DATA CONTROLLER

ILLVA SARONNO S.p.A.

Via Archimede, 243

21047 Saronno (VA)

VAT no. 02649100126 

(“Company” or “Data Controller”)

PERSONAL

DATA PROCESSED

In addition to the provisions set forth in other pages (with particular reference to the “Cookie”), by the Website and the use of the respective features and/or subscription to services offered therein, the following data can be collected and processed:

• browsing information: they are data that the server collects automatically at every access to the Website, such as IP addresses or domain names of computers used by the users to connect to the Website, URI addresses (Uniform Resource Identifiers) of requested resources, the time of the request, the method used to submit the request to the server, the dimension of the files obtained as an answer, the code number which indicates the answer status supplied by the server (i.e. good result, mistake, etc.) and other parameters related to the operating system and to the users’ IT environment;

• personal data voluntarily provided by the users: such as name, surname, email address, additional contact data and further data and information provided in messages sent to the contact details of the Company or by filling in the electronic forms therein published.

The Website does not contain any information or feature or service directly offered to users of minor age. 

Minors shall not provide information or personal data without the consent of those having parental responsibility. 

Users of minor age are invited not to provide any personal data without prior authorization of their parents or by those exercising parental responsibility. In case the Company will be notified that personal data have been provided by a minor, the Company will immediately delete said data or request appropriate consent by the parents (or by the holder of parental responsibility), reserving the right to prevent any access to the services offered on the Website to any user who hided the minor age or who communicated personal data without consent of the parents (or of the holder of parental responsibility).

LEGAL BASIS AND PURPOSE OF PROCESSING

The processing of personal data is exclusively carried out for the following purposes:

(i)             fulfilment of contractual or pre-contractual obligations (art. 6 lett. B) GDPR) – for the execution of services or for providing information requested through the Website and/or through electronic forms herein posted and for fulfilling all obligations arising out of pre-contractual or contractual relationships with the user and for managing interactions with the users. It is included the newsletter service “ILLVA NEWS” and, consequently, the processing of personal data of the user who spontaneously subscribes to this service, for managing the service and sending the related communications;

(ii)          fulfilment of legal obligations (art. 6 lett. c) GDPR)- for the fulfilment of obligations set forth by national and/or European laws or regulations in force, included the Tax area, as well as the fulfilment of orders of the competent entities or authorities;

(iii)           on the basis of a legitimate interest of the Company (art. 6 lett. d) GDPR) for the legal defence of a right or interest before any competent authority or entity (even with respect to cybercrime).

CONSEQUENCES OF THE REFUSAL TO PROVIDE DATA

The provision of data for the purposes set out in paragraphs (i) (fulfilment of contractual obligations) above is purely optional. However, since the processing of data for such purposes is necessary in order to allow subscribing to the newsletter and for using the online services offered through the Website, the missing, partial or incorrect provision of data will prevent the user, as the case maybe, from registering to the newsletter or from using the services provided online and, in general, will prevent the handling of users’ specific requests.

DATA COMMUNICATION

Data can be communicated to the following categories of subjects (“recipients”):

• to all those parties (including Public Authorities) having access to the personal data according to law or administrative provisions;
• to all those public and/or private parties, individuals and/or legal entities to which data must be communicated in compliance with the contract or applicable law.

In addition to the above, in order to pursue the mentioned purposes, personal data may be disclosed to Company’s staff that has been expressly authorized (in particular belonging to the IT and administration offices) and/or to third parties operating on behalf of the Company, such as, by way of example and not limited to:

• companies, consultants or professionals in charge of the set-up, maintenance, updating and, in general, the management of the Website;
• companies or professionals in charge of the development and realization and/or of the transmission of informative documents and communications;
• legal and tax professionals and consultants, statutory auditors and auditing companies or professionals, members of the supervisory body,

that will process the personal data in their quality as data processors on behalf of the Company or as independent data controller, as the case maybe and on the basis of the specific relationships with the Company.

In case of transfer of personal data in countries outside the European Union, conditions and requirements set out in the GDPR will be duly complied with. The data will be transferred, therefore, on the basis of requirements provided by GDPR, such as – for example – the adoption of Standard Contractual Clauses approved by the European Commission or by using third parties having operating in countries for which the European Commission issued an adequacy decision. 

DATA RETENTION

Personal data will be retained for the entire duration of the contractual relationship and, subsequently, for the period of time allowed by applicable law on statutory or time limitation periods (also with respect to administrative and tax purposes) and, in general, for the time necessary for the exercise of Company’s rights in relation to claims raised by public authorities, public and private entities and subjects.

RIGHTS OF DATA SUBJECTS

Right to access

Right to rectification

Right to erasure

Right to restriction of processing

Right to object

Right to data portability

As a data subject, the user may ask to the Data Controller to exercise the following rights:

The user has the right to present a claim before the Supervisory Authority (http://www.garanteprivacy.it/) in the cases referred to by Article 77, GDPR, and then when the user believes that the data are processed infringing the law.

The above rights can be exercised by sending without any formality a request to the Data Controller. The request can be sent to the Data Controller via mail or e-mail to the following address privacy@disaronno.it.