Information on the processing of personal data

Introduction

This information on the processing of personal data (hereinafter, "Information") is provided pursuant to art. 13 of EU Regulation 679/2016 (General Data Protection Regulation – hereinafter, "GDPR").

The Information describes in detail how and for what purposes your personal data will be processed during your navigation on the www.engitel.com website (hereinafter, "Site") and the use of the various functions and services made available within it.

For the purposes of this Policy, the term "you" (and the adjectives "Your", "Your", "Your", "Your") will identify the user / user of the Site and its functions / services, as the interested party to whom the personal data processed refer.

A) Data controller

The data controller of your personal data is Engitel S.p.A. (hereinafter, "Data Controller").

It is possible to contact the Data Controller, for questions, requests or clarifications relating to this Information or in general to the processing of your personal data, at the following addresses:

• e-mail address (indicating in the subject "Privacy"): privacy@engitel.com
• physical address: Milan, via Zarotto 6
• Phone Number: 02 / 6693337

B) Categories of personal data processed

The Data Controller processes the following categories of personal data during your navigation on the Site and the use of the related functions / services:

1. information and data relating to your navigation on the Site and the devices you use to browse the Site and use its functions and services (by way of example but not limited to, information about the pages and sections of the Site visited, your activities on the Site, the time spent on the individual pages and sections of the Site, IP address, browser used, type of device used, data relating to your geographical position - only on condition that you have previously given consent to such processing, information from cookies or similar tools issued by the pages of the Site);
2. if you wish to receive a demo of our products by filling in the appropriate form in the "Products" section of the Site (or by transmitting communications to the contacts of the Data Controller), the personal data and information requested therein to send the contact request and to manage your communication (by way of example and not exhaustive, name, surname, e-mail address for any feedback, in addition to the content of the information or requests transmitted by you);
3. if you wish to respond to job advertisements on the Site by sending emails to the address indicated, personal data and information requested therein to manage your communication (by way of example and not limited to, name, surname, e-mail address for any feedback, in addition to the content of the information or requests transmitted by you);
4. if you wish to interact in any way or reason with our Company by sending emails to the address indicated, personal data and information requested therein to manage your communication (by way of example and not limited to, name, surname, e-mail address for any feedback, in addition to the content of the information or requests transmitted by you);
5. in case of recourse, on your part, to the possibilities of interaction between the contents of the Site and your profiles on social networks (eg "like" buttons, "tweets"), data and information relating to these profiles will also be processed.
   
   Furthermore and more generally, the Data Controller may process the following categories of personal data collected outside the Site:
    
6. information and personal data taken from business cards (both paper and digital), collected from the interested party or through third parties;
7. information and personal data acquired at events, meetings and conferences, based on specific information made available to the interested party at the place of collection;
8. curriculum vitae also acquired in paper form, for the same purposes referred to in letter c) above.

The personal data referred to in category a) are automatically collected by the Data Controller during your navigation on the Site. This information is not collected to be associated with identified interested parties, but by their very nature could, through processing and association with data held by third parties, allow users to be identified. These data are in any case used for the sole purpose of obtaining anonymous statistical information on the use of the site and to check its correct functioning.

Personal data belonging to all other categories are provided directly and voluntarily by you.

C) Consequences of failure to provide personal data

The processing of personal data referred to in category a) of the previous section is necessary for the Data Controller in order to guarantee you the best possible browsing experience, and to provide you with all the functions and services provided through the Site. However, it is possible to limit the processing of such personal data by resorting to some features made available by the Site (with reference, in particular, to the transmission of cookies or similar tools – on this point, please refer to the Site's cookie policy) or from your device or browser / navigation application. In this case, navigation on the Site may be limited, and some of its functions / services may be inaccessible.
The processing of personal data referred to in the categories other than a) contained in the previous section, is necessary in fulfillment of contractual obligations (that is, to allow you to access and use specific functions / services of the Site, such as but not limited to the receipt of Demos) and legal (with reference to the execution of regulatory obligations for the Data Controller); You are therefore obliged to provide such personal data to use the services and functions of the Site, requested from time to time.
In case of failure to provide the above data, it will not be possible for the Data Controller to provide the functions and services of the Site requested by you.

