Protection of personal data is an important commitment for Cereal Docks S.p.A. (hereinafter “Cereal Docks” or “Company”).

(EU) Regulation 2016/679 “(EU) Regulation 2016/679 of the European Parliament and Council dated 27 April 2016 related to "the protection of natural persons for what concerns their personal data, and the free circulation of that data” (hereinafter “GDPR”) coming into force provided the opportunity to further adapt the activities performed by the Company to the personal data transparency and protection principles, respect of the rights and fundamental freedoms of all the data subjects, whether they were employees, collaborators, customers, suppliers or third parties interested in receiving information.

Cereal Docks therefore implemented its “Privacy Organisational Model” (MOP) described generally below, aimed at analysing all data processing, organising them functionally and managing them securely and transparently. This website section also provides information on data subject rights and how they can be exercised with the Controller.

1 - GDPR Privacy Organisational Model
1.1 - Subjects
1.2 Analysis of the risk and privacy risk prevention measures
2 - Transparency and data subject rights
2.1 - Rights concerning the protection of personal data
2.2 - Exercising rights
2.3 - Forms and information notices

DATA CONTROLLER

The Data Controller is:
Cereal Docks S.p.A. (hereinafter also “CONTROLLER”)
Via dell’Innovazione, n. 1, 36043 – Camisano Vicentino (VI)
Tel. +39 0444 419411
email: This email address is being protected from spambots. You need JavaScript enabled to view it.
Certified Electronic Mail: This email address is being protected from spambots. You need JavaScript enabled to view it.
VAT number and Tax Code: 02218040240

DATA PROTECTION OFFICER

The Data Protection Officer is:
TZ&A Studio Associato (hereinafter also "DPO”)
Email: This email address is being protected from spambots. You need JavaScript enabled to view it.

Cereal Docks S.p.A. And other “Cereal Docks Group” companies have decided to avail themselves of the right established by art. 37, paragraph 2, of the GDPR for the shared designation of the same Data Protection Officer, who acts in synergy with the internal privacy team.

The DPO is domiciled c/o the CONTROLLER and may be contacted for any need related to the personal data processing of all the data subjects.

TEAM PRIVACY

The CONTROLLER has decided to appoint an internal “Privacy team” of persons with organisational, technical, and IT skills.

The Privacy team’s task is to support the activities of the CONTROLLER and DPO.

PARTIES AUTHORISED TO PROCESS DATA (pursuant to art. 29 GDPR)

The MOP envisages that each employee/collaborator of the CONTROLLER only processes data that is indispensable for his/her tasks, based on the internal organisation and, above all, the purposes indicated and proposed by the data subject (so-called principle to “purpose limitation and data minimisation”, art. 5 paragraph 1, letter b) and c) of the GDPR). For this purpose, processing has been segmented into uniform areas of processors, limiting employees/collaborators operating in each area to a specific processing area. Each authorised processor has received specific instructions on personal data processing from the CONTROLLER. For that purpose, the design of the IT system is “compartimentalised”. The employee/collaborator can only access data that is indispensable for their jobs from their IT position. The specific processing areas are designated after careful analysis of the structure and company organisation and of the flow of internal and external data to the Company. This is summed up in a specific internal matrix identifying the processing environment of each area.

The employee/collaborator has also been given internal regulations on the use of IT instruments and the rules of conduct, including ethical ones, on all information accessed due to his/her specific job.

To effectively guarantee adjustment to the personal data processing principles, the CONTROLLER has also envisaged training and updating courses on the subject for employees/collaborators who, due to their jobs, process personal data.

SYSTEM ADMINISTRATORS (INTERNAL AND EXTERNAL)

The CONTROLLER uses computer systems to manage and organise its activities. For that reason, CONTROLLER activities have always been based on care over the construction of software, how it is used, and data security. Parties with “administrator” privileges in the company are specifically appointed and trained. Even the other external specialised companies accessing company data are specifically appointed as External Processors and/or External System Administrators pursuant to art. 28 of the GDPR.

