Information pursuant to art. 13 of the Regulation (EU) n. 679/2016 (“GDPR”)
AREA IMPIANTI SPA protects the confidentiality of personal data and guarantees to them the necessary protection from any event that could put them at risk of violation.
As required by the European Union Regulation no. 679/2016 (“GDPR”), and in particular to the art. 13 below, the information requested by the law regarding the processing of personal data is provided to the Data Subject.
Who we are and what data we process (article 13, paragraph 1 letter a, article 15, letter b GDPR)
AREA IMPIANTI SPA, in the person of its legal representative pt, with headquarters in Albignasego (PD), Via Leonino da Zara 3 / A, operates as Data Controller and can be contacted at firstname.lastname@example.org and collects and / or receives information concerning the interested party, such as:
Data category and Exemplification of data types
Identification data of the company and of the persons who are part of it subject to ordinary confidentiality:
Company name, legal / operational / administrative address, landline and / or mobile phone, fax, VAT number, tax code, e-mail address
Data related to persons subject to control of the general requirements during the tender
IBAN and bank / postal data
AREA IMPIANTI SPA does not require the Subject to provide data so-called “Particulars”, or, according to the provisions of the GDPR (art. 9), personal data revealing racial or ethnic origin, political opinions, religious or philosophical convictions, or union membership, as well as genetic data, data biometrics designed to uniquely identify a natural person, data relating to a person’s health or sexual life or sexual orientation.
For any information or request, the interested party can contact the address email@example.com Telephone +39 049 8626426
For what purposes we need the data of the interested party (Article 13, paragraph 1 of the GDPR)
The processing of personal data may have the following purpose:
stipulation of contracts and fulfillment of contractual obligations (in charge and in favor of the owner), and therefore for purposes strictly connected to the management of the contractual relationship, including formalities and administrative and accounting obligations (for example: acquisition of preliminary information to the conclusion of a contract, execution of transactions based on the obligations arising from the contract concluded, for operational and management needs, for control over performance, for tax and tax regularity checks, for the management of litigation – contractual breaches; transactions, debt collection, arbitration, litigation, etc.)
The legal basis of these treatments is the fulfillment of the services inherent in the contractual relationship and compliance with legal obligations.
In no case AREA IMPIANTI SPA resells the personal data of the interested party to third parties or uses them for purposes not declared.
The Owner, in line with the provisions of article 49 of the GDPR, treats, even through its suppliers (third parties and / or recipients), the personal data of the interested party to a strictly necessary and proportionate extent to ensure network security and information, ie the ability of a network or information system to resist, at a given level of security, unforeseen events or illicit or malicious acts that compromise availability, authenticity, integrity and the confidentiality of personal data stored or transmitted.
The Data Controller will promptly inform the Interested parties, if there is a particular risk of violation of their data without prejudice to the obligations arising from the provisions of art. 33 of the GDPR concerning notifications of violation of personal data.
Base giuridica di tali trattamenti è il rispetto di obblighi di legge ed il legittimo interesse del Titolare ad effettuare trattamenti inerenti a finalità di tutela del patrimonio aziendale e sicurezza delle sedi e sistemi di AREA IMPIANTI SPA.
The Owner DOES NOT perform the profiling of personal data.
What happens if the Data Subject does not provide his identification data as necessary for the execution of the requested supply and / or service? (Article 13, paragraph 2, letter e GDPR)
collection and processing of personal data are necessary to follow up the provision of the service and / or the supply of the requested product; if the data subject does not provide the data expressly provided for as necessary, the data controller will not be able to process the processing of the requested services and / or the contract and the services / products connected to it, or the obligations that depend on them.
The data of the interested party can also be processed for:
a) registration and contact requests and / or information material
The processing of personal data of the interested party may take place to carry out preliminary activities and consequent to the management of requests for information and for contacting and / or sending informative material, as well as for the fulfillment of any other obligation arising.
The legal basis of these treatments is the fulfillment of the services inherent to the request for information and for contacting and / or sending information material and compliance with legal obligations.
b) promotional activities on Services / Products similar to those purchased by the Interested Party (Article 47 GDPR)
The data controller, even without explicit consent, may use the contact details communicated by the interested party, for the purpose of direct promotion of their own Services / Products unless the interested party explicitly objects.
This treatment can take place, in an automated way, with the following methods:
– telephone contact;
and can be carried out if the interested party has not revoked his consent for the use of the data;
The legal basis of such processing is the consent given by the interested party prior to the processing itself, which can be revoked by the interested party freely and at any time.
