Below, we indicate the purposes for which we will use your personal data as the Controller, the legal basis pursuant to Article 6 of the Regulation, and a brief explanation of each purpose.

Providing your personal data for purposes a) and b) is optional. However, without it, we will not be able to provide our services. Providing your personal data for purpose c) is mandatory as it is necessary to comply with legal obligations. Providing your personal data for purpose d) is optional. Failure to provide consent does not prevent you from using our services.

Your personal data is not shared with entities outside the European Economic Area; should this occur, we ensure that it is done in compliance with Regulation 679/2016, adopting precautions that provide for transfer only to countries subject to an adequacy decision, standard contractual clauses approved by the European Commission, consent, or other suitable legal basis.

Personal data will be retained only for the needs related to each of the purposes outlined in paragraph 2 and in compliance with the principle of minimization. We may need your data to defend your or our rights (Articles 2946 and following of the Italian Civil Code), as well as to comply with record-keeping obligations. Therefore, we retain this data as long as necessary and in any case not beyond a maximum of 10 years. We also retain your data whenever required by law or an order from public authorities.

Personal data processed for profiling purposes will be retained for a maximum period of 12 months, unless different provisions are provided by applicable regulations or specific justified needs are duly documented. Data used for sending newsletters and promotional communications will be retained until the user withdraws consent, exercises the right to object, or requests deletion using the tools provided (e.g., the "unsubscribe" link in emails). For minors under the age of 14, in accordance with Italian law, consent to the processing of personal data can only be given by the parent or legal guardian. The services offered by the Controller are not intended for users under the age of 14 without such consent.

More information on data retention periods and the criteria used to determine such periods can be obtained by writing to: privacy@mammajumboshrimp.com.

You have the right to access your data at any time, pursuant to Articles 15-22 of the Regulation (GDPR). In particular, you may exercise the following rights:

• Data access (Art. 15 GDPR): you have the right to obtain confirmation as to whether or not your personal data is being processed, access such data, and receive information about its origin, processing purposes, recipients or categories of recipients to whom the data has been or will be disclosed, and the intended retention period.
• Rectification (Art. 16 GDPR): you have the right to obtain the correction of inaccurate personal data or the completion of incomplete personal data without undue delay.
• Deletion (Art. 17 GDPR): you have the right to have your personal data deleted in the cases provided for by the Regulation, such as when it is no longer necessary for the purposes for which it was collected or processed, or when you withdraw your previously given consent.
• Restriction of processing (Art. 18 GDPR): you have the right to restrict the processing of your personal data in certain circumstances, such as:
  - When you dispute the accuracy of the personal data, for the time necessary to verify its accuracy. - If the processing is unlawful and you object to deletion, requesting instead that its use be restricted. - When the data is no longer needed for the purposes of processing, but is required to establish, exercise, or defend a legal claim. - If you have objected to processing under Art. 21 GDPR, pending verification of whether the legitimate grounds of the Controller override your objections.
• Data portability (Art. 20 GDPR): you have the right to receive the personal data you provided in a structured, commonly used, and machine-readable format, and to transmit it to another controller without hindrance, where provided by the Regulation. Where technically feasible, you can request direct transmission between controllers.
• Right to object (Art. 21 GDPR): you have the right to object, at any time and free of charge, to the processing of your data based on legitimate interest.
• Revocation of consent (Art. 7 GDPR): you can revoke the consent given at any time, without affecting the lawfulness of the processing carried out before revocation.

For further information or enquiries as well as to exercise the aforementioned rights, we are available at the email address: privacy@mammajumboshrimp.com.

This privacy policy has been in effect since 14/11/2018. The Data Controller reserves the right to modify or simply update its content, in part or in full, also due to changes in applicable regulations. The Data Controller will inform you of such changes, and they will become binding as soon as they are published on the Website. The Data Controller therefore invites you to regularly visit this section to be aware of the most recent and updated version of the privacy policy, so that you are always informed about the data collected and its use.