to those who need it due to their job or hierarchical position. These persons are appropriately identified as persons authorised to carry out processing pursuant to Articles 29 and 32 of the EU Data Protection Regulation and are obliged to the legal commitment to confidentiality and are specifically instructed in order to avoid losses, destruction, unauthorised access or unauthorised processing of data.

Individual’s personal data will not be disseminated. On the users’ personal dashboard (such as “MyStock”) that they manage autonomously as independent Data Controllers, there could be available options or functions selected by the data subject making the information visible to not identified or identifiable recipients. In this case the data subject shall establish on his/her own as independent Data Controller the scope of dissemination.

B.1 Mandatory or optional consent for the pursuit of the primary purposes for the processing of personal data. 

In all the cases described above in Paragraphs A and B (for the hypothesis of communication to third parties) – and having regard to the legal bases pursuant to Article 6 of the EU Data Protection Regulation – the Company is not obliged to acquire any specific consent to the Data Subject’s processing. All the aforementioned processing pursues primary purposes for which the EU Data Protection Regulation exclude the need to acquire specific consent, applying alternatively different legal-case law bases that legitimise and render the processing lawful without consent. In particular, these are the legal bases of the processing necessary to fulfil obligations arising from the providing of the services requested by the clients or to take steps at the request of the data subject.

Consent is the legal basis of the data processing only with regard to the newsletter service, as detailed above.

Should the user not intend to provide such personal data requested and necessary on the basis of the foregoing, the consequence would be that of the impossibility to proceed with the execution of the services proposed on a time to time basis. In such circumstance, browsing the Site as an unregistered user would still be possible.

1. Transfer of personal data to countries outside the European Union.

Pursuant to Article 13, Paragraph 1, Letter (f) of the EU Data Protection Regulation, we hereby inform you that certain personal information of the data subject may be transferred to a country outside the European Union. Specifically, this refers to the United Kingdom, where the Company has its legal seat. This transfer takes place pursuant to Article 45 of the EU Data Protection Regulation on the basis of the adequacy decision enacted by the EU Commission which has decided that UK ensures an adequate level of data protection. Such a transfer shall not require any specific authorisation.

1. Data retention periods and other information.

The data will be kept for the periods specified in the relevant legislation, which are specified below pursuant to Article 13, Paragraph 2, Letter (a) of the EU Data Protection Regulation: ten years from the termination of the contractual relationship for documents and related data of a civil, accounting and tax nature as required by the ongoing legislation.

    H. Exercise of rights by the Data Subject. 

Pursuant to Articles 13, Paragraph 2, Letters (b) and (d), from 15 to 22 of the EU Data Protection Regulation, the Data Subjects are hereby informed that they:

1. have the right to ask the Company for access to personal data, rectification or cancellation of the same or limitation of the processing that concern them or to oppose their processing, in the cases provided thereto;
2. have the right to propose – in Italy – a complaint to the Italian Data protection Authority as competent authority, following the procedures and indications published on the official website of the Authority on www.garanteprivacy.it;
3. alternatively, they have the right to lodge a complaint with another European privacy authority located in the place of habitual residence or domicile in Europe of those who dispute a violation of their rights, following the procedures and indications thereto;
4. any corrections or cancellations or limitations on processing carried out at the request of the Data Subject – unless this proves impossible or involves a disproportionate effort – shall be communicated by the Company to each of the recipients to whom the personal data have been transmitted. The Company may communicate the recipients to the Data Subject upon request from the same.

The exercise of rights is not subject to any form of constraint and is free of charge. Only in the event of a request for further copies of information requested by the Data Subject, will the Company be able to charge a reasonable fee based on administrative costs. Should the Data Subject make the request by electronic means, and unless otherwise requested by the Data Subject, the information shall be provided in a commonly used electronic form. The specific address of the Company to transmit claims for the exercise of rights as recognised by the EU Data Protection Regulation is as follows: marica.cinque@samaroli.it. No other formalities are required. Responses shall be given in accordance with the provisions of Article 12, Paragraph 3 of the EU Data Protection Regulation (“The Data Controller provides the Data Subject with regard to the action taken on a request pursuant to Articles 15 to 22 without undue delay and, in any case, no later than one month after receipt of the request. Such period may be extended by two further months where necessary, taking into account the complexity and number of the requests. The Data Controller shall inform the Data Subject of any such extension within one month of receipt of the request, in conjunction with the reasons for the delay. Where the Data Subject makes the request by means of electronic form, such information shall be provided by electronic means where possible, unless otherwise requested by the Data Subject“)

