Welcome to the www.elmagroup.eu web site of Elma Group Services S.p.A. (hereinafter the “Site”).
Navigation is free and does not require registration. Any provision of personal data is foreseen only in the “Office and Contacts” section, in which a specific personal data processing statement is included.
Within the Site there could be hypertext links to web sites, pages, or online services of third parties. By clicking on those links, the user may access multimedia content that, being under the exclusive competence of the cited subjects, is outside of the control of Elma Group Services S.p.A. and is not subject in any manner to what is indicated in this policy. Elma Group Services S.p.A. therefore invites the user to be careful in accepting the services offered by third parties, and to carefully read the data processing statements that are provided by said subjects, in relation to which Elma Group Services S.p.A. cannot perform any controls, nor be considered liable.
- Data Controller
The Data Controller is Elma Group Services S.p.A. (Tax code and VAT number 02828870127), with registered office in Busto Arsizio (VA), Viale delle Rimembranze n. 1, telephone 0331/639147, fax 0331/637340, e-mail address: firstname.lastname@example.org, certified e-mail address: email@example.com (hereinafter the “Company”).
- Type of personal data processed
Personal data is understood as any information that concerns the user and refers to the same.
Specifically, the processing will regard:
- Personal data concerning navigation
In the case of navigation on the Site, Elma Group Services S.p.A. collects navigation data through cookies and other tracking technologies to verify the proper functioning of the Site and allow the user to make use of the services foreseen there, to obtain – in anonymous and aggregate form – information concerning visits and develop statistical analysis, and to identify anomalies and/or instances of abuse.
For more information on the technologies used for the collection of that data, Elma Group Services S.p.A. invites the user to carefully read the contents of point 4) below relating to Cookies.
- Data provided voluntarily by the user
The Company also processes personal data provided voluntarily by the user during interaction with the services provided by the Site, and specifically, in the case of requests for information. In the section “Office and Contacts” a specific statement is published on data processing pursuant to Art. 13 of the Regulation, in which it is specified that the data processed are: first name, last name, electronic mail address, telephone number and any other data provided to fill out the form in order to respond to and fulfill the user’s request.
Hereinafter, these shall collectively be referred to as the “Data”.
The optional and voluntary transmission of electronic mail messages to the addressed indicated on this Site entails the acquisition of the sender’s electronic mail address, and any other personal data voluntarily indicated in the message. Those data are used only in order to respond to the sender and are not disclosed in any way.
- Purpose of processing, legal basis and nature of provision of the Data
In the context of the consultation of the Site and use of the services provided therein, the Data are processed for the following purposes:
- to allow navigation on the Site, obtain anonymous statistical information on its use, and check the proper functioning and determine liability in the case of IT crimes (hereinafter “Navigation on the Web Site”). The legal basis is the legitimate interest of the Company (Art. 6.1 f) Regulation);
- to respond to and fulfill the user’s requests (hereinafter “Contacts”). The legal basis is the express consent given by the user (Art. 6.1 a) Regulation);
- to exercise and defend the Company’s rights in all venues, including judicial, administrative, arbitration and/or mediation and conciliation procedures (hereinafter “Defense”). The legal basis is the legitimate interest of the Company (Art. 6.1 f) Regulation).
With the exception of the navigation data (collected automatically), the provision of the Data is necessary for the pursuit of the purposes indicated in letter b) above. Therefore, failure to provide the Data marked as (required) shall entail the impossibility for the Company to respond to and fulfill the request, while failure to provide the Data not marked with (required) shall not affect the response to and fulfillment of the request. In any case, the provision or lack of provision of the data shall not affect the use of the Site and the Company’s right to defense.
- Method of processing
In the context of the purposes indicated in point 3) above, the Data processing will take place principally by electronic and automated means, and in paper form, in respect for the regulatory provisions on the subject of personal data processing, adopting adequate security measures. The Data processing is managed by the Company’s internal personnel (personnel in the administration office, sales office and personnel office, as well as management) specifically authorized for that purpose, trained and instructed to guarantee adequate security and privacy, and to avoid risks of loss and/or destruction and access by unauthorized persons.
- Communication and disclosure of the Data
The Data shall not be disclosed. Within the limits strictly pertinent to the purposes indicated in point 3) above, the Data can be communicated to:
- subjects with legitimate interests under law or regulations, such as, but not limited to, public and judicial authorities;
- subjects that, as autonomous data controllers or processors pursuant to Art. 28 of the Regulation, are involved in the processing of the Data (such as, but not limited to, the company in charge of management and maintenance of the IT systems and the Site).
The updated list of names of the data processors can be requested from the Company, sending a communication by electronic mail to the address: firstname.lastname@example.org.
- Data retention period
The Company retains the Data for the period of time strictly necessary to reach the purposes for which said data have been collected. Without prejudice to what is expressly foreseen in point 4) above, the Data for the purpose of “Contacts” shall be retained for the period of 12 months from the date of their collection; without prejudice, however, to the right to revoke consent for those processing operations that have that legal basis, the right to object to the processing, and the fulfillment of specific retention obligations established by law and the exercise of the right to defense in the event of litigation.
- Data subject’s rights
With reference to the Data, the data subject has the right to request from the Company, with the methods indicated in the Regulation and without prejudice to the provisions and limitations set forth in Legislative Decree no. 196/2003 (Part I – Title I – Section III):
- access, in the cases foreseen (Art. 15 Regulation);
- the rectification of inaccurate Data and the completion of incomplete Data (Art. 16 Regulation);
- the erasure of Data for the reasons foreseen (Art. 17 Regulation), such as when they are no longer necessary in relation to the purposes indicated above or are not processed in respect for the Regulation;
- the restriction of processing for the situations foreseen (Art. 18 Regulation), such when the accuracy of the Data is contested, and it is necessary to verify the data are correct;
- portability, meaning the right to receive the Data, in the cases foreseen (Art. 20 Regulation), in a structured, commonly used and machine-readable format, and to transmit said Data to another controller;
- object to the processing, in the cases foreseen (Art. 21 Regulation).
In the case of processing based on consent, the data subject also has the right to revoke that consent at any time without affecting the lawfulness of the processing performed before revocation.
All of the rights listed above can be exercised by the user by sending the Company a communication by electronic mail to the address email@example.com or a registered letter to be sent to the Company’s address, to the attention of the Privacy Officer.
In the event that the user believes that the Data processing violates the provisions contained in the Regulation, the user shall have the right to submit a complaint to the Personal Data Protection Authority, as provided for by Art. 77 of the Regulation.
- Transfer of Data abroad
The Data are retained on servers located in the European Union. In the case of transfer of data abroad, the Company undertakes to ensure that the transfer of the Data to those countries takes place in accordance with the provisions of the Regulation, and specifically, in the presence of adequate guarantees (decisions on adequacy, standard contractual clauses approved by the European Commission, etc.).
Elma Group Services S.p.A.