D) Purposes of the processing and related legal bases

Your personal data will be processed for the following purposes, and according to the following legal bases.

 With specific reference to the processing purposes referred to in nn. 5., 6., 7., the following is specified:

If you would like more and more specific information about the assessment carried out by the Data Controller regarding the balance between the legitimate interests pursued and the interests or fundamental rights and freedoms of the interested parties, you can contact the Data Controller, at the addresses referred to in section A).

E) Categories of recipients of personal data processed

In order to fulfill the aforementioned purposes, your personal data will also be processed by third parties other than the Data Controller.
These subjects will process your personal data both on behalf of the Data Controller (therefore, as managers), and as independent data controllers, upon specific communication from the Data Controller.

Specifically, the following categories of recipients will process your personal data:

1. service providers necessary for the proper functioning of the Site and its functions / services (by way of example and not limited to, ICT service providers, hosting service providers, platform providers and IT applications);
2. jurisdictional, administrative and/or public security authorities, in accordance with the provisions of the law, for the purpose of ascertaining and prosecuting offences, preventing and safeguarding risks or threats to security and public order, as well as for any reason related to the protection of the rights and freedoms of individuals.

In the event that you want to know in detail the identification details of all the recipients listed above by categories, you can contact the Data Controller, at the addresses referred to in section A).

F) Transfer of personal data outside the European Economic Area

Personal data will be transferred, outside the European Economic Area, only to countries that ensure an adequate level of protection of the personal data of the interested parties, on the basis of an adequacy decision adopted by the European Commission (eg United States).
In case of transfer to countries outside the European Economic Area that do not ensure an adequate level of protection of the personal data of the interested parties, the transfer will only take place:
(i) subject to the adoption of appropriate or appropriate guarantees (such as, but not limited to, the stipulation of data transfer agreements that implement the standard contractual clauses approved by the European Commission);
(ii) if it is necessary for the conclusion of a contract or the fulfillment of contractual obligations between you and the Data Controller.
In any case, in such cases, the Data Controller will take care to provide you, upon your simple request, with detailed information about the methods of transferring data to third countries, any appropriate or appropriate guarantees adopted and the means to obtain a copy of such data or the place where they were made available.

G) Retention period of personal data processed

Your personal data will be kept for a variable period depending on the type and purpose of the processing. At the end of the retention period, personal data will be deleted or made irreversibly anonymous. The retention periods of personal data are indicated below:

1. the data relating to your navigation on the Site and / or the devices you use, except in cases used to ascertain responsibility in case of hypothetical crimes against the Site or third parties, will be kept for no more than 7 (seven) days;
2. data relating to commercial transactions carried out on the Site (including payment data): they will be kept until the finalization of any administrative, fiscal, civil fulfillment (by way of example and not exhaustive, the deadline to exercise the right of withdrawal or dispute payment). Billing data will be kept for 10 (ten) years;
3. data relating to your registration in the Reserved Area: they will be kept until you request the cancellation of the account (or exercise any other right recognized by current legislation);
4. data and information relating to contacts between you and the Data Controller: they will be kept until the fulfillment and satisfaction of your requests;
5. data relating to the transmission of commercial communications relating to news, initiatives and offers of the Data Controller about the products / services already purchased: they will be kept until the exercise of the right of opposition of the interested party or cancellation of the data processed (also by selecting the appropriate function in the context of the communications sent – so-called unsubscribe link);
6. data relating to the transmission of commercial communications (also by third party business partners), market research and statistical surveys, carried out with the consent given by the interested party: they will be kept until the exercise of the right of opposition of the interested party or cancellation of the data processed (also by selecting the appropriate function in the context of communications sent – so-called unsubscribe link), and in any case after 2 (two) years from your last interaction with the Site.

If, at the end of the aforementioned period, personal data should be processed for specific purposes (e.g. to protect the rights of the Data Controller in the context of litigation), they will be kept until these purposes are exhausted (e.g. until the dispute is settled).

At the end of the retention periods indicated above, your personal data will be deleted, or otherwise made unintelligible by the Data Controller.

