Dear Customer / Provider,

we wish to inform you that, pursuant to Article 13 of EU Regulation 2016/679 (General Data Protection Regulation – hereinafter “GDPR 2016/679“), containing provisions for the protection of individuals with regard to the processing of personal data, the personal data you provide will be processed by our Company. The processing of personal data will take place in compliance with the aforementioned regulations, in particular, according to the principles of lawfulness, fairness, transparency and protection of your privacy and your rights, with particular reference to integrity, confidentiality, personal identity and the right to protection of personal data.

1. Data Controller

Data Controller: Salvioni S.p.A.

Registered office: via Durini n. 3 – 20122, Milan (MI)

E-mail address with which to contact the Data Controller: [email protected]

2. Data Protection Officer (DPO)

The Company has not appointed a Data Protection Officer (DPO), as the conditions provided for by art. 37 of the GDPR.

3. Types of data collected

The provision of personal data is necessary for the stipulation of contracts, for their modifications and any other relationship with the Company. The personal data collected includes:

1. personal data of the customer who is a natural person or of the legal representative/company contact person of the client company;
2. contact details of the customer, a natural person or of the legal representative/business contact person of the client company;
3. data necessary for administrative, tax and civil obligations (e.g. tax code, bank details);
4. data necessary to carry out the delivery of the products (such as, for example, the customer’s delivery address);
5. photographic images and/or video footage taken during the installation, subject to consent.

 

4. Purposes of the processing for which the data are intended

The personal data you provide will be used for the following purposes:

1. comply with legal obligations, regulations, community legislation, civil and tax rules;
2. to carry out the services requested, to fulfil any contractual obligations and to allow effective management of the relationship with the other party in order to respond to requests for information, assistance, suggestions and/or needs reported by you.
3. use of images for institutional and promotional communication purposes, subject to consent.

 

5. Nature of the provision and legal basis of the processing

The processing of personal data is based on the performance of a contract to which the data subject is a party (art. 6, par. 1, lett. b GDPR), as well as on the fulfilment of legal obligations to which the Data Controller is subject (art. 6, para. 1, lett. c GDPR). Where necessary, the processing may also be based on the consent of the data subject (art. 6, par. 1, lett. a GDPR).

6. Processing methods

The processing will be carried out in automated and/or manual form, with methods and tools that comply with the security measures referred to in art. 32 of the GDPR 2016/679, by specially appointed subjects, in compliance with the provisions of art. 29 of the European Regulation.

Security measures will be used to guarantee the confidentiality of the data subject to whom such data refer and to avoid undue access by third parties and/or unauthorized personnel.

The Data Controller shall adopt appropriate security measures to prevent unauthorized access, disclosure, modification or destruction of personal data.

Any IT tools used to support business activities do not involve automated decision-making processes that produce legal effects or significantly affect the data subject.

7. Data retention

We would like to point out that, in compliance with the principles of lawfulness, purpose limitation and data minimisation (pursuant to Article 5 of the GDPR 2016/679), your personal data will be stored for a period of time not exceeding the achievement of the purposes for which they are collected and processed and, in particular:

• the data processed for administrative, accounting and contractual purposes will be stored for a period not exceeding 10 years, in compliance with legal obligations;
• the data processed for the management and organization of the installation of the product will be stored for the time necessary to carry out the activity and to manage any post-installation needs;
• the photographic images and/or video footage will be kept for a period of time consistent with the Company’s communication and promotion purposes, unless consent is revoked.

At the end of the storage periods stated above, the personal data will be deleted or anonymized.

8. Scope of communication

The data may be communicated to third parties, in relation to the purposes indicated above, including:

• public entities and competent authorities in the cases provided for by law;
• consultants and professionals appointed by the Company;
• suppliers and partners involved in the organization and management of the installation of the product.

Only the photographic images and/or video footage taken during the installation may be disseminated, including through websites, social networks and information/promotional materials, only with the consent of the interested party.

The recipients of the data will process the same, as the case may be, as Data Processors or independent Data Controllers.

9. Transfer of data to non-EU countries

The Data Controller does not systematically transfer personal data to countries outside the European Union. However, if it becomes necessary to use cloud services or suppliers established in non-EU countries, the transfer will take place in compliance with the provisions of art. 44 et seq. of the GDPR, adopting the appropriate guarantees provided for by the applicable legislation.

10. Rights of the data subject

At any time, you may exercise the right to the Data Controller, pursuant to Articles 15-22 of the GDPR 2016/679, to:

• obtain confirmation of the existence or otherwise of personal data concerning you and access them;
• obtain information about the purposes of the processing, the categories of data processed, the recipients or categories of recipients to whom the data have been or will be communicated and, when possible, the retention period;
• obtain the rectification of inaccurate data or the integration of incomplete data, as well as the erasure of data or the limitation of processing in the cases provided for by law;
• receive personal data in a structured, commonly used and machine-readable format, as well as transmit them to another Data Controller (right to portability);
• object to the processing in the cases provided for by law;
• revoke any consent given at any time, without prejudice to the lawfulness of the processing based on consent before its withdrawal;
• lodge a complaint with the competent supervisory authority (Guarantor for the protection of personal data).

 

11. Information not contained in this policy

Further information in relation to the processing of Personal Data may be requested at any time from the Data Controller using the contact details.