PRIVACY NOTICE FOR CUSTOMERS AND PROSPECTIVE CUSTOMERS PURSUANT TO ARTICLES 13–14 OF REGULATION (EU) 2016/679
Pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 concerning the protection of natural persons with regard to the processing of personal data (hereinafter, the “GDPR”), we hereby inform you that your personal data may be processed in compliance with the applicable legal and contractual provisions.
This notice is provided to the so-called “contact personnel” belonging to the organizational structure of a company that maintains or intends to establish business relationships with IMA S.p.A. or with one of its subsidiaries or group companies (“IMA Group Companies”).
Accordingly, this notice must be submitted to the person(s) within the company organization responsible for managing relations and communications with our Company.
In this regard, please be informed as follows:
1. DATA CONTROLLER
The controller of the personal data, namely the entity that determines the purposes and means of the processing of personal data, is the IMA Group Company with which your company maintains contractual relations (“Company” or “Controller”).
The updated list of companies controlled by and/or affiliated with IMA S.p.A. (hereinafter also referred to as the “IMA Group”) may be consulted at: https://imagroup.com/corporate/investors
All identifying details of the Controller may be requested by email at privacy@ima.it.
The IMA Group Companies have appointed a Data Protection Officer (“DPO”), who may be contacted for clarification regarding the processing of personal data.
In particular, the Italian companies have appointed the following DPO:
Alberto Bertuzzo
Pirola Pennuto Zei & Associati
Via delle Lame 109
40122 Bologna (Italy)
Tel.: +39 051 526711
Email: dataprotectionit@ima.it
The other European companies have appointed the following DPO:
Christian Schwinge
schwinge GmbH
Am Kochenhof 12
70192 Stuttgart
Germany
Phone: +49 (0) 711 / 258560-0
Email: dataprotectioneu@ima.it
2. DATA PROCESSED AND SOURCE OF THE DATA
For the purposes of the processing activities described in Section 3 below, only personal data relating to your identification and contact details acquired during the execution of a contract, at an event or trade fair, or voluntarily provided by you (verbally, through a business card, by email, or through the IMA website) will be processed.
Specifically, the Company may process personal data necessary for identification purposes, including but not limited to: first name and surname, tax identification number, email and/or certified email (PEC) addresses, employer company, role and/or job position (“Personal Data”).
Data Updating
At any time, you may ensure that the Personal Data processed for the purposes described in this notice are accurate and, in the event of any changes, you may request that such data be updated by sending a communication via email to privacy@ima.it or by registered mail to the Company’s registered office.
3. PURPOSES OF PROCESSING AND LEGAL BASIS
The collection and processing of your Personal Data are carried out for the following purposes, as applicable depending on the relationship between your company and the Controller:
a) performance of the Contract and provision of the related requested services;
b) compliance with legal and/or regulatory obligations (e.g., invoicing, accounting records);
c) protection of the rights of the Company and/or the IMA Group, both in and out of court;
d) carrying out soft-spam campaigns, i.e., sending commercial communications relating to products or services similar to those already subject to existing business relations with the Controller (where applicable);
e) carrying out marketing campaigns, i.e., sending commercial communications (by email or telephone) concerning goods and services produced by IMA (or another Group company), which we believe may be of interest for the purpose of establishing future business relations with your company.
The legal basis for the processing of your Personal Data is:
– Article 6(1)(b) GDPR – processing is necessary for the performance of a contract or in order to take steps at your request prior to entering into a contract – with reference to point a);
– Article 6(1)(c) GDPR – processing is necessary for compliance with a legal obligation to which the Controller is subject – with reference to point b);
– Article 6(1)(f) GDPR – processing is necessary for the purposes of the legitimate interests pursued by the Controller – with reference to points c) and d);
– Article 6(1)(a) GDPR – you have given your consent to the processing of personal data for that specific purpose – with reference to point e).
Please note that you may object to the above processing activities at any time by contacting the Company using the details indicated in Section 8 below, unless the Company demonstrates compelling legitimate grounds overriding your interests, rights and freedoms, or for the establishment, exercise or defence of legal claims pursuant to Article 21 GDPR.
Furthermore, the right to object to the processing of your Personal Data for the purpose referred to in point d) above (“Soft Spam”) may be easily exercised through the opt-out option included at the bottom of each commercial communication received from the Company.
4. MEANS OF DATA PROCESSING
Personal Data shall be processed in accordance with the principles of fairness, lawfulness, transparency and protection of confidentiality and rights, in compliance with the principles set out in the GDPR.
The processing of your Personal Data may be carried out by means of paper and/or electronic tools and shall include – within the limits and under the conditions established by applicable law – all operations necessary for the processing in question, including disclosure to the entities referred to in Section 5 below.
The processing of Personal Data shall be carried out in compliance with the confidentiality and security requirements established by European legislation, national laws, implementing regulations and internal provisions.
The processing of Personal Data is carried out by means of the operations referred to in Article 4(2) GDPR, namely: collection, recording, organisation, structuring, updating, storage, adaptation or alteration, retrieval and analysis, consultation, use, disclosure by transmission, comparison, interconnection, restriction, erasure or destruction.
