- General information
Data subjects (as defined in the GDPR and the Act) are informed of the following general profiles, which apply to all areas of processing:
- all data are processed lawfully, fairly and transparently in relation to the data subject, in compliance with the general principles laid down in the GDPR and the Act
- as little personal data as possible is collected and processed
- when collecting the personal data of a data subject, efforts are made to ensure that they are as accurate and up-to-date as possible
- if the personal data collected are no longer needed for any purpose and the law does not require them to be stored, the data will be erased, destroyed or made anonymous
- certain security measures are taken to prevent data loss, illicit or improper use and unauthorized access
- personal data will not be subject to automated processing or profiling
- Data collected, processing and purposes
The personal data collected in the ways indicated in the following sub-paragraphs will be processed with the support of hard copy and PC with organisational and processing logics strictly related to the purposes and in any case in such a way as to guarantee the security, integrity and confidentiality of the data in compliance with the organisational, physical and logical measures provided for by the provisions in force. Please note that no profiling activities are carried out using automated methods.
In addition to the Data Controller, in some cases personal data may be accessed by categories of persons in charge duly authorised by the data controller (administrative staff, system administrators, etc.) or external parties (see par. 4) appointed, where applicable, as processors (hereinafter referred to as “Processors”) by the Data Controller. You may ask the Data Controller for an updated list of Processors.
Your personal data are processed at the operations offices of the Data Controller and anywhere else the parties involved in processing are located. For more information, contact the Data Controller.
The data subject declares that he or she is providing truthful and accurate data and that he or she will not provide the data of other data subjects unless expressly authorised in writing to do so.
- Data collected and purpose of processing
The personal data collected (first name, surname, VAT number/tax ID, business address, landline telephone and/or work mobile phone, work e-mail address, any other necessary personal data) are used to enable the following:
- the drafting of commercial offers, if requested by the data subject
- invoicing of purchased products/services
- the provision of ancillary services, if requested by the data subject
- administrative, accounting and fiscal management linked to invoicing following the sale of products/services
- any communications linked to the sale of the product and/or provision of the service (by way of example only, planning of services, after-sales assistance and management of complaints by the data subject, satisfaction surveys, statistics linked to management systems, for quality, payment of invoices)
- the fulfilment of other obligations under the contract or under applicable law, possibly with the help of the third parties referred to in point 4 below
- Personal data of internal contact persons of legal persons
In the case of legal persons, the GDPR does not apply; however, in the course of normal business activities between companies, the personal data of employees and collaborators may be exchanged (in general, first name, surname, work e-mail, work mobile phone number and any other necessary personal data). We therefore invite you, in accordance with the GDPR and if the prerequisites are met, to inform your employees and collaborators of the purposes and methods of processing their personal data, i.e.:
- the exchange of communications and documentation for the purpose of drafting/managing commercial offers, purchase orders, order confirmations, transport documents, invoicing and other documentation required for the sale of products and the provision of services
- any communications linked to the sale of products and the provision of services, such as, but not limited to, planning of services, appointment confirmation, delivery management, after-sales service and management of complaints, satisfaction surveys, statistics linked to management systems, quality management, invoicing and related management
- the fulfilment of other obligations arising from the contract or from applicable legislation
- Further processing
The data subject’s personal data may be used by the Data Controller:
- 1. in legal proceedings or in the preparatory stages of such proceedings for the purpose of pursuing a legitimate interest of the data controller (for example, debt collection, management of litigation)
- for disclosure at the request of public authorities for the fulfilment of legal obligations of the Data Controller (by way of example, images recorded by a video surveillance system).
- Disclosure, categories of recipients, transfers
Without prejudice to disclosures carried out in compliance with legal and contractual obligations, all data collected and processed may be disclosed to the following category of recipients exclusively for the purposes specified above:
- Companies, professional firms, consultants and professionals, even in associated form, providing consultancy or collaboration in accounting, tax, legal, commercial and debt collection, management systems (e.g. quality management systems, data protection)
- public administrations for the performance of their institutional functions within the limits set by the Law
- Banking institutions for the management of particular payment methods agreed with the Customer
- Companies involved in the management of computer networks and related elements (e.g. servers, PCs, etc.), software and hardware support, telecommunications and web services (e-mail, instant messaging, etc.) for organisational, production, security and service management purposes
- third-party suppliers of products or services to whom the communication is necessary for the performance of the services covered by the contract (e.g. carriers and couriers)
- Certification/accreditation bodies, where applicable
No further disclosure to other recipients or dissemination is envisaged; personal data will not be transferred outside the European Union. In any case, it is understood that, if necessary, the Data Controller may transfer personal data to non-EU countries or use external services (e.g. e-mail services) that may transfer and/or store data in non-EU countries. In such case, the Data Controller hereby ensures that the transfer of personal data will take place in accordance with the applicable legal provisions, where necessary by entering into agreements guaranteeing an adequate level of protection.
