PRIVACY POLICY IN ACCORDANCE WITH ART. 13 OF EU REGULATION 2016/679 OR GDPR

PRIVACY POLICY regarding Users of the Website, Customers, Potential Customers, Suppliers and Candidates of ARCARI E CO Srl

We inform you that, pursuant to EU Regulation 2016/679 (hereinafter: “Regulation”), the Personal Data that you have provided to us or will provide us directly, through this site, directly or through third parties, will be processed by the following Data Controller.

1. Data controller of personal data relating to web users (this website), customers, potential customers, suppliers and job candidates:

ARCARI E CO Srl – Via Zanzi No. 16, Granarolo Faentino (RA)

Contact details of the Data Controller: Email: amministrazione@arcarieco.com

2. PROCESSED DATA, PURPOSES AND SUB-PURPOSES, STORAGE AND METHODS

I – DATA PROCESSED

Among the information provided by Users of the website, Customers, Potential Customers, Suppliers, candidates for a job position (CV) or by users of the site, through the email addresses indicated on the contact page, provided directly by the data subject and/or through third parties (e.g. the company for which they work), there are the following by way of example and not limited to: Cookies relating to navigation data, Company Name, Name and Surname, Email Address, Telephone number, Mobile number, Personal and contact data, Bank data, User and Password (reserved area only), Data contained in the Curriculum Vitae and other types of data.

N.B.: In the event that the user communicates, by email, particular categories of data (e.g. data relating to health, data of racial or ethnic origin, political and sexual orientations, judicial data contained in the CVs) pursuant to Article 9 of Regulation (EU) 2016/679, this represents an expression of free, specific, informed will, through unequivocal positive action with which the User expresses their explicit consent so that the personal data concerning them are subject to processing by the Data Controller.

However, the Data Controller and Data Processor will do everything possible to delete these data once the requested purpose has been achieved or if they exceed the principle of minimisation.

II – PURPOSES AND LEGAL BASES

The Data Controller directly or indirectly, also making use of other Processors and Sub-Processors whose references are available upon request to the indicated references, uses personal data for the purposes, sub-purposes and according to the legal bases specified below:

REQUEST FOR CONTACT, QUOTATION, PURCHASE ORDER (customers, potential customers, suppliers and potential suppliers):

The personal data provided through the compilation of a quote/order are processed in order to satisfy your request for contact, quote or fulfilment of the order or a requested service or to contact the customer/supplier or its employees and appointed for the performance of the functions inherent to the contractual relationship;

The data are mandatory to fulfil these purposes, without which we will not be able to finalise your request.

The legal basis of this data processing is the contractual and/or pre-contractual obligation.

LEGAL AND ADMINISTRATIVE PURPOSES (Customers and Suppliers):

The personal data collected are aimed at carrying out all administrative, accounting and tax activities related to the active and/or passive invoicing of the services/products requested. It is understood that any refusal to provide such data and failure to consent to their processing will make it impossible to achieve the purpose. The data will be processed for the times and in the manner required by current regulations.

In addition, the data may be processed to:

execute legal obligations, regulations, national and community regulations and regulations deriving from provisions issued by authorities legitimised by law;

ascertain, exercise and/or defend a right in the court of the Data Controller.

Legal bases for this processing are the Contractual and pre-contractual Obligation, Legal Obligations, Legitimate Interest for Common Data.

COMMERCIAL AND MARKETING (customers and potential customers)

The personal data provided directly at its headquarters or provided through third parties (e.g. the company with which it collaborates) by the Data Controller listed above also allow us to subscribe you to our Commercial and Marketing services by automated means (e.g. Email, Newsletter, text message, online messaging, social media, web advertising, re-marketing etc.) and/or by other non-automated means (e.g. telephone operator, paper mail) updating you on news, initiatives, promotions, events and other marketing activities organised directly or indirectly by the Data Controller.

For this purpose, if you are already a Customer and no more than 24 months have elapsed “since the Last Contact” and, even in the absence of consent, the legal basis for carrying out the processing is that of Legitimate Interest, on the basis of which the Data Controller can send commercial communications and marketing related to products/services that you have already purchased (recital 47 of the GDPR).

