INFORMATION ON THE PROCESSING OF PERSONAL DATA ACCORDING TO ARTICLE 13 OF EU REGULATION 2016/679
SACE SRL in the person of its pro tempore legal representative with registered office in Sasso Marconi (BO), Via Cartiera 154, 40037 in the Borgonuovo District (Tax Code and VAT Number 01698441209), according to Article 26 of EU Regulation 2016/679 (hereinafter the GDPR) in a joint data controller relationship with the following companies, which jointly determine the purposes and means:
FLODRAULIC EUROPE SRL in the person of its pro tempore legal representative with registered office in Granarolo dell’Emilia (BO), Via Don Minzoni 28-30-32, 40057 in the Cadriano District;
HTH SRL in the person of its pro tempore legal representative with registered office in Pontecchio Marconi (BO), Via Vizzano 44, 40037;
OLEOBI SRL in the person of its pro tempore legal representative in Via Don Minzoni 28, 40057 in the Cadriano District;
PK SRL in the person of its pro tempore legal representative in Castel Maggiore (BO), Via Lirone, 60/C, 40013;
EBI MOTION CONTROLS SRL in the person of its pro tempore legal representative in Granarolo dell’Emilia (BO), Via Andrea Costa 11/2, 40057, in the Cadriano District.
The Joint Data Controllers have entered into a a joint data controller agreement in accordance with the provisions of Article 26 of the GDPR. The essential content of the agreement is made available to data subjects by sending an express request to the Joint Data Controllers contact point, at the following e-mail address: comitatoprivacy@flodrauliceurope.com
SACE SRL, as Data Controller, will process the personal data of its customers, suppliers and users of the website for which it independently determines the purposes and means of processing.
We inform you that the personal data you provide will be processed in accordance with current legislation, in compliance with the principles of correctness, lawfulness and transparency.
1. Purpose and legal basis of the processing
Your personal data will be processed for the following purposes:
1.1 to conclude contracts with the Data Controller and/or the Joint Controllers and manage the related relationships in the pre-contractual, contractual, fiscal, administrative and accounting phases; (the legal basis of processing is the execution of the contract or pre-contractual measures and the fulfilment of legal obligations pursuant to Article 6 paragraph 1 letter b) and c) GDPR);
1.2 to send commercial or advertising communications concerning products or services similar to those already provided (soft spam) to the e-mail address provided by the data subject as part of a previous contractual relationship with the Controller and/or the Joint Controllers, without prejudice to the right of opposition pursuant to Article 21 GDPR in the first or subsequent communication (the legal basis for processing is the legitimate interest pursuant to Article 6 paragraph 1 letter f) GDPR);
1.3. to send commercial communications and/or advertising material and/or direct sales and/or market research (i.e. direct marketing) relating to the Data Controller and/or Joint Controllers’ products or services, through automated (for example, e-mail, sms, fax, mms, etc.) and traditional (paper mail and telephone contact) systems (the legal basis for processing is the data subject’s consent according to Article 6, letter a) GDPR);
1.4 to respond to the request for information formulated by filling in the appropriate contact form on the Data Controller’s website (the legal basis of the processing is the execution of the contract or pre-contractual measures pursuant to Article 6 paragraph 1 letter b) GDPR);
1.5 to register on the Data Controller's website (the legal basis for processing is the data subject’s consent pursuant to Article 6 letter a) of the GDPR);
1.6 to register to the group’s newsletter to stay up to date on the Joint Data Controllers’ initiatives, products and services (the legal basis for processing is the consent according to Article 6, letter a) GDPR);
1.7 to manage disputes and any disputes that may arise in the execution of relations with Your (the legal basis of the processing is the legitimate interest pursuant to Article 6, paragraph 1, letter f) GDPR).
2. Processing methods and data retention period
Data processing will be carried out by means of the operations indicated in Article 4 No. 2 GDPR in manual form and through IT and telematic tools.
Your personal data will be processed by applying security, technical and organisational measures that guarantee a level of security appropriate to the risk, taking into account the state of the art and cost to implement such measures, in accordance with the provisions of current legislation on personal data, as well as in compliance with the Italian Data Protection Authority’s provisions and within the limits of the provisions of Article 5 of the GDPR.
Data retention is limited to the time necessary to achieve the purposes for which the data was collected, except for the mandatory ones which are kept within the limits of the law.
In particular, for the purposes referred to in Article 1.1, the data will be kept for 10 years from the termination of the contract, except for the interruption of the requirement (Article 2946 of the Italian Civil Code). For direct marketing purposes referred to in Articles 1.2. and 1.3, personal data will be kept for no more than 24 months from their acquisition, without prejudice to the right of opposition in case of soft spam (Article 1.2.) and the revocation of consent given by the data subject (Article 1.3).
