PRIVACY POLICY PURSUANT TO ART. 13 EU REGULATION 679/2016 (“GDPR”)

Protecting the security and privacy of your personal data is important to PROMOX S.p.A., with registered office at Via Carrobbio 11, 21100 Varese, Italy, in the person of its legal representative pro tempore (hereinafter, the “Data Controller”), which acts in accordance with the laws currently in force on the protection and security of personal data. We trust that the information below will help you understand what kind of data the Data Controller usually collects, how it uses and safeguards it, and with whom it is shared.

Therefore, pursuant to art. 13 GDPR, we inform you that the processing of your personal data will be based on the principles of fairness, lawfulness and transparency, and protecting your privacy and your rights and in compliance with the current legislation on security and protection of personal data.

In particular, we inform you of the following:

a. Source of personal data

The personal data we process are those provided by you when submitting a request for information about our products and/or services by completing the contact form available on the website https://promox.eu/ (hereinafter, the “Site”), including your first name, last name and e-mail address.
All personal data will be processed in compliance with the Italian Privacy Code, the GDPR and the confidentiality obligations that have always inspired the activities of the Data Controller.

b. Legal Basis and Purpose of the Processing

b.1) Management of your requests
By processing the data you provide, we will be able to respond to your requests for information regarding the characteristics and nature of the products/services in relation to which you have expressed your interest, or to similar products/services, in the event that those of interest to you are not available, temporarily or permanently, as well as to any initiatives carried out by the Data Controller. The legal basis for such processing is the execution of pre-contractual measures adopted at your request.

b.2) Establishment, exercise or defence of legal claims
Your personal data may be processed for the purpose of establishing, exercising or defending legal claims, including by third parties. The legal basis for this processing is the legitimate interest of the Data Controller.

b.3) Compliance with legal obligations and management of contractual relationships
Your personal data may also be processed in order to comply with specific obligations arising from the existing relationship and to manage all activities deriving from any agreement between the parties.
The legal basis for this processing is compliance with legal obligations.

c. Processing methods

The processing of data will be carried out using manual or electronic methods, suitable to guarantee, in relation to the purposes for which they were communicated and collected, their security, as well as to avoid unauthorized access by third parties and, in any case, in compliance with the provisions of national and European legislation.

d. Nature of the provision

The provision of data in relation to the purposes referred to in points b.1), b.2) and b.3) is mandatory, as a necessary requirement to be able to respond to your requests; in case of failure to provide it, the consequences of your refusal will be that you will not be able to receive information relating to our products/services, for which you have expressed interest.
We invite you not to provide, during the use of the interactive services, sensitive/particular data, i.e. data from which it may be inferred, among other things, racial or ethnic origin, religious beliefs, political opinions, membership of parties, trade unions, associations and organizations of a religious, philosophical, political or trade union nature, as well as the state of health. Any sensitive data provided will be deleted immediately.

e. Subjects of data processing

Your personal data may be processed by the employees and/or collaborators of the Data Controller, in charge of carrying out activities necessary in order to achieve the purpose of processing indicated above.
They may also be processed by IT and logistics service providers, functional to the operation of the Site, outsourced service providers, professionals and consultants.
These subjects, formally appointed by the Data Controller as authorised persons, Data Processors and/or System Administrators, will process your data in compliance with and exclusively for the purpose indicated in this policy and under the control and supervision of the same Data Controller. Your personal data may also be disclosed to third-party suppliers who process them either as Data Processors appointed by the Data Controller or, where applicable, as independent Data Controllers. The complete and updated list of the entities to whom your personal data have been disclosed may be requested from the Data Controller by writing to the e-mail address indicated in section h.

f. Dissemination of data

The Data Controller will not disseminate your personal data.

g. Transfer of data abroad

Your personal data may be transferred to countries outside the European Economic Area (EEA).

In such cases, the transfer will take place either to countries recognised by the European Commission as providing an adequate level of protection or by adopting appropriate safeguards for the protection of personal data, in accordance with Articles 44, 45 and 46 of the GDPR.

For further information regarding the countries to which your personal data may be transferred, the safeguards adopted and to obtain a copy of such safeguards, as well as a list of the Data Processors that may process your personal data abroad on behalf of the Data Controller, you may contact the Data Controller at any time using the contact details provided in section h.

h. Rights of the data subject

Finally, we inform you of the possibility of exercising at any time the rights recognized by law, which we report below: ∙ access the data you provide;
∙ obtain the rectification of the data provided, their cancellation, their transformation into anonymous form, the blocking of data processed in violation of the law or the limitation of data processing;
∙ object to the processing of data;
∙ withdraw your consent, if given;
∙ obtain the portability of your data;
∙ obtain confirmation of the existence or otherwise of the same data, know its content and origin, verify its accuracy or request its integration or updating, know the purposes and methods of processing, the logic applied in the case of processing carried out with the aid of electronic tools, the identification details of the data controller, the data processors, authorised persons and the DPO (where appointed);
∙ lodge a complaint with the supervisory authority (Italian Data Protection Authority: Garante per la protezione dei dati personali);
∙ object to automated decision-making relating to natural persons, including profiling, where consent has been provided; ∙ obtain, without undue delay, the notification of a breach of your personal data.
Requests should be addressed to privacy@promox.eu

i. Data Retention Period

The data you provide for the purposes referred to in points b.1), b.2) and b.3), will be retained for the time necessary to process your request for information and, subsequently, for the time necessary for the execution of the contract, if it is concluded, following your request for information. Subsequently, the data you provide may be retained for a period of ten years in order to comply with legal obligations and, in particular, with the obligations referred to in Articles 2214 and 2220 of the Italian Civil Code. Any further retention of your personal data may take place for the purpose of establishing, exercising or defending our rights, including before judicial authorities, until the applicable limitation period has expired. Upon termination of the relationship, your personal data may also be retained where required by European Union or national laws and regulations, for the period prescribed therein. Furthermore, if, for any reason, the retention of your personal data is no longer justified on the basis of assessments carried out by the Data Controller, taking into account the principles of necessity, proportionality, adequacy and relevance of the processing, such data will be deleted or anonymised without undue delay.

l. Data Controller

The Data Controller is PROMOX S.p.A., with registered office at Via Carrobbio 11, 21100 Varese (Italy), Tel. +39 0332 648380, Fax +39 0332 648105, website: www.promox.eu, e-mail: info@promox.eu, privacy e-mail: privacy@promox.eu.