INFORMATION ON THE PROCESSING OF PERSONAL DATA

PME SRL VIA DELLA PRODUZIONE 6 00030 SAN CESAREO, Taxpayer ID Code and VAT Code 05192231008 (hereinafter, “Controller”), as data controller responsible for the processing of your personal information, wishes to inform you pursuant to Article 13 of the Legislative Decree  30.6.2003 No. 196 (hereinafter, “Privacy Code”) and Article 13 of EU Regulation No. 2016/679 (hereinafter, “GDPR”) that your data shall be processed with the following methods and purposes:

  1. Data subject to Processing

The Controller processes personal and identification information (for example: name, surname, business name, address, phone number, e-mail, bank and payment coordinates – hereinafter, “personal data” or “data”) provided by you in the context of stipulating agreements for the supply and fulfillment of products and services requested to the Data Controller.

  1. Purpose of processing

Your personal data is processed:

  1. A) without your express consent (Article 24 a), b), c) of Privacy Code and Article 6 b), e) GDPR), for the following Purposes of Service:

To finalize the supply and fulfillment of products and services requested to the Controller.

  • To fulfill pre-contractual, contractual and fiscal obligations resulting from existing relations with you;
  • To discharge obligations of law and regulation, including European Community regulations, or orders issued by an Authority (for example, related to anti-money laundering policies);
  • To exercise the Controller’s rights, for example, the right to defend in Court;
  1. B) Only with your explicit and specific prior consent (Articles 23 and 130 Privacy Code and 7 GDPR), for the following Marketing Purposes:
  • To send you – via e-mail, post and/or text message and/or phone contacts – newsletters, business notifications and/or advertising material concerning products and services offered by the Controller, and surveys to determine your degree of satisfaction with service quality;
  • To send you – via e-mail, post and/or text message and/or phone contacts – commercial and promotional communications on behalf of third parties.

We inform you that if you are already our customer, we may send you commercial communications pertaining to available services and products comparable to those previously provided to you, unless you expressly dissent (Article 130 c. 4 Privacy Code).

  1. METHODS OF PROCESSING

The processing of your personal data is carried out by means of the operations described in Article 4 of the Privacy Code, specifically: collection, recording, organization, storage, consulting, development, modification, selection, extraction, comparison, use, interconnection, blocking, communication, erasure and destruction of data.

Your personal data is subject to processing in paper, electronic and/or automated format. The Controller shall process the personal data for the amount of time that is necessary to fulfill the above-mentioned purposes and, in any case, for no longer than 10 years after the termination of the relation for Purposes of Service.

  1. Access to Data

Access to your data may be granted for the purposes specified under Articles 2. A) and 2.B):

  • To the Data Controller’s employees and associates, in their capacity as processors and/or internal persons in charge of data processing and/or system administrators;
  • To third parties or other subjects (merely as an example, banking institutions, professional firms, consultants, etc.) who conduct outsourced activities on behalf of the Data Controller, in their capacity as external persons in charge of processing.
  1. Data Communication

Without express consent required (ex Article 24 letter a), b), d) Privacy Code and Article 6 lett. b) and c) mGDPR), the Data Controller may communicate your data for the purposes specified under Article 2.A) to Supervisory Bodies, Judicial Authorities, as well as to those subjects to whom the communication is mandatory by law for the fulfillment of said purposes.  These subjects shall process said data in their capacity as independent data controllers.

Your data shall not be disseminated.

  1. Data Transfer

The personal data is stored in servers located in Italy, within EU territory.  In any case, it is understood that the Data Controller shall have the right to transfer said servers to non-EU countries, should the need arise. In this event, the Data Controller hereby assures that the transfer of data to non-EU countries shall be executed in accordance with all applicable provisions of law, subject to the stipulation of standard contractual clauses required by the EU Commission.

  1. Voluntary or Obligatory nature of providing data and consequences of refusal to respond

Providing data for the purposes specified under Article 2. A) is mandatory.

In the absence of said data, we are unable to guarantee the Services specified under Article 2. A).  Conversely, providing data for the purposes specified under Article 2.B) is optional. You may therefore choose not to provide any data or to refuse the possibility of processing previously provided data at a later time; in this case, you will no longer be able to receive newsletters, business communications and advertising material pertaining to the Services offered by the Controller. You will however still be entitled to the Services specified under Article 2. A).

  1. Rights of the Data Subject

In your capacity as interested party, you are entitled to the rights specified under Article 7 of the Privacy Code and Article 15 GDPR, more exactly:

  1. To obtain confirmation as to whether or not personal data concerning you exists, even if not yet registered, and to have said data be made available to you in an intelligible form;
  2. To obtain information about: a) the origin of personal data; b) the purposes and methods of the processing;
  • c) the logic involved in case of processing assisted by electronic instruments; d) the identification details of the Controller, Processors and designated representative pursuant to Article 5, paragraph 2 of the Privacy Code and Article 3, paragraph 1, GDPR; e) the recipients or categories of recipient to whom the personal data might be disclosed or who might gain access to the same in their capacity as appointed representatives in
  • the national territory, processors or data handlers;
  • To obtain: a) the update, correction or, if interested, the supplementation of data; b) the erasure, transformation into anonymous form or blocking of data unlawfully processed, including data whose retention is unnecessary for the purposes for which the data were collected or subsequently processed; c) the assurance that the operations referred to in points a) and b) have been brought to the attention, also with regards to their content, of the recipients of the communication and dissemination of said data, except in those cases in which said fulfillment proves impossible or entails an expenditure of means manifestly disproportionate to the safeguarded right;
  1. To object, in whole or in part: a) for legitimate reasons, to the processing of personal data concerning you,
  • albeit relevant to the purpose of the collection; b) to the processing of personal data concerning you for the
  • purpose of sending advertising or direct sales material or engaging in market research or commercial
  • communication, through the use of automated call systems without the intervention of an operator by e-mail
  • an /or through traditional marketing methods by telephone and/or post mail.

It should be noted that the right of objection of the interested party, set forth in the aforementioned point b), for direct marketing purposes via automated methods, extends also to traditional methods and does not, in any case, preclude the possibility of the data subject exercising the right of objection even only partially.  Therefore, the interested party may choose to receive communications only via traditional methods or only via automated methods, or to receive neither of the two types of communication. If applicable, the data subject is also entitled to the rights specified under Articles 16-21 GDPR (Right of rectification, right to be forgotten, right of limitation of processing, right to data portability, right of objection), as well as the right to lodge a complaint with a Supervisory Authority.

  1. Procedure to exercise your rights You may exercise your rights at any moment by sending an e-mail to the following address:

info@pmeparts.it

  1. Data Controller, Data Processor and persons in charge of data processing

PME SRL VIA DELLA PRODUZIONE 6 00030 SAN CESAREO, TAXPAYER ID CODE AND VAT CODE 05192231008.

The updated list of Data Processors and persons in charge of data processing is stored at the Data Controller’s registered office.