The suppliers or external computer services are chosen with care for their professional skills, not purely technical but also related to data protection, favouring certified companies.

PROCESSORS (pursuant to art. 28 GDPR)

In principle, the CONTROLLER manages all processing activities internally. Any outsourcing to third parties of certain activities implying the processing of data on behalf of the CONTROLLER is specifically indicated in the single information notices. In these cases the relationship with the third party is regulated by a specific contract appointing the “Processors” pursuant to art. 28 of the GDPR.

The CONTROLLER entrusts that processing activity to external parties providing sufficient guarantees on implementing suitable technical and organisational measures to meet the GDPR requirements and guarantee protection of data subject rights.

According to the so-called “accountability” principles, the CONTROLLER is responsible for implementing a number of measures – organizational, physical, legal, technical and IT – to prevent the risk of breaching the rights and personal freedoms of the data subjects. To achieve this goal, risks are continuously analysed, based on the processing, instruments used, type and amount of data processed.

RECORDS OF PROCESSING ACTIVITIES (pursuant to art. 30 GDPR) AND DATA PROTECTION IMPACT ASSESSMENT (pursuant to art. 35 GDPR)

The MOP envisages constant, careful analysis of risks for the processing of personal data, identified for each activity or service allocated through Records of Processing pursuant to art. 30 paragraph 1 of the GDPR.

Having analysed the processing performed by the CONTROLLER, it is felt that there are currently no risk activities needing a specific assessment of the impact pursuant to art. 35 of the GDPR (so-called (“DPIA” data processing impact assessment).

The analysis of cyber risks and corporate hardware and software infrastructures and on the IT adjustment measures has been conducted by both our System Administrator using specific tools and check lists and by an external company specialised in cyber security, which conducted an in-depth audit with security tests. The results enabled technicians to further improve measures to protect against cyber attacks and threats, graded and proportional to the risk for the rights and freedoms of data subjects.

• Right to be informed (data processing transparency)

The data subject has the right to be informed of how the CONTROLLER processes his/her personal data, for what purposes and on other information envisaged by art. 13 of the GDPR. For that purpose, the CONTROLLER has prepared organisational processes enabling, when the personal data are acquired or requested, an Information notice form created “ad hoc” to be issued based on the category the data subject belongs to (employee, customer, supplier, etc.). This document suitably notifies all subjects the data refer to on how the CONTROLLER conducts its processing. The information model may be requested with a specific request addressed to the CONTROLLER.

• Right to withdraw consent (art. 13)

You have the right to withdraw your consent at any time for all processing where the legitimacy assumption is a display of your consent. Withdrawing consent does not affect the lawfulness of processing based on consent before its withdrawal.

• Right to access data (art. 15)

You may request a) the purposes of the processing; b) the categories of personal data concerned; c) the recipients or categories of recipient to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organisations; d) where possible, the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period; e) the existence of the right to request from the controller rectification or erasure of personal data or restriction of processing of personal data concerning the data subject or to object to such processing; f) the right to lodge a complaint with a supervisory authority; g) where the personal data are not collected from the data subject, any available information as to their source; h) the existence of automated decision-making, including profiling, referred to in Article 22(1) and (4) and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject. You have the right to obtain a copy of the personal data being processed.

• Right to rectification (art. 16)

You have the right to obtain rectification of inaccurate personal data concerning you and to have incomplete personal data completed.

• Right to be forgotten (art. 17)

You have the right to obtain erasure of the personal data concerning you from the controller if the data are no longer needed for the purpose for which they were collected or otherwise processed, if consent is withdrawn, if there is no other overriding legitimate grounds for the processing, if the personal data have been unlawfully processed, if there is a legal obligation to erase them; if the data refer to web services provided to minors without the relative consent. The erasure may take place unless the right to freedom of expression and information is prevalent, they are stored to fulfil a legal obligation or to perform a task in the public interest or exercising public powers, on grounds of public interest in the health sector, for filing purposes in the public interest, scientific or historical research or for statistical purposes or to ascertain, exercise or defend a right before the law.

