PRIVACY NOTICE PROVIDED PURSUANT TO Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016, and Legislative Decree No. 196 of June 30, 2003, as amended by Legislative Decree No. 101 of August 10, 2018, published in the Official Gazette September 4, 2018, concerning the protection of natural persons with regard to the processing of personal data and on the free movement of such data (hereinafter “GDPR”). Pursuant to Articles 13 and 14 of the GDPR, we provide the following information:
1. Identity and contact details of the data controller and its representative
The DATA CONTROLLER is the company GIORGIO BORMAC S.R.L., with registered office at Via della Meccanica No. 25, CARPI (MO) – ZIP Code 41012, registered in the Modena Business Register under No. MO - 448608; VAT Number: 04168650366; Phone: 059653274; Email: info@giorgiobormac.com; Certified Email (PEC): gbormac@legalmail.it
THE REPRESENTATIVE OF THE DATA CONTROLLER is the current legal representative—currently Ms. Rosanna Orlandi, domiciled at the Data Controller’s registered office—and, in any case, the person listed in the Modena Business Register as the legal representative.
2. Contact information for the Data Protection Officer
Not applicable.
3. Types of data subject to processing
The Personal Data that may be collected and processed by the Data Controller during the course of the established relationship may relate to the following categories of data subjects:
I) natural persons who are customers or suppliers of the Data Controller;
II) natural persons acting as legal representatives of companies that are customers or suppliers of the Data Controller;
III) natural persons who are employees, collaborators, or consultants of the Data Controller’s customers or suppliers.
The Data Controller will process the Personal Data of the aforementioned individuals who fall under the definitions set forth in Article 4(1) of the Regulation, and in particular the identifying data of natural persons, including, but not limited to, first name, last name, domicile and/or residence, telephone numbers, email address, chat or social media contact information, online identifier, tax identification number, VAT number, registration numbers with the R.I. and R.E.A., professional registry numbers, and bank details.
4. Purposes of Processing
Personal Data will be processed for the purposes set forth below:
a) to carry out activities preparatory to and subsequent to the execution of commercial contracts, or to fulfill all contractual and pre-contractual obligations with respect to the data of the individuals referred to in paragraphs I), II), and III) of point 3);
b) to fulfill the obligations to which the Data Controller is subject, as provided for by applicable laws (by way of example: civil law obligations, accounting and tax obligations such as bookkeeping, invoicing, and the submission of data to the State tax authorities) — with respect to the data of the individuals referred to in paragraphs I) and II) of point 3);
c) to carry out the following activities—which are not personalized and do not involve the creation or use of profiles—relating to the goods and services provided by the Data Controller: direct marketing, promotional activities, advertising, and publicity through the sending of commercial illustrative and informational materials; with reference to the data of the individuals referred to in paragraph I) of point 3);
d) conduct customer satisfaction surveys without creating or using profiles.
5. Legal Basis for Processing
Personal Data processed for the purposes set forth in subparagraphs (a) and (b) of paragraph 4) is lawfully processed because the conditions set forth in Article 6, paragraph 1, subparagraphs (b) and (c) (“processing is necessary for the performance of a contract to which the data subject is a party or for the the implementation of pre-contractual measures taken at the data subject’s request, and the processing is necessary to comply with a legal obligation”), while data for the purposes set forth in points (c) and (d) of Section 4) are lawfully processed because the conditions set forth in Article 6, paragraph 1, points (f) (“processing is necessary for the legitimate interests of the Data Controller”) are met.
6. Provision of Data and Refusal
The provision of data is necessary for the fulfillment of the contractual purposes referred to in point 4), and refusal by data subjects to provide such data will make it impossible to fulfill the aforementioned purposes.
7. Methods of Processing
Processing is carried out through operations performed with or without the use of electronic tools and consists of the collection, recording, organization, storage, consultation, processing, modification, selection, extraction, comparison, use, erasure, and destruction of data. Data processing is carried out by the Data Controller, by internal personnel expressly authorized by the Data Controller, or by one or more external data processors appointed by the Data Controller.
8. Recipients
Personal Data collected by the Data Controller may be disclosed for the purposes set forth in point 4) to the following parties:
a) third parties and other entities appointed by the Data Controller to fulfill the contractual obligations and protect the rights referred to in point 4) (for example: suppliers, employees, collaborators, consultants, professionals, etc.)—with regard to the data of the individuals referred to in paragraphs I), II), and III) of point 3);
b) third parties appointed by the Data Controller, acting as data processors for specific processing activities, to carry out specific tasks related to the fulfillment of obligations that are distinct from but related to contractual obligations—with reference to the data of the individuals referred to in paragraphs I) and II) of point 3);
d) The State Tax Administration and other government agencies, to comply with the Data Controller’s legal obligations—with reference to the data referred to in paragraph I) of point 3);
e) all other parties for whom disclosure is necessary for the Data Controller to properly fulfill its legal obligations—with reference to the data referred to in paragraph I) of point 3). Personal Data is not subject to disclosure.