- Storage of personal data
The management and storage of personal data in electronic format will take place on servers/electronic archives, located within the European Union, of the Data Controller and/or duly appointed third party companies.
In any case, it is understood that, if necessary, the Data Controller has the option to move the location of electronic files to non-EU countries or use external services (e.g. e-mail services) that may transfer and/or store data in non-EU countries. In such case, the Data Controller hereby ensures that the transfer of data will take place in accordance with the applicable legal provisions necessary by entering into agreements, if necessary, guaranteeing an adequate level of protection.
The storage of personal data on hard copy will take place in specially prepared files at the Data Controller’s premises.
- Storage period of personal data
Data required for contractual, accounting and service provision purposes are stored for as long as necessary for the performance of the contractual relationship, including the relevant applicable legislative requirements.
The data of those who do not purchase or make use of the services offered, even though they have had previous contact with the Data Controller, shall be stored until the offer reaches its expiry date and erased/destroyed within a maximum of one year from the date of the offer; this period is also considered reasonable for the benefit of the Customer who may wish to request new offers or changes to offers already issued, even if the date of validity of the same has already passed. After this period, the data will be erased/destroyed.
Once the above storage periods have expired, the data subject will no longer be able to exercise the right of access, erasure, rectification and portability of his/her personal data.
- Nature of the provision of personal data and legal basis
The provision of personal data as referred to in par. 3, which are essential and necessary for due execution of the contractual relationship, is not compulsory; however, the data subject’s failure to provide personal data will not allow the contract to be executed.
The legal basis for the processing of the data referred to in par. 3 is constituted by:
- the purposes set out in par. 3.1(a), par. 3.1.1 point a) the fulfilment of obligations in connection with activities carried out prior to the contract and the pursuit of a legitimate interest of the Data Controller
- the purposes set out in par. 3.1 points b), c), d), e), par. 3.1.1 points a), b) and c) by the performance of the contract
- the purposes set out in par. 3.1 points d), f), par. 3.1.1 point c) the performance of the contract and the fulfilment of the Controller’s legal obligations
- the purposes set out in par. 3.2 point a) the pursuit of a legitimate interest of the Data Controller
- the purposes set out in par. 3.2 point b) the fulfilment of legal obligations of the Data Controller
- Rights of the data subject
Pursuant to the GDPR and national legislation, the data subject may, in the manner and within the limits provided for by current legislation, exercise the following rights:
- to request confirmation of the existence of personal data concerning him/her (right of access)
- to know its origin
- to receive intelligible communication
- to know about the existence of automated decision-making process of personal data, including profiling
- to have information on the logic, methods and purposes of processing
- to request the updating, rectification, completion, erasure (“right to be forgotten”), transformation into anonymous form, to object, to ask for restriction of processing, blocking of data processed in breach of the law, including data no longer necessary for the purposes for which they were collected; in the event of rectification or erasure of personal data or restriction of processing, the data controller shall notify any recipients of the processing of such data
- in cases where processing is based on consent and the processing is carried out by automated means, to receive their personal data provided to the Data Controller, in a structured and machine-readable form and in a format commonly used by an electronic device (right to data portability)
- in cases of processing based on consent, withdraw consent at any time without prejudice to the lawfulness of the processing based on the consent given before withdrawal
- receive information about possible breaches of personal data, if the breach is likely to present a high risk for the rights and freedoms of the data subject and if the conditions for such a breach are met (Art. 34 GDPR)
- submit a complaint to the Supervisory Authorities.
You may exercise your rights by sending a request to the addresses indicated below in paragraph 9.
- Data Controller, Data Controller’s Representative, Data Protection Officer and contact details
The Data Controller is Magis S.p.A., in the person of the Managing Director, who can be contacted at the following addresses:
- Viale della Repubblica, 10 – 27100 Pavia
to which data subjects may apply to exercise all their rights under the GDPR and the Act (see par. 8), as well as to withdraw consent previously given; in the event of failure to respond to their requests, data subjects may lodge a complaint with the Data Protection Supervisory Authorities.
A Data Protection Officer (DPO) has not been appointed as it is unnecessary under Article 37 of the GDPR.
Since the controller is established in the European Union, there is no obligation to designate a representative of the controller (Art. 27 GDPR).