For the purposes referred to in Article 1.4 for the time necessary to process the request.
For the purposes referred to in Articles 1.5 and 1.6 the data will be kept until the Data Subject exercises the right of revocation of consent.
For the purposes referred to in Article 1.7 for the time strictly necessary for this purpose and, in any case, no later than the applicable limitation periods.
3. Recipients of the processing
The personal data may be made accessible to the Data Controller and/or Joint Controllers’ employees and/or collaborators in their capacity as people authorised to process the data who are adequately instructed for this purpose.
The data may be communicated to external subjects for the obligations imposed by the legislation or for a correct execution of the contractual relationship. These subjects will process the data as independent data controllers, or as data processors, duly appointed in accordance with current legislation (depending on the role they play in relation to the processing): for example, to social security, welfare and insurance institutions, trade associations, tax and labour offices, other companies of the group, professional legal, commercial, tax assistance offices, auditing firms, banks and credit institutions.
4. Nature of the provision
The communication of data is mandatory to fulfil contractual and legal obligations and, therefore, any refusal to provide them, in whole or in part, makes it impossible to execute the contractual relationship with you in all its phases.
The communication of data for other purposes is optional and, therefore, any refusal to provide your data will only make it impossible to use the services shown on the Data Controller's website such as subscribing to the group newsletter or requesting information through the contact form, and to receive commercial and/or advertising communications for direct marketing purposes, in the manner indicated above.
With reference to direct marketing activities, we remind you that you can exercise, even subsequently, the right to object to the processing of data for this purpose (in the case of soft spam) and the data will no longer be processed for this purpose, or revoke the consent given, in the manner indicated in section 7 below. We also remind you that when the processing of your data is based on consent, the provision is optional and you can revoke the consent given at any time in the manner indicated in paragraph 7 below.
5. Transfer of data abroad
Your data will not be transferred to third countries countries outside the European Union or to international organisations. If for technical and/or operational reasons or for the execution of the contract it is necessary to make use of subjects located outside the European Union, we inform you that the data will be transferred outside the EU in compliance with applicable legal provisions, or, will be carried out by virtue of the existence of an adequacy decision by the European Commission, in the absence of the same, on the basis of the adequate guarantees provided pursuant to Articles 46 or 47 of the GDPR (e.g. signing of the "standard clauses" of data protection adopted by the European Commission) or if there is a derogation pursuant to Article 49 of the GDPR.
6. The Data Subject's rights
In your capacity as data subject, you may exercise the rights provided for under Articles from 15 to 22 GDPR at any time
In particular, you may:
• access your personal data, obtaining evidence of the purposes pursued by the data controller, the categories of data involved, the recipients to whom they may be communicated, the applicable retention period, the existence of automated decision-making processes, including profiling, and, at least in such cases, significant information on the logic used, as well as the importance and possible consequences for the data subject, if not already indicated in the text of this Privacy Policy;
• obtain without delay the correction of inaccurate personal data concerning you;
• in the cases provided by the law, obtain the deletion of data;
• obtain the limitation of the processing or oppose it, when admitted based on the legal provisions applicable to the specific case;
• in the cases provided for by law, request the portability of the data you have provided to the data controller, i.e. to receive them in a structured format, commonly used and readable by an automatic device, and also request to transmit such data to another data controller, if technically feasible;
• where deemed appropriate, lodge a complaint with the Italian Data Protection Authority (see Article 77).
• In particular, the following rights are recognised: Article 15 - "The Data Subject's Right to access", 16 - "Right of rectification", 17 - "Right to cancellation", 18 - "Right to limit the processing", 19 - "obligation to notify in case of rectification or cancellation of personal data or limitation of processing", 20 -"Right to data portability", 21 -"Right to object", 22 -"Automated decision-making process relating to natural persons, including profiling” of the GDPR within the limits and under the conditions provided for by Article 12 GDPR.
In general, we remind you that for the processing of personal data for which the legal basis is consent, this may be revoked at any time, without prejudice to the lawfulness of the processing based on the consent given before the revocation.
7. Procedures for exercising rights
The data subject may exercise their rights towards and against each Joint Data Controller.
in exercising the rights, the Data Subject can contact SACE SRL, Via Cartiera 154, 40037 in the Borgonuovo district, Sasso Marconi (Bo), by sending a written communication to the company’s offices or send an e-mail to the following e-mail address: comitatoprivacy@flodrauliceurope.com
Updated in November 2020