INFORMATIVE NOTE
on personal data processing
Articles 12 et seq. of the Regulation (EU) 2016/679 (GDPR)
FOREWORD
In compliance with the provisions of EU Regulation 2016/679 (hereinafter GDPR) below we provide you with information regarding the processing of the personal data provided, as regards relations with our Organization. This notice is provided pursuant to Art. 13 GDPR.
1. IDENTITY AND CONTACT DETAILS OF THE JOINT DATA CONTROLLERS
The Joint Data Controllers, according to Art. 26 GDPR, are the companies of the Zucchetti Group (being Zucchetti Spa and its subsidiaries or associated or investee companies) whose contact details are: Via Solferino No. 1 – 26900 Lodi (LO), tel.: (0371) 5941; email: ufficio.privacy@zucchetti.it.
The list of joint data controller companies and the joint data controller agreement are made available upon request by the data subject, who may send an email to ufficio.privacy@zucchetti.it.
2. CONTACT DETAILS OF THE DATA PROTECTION OFFICER (DPO)
For Group companies which have made such an appointment, the Data Protection Officer is Mr. Mario Brocca, tel. (0371) 594-3191, email dpo@zucchetti.it; certified email: dpogruppozucchetti@gruppozucchetti.it.
3. PURPOSE OF PROCESSING, LEGAL BASIS AND DATA STORAGE PERIOD
| Purpose | Types of data that can be processed: | Legal basis | Storage period* |
| a) Pre-contractual/contractual
To provide information on products and services marketed, if requested by the data subject; execution of existing contractual relationships (administrative-accounting obligations, tax obligations, order management, invoicing, solvency, debt collection; management of any disputes); sending of required communications related to contracted products/services |
Personal data and contact details (email address, landline and mobile phone numbers); data relating to the company and the contractual relationship as well as information relating to its execution and necessary for the fulfillment of the contract itself; data relating to the economic relationship, the amounts due and payments, their periodic progress, the summary of the accounting status of the relationship; data relating to your employees and collaborators | Performance of a contract to which you are a party or pre-contractual measures taken at the request of the data subject;
Fulfillment of legal obligations
Art. 6, paragraph 1 letters b) and c) GDPR. |
According to law
|
| b) Direct Marketing
Sending advertising material, newsletters, promotional and commercial communications by automated means of contact (email and instant messaging) and traditional means (telephone calls with operator and regular mail), relating to products and/or events and/or training courses in relation to, as well as for conducting market studies, statistical analysis and customer satisfaction surveys; |
Personal data and contact details (email address, landline and mobile phone numbers); | Consent (required with contract or specific request)
(optional and can be withdrawn at any time) Art. 6, paragraph 1 letter a) GDPR. |
Until withdrawal of consent for such a purpose and / or five years after giving consent. |
| c) Marketing to existing customers
sending communications relating to contracted products/services and/or products/services similar to those already agreed (newsletters, webinars, events, training activities) |
Personal data and contact details (email address, landline and mobile phone numbers); data relating to the company you belong to and your position there | Legitimate interest
Art. 6, paragraph 1 letter f) GDPR. |
Until consent is withdrawn |
| d) Indirect marketing
Disclosure of data to business partners/third parties so that they can send marketing communications to you |
Personal data and contact details (email address, landline and mobile phone numbers); | Consent (required with contract or specific request)
(optional and can be withdrawn at any time) Art. 6, paragraph 1 letter a) GDPR. |
Until withdrawal of consent for such a purpose and/or five years after the last interaction with the Joint Data Controllers. |
| e) Content collection and publication:
generation of case histories and |
Personal data; images, sounds, company you belong to, professional role and experience, nickname, social network profile | Consent (optional and can be withdrawn at any time)
Art. 6, paragraph 1 letter a) GDPR. |
Until withdrawal of consent for such a purpose and/or five years after the last interaction with the Joint Data Controllers |
| f) If necessary, to ascertain, exercise or defend the rights of the Joint Data Controllers in judicial proceedings | Personal data and contact details (email address, landline and mobile phone numbers); data relating to the company and the contractual relationship as well as information relating to its execution and necessary for the fulfillment of the contract itself; data relating to the economic relationship, the amounts due and payments, their periodic progress, the summary of the accounting status of the relationship; data relating to your employees and collaborators | Legitimate interest (judicial protection)
Art. 6, paragraph 1 letter f) GDPR. |
For the time necessary to exercise rights in court. |
| g) Registration on Internet Portals | Personal data and contact details, data relating to the company you belong to and your position there | Express consent | Five years from last interaction |
| h) Purpose of support with purchased products and services | Master data, contact data, personal data depending on the product/service contracted | Execution of a contract to which you are a party (to resolve anomalies and malfunctions)
Legitimate interest (for analysis aimed at improving service) |
Five years from last interaction |
*After cancellation, data may be stored for an additional period of up to one year, depending on backup storage policies.