The Company guarantees the logical and physical security of the data and, in general, the confidentiality of the Personal Data processed by implementing all necessary technical and organisational measures to prevent loss, unlawful or improper use, and unauthorised access by third parties.
5. DISCLOSURE OF DATA
For the purposes described in Section 3 above, the Company may make your Personal Data available to:
• its employees and collaborators, acting in their capacity as authorised persons processing the data;
• third parties carrying out outsourced activities on behalf of the Company and providing specific services as Data Processors pursuant to Article 28 GDPR;
• IMA Group Companies;
• banks and/or credit institutions for the management of collections and payments arising from contractual relationships;
• members of supervisory bodies, such as the Board of Statutory Auditors, the Supervisory Body established pursuant to Legislative Decree 231/2001, external and internal auditors appointed to carry out inspections and audits on behalf of the Company;
• judicial authorities, supervisory authorities, administrations, public bodies and institutions (national and foreign), in compliance with legal provisions and upon formal legitimate request.
The above-mentioned third parties shall process your Personal Data either as Data Processors duly appointed pursuant to Article 28 GDPR or as independent Data Controllers.
Personal Data collected by the Company shall not, in any case, be disseminated, without prejudice to disclosures required by law.
It is understood that, in the event of extraordinary corporate transactions (e.g., transfer or lease of a business, merger, etc.) involving the Company, Personal Data may be transferred or assigned to third-party purchasers, lessees or successors.
6. TRANSFER OF PERSONAL DATA TO THIRD COUNTRIES OR INTERNATIONAL ORGANISATIONS
The complex business structure of the IMA Group necessarily involves the circulation of personal data outside the territory of the European Union and the European Economic Area (“EEA”), which qualifies as a transfer of personal data to third countries pursuant to Article 44 GDPR.
Should your Personal Data be transferred to third countries, they shall always be processed in compliance with Articles 45 et seq. GDPR.
For further information regarding the transfer of your Personal Data, you may contact the Company at privacy@ima.it.
7. DATA RETENTION PERIOD
Your Personal Data shall be retained for the period strictly necessary to achieve the processing purposes described in Section 3 above and, specifically:
• If you are part of the organisational structure of one of the Company’s customers, your data shall be retained for a period of 10 years from the termination of the business relationship between the Controller and the customer company, including all sales and after-sales service activities (“Retention Period”), in accordance with Article 2220 of the Italian Civil Code. Upon expiry of the Retention Period, the Personal Data shall be permanently deleted or anonymised.
However, although retained for the above purposes, your Personal Data may not be used by the Controller for the purposes referred to in Section 3(d) and (e) once the business relationship between the companies has ended.
• If you are part of the organisational structure of a prospective customer of the Company, your data shall be retained for the time strictly necessary to assess the possibility of establishing a business relationship with IMA (or another IMA Group Company) and/or obtaining consent for marketing purposes. In particular, if such purposes are not achieved within 12 months, your Personal Data shall be deleted.
8. DATA SUBJECT RIGHTS
With regard to Personal Data, you may exercise at any time the rights granted by the GDPR, including:
• Right of access to personal data pursuant to Art. 15 GDPR: to obtain confirmation as to whether or not Personal Data concerning you are being processed and, where that is the case, access to the following information: the purposes of the processing, the categories of data concerned, the recipients or categories of recipients, the retention period, the right to lodge a complaint with a Supervisory Authority, the right to request rectification, erasure or restriction of processing, or to object to such processing, as well as the existence of any automated decision-making process;
- Right to rectification pursuant to Art. 16 GDPR: to obtain, without undue delay, the rectification of inaccurate Personal Data concerning you and, where necessary, the completion of incomplete Personal Data;
- Right to erasure pursuant to Art. 17 GDPR: to obtain, without undue delay, the erasure of Personal Data concerning you;
- Right to restriction of processing pursuant to Art. 18 GDPR: “restriction” means the marking of stored data with the aim of limiting their processing in the future; in such cases, the Company shall suspend the processing of the relevant Personal Data;
- Right to data portability pursuant to Art. 20 GDPR: where processing is carried out by automated means on the basis of your consent or for the performance of a contract, to receive your Personal Data in a structured, commonly used and machine-readable format;
- Right to object pursuant to Art. 21 GDPR: to object to the processing of your Personal Data, unless the Controller demonstrates compelling legitimate grounds for continuing the processing;
- Right to withdraw consent: with reference to the processing of data for the purpose set out in Section 3(e) of this Privacy Notice, you may withdraw your consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal.
The Company further informs you that you may lodge a complaint pursuant to Article 77 GDPR with the competent Supervisory Authority (for example, in the Member State of your habitual residence, place of work, or place of the alleged infringement).
In Italy, the competent authority is the Italian Data Protection Authority (Garante per la Protezione dei Dati Personali), whose contact details are available at http://www.garanteprivacy.it/.
The above rights may be exercised by sending a request via email to privacy@ima.it or by registered mail to the Company’s registered office.
Requests concerning the exercise of rights shall be handled without undue delay and, in any event, within 30 days of receipt.
Finally, please note that the Company may amend or update this Privacy Notice, including in order to comply with new legal requirements or technical needs.