9. Transfer of Data Abroad
Please be advised that the Data Controller does not transfer Personal Data outside the European Economic Area.
10. Retention Period
The Personal Data collected is retained only for as long as necessary to achieve the purposes set forth in point 4).
Access to your information is limited solely to those who need to use it for relevant purposes. Personal Data that is no longer necessary, or for which there is no longer a legal basis for retention, is permanently deleted.
Personal Data will be retained in accordance with the procedures described above for:
a) the entire duration of the contract and, following the termination of the contractual relationship, for 10 years, which is the ordinary statute of limitations period, unless otherwise required by law;
b) in the event of litigation, for the entire duration of the dispute and until the expiration of the time limits for bringing legal actions and appeals.
11. Rights of the Data Subject
The data subject may, at any time, exercise the rights provided for in Chapters 3 and 8 of EU Regulation No. 679/2016 and in any regulations issued by the Italian government on this matter, in particular:
a) the right to obtain a copy of the personal data you have provided;
b) the right to access personal data;
c) the right to obtain the rectification or erasure of such data or the restriction of processing concerning the data subject;
d) the right to object to processing;
e) the right to data portability;
f) the right to withdraw consent, where applicable (withdrawal of consent does not affect the lawfulness of processing based on consent given prior to withdrawal);
g) the right to lodge a complaint with the supervisory authority.
The exercise of these rights is subject to certain exceptions designed to protect the public interest (such as the prevention or detection of crimes) and our own interests. If you exercise any of the aforementioned rights, it will be our responsibility to verify that you are entitled to exercise them, and we will generally respond within one month.
You may exercise these rights by sending a request via email to privacy@giorgiobormac.com
NOTICE ON THE PROCESSING OF PERSONAL DATA
(Art. 13 of EU Regulation No. 679 of April 27, 2016, on the protection of personal data, “GDPR”) Dear Data Subject, We hereby inform you, pursuant to European Regulation 2016/679, that your data will be processed in accordance with the principles of “lawfulness, fairness, and transparency” (Art. 5, letter a), and we provide you with the following information:
• Data Controller: GIORGIO BORMAC S.r.l. - Via della Meccanica, 25 - 41012, Carpi (MO) - Italy
The Data Controller is responsible to you for the lawful and proper use of your personal data and may be contacted for any information or requests regarding the processing activities listed below:
Management of interviews for personnel selection
Purposes that do not require consent
-Purpose: Scheduling interviews / Legal Basis: Performance of a contract and/or pre-contractual measures
-Purpose: Candidate evaluation / Legal Basis: Performance of a contract and/or pre-contractual measures
Methods of processing: Data processing will be conducted in paper form and/or digitally using IT tools.
Automated decision-making: The processing is not based on automated decision-making.
Types of Required Data: Contact information, Personal identification data, Data contained in resumes, Any special categories of data. If the required data is not provided or is provided incorrectly, the Data Controller will be unable to properly carry out contractual and/or pre-contractual procedures.
Data Transfer: The transfer of data to countries outside the EU or to international organizations is suspended.
Retention periods by category of personal data:
- Category: General Data / Retention period: 12 months
- Category: Special Categories of Data / Retention period: 12 months
RIGHTS OF THE DATA SUBJECT
We also inform you of the following rights you may exercise with respect to the Data Controller:
• Right of access: The data subject has the right, in accordance with Article 15 of the GDPR, to request access to their personal data from the Data Controller.
• Right to rectification: The data subject has the right, in accordance with Article 16 of the GDPR, to request that the Data Controller rectify their personal data.
• Right to erasure: The data subject has the right, in accordance with Article 17 of the GDPR, to request that the Data Controller erase their personal data.
• Right to lodge a complaint: The data subject may also, in accordance with Article 77 of the GDPR, lodge a complaint with a supervisory authority (such as the Italian Data Protection Authority).
• Right to restriction of processing: The data subject has the right, pursuant to Article 18 of the GDPR, to request that the data controller restrict the processing of data concerning him or her.
• Right to object: The data subject has the right, pursuant to Article 21 of the GDPR, to object to the processing of his or her personal data.
• Right to data portability: The data subject has the right, in accordance with Article 20 of the GDPR, to exercise their right to data portability.
CONTACT INFORMATION FOR EXERCISING RIGHTS
Requests to exercise these rights may be directed to the Data Controller at the following contact information:
Address: Via della Meccanica, 25 - 41012, Carpi (MO) - Italy
Contact Information: Tel. 059653274, info@giorgiobormac.com, gbormac@legalmail.it
▢ I hereby declare that I have read the privacy notice