Based on the provisions of the Guidelines on transparency WP 260/2017 issued by the Group of EU Data Protection Authorities in indicating the rights of the Data Subject, the Data Controller must specify a summary of each right in question and must provide separate indications on the right to portability.

Specific information on portability rights of personal data.

The Company informs the Data Subject about the specific right to portability. Article 20 of the General Data Protection Regulation introduces the new right to data portability. This right allows the Data Subject to receive the personal data provided to the Company in a structured format, commonly usable and readable by an automatic device, and – under certain conditions – to transmit them to another Data Controller without impediments.

Only personal information that (a) pertains to the Data Subject and (b) has been provided by the Data Subject to the Company; (c) is processed electronically in connection with the stipulation of a contract.

Data portability includes the right of the Data Subject to receive a subset of their personal data processed by the Company and to keep them for further use or for personal purposes. This storing can take place on a personal support or on a private cloud, without necessarily involving the transmission of information to another Data Controller. Portability is a sort of integration and strengthening of the different right of access to personal data, also provided for by Article 15 of the EU Data Protection Regulation.

In the event the Data Subject requests for the portability together with the direct transmission of their data to another data controller, please note that this right is subject to the condition of technical feasibility: Article 20, Paragraph 2 of the EU Data Protection Regulation provides that data may be transmitted directly from one owner to another at the request of the Data Subject, and where this is technically possible. The technical feasibility of transmission from one Data Controller to another must be assessed on a case-by-case basis. Point 68 of the EU Data Protection Regulation clarifies the limits of what is “technically feasible”, specifying that “it should not imply the obligation for Data Controllers to adopt or maintain technically compatible processing systems”. Therefore, direct transmission of data from the Company to another processor may occur if it is possible to establish communication between the two processors’ systems (transferor and receiver) securely, and if the receiving system is technically able to receive the incoming data. If technical impediments preclude direct transmission, the Company will provide detailed information and explanation to the Data Subject. With regard to the compatibility of formats to ensure portability, the Company shall comply with the provisions of Paragraph 1021, Letter (b) of Law 205/2017 (“presence of adequate infrastructures for the compatibility of the formats where data is made available to the Data Subjects”) if in force following 25 May 2018 and in any case within the limits of what has been clarified by the Guidelines on data portability WP242 issued by the Group of European Guarantors (“The expectation is that the owner transmits personal data in a compatible format, but this does not impose any obligation on the other Data Controllers to support this format”).

We inform you that according to the Guidelines on data portability WP242, Data Controllers who comply with a request for portability have no specific obligation to verify the quality of the data before transmitting them. Furthermore, portability does not impose any obligation on the Company to retain data for a period longer than necessary or further than specified. Above all, it does not impose any further obligation to retain personal data for the sole purpose of fulfilling a potential request for portability.

Exercising the right to data portability (or any other right under the EU Data Protection Regulation) does not affect any other rights. The Data Subject can continue to benefit from the service offered by the companies even after a portability operation has been completed. Portability does not result in automatic deletion of data stored in the Company’s systems nor does it affect the retention period originally envisaged for the transmitted data. The Data Subject can exercise these rights as long as the Company is carrying out processing.

The Company undertakes to fulfil requests for portability within 30 days of receipt thereof, reserving, pursuant to Article 12, Paragraph 3 of the EU Data Protection Regulation, the right to fulfil the request within three months in cases of greater complexity. The portability request must be addressed to the following email address: marica.cinque@samaroli.it.

 

Summary information on the Data Subject’s other rights.