4. OBLIGATORY NATURE OF PROVISION OF DATA
The Joint Data Controllers must be provided data for carrying out the contractual relationship, as well as the data necessary to fulfill the obligations provided for by laws, regulations, community standards, and by provisions of Authorities legitimated by law and by supervisory and control bodies (referred to in purposes a) and f) above).
Non-essential data, not required for execution of the contractual relationship, must be identified and considered additional information whose provision, if requested, is optional and requires consent. Consent may be withdrawn at any time by sending an email to the address: ufficio.privacy@zucchetti.itSuch withdrawal shall in no way affect the lawfulness of processing based on the consents given prior to withdrawal of consent.
5. PROCESSING METHODS
Personal data will be recorded, processed and stored in our files, paper and electronic, in compliance with the appropriate technical and organizational measures referred to in Art. 32 of the GDPR. The processing of your personal data may consist of any operation or series of operations described in Art. 4, paragraph 1, point 2 of the GDPR.
Personal data will be processed using suitable tools and procedures that guarantee security and confidentiality. Such processing may be carried out directly and/or via delegated third parties, both manually using hard-copy support and electronically using IT equipment and other instruments. In order to manage properly the relationship and fulfillment of legal obligations, personal data may be entered in the internal documentation of the Joint Data Controllers and, if necessary, in the documents and registers required by law.
Your data may be processed by the employees of the company departments of the Joint Data Controllers assigned to the pursuit of the above-mentioned purposes, who have been expressly authorized to process the data and who have received adequate operating instructions pursuant to and for the purposes of Art. 29 GDPR.
6. CATEGORIES OF RECIPIENTS OF PERSONAL DATA
The data may be communicated and processed by external parties operating as autonomous data controllers under Articles 4 and 24 GDPR such as, for example, authorities and supervisory and control bodies and in general public or private subjects entitled to request the data and / or subjects operating as data processors under Art. 28 GDPR), such as consulting firms and / or professional firms, and / or legal and tax professionals and insurance companies.
The data may also be disclosed to our business partners / dealers for the performance of services related to the execution of the contract or for carrying out commercial actions by the same, subject to your express consent.
7. DATA TRANSFER TO COUNTRIES OUTSIDE THE EU
The data you provide will only be processed in Italy or in countries within the European Union. If your data is processed in a country outside of the EU during the contractual relationship, your rights under EU legislation will be guaranteed and you will be informed on a timely basis.
8. RIGHTS OF THE DATA SUBJECT
Pursuant to Articles 15 et seq of the GDPR, you may exercise the following rights:
- access: to obtain confirmation of whether or not your personal data are being processed and the right to access them; requests that are manifestly unfounded, excessive or repetitive cannot be answered;
- rectification: to correct/obtain the correction of personal data if incorrect or outdated and to complete data if incomplete;
- erasure/to be forgotten: in some cases, to obtain the erasure of the personal data provided; this is not an absolute right, as the Joint Data Controllers may have legitimate or legal reasons to store them;
- limitation: the data will be stored, but cannot be processed further, in the cases foreseen by the regulation;
- portability: to move, copy or transfer data from our databases to others. This applies only to data that you have provided, when processing is based on the performance of a contract or consent and processing is carried out by automated means;
- to object to direct marketing;
- to withdraw consent at any time if processing is based on consent.
Pursuant to Art. 2-undicies of Legislative Decree 196/2003, the exercise of your rights may be delayed, restricted or excluded, following justification provided without delay, unless this might compromise the purpose of the restriction, for as long as and to the extent that this constitutes a necessary and proportionate measure, taking into account the fundamental rights and legitimate interests of the data subject, in order to safeguard the interests referred to in paragraph 1, letters a) (protected interests with regard to money laundering), e) (for the conduct of defensive investigations or the exercise of a right in court) and f) (for the confidentiality of the identity of the employee who reports offenses he becomes aware of on his duties). In such cases, your rights may also be exercised through the Personal Data Protection Authority in the manner referred to in Article 160 of said Decree. In such case, the Personal Data Protection Authority will inform you that it has carried out all the necessary checks or that it has carried out a review, as well as of your right to take legal action.
It should also be noted that – before processing the requests – the Joint Data Controllers may ascertain your identity, in order to evaluate the legitimacy of the same.
To exercise such rights, you may contact the “Joint Data Controllers” at ufficio.privacy@zucchetti.it or call +39 (0371) 594-3191 or write to the Zucchetti Privacy Office, Via Solferino 1 – 26900 Lodi.
The Joint Data Controllers will respond within 30 days of receiving your formal request.
If your rights concerning your personal data are infringed, you may complain to the competent authority: “Personal Data Protection Authority”.
Pursuant to Art. 26, paragraph 3 of the GDPR, we hereby inform you that you may exercise these rights vis-a-vis and against each Data Controller, the complete list of which is made available upon request, by sending an email to ufficio.privacy@zucchetti.it. In addition, please note that the same address may be used to request the Joint Controller Agreement signed by all Group companies.
THE JOINT DATA CONTROLLERS