In the event that the interested party has given consent and should subsequently withdraw or oppose the treatment for commercial promotion activities, his data will no longer be processed for such activities, without this having consequences or detrimental effects for the interested party and for the requested services.
Communication to third parties and categories of recipients (Article 13, 1st paragraph GDPR)
The personal data will be communicated mainly to third parties and / or recipients whose activity is necessary for the performance of the activities related to the relationship established and to meet certain legal obligations, such as:
Target categories and purposes
Company of the Area Impianti Spa Group
Administrative, accounting and contractual compliance obligations
Third-party suppliers of the Area Impianti Spa Group
Supplies and services (assistance, maintenance, delivery / delivery of products, provision of additional services related to the requested service)
The Data Controller imposes on its Third Party suppliers and on Data Processors the respect of security measures equal to those adopted towards the interested party, restricting the perimeter of action of the Manager to the treatments related to the requested service.
Credit and digital payment institutions, banking / postal institutions
Management of collections, payments, connected to the contractual performance
External professionals / consultants and consulting firmsa
Fulfillment of legal obligations, exercise of rights, protection of contractual rights, recovery of credit /p>
Financial administration, public bodies, judicial authorities, supervisory authorities and control
Compliance with legal obligations, defense of rights; lists and registers held by public authorities or similar bodies on the basis of specific legislation, in relation to the contractual performance
Formally delegated subjects or having a recognized legal title
Legal representatives, procurators
The Data Controller provides for the use of adequate security measures to preserve the confidentiality, integrity and availability of the personal data of the interested party and imposes similar security measures on third parties and on the Managers.
The personal data of the interested party are stored in paper, computerized and electronic archives located in Italy.
The legal basis of these treatments is the fulfillment of the services inherent to the relationship established, compliance with legal obligations and the legitimate interest of Area Impianti Spa to carry out the necessary treatments for these purposes.
Unless he expressly expresses his will to remove them, the data of the interested party will be kept until they are necessary with respect to the legitimate purposes for which they were collected.
In the case of data provided to the Owner for the purposes of commercial promotion, these will be retained until revocation of consent given by the party concerned.
Regardless of the determination of the interested party to their removal, the data will in any case be kept according to the terms established by current legislation and / or national regulations, for the sole purpose of guaranteeing the specific requirements of some Services (but not limited to non-exhaustive, assistance, maintenance, on-line plant supervision).
Furthermore, the data will in any case be kept for the fulfillment of the obligations (i.e. fiscal and accounting) that remain even after the termination of the contract (Article 2220 c.c.); for these purposes the Data Controller will retain only the data necessary for the relative prosecution.
Except in cases where the rights deriving from the contract and / or registration should be asserted in court, in which case the personal data of the interested party, exclusively those necessary for such purposes, will be processed for the time necessary to their pursuit.
What are the rights of the interested party? (Articles 15 – 20 GDPR)
The GDPR attributes the exercise of the following rights to:
Access to personal data
therefore the right to have free information about the personal data held by the Data Controller and the related processing, and to obtain a copy in an accessible format;
we will, on explicit notification, to the correction or integration of incorrect or inaccurate data, even if they have become such as not updated
Withdrawal of consent
if the processing is done by consensus, it may revoke the consent at any time, without prejudice to the lawfulness of the treatment provided before the revocation
The interested party has the right to cancel his / her personal data if there is no legitimate overriding reason for the Data Controller than the one giving rise to the request, and in any case in case the Data Subject opposes the processing for commercial promotion activities.
How and when can the data subject oppose the processing of personal data? (Article 21 GDPR)
For reasons related to the particular situation of the interested party, the same may oppose at any time the processing of their personal data if it is based on legitimate interest or if it takes place for business promotion, sending the request to the owner at firstname.lastname@example.org.
For any further information and in any case to send the request, the interested party must contact the Data Controller at email@example.com. In order to ensure that the rights mentioned above are exercised by the Data Subject and not by unauthorized third parties, the Data Controller may request the same to provide any additional information necessary for the purpose.
To whom can the interested party submit a complaint? (Article 15 GDPR)
Without prejudice to any other action in administrative or judicial seat, the interested party may lodge a complaint with the competent supervisory authority on the Italian territory (Authority for the protection of personal data) or the one carrying out its duties and exercising its powers in the Member State where the GDPR violation took place.
Each update of this Information will be promptly communicated by reasonable means and will also be communicated if the Data Controller processes the data of the Data Subject for further purposes than those referred to in this Notice before proceeding and following the manifestation of the relative consent of the ‘Interested if necessary.