The EU Data Protection Regulation confer a series of rights to the Data Subject that according to the Guidelines on Transparency WP 260 it is mandatory to summarise their main contents within the disclosure paper. These rights are summarised below:

Right of access (to personal data only): the right to obtain confirmation from the Data Controller that personal data is being processed concerning the Data Subject and, in this case, to obtain access to personal data and to be informed about the purposes of the processing; on the categories of personal data in question; on the recipients or categories of recipients to whom the personal data have been or will be communicated, in particular if recipients are in other countries or belong to international organisations; whenever possible, on the retention period of the personal data provided or, if this is not possible, on the criteria used to determine such period; if the data has not been collected from the Data Subject, the right to receive every information available on its origin; the right to receive information on the existence of an automated decision-making process, including profiling and significant information on the logic employed, as well as the importance and expected consequences of such processing for the Data Subject.

Right of rectification and integration: The Data Subject has the right to obtain the correction of any inaccurate personal data without undue delay from the Data Controller. Taking into account the purposes of the processing, the Data Subject has the right to obtain the integration of incomplete personal data, also by providing an additional declaration. The Data Controller shall inform each of the recipients to whom the personal data have been transmitted of any corrections, unless this proves impossible or involves a disproportionate effort. The Data Controller shall inform the Data Subject about those recipients upon request of the latter.

Right to cancel: the Data Subject has the right to obtain from the Data Controller the cancellation of their personal data without unjustified delay (and where the specific reasons pursuant to Article 17, Paragraph 3 of the EU Data Protection Regulation do not exist, on the contrary they relieve the Data Controller from the obligation of cancellation) if personal data is no longer necessary with respect to the purposes for which they were collected or otherwise processed; or if the Data Subject revokes the consent and there is no other legal basis for the processing; or if the Data Subject opposes the processing for marketing or profiling purposes, also by revoking its consent; if the personal data has been processed unlawfully or concerns information collected from minors, in violation of Article 8 of the EU Data Protection Regulation. The Data Controller communicates to each of the recipients to whom the personal data has been transmitted, any cancellations, unless this proves impossible or involves a disproportionate effort. The Data Controller shall inform the Data Subject about those recipients upon request of the latter.

Right to limitation of processing: the Data Subject has the right to obtain the limitation of the processing from the Data Controller (i.e., according to the definition of “processing limitation” provided by Article 4 of the EU Data Protection Regulation: “the marking of personal data stored with the objective to limit processing in the future”) when one of the following hypotheses occurs: the Data Subject disputes the accuracy of personal data for the period necessary for the Data Controller to verify the accuracy of such personal data; the processing is illegal and the interested party opposes the cancellation of personal data and asks instead that its use is limited; although the Data Controller no longer needs it for processing purposes, personal data is necessary for the Data Subject to ascertain, exercise or defend a right in court; the interested party opposed marketing processing, pending verification of the possible prevalence of the legitimate reasons of the Data Controller with respect to those of the Data Subject. If processing is limited, such personal data shall be processed, except for storage, only with the Data Subject’s consent or for the assessment, exercise or defence of a right in court or to protect the rights of another natural or legal person or for reasons of significant public interest the party who has obtained the limitation of processing is informed by the Data Controller before such limitation is revoked. The Data Controller shall inform each of the recipients to whom the personal data have been transmitted of any limitations, unless this proves impossible or involves a disproportionate effort. The Data Controller shall inform the Data Subject about those recipients upon request of the latter.

The right to oppose: the Data Subject has the right at any time to oppose, for reasons related to their particular situation, to the processing of their personal data concerning carried out by the Data Controller or for the performance of a task of public interest or connected to the exercise of public powers vested in the Data Controller or carried out for the pursuit of the legitimate interests of the Data Controller including by third parties (including profiling). Furthermore, if personal data is processed for direct marketing or commercial profiling purposes, they have the right at any time to oppose the processing of personal data for such purposes.

Right not to be subject to automated decisions, including profiling: the Data Subject has the right not to be subjected to a decision based solely on automated processing, including profiling, which produces legal effects concerning the same or which significantly affects their person, except in cases where the automated decision is necessary for the conclusion or execution of a contract between the Data Subject and a Data Controller; is required by law, in compliance with measures and precautions; or is based on the explicit consent of the person concerned.

For any purpose, the link to the Articles from 15 to 23 of the Rules on the rights of the Data Subject.