If you have not had any “Contact” with the Data Controller, including participation in an event, the use of a product or service, the opening of an email or a contact with our sales network in the previous 24 months (concept of “Last Contact”), the only legal basis for this purpose remains the Consent collected through this site(s), or directly c/o the data subject, through third parties (e.g. the company with which you collaborate) or through our sales network.

WEBSITE NAVIGATION DATA (Cookies)

d.1) Cookie Navigation Data

Cookies are portions of code installed in the browser that assist the Data Controller in providing the service for the purposes described. Some of the purposes for installing Cookies may also require user consent.

This site uses different types of cookies: technical or necessary, preferences, statistics and marketing.

You can modify or revoke your consent to cookies at any time by clicking on the paper-clip icon located at the bottom left of each page.

When the installation of Cookies is based on consent, this can be freely revoked at any time by following the instructions contained in this document.

d.1) Technical cookies

This website uses cookies to save user sessions and to perform other activities which are strictly necessary for it to function, for example in relation to site traffic distribution.

The legal basis for this purpose is the pre-contractual relationship as any rejection of technical cookies would not allow navigation of the site itself.

d.2) Statistical and preference cookies (sub-purposes):

In order to provide you with communications and services more oriented to your interests and preferences, we may use the data that you provide us, through the website or directly, in order to improve the quality and accuracy of the information and products/services that we may offer you in the future, excluding fully automated systems (automatic profiling), through the help of operators for the aggregation of data (e.g. through ERP systems, CRM, spreadsheets, mailing platforms, etc.).

The Legal Basis for this sub-purpose is the consent expressed through the banner that appears at the opening of the site, which can be modified at any time, even later, through the icon that appears at the bottom left.

d.3) Cookie Marketing (sub-purposes)

Marketing cookies are used to monitor visitors on websites. The intention is to display relevant, engaging advertisements for the individual user and therefore the most valuable for publishers and third-party advertisers (e.g. Facebook, Google, etc.).

The Legal Basis for this sub-purpose is the consent expressed through the banner that appears at the opening of the site, which can be modified at any time, even later, through the icon that appears at the bottom left.

EVALUATION OF CANDIDATES for job vacancies

The data provided spontaneously by candidates for job vacancies, through the emails indicated on the site, contained in the body of the email or in the attached Curriculum vitae that may be provided, will be processed exclusively to evaluate the candidate themselves and will not be processed for further purposes.

Legal basis for this processing is the pre-contractual relationship (employment contract) for the Common Data and the consent in case you spontaneously want to provide us with Particular Personal Data (e.g. sensitive data). of which we cite by way of example and not exhaustively:

Health data, Judicial Data, Data of ethnic or religious origin, Sexual and political orientations, Geolocation data and other special categories of data;

III – DATA RETENTION

Personal data will be kept for a period not exceeding that necessary for the achievement of the purposes for which they were collected and subsequently processed. Personal data will be kept for the duration of the contract concluded by you and also for a later period based on the following criteria:

within the terms established by current legislation;

within the deadlines established by secondary legislation that require the retention of data (for example, tax returns);

within the period necessary to protect the rights of the data subject in the event of any legal disputes related to the service provided;

The data processed for marketing purposes based on Legitimate Interest (deriving from the customer/supplier relationship) will be kept up to a maximum of 24 months from the last contact, purchase or expression of interest by the Customer;

Where other Legal Bases do not apply, the data processed by informed consent for the purposes referred to in letters (c) and (d) will be kept until revocation of the same or exercise of another right of the User (see rights of the data subject);

The data contained in the Curriculum Vitae provided by candidates for a job vacancy for the purposes referred to in letter (e) will be kept for a maximum of 24 months, after which they will be destroyed.

IV – PROCESSING METHODS

The data provided will be processed with digital and paper tools, exclusively by our personnel who are specifically authorised and trained for this processing and/or by other Data Processors selected according to the requirements and appointed by the Data controller itself.

The list of Processors and any Sub-Processors can be provided upon request by sending an email to amministrazione@arcarieco.it

The data will be processed with adequate organisational and instrumental security and protection measures in order to reduce risks, prevent and mitigate any breach due to loss, illicit use, incorrect or unauthorised access in accordance with Article 32 of the GDPR.

