Information about the processing of personal data

INFORMATION ABOUT THE PROCESSING OF PERSONAL DATA  
 
Information document pursuant to Arts. 13 ff. of EU Regulations No. 2016/679 
 
In compliance with the provisions of EU Regulations No. 2016/679 as well as Italian Legislative Decree No. 196 of 30 June 2003 where applicable, we are providing you with the required information about the purposes and procedures of the processing of your personal data, the scope of their disclosure and transfer, as well as the nature and collection of the data we possess. 
 
Purposes of processing 
 
1. Accounting and bookkeeping 2. Compliance with the company’s business obligations 3. Legal obligations in civil and tax-related matters 4. Statistical analyses 5. Surveillance 6. Marketing 
 
Processing under point 5) will be carried out only on the company’s premises. We inform you that Art. 130 paragraph 4 of Legislative Decree 196/2003, Measure 330 by the Italian Privacy Supervisor of 2013/07/04, as well as Preliminary Statement 47 of EU Regulations 2016/679, come into force on 2018/05/25, allow the Controller SimeVignuda SpA to carry out "direct marketing" activities (sending business communication, promoting directly marketed goods and services) without your previous consent. You can object to the processing (so-called opt-out) at any time by following the procedures  given below (Rights of the data subject). 
 
Procedures for processing and storing data 
 
Processing will be carried out both manually and with the help of computerised systems as well as by subjects entrusted with this activity. We inform you that the Controller uses computer devices which store telephone numbers in order to evaluate the degree of satisfaction of our customers as well as the time taken to process enquiries, by means of statistical analyses. The Controller will process personal data for the time needed to carry out the purposes above and in any case within legal time limits. The personal data collected are stored in servers located in Italy, within the European Union. It is understood that the Controller, where necessary, will also have the right to move the servers outside the EU, in compliance with legal provisions. In the latter case, data will be transferred according to Art. 44 – General principle for transfer; Art. 45 – Transfers on the basis of an adequacy decision; Art. 46 – Transfers subject to appropriate safeguards. Specifically, the data will be transferred:  - to third countries or international organisations that have provided adequate safeguards, and where the data subject has enforceable rights and effective appeal measures (Art. 46 of EU Regulations No. 2016/679, including contractual clauses and other arrangements as per Art. 46, paragraph 3). The data subject can obtain information about the safeguards concerning the data transfer by e-mailing this address: privacysimevignuda@gruppocomet.it.  
 
Scope of disclosure and transfer 
 
Personal data collected will be communicated to recipients that shall process the data as Processors (Art. 28 of EU Regulations 2016/679) and/or as persons acting under the authority of the Controller or Processor (Art. 29 of EU Regulations 2016/679), for the purposes of processing as listed above. In particular, your personal data will be processed by employees and consultants of the company that are entrusted with the processing, and can later be disclosed to accountants, professionals, credit institutions and service providers. They can also be disclosed to other companies belonging to the Comet Group. Any other disclosure or transfer will only occur with your explicit consent. The updated list of people entrusted with and responsible for the processing is stored at the branch office in San Daniele del Friuli.

Nature of collection 
 
The collection of your data is obligatory since it is necessary to comply with legal obligations and/or contracts, accounting, tax-related issues etc. The controller also informs you that any failed communication or incorrect communication of any of the required data will have the following consequences:  the impossibility for the controller to ensure that the processing complies with the contract agreements for which it is carried out;  the possible non-compliance of the results of the processing with obligations from tax, accounting or labour regulations to which it is related. The collection of data, however, is optional for the purposes under point 6 above. 
 
Rights of the data subject 
 
You can exercise your rights as stated in Arts. 15 ff. of EU Regulations No. 2016/679, and in particular the rights to: 
 
a) obtain confirmation of the existence or non-existence of your personal data, even if not yet recorded, and their communication in intelligible form; 
 
b) obtain information about: a) the source of personal data; b) the purposes and procedures of processing; c) the logic involved in case of processing by means of electronic devices; d) the identity of the controller, data processor and any representatives designated according to Art. 5, paragraph 2, of the Italian Privacy Code, and Art. 3, paragraph 1, GDPR; e) the subjects or categories of subjects to whom personal data can be disclosed or who can come to know them as designated representatives within the territory of the State, data processors or people entrusted with the data;  
 
c) obtain: a) updating, correction or, when needed, integration of the data; b) erasure, conversion into anonymous form or restriction of data that have been unlawfully processed, including when their storage is not necessary for the purposes for which they have been collected or later processed; c) a statement that operations under letters a) and b), including their content, have been communicated to those people to whom the data have been disclosed or transferred, except when such compliance is impossible or involves the employment of means that are clearly disproportionate to the protected right;  
 
d) totally or partially object to: a) the processing of your personal data, for legitimate reasons, even if relevant to the purpose for which they are collected; b) the processing of your personal data for the purpose of sending advertising material or direct selling or market research or business communication, by means of automatic calling systems without operators, e-mail and/or conventional marketing tools, telephone and/or paper mail. We point out that the data subject’s right to object, as per point b) above, to purposes of direct marketing with automated procedures extends to conventional ones, and that there is no detriment to the possibility for the data subject to exercise the right to object, even partially. Therefore the data subject can decide to receive only communication by conventional means, only automated communication or neither type of communication. 
 
e) Where applicable, you also have the rights pursuant to Arts. 16-21 GDPR (Right to rectification, Right to be forgotten, Right to restriction of processing, Right to data portability, Right to object), as well as the right to lodge a complaint with the Supervisory Authority. 
 
 
 
You can exercise said rights by contacting the Data Controller SimeVignuda SpA in Verona either by registered mail to the above address or by e-mail to this address: privacy.simevignuda@gruppocomet.it.

(Mod. GDPR_01 01_Informativa clienti e fornitori_INGLESE nov2019)