• Right to restriction of processing (art. 18)

You have the right to ask the controller to limit processing when the accuracy of the personal data is contested (for a period enabling the controller to verify the accuracy of the personal data) or if processing is unlawful, but you oppose the erasure of the personal data and request the restriction of their use instead, or if they are needed by you to for the establishment, exercise or defence of legal claims, whereas they are no longer needed by the Controller.

• Right to data portability (art. 20)

You have the right to receive the personal data concerning you which you have provided to a controller, in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller if the processing is based on consent, on a contract and if processing is done automatically, unless the processing is needed to perform a task of public interest or is connected to the exercising of public powers, and that their transmission does not adversely affect the rights and freedoms of others.

• Right to object (art. 21)

You have the right, at any time, to fully or partially object to the processing of your personal data if that processing is performed to pursue a legitimate interest of the Controller or for direct marketing purposes.

• Right to lodge a complaint with a Supervisory Authority (art. 77).

Without prejudice to any other administrative or judicial remedy, you shall have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement if you consider that the processing of personal data relating to you infringes this Regulation.

Information notices

Cereal Docks' commitment to ensuring a more sustainable food production is realized through the promotion of good agricultural practices that enhance the climate resilience of agroecosystems. To initiate this change, Cereal Docks proposes a path to share knowledge and experiences with the agricultural, scientific, industrial, and associative world, promoting the dissemination of the best regenerative practices through the Nurture the Future Manifesto.

Sistema Green

Alimento Italia

Energy efficiency and renewable energies

Sustainable logistics

HQ at zero energy

In an increasingly more complex, rapidly changing world, Research & Innovation represents the “auxiliary motor of the Cereal Docks Group” accelerating towards tomorrow.

The guiding star of Research & Innovation activities consists in “contributing to the growth of the Cereal Docks Group towards the nutrition and wellness sectors linked to food; in order to become one of the European leaders in the human and animal food and nutrition, sustainability and circular economy areas.”

In the Cereal Docks Group, the Research & Innovation Department, together with all Group activities and departments, handles the “development of new businesses for Cereal Docks identifying new value creation areas and contribution to significantly innovating internal processes, going beyond ongoing improvement.“

The pure plant-based oils (OVP) from the pressing of soy, rapeseed and sunflower seeds are used as a bio-fuel by electricity operators who access the all-inclusive tariff for the production of energy from renewable sources.

The supply chain for the production of energy from OVP creates a synergy between the various economic sectors: farming, first seed processing industry, animal feed industry. Plant-based oil amounts to about 18% of soy-seed processing and, because of the difficulty had marketing it, in the last ten years it has been enhanced for the production of electricity from renewable sources, with the circular economy in mind. 

Use of OVP for energy purposes has proved a valid solution for decreasing the dependence on imported gas, hence a way of contributing to greater energy self-sufficiency with a view to the FER decree, besides being an opportunity for companies to reduce their CO2 quotas.

As a company for the first processing of raw agricultural materials, Cereal Docks takes part in the growth of agro-energy supply chains for the production of bio-fuels that do not compete with human and animal nutrition.

In the mix of crops that can be suitably placed in the biofuel sector you have soy oil, a structural sub-product of the soy seed transformation process into plant-based protein seeds for animal nutrition. That oil cannot be used for food purpose, but has strong potential as a raw material for biofuels.

Due to its characteristics, soy oil can make an important contribution to decarbonising the mobility sector. It can also be used pure after hydrogenation (HVO) in heavy vehicles – that are technically approved – and for which there are no mature alternatives available yet for their decarbonisation.

Lectins are an irreplaceable component of several production processes. In the tanning sector they assure leather a fine, soft consistency and prevent micro-organisms from forming on the surface.

In the paints industry, lectin fixes the final colour and stops granules forming or sedimentation; and is used in printed inks to facilitate the regulation of humidity, viscosity and the distribution of solvents. They are used as plastifiers to improve the laying properties of cold asphalt and tarmac, or as an emulsifier to help the incorporation of oils, with excellent application performance.

Continue your trip