V – MANDATORY OR OPTIONAL NATURE OF THE PROVISION OF DATA AND LEGAL BASIS FOR PROCESSING

Some data are necessary for the operation of the site, others are used for the sole purpose of obtaining anonymous statistical information on the use of the site and to check its correct functioning, and are deleted immediately after processing (session cookies).

For the purposes referred to in points (a) and (b) of the previous paragraph II, the provision of personal data of Users/Customers/Suppliers is mandatory since, failing that, the requested services cannot be provided.

On the other hand, the provision of personal data and consent to their processing are not mandatory but optional for the purposes referred to in points (c) and (d) of the previous paragraph and failure to consent to the processing will not prevent you from receiving the other services referred to in points (a) and (b) for the sole common data.

3. COMMUNICATION AND TRANSFER OF DATA

I – Communication of data to third parties

Your data, limited to the purposes indicated, may also be communicated to third parties such as, but not limited to:

Banking institutions for the management of payments, Financial and Leasing Companies, Public Bodies, Judicial Authorities, Police Forces and other supervisory bodies, the Ministry of Health and regionally competent local health companies, Tax and legal consultants, IT Assistance, Web & Marketing Agencies, professionals and authorised cinema/photo-operators, authorised employees and collaborators, Processors and Sub-Processors and/or those appointed by the Data controller/Owner/Co-owners, suppliers, Transport companies, taxis and couriers as well as companies that we can use to provide our services.

Please note that, for no reason will the data you provide, directly or through third parties (company with which you collaborate), be transmitted to third parties, not expressly indicated in this statement, for Commercial or Marketing purposes (lett. c and d)

II – Transfer of Data outside the EU

Pursuant to the General Data Protection Regulation or GDPR, the transfer of such data to a third country can, in principle, only take place if the third country concerned guarantees such data an adequate level of protection. According to that regulation, the Commission may find that, by virtue of its national legislation or international commitments, a third country ensures an adequate level of protection. In the absence of such an adequacy decision, such a transfer may be made only if the exporter of the personal data, established in the Union, provides adequate safeguards, which may result, in particular, from standard data protection clauses adopted by the Commission, and if the data subjects have enforceable rights and effective remedies. The GDPR also sets out precisely under what conditions such a transfer may take place in the absence of an adequacy decision or adequate safeguards.

If it is necessary to transfer data to non-EU countries and, in the absence of the above adequacy requirements or Standard Contractual Clauses, the only legal basis is consent.

RIGHTS OF THE DATA SUBJECT

Individuals concerned may exercise, at any time, the rights of the Privacy Regulation, by sending a written communication to one of the addresses indicated in this privacy policy.

In particular, the data subject can ask the Data Controller for access to and rectification or deletion of personal data or restrictions on processing their data, or to object to the processing, as well as the right to data portability. The data subject has the right to withdraw their consent at any time without prejudice to the lawfulness of the processing based on the consent given prior to the revocation and has the right to lodge a complaint with a supervisory authority.

It is understood that the User/Customer/Supplier exercises their rights in compliance with the conditions established in paragraph 4 and the EU Privacy Regulation 2016/679.

If, in any case, you wish to object to the processing of your data for the purposes referred to in points c) and d) carried out by the means indicated herein, as well as revoke the consent given, you may do so at any time, by clicking on the “Unsubscribe” link at the bottom of the email or by contacting the Data Controller at the addresses indicated in this privacy policy, without prejudice to the lawfulness of the processing based on the consent given before the revocation.

If you wish to complain to the Supervisory Authority, you can do so by following the instructions at the following link: https://www.garanteprivacy.it/home/modulistica-e-servizi-online/reclamo

CHANGES AND ADDITIONS TO THE PRIVACY POLICY

Transparency about how we treat data and keep it safe is part of our commitment to ensuring and strengthening privacy rights. For these reasons, this information may be subject to updates to the Processing; for minor changes it is advisable to periodically consult this web page.

Legal references

This privacy policy is drawn up on the basis of multiple laws, including Articles 13 and 14 of Regulation (EU) 2016/679 or GDPR, Legislative Decree 196/2003 and its updated Legislative Decree 101/2018, as well as according to the EDPB Guidelines. ENISA and the Italian Data Protection Authority. Unless otherwise specified, this privacy policy applies exclusively to this Website.

Last revision of this policy: 02.01.2022