H) Processing of personal data by automated decision-making

There is no processing of your personal data through automated decision-making processes (including profiling pursuant to Article 22, paragraphs 1 and 4, of the GDPR).

I) Your rights regarding the processing of personal data

You have the right to request from the Data Controller access to personal data concerning you, pursuant to art. 15 GDPR.
By exercising the right of access, you may request information about:

• the purpose of the processing;
• the categories of personal data concerned;
• the recipients or categories of recipients to whom the personal data have been or will be communicated, in particular if recipients of third countries or international organizations;
• where possible, the envisaged retention period of personal data or, where not possible, the criteria used to determine this period;
• the existence of the right to ask the Data Controller to rectify or delete personal data or limit the processing of personal data concerning you or to oppose their processing;
• the right to lodge a complaint with a supervisory authority,
• if the personal data are not collected from you, all available information on their origin;
• the existence of an automated decision-making process, including profiling pursuant to art. 22, paragraphs 1 and 4, of the GDPR and, at least in such cases, significant information on the logic used, as well as the importance and expected consequences of such processing for you.

You are also granted the following rights:

1. the right to revoke the consent given, pursuant to art. 7 (3) GDPR, without prejudice to the lawfulness of the processing carried out before the revocation, and the lawfulness of the processing based on a different legal basis;
2. the right to obtain from the Data Controller the correction of inaccurate personal data, or the integration of incomplete personal data, pursuant to art. 16 GDPR;
3. the right to obtain from the Data Controller the cancellation of personal data, pursuant to art. 17 GDPR. The exercise of this right may not be guaranteed by the Data Controller (or the Data Controller may find requests only partially) to the extent that the processing of personal data subject to the cancellation request is provided for in compliance with legal obligations or for the assessment, exercise or defense of a right in court;
4. the right to obtain from the Data Controller the limitation of processing, pursuant to art. 18 GDPR;
5. within the limits established by law, the right to obtain from the Data Controller the portability of personal data processed following consent or on a contractual basis pursuant to art. 6, paragraph 1, letters a) and b) of the GDPR; in case of exercise of this right, it will be the responsibility of the Data Controller to provide you with all data concerning you, acquired with your consent or in execution of a contractual obligation, in a structured and interoperable format; where technically possible, such personal data may be transferred, in the same way, also to third parties selected by you and indicated with a specific request;
6. the right to object to the processing of your personal data pursuant to art. 21 GDPR, unless the Data Controller demonstrates, upon receipt of a request in this regard, the existence of binding legitimate reasons to proceed with the processing that prevail over your interests, rights and freedoms, or for the assessment, exercise or defense of a right in court.

The above requests must be addressed to the contact details referred to in section A).
The Data Controller will respond to requests without undue delay.
With specific reference to the right to withdraw consent, this may also be exercised by selecting the appropriate functions made available at the bottom of any communication of a commercial nature (or relating to participation in market research or statistical surveys).

In the event of failure to respond or negative, not punctual or unsatisfactory feedback to your requests, or if you believe in any case that the Data Controller processes your data in an illegitimate or non-transparent manner, you may contact a supervisory authority.
If you are an Italian citizen, habitually reside or work in Italy, or believe that the alleged violation of the Data Controller with reference to the processing of your personal data has been carried out in Italy, you can contact the Guarantor for the protection of personal data – www.garanteprivacy.it – to obtain adequate protection of your rights.
If you are a citizen of another EU member state, habitually reside or work in another EU member state, or believe that the alleged violation of the Data Controller with reference to the processing of your personal data has been carried out in another EU member state, you can consult the following web page http://ec.europa.eu/justice/article-29/structure/data-protection-authorities/index_en.htm for more information about the authority competent control.

J) Changes and updates to the Policy

If this Policy is modified or supplemented, the Data Controller will make every reasonable effort to inform the interested parties of such changes (e.g. through specific communications for users registered in the Reserved Area, or with specific communications – in the form of banners or similar tools – on the homepage of the Site).
We invite you, in any case, to periodically check the section of the Site in which this Information is hosted, and to consult the most recent information text (whose entry into force is indicated in the epigraph).