Information to data subjects pursuant to and to the effects of Article 13 of Regulation (EU) 2016/679 (GDPR) on the protection of processed personal data
Pursuant to and to the effects of Articles 13 and 14 of Regulation (EU) 2016/679 (hereinafter GDPR) laying down provisions on personal data protection, the Company, in its capacity as the Data Controller, informs you that the data concerning you, provided by you or otherwise acquired, will be processed in compliance with the GDPR.
Your personal data will be processed lawfully, fairly and in a transparent manner in relation to the data subject.
Personal data processing refers to any operation or series of operations, whether carried out manually or using electronic tools, concerning the collection, recording, organisation, storage, consultation, preparation, modification, selection, extraction, comparison, use, interconnection, blocking, communication, dissemination, erasure or destruction of data, regardless of whether said data are recorded in a databank;
DATA CONTROLLER
The Data Controller is the Company ZEC S.p.A. (VAT Identification Number IT01720400348), with registered office at Via Lungolorno, 11, 43052 Colorno (PR), Italy, contact details: e-mail info@zecspa.com certified e-mail address (Italian acronym PEC) info@pec.zecspa.com Phone +39 0521 816631, through its legal representative currently in office.
CATEGORIES OF DATA PROCESSED:
The data that will undergo this processing operation are the following:
- In case of natural persons, they will be identifying personal data, such as first name, last name, place and date of birth, Taxpayer Identification Number, identity document, phone number, e-mail address, IBAN);
- In case of legal persons, the data will be the name of the firm or of its owner/point of contact, e-mail address, IBAN, first name, last name, place and date of birth, Taxpayer Identification Number and any points of contact/representatives of the company.
PROCESSING PURPOSE AND LEGAL BASIS
Your personal data shall be processed for the following purposes:
A. FINALIZATION AND PERFORMANCE OF THE SUPPLY/SERVICE CONTRACT, consisting for example of: precontractual activities, contract execution and performance, dispute management.
Legal basis for the processing: the legal basis for the processing of the collected data is the contract for the supply of goods or provision of services to which you are a party (Article 6(b) of the GDPR).
Recipients of the data: the data collected for the stated purpose may be communicated to law firms, chartered accountants or labour consultants, to the data processors designated in accordance with Article 28 of Regulation (EU) 2016/679, to insurance undertakings, IT consultants/system administrators.
The updated list of data processors is on file at the headquarters of the Data Controller.
The data will not be disclosed to third parties.
Duration of the processing: the data collected for the above-stated purpose will be stored until the end, for any cause whatsoever, of the contractual relationship or for any longer period until the end of the statute of limitations ordinary period for contractual liability, unless special requirements for longer storage of the data apply regarding the contractual relationship.
Failure to provide the data: Providing the necessary data to pursue the stated purpose is a contractual obligation which the data subject is required to comply with. Any failure by the data subject to provide those data shall entail the impossibility to perform the contract.
B. COMPLIANCE WITH LEGAL OBLIGATIONS, which, for example, consist in in: administrative and accounting obligations, tax obligations.
Legal basis for the processing: the legal basis for the processing of the collected data is compliance with legal obligations lying with the Data Controller (Article 6(c) of the GDPR)
Recipients of the data: the data collected for the stated purpose may be communicated: to credit institutions, to Agenzia delle Entrate (the Italian Revenue Agency), other public authorities and/or private parties to which the data are to be communicated by law, to law firms, chartered accountants or labour consultants, to the data processors designated in accordance with Article 28 of Regulation (EU) 2016/679, to insurance undertakings, IT consultants/system administrators.
The updated list of data processors is on file at the headquarters of the Data Controller.
The data will not be disclosed to third parties.
Duration of the processing: the data collected for the above-stated purpose will be stored for the time laid down by the legislation that imposes their processing or for any longer period regarding the statute of limitations of the related rights, unless special requirements for longer storage of the data apply due to new legal obligations.
Failure to provide the data: the provision of the data is mandatory and necessary in order to comply with legal obligations. Any refusal to provide the data for said purpose shall determine the impossibility to continue the business relationship.
C. DIRECT MARKETING PURPOSE AIMED AT SELLING/ADVERTISING PRODUCTS OR SERVICES SIMILAR TO THOSE ALREADY PURCHASED BY THE DATA SUBJECT (known as Soft Spam), which consists in sending communications aimed at selling and/or advertising products or services similar to those already purchased before by the data subject, known as “direct marketing” to inform the data subject of promotions, easy terms, conditions of very advantageous offers based on the preferences of/purchases made by the customers.
Legal basis for the processing: The legal basis for the processing of any collected data is the Data Controller's legitimate interest (Article 6(f) of the GDPR).
Recipients of the data: the data collected for the stated purpose may be communicated to public authorities and to service companies or other private parties that have a role in the management of those activities, to the persons in charge of/authorized for data processing designated in accordance with Article 28 of Regulation (EU) 2016/679, IT consultants/system administrators, and independent data controllers, and co-controllers.
The updated list of data processors is on file at the headquarters of the Data Controller. The data will not be disclosed to third parties.
Duration of the processing: The data collected for the above-stated purpose will be stored until the end, for any cause whatsoever, of the contractual relationship or for any longer period until the end of the statute of limitations ordinary period for contractual liability, unless special requirements for longer storage of the data apply regarding the contractual relationship.
Failure to provide the data: The legal basis for the provision of the data is the controller’s legitimate interest. It is specified that, in the case envisaged in this point c) of this information to data subjects, the customer shall be entitled to opt out and thus terminate receipt of the related communications, with no consequence whatsoever, by sending the related notice directly to the Data Controller to the addresses given below.
Methods of processing: the data processing for the above-stated purposes is done via electronic, IT or paper media, in compliance with the confidentiality and security rules laid down by the aforementioned legislation and by other subsequent legislation and regulations.
Transfer of the data abroad: The data collected for the above-stated purposes will not be transferred to countries not belonging to the EU. Nevertheless, the Data Controller reserves the right to use cloud services and, in this case, the providers of the services will be selected amongst those who ensure appropriate safeguards in accordance with Article 46 of Regulation (EU) 2016/679.
Automated decision-making processes: the data collected for the above-stated purposes are not the subject-matter of any automated decision-making processes (including profiling).
Rights of the data subject: pursuant to Regulation (EU) 2016/679 the data subject shall have the following rights:
Lastly, the data subject has the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali) under Article 13(2) and Article 77 of the GDPR.
How to exercise your rights as the data subject: the data subject shall be entitled to exercise his or her rights, at any time, in compliance with Article 12 of Regulation (EU) 2016/679, sending:
- A registered letter with return receipt to: ZEC S.p.A., in Via Lungolorno, 11, 43052 Colorno (PR), Italy;
Certified e-mail address (Italian acronym PEC): info@pec.zecspa.com;
- E-mail: info@zecspa.com
Referral clause: for anything not provided for in this information to data subjects, please refer to the applicable legislation on this matter, specifically to Regulation (EU) 2016/679 and to Italian Legislative Decree no. 196/03 as amended by Italian Legislative Decree 101/18 as amended and supplemented, as well as to any other applicable measure
Having received and read the information to data subjects, I, the undersigned, acknowledge the above regarding the processing of personal data for the stated purposes.
