INFORMATION REGARDING THE PROTECTION OF PERSONAL DATA
Pursuant to Art. 13 D of Regulation 2016/679
In compliance with the provisions pursuant to and in accordance with Art. 13 of Regulation (EU) 2016/679, the company Eigenmann & Veronelli S.p.A., in its capacity as Data Controller, in the person of its pro-tempore legal representative, hereby informs its clients about the purposes and methods of processing any personal data collected, their scope of communication and dissemination and the nature of their provision.
1. PERSONAL DATA
- Identification data (corporate or business name, or name and surname of natural persons,
address, telephone number, email, tax data, etc.). - Data relating to economic and commercial activity (by way of example, but not limited to: collected orders, concluded contracts, solvency, bank and financial data, accounting and tax data, etc).
2. PURPOSE
The data collected from the Clients, object of the processing, are processed and used directly to fulfil the purposes instrumental to the accomplishment of activities such as:
1. execution of legal relations concluded or to be concluded with you, and the related
commitments;
2. fulfilment of legal obligations related to the abovementioned legal relationships;
3. organisational management of any existing relationship;
4. possible external professional collaborations for the fulfilment of legal obligations;
5. protection of legal transactions;
6. institutional communications;
7. marketing activities by sending promotional material relating to products or services
similar to those of the current relationship, or the same Company;
in full compliance with the principle of correctness, lawfulness, purpose and proportionality and the provisions of the law, no profiling of the data subject is envisaged.
3. PROCEDURE
The processing of data is carried out using IT procedures or, in any case, electronic means or paper supports by specially appointed internal individuals. The data are stored in paper, computer and electronic archives and the minimum security measures provided for by Regulation (EU) 2016/679 are ensured. There shall be no automated decision-making process, including profiling as per art. 22(1) and (4) of Regulation (EU) 2016/679.
4. COMMUNICATION AND/OR DISSEMINATION
Personal, accounting and tax data will not be communicated, sold or exchanged with third parties, except for any communications to third parties (such as: consultancy firms; professional offices; competent authorities and/or Supervisory Bodies for the fulfilment of legal obligations; Public Administrations for their institutional purposes; professionals authorised to study and resolve any legal and contractual problems) for the performance of activities functional to the company, unless this is essential for the performance of the obligations assumed by the parties or for institutional activities. In this case, their use by third parties shall be in full compliance with the principle of fairness and the provisions of the law.
Data may also be processed in non-EU countries, in particular Turkey, Russia and China, in order to provide commercial services, according to adequate safeguards provided for in Regulation (EU) 2016/679 and by means of the standard contractual clauses as specified under Art. 46 of the aforementioned Regulation, agreed upon between the Data Controller and the companies belonging to the same business group.
5. INCORRECT OR LACK OF COMMUNICATION
The Data Controller declares that any incorrect or failed communication of any mandatory information may lead to the Data Controller being unable to ensure the adequacy of the processing for the contractual agreements for which it is performed.
6. THE RIGHTS OF THE DATA SUBJECT
The data subject may assert his rights as expressed in Art. 15, 16, 17, 18, 20, 21 and 22 of Regulation (EU) 2016/679.
We inform you that, as data subject, besides the right to lodge a complaint with a Supervisory Authority, you have also the following rights, which you may exercise by sending a specific written request to the Data Controller and/or Processor, as specified in point 1.
Art. 15-Right of access
The data subject shall have the right to obtain from the controller confirmation as to whether or not personal data concerning him or her are being processed, and, where that is the case, access to the personal data and information on their processing.
Art. 16-Right to rectification
The data subject shall have the right to obtain from the controller without undue delay the rectification of inaccurate personal data concerning him or her. Taking into account the purposes of the processing, the data subject shall have the right to have incomplete personal data completed, including by means of providing a supplementary statement.
Art. 17 - Right to erasure (right to be forgotten)
The data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay and the controller shall have the obligation to erase personal data without undue delay.
Art. 18 - Right to restriction of processing
The data subject shall have the right to obtain from the controller restriction of processing where one of the following applies:
a) the accuracy of the personal data is contested by the data subject, for a period enabling the controller to verify the accuracy of the personal data;
b) the processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of their use instead;
c) the controller no longer needs the personal data for the purposes of the processing, but they are required by the data subject for the establishment, exercise or defence of legal claims;
d) the data subject has objected to processing pursuant to Article 21(1) pending the verification whether the legitimate grounds of the controller override those of the data subject.
Art. 20 - Right to data portability
The data subject shall have the right to receive the personal data concerning him or her, which he or she has provided to a controller, in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller without hindrance from the controller to which the personal data have been provided.
In exercising his or her right to data portability pursuant to paragraph 1, the data subject shall have the right to have the personal data transmitted directly from one controller to another, where technically feasible.
Art. 21 - Right to object
The data subject shall have the right to object, on grounds relating to his or her particular situation, at any time to processing of personal data concerning him or her which is based on point (e) or (f) of Article 6(1), including profiling based on those provisions.
Art. 22 - Right not to be subject to automated decision-making process, including profiling
The data subject shall have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her.
Should you wish to exercise the rights provided for by Articles 15-22 of Regulation (EU) 2016/679, please write to privacy@eigver.it, to the attention of the privacy contact.
7. DATA CONTROLLER AND PROCESSORS
The Data Controller is Eigenmann & Veronelli S.p.A.
The updated list of external processors provided for by Art. 28 of the GDPR may be consulted by submitting a written request to the Data Controller referred to above.
8. RETENTION TIME
The data shall be retained for the time necessary to achieve the purposes as per point 2, and, more specifically:
The data shall be retained for the time necessary for the fulfilment of accounting and tax purposes as required by law and, in any case, no longer than 10 years from the termination of the relationship established.
For the purposes of marketing involving the mailing of promotional materials on products and services similar to those that are the subject of the existing agreement, or of the Company itself, the data shall be retained until the data subject objects.
9. LEGAL BASIS AND NATURE OF CONSENT
Pursuant to and in accordance with the obligations under the existing agreement, consent to the processing of the data is not required for points 1) to 6) of paragraph 2, as these are collected to comply with a legal obligation and/or perform the obligations under the agreement between the parties. Consent to point 7) of paragraph 2, pursuant to and for the purposes of Art. 7 of Regulation (EU) 2016/679, is voluntary, and the lack thereof shall not affect the existing agreement.
