INFORMATION NOTICE TO CUSTOMERS

This information notice is provided to legal entity Customers and to natural persons acting in the name and on behalf of legal entity Customers of this company, pursuant to and for the purposes of Articles 13 and 14 of EU Regulation 2016/679 “European General Data Protection Regulation” and D.lgs n. 101 of August 10, 2018, as amended and supplemented, to inform them of the essential elements of the processing operations carried out.

DATA CONTROLLER

The Data Controller is the company MOLINO PIANTONI S.A.S. DI MICHELANGELO PIANTONI & C., with registered office in Chiari (BS), via Cologne 19, in the person of its pro tempore Legal Representative.
Email: info@molinopiantoni.it
PEC (Certified Email): molinopiantonisas@legalmail.it
Telephone: +39 030 711001

DATA PROCESSORS AND PERSONS AUTHORIZED TO PROCESS DATA

The updated list of data processors and persons authorized to process data is kept at the registered office of the Data Controller.

TYPES OF DATA COLLECTED

In accordance with Article 14 of the GDPR Regulation, as data may not have been obtained directly from the data subject, the categories of personal data subject to processing are reported below. The data collected consist of personal identification and tax data of natural persons and legal entities (and of natural persons acting in the name and on behalf of legal entity Customers) required for the performance and management of contractual relationships. Data such as images, photos, and any data deriving from the DURC (Single Insurance Contribution Payment Certificate) and the Chamber of Commerce may also be collected.

SOURCE OF PERSONAL DATA

The collection of personal data is carried out by the Data Controller by recording data collected directly from the data subject at the time of initial contact or subsequent communications (e.g., visits and/or phone calls, requests for information and/or quotes, including by email); provided by third parties or through other forms of data collection in compliance with current privacy legislation.

DATA PROCESSING METHODS

Please be informed that data will be processed using both paper and electronic means, in compliance with the confidentiality and security rules provided by European and National legislation. The data are currently processed and stored at the writer’s premises. They are also processed on behalf of the writer by professionals and/or companies appointed to perform technical, managerial, development, administrative, accounting, tax, and legal activities, etc. For all the purposes indicated in this information notice, the common personal data of the Data Subject will not be transferred or communicated to others outside the recipients indicated herein. The writer also reserves the right to use cloud services, ensuring that service providers will be selected from among those who provide adequate guarantees, as provided for by Art. 46 of EU Regulation 2016/679 “European General Data Protection Regulation”. The Controller does not perform processing operations consisting of automated decision-making processes on the data of natural persons acting in the name and on behalf of suppliers.

PURPOSES OF DATA PROCESSING

The collection and processing of personal data are carried out for the following purposes:

1. To fulfill all operations required by regulatory obligations;
2. To conduct operations strictly connected and instrumental to the initiation of contractual relationships, including the acquisition of preliminary information prior to the conclusion of the contract;
3. To exchange information aimed at the execution of the contractual relationship, including post-contractual activities and the management of any potential litigation;
4. To manage and control risks, and prevent possible fraud, insolvency, or defaults;
5. To formulate requests or fulfill requests received;
6. To manage administrative, accounting, civil law, and tax compliances;
7. To protect the property and safety of individuals through internal control services (security, productivity, quality of services, asset integrity, video surveillance);
8. To send communications of various kinds through different means of communication, make requests, and carry out other direct marketing activities;
9. To send promotional communications relating to services similar to those covered by the pre-existing relationship, regarding which the data subject has already expressed interest and has already provided personal contact details (soft spam);
10. To use and publish images and photos for company promotional activities.

Personal data will be processed in accordance with the principles of fairness, lawfulness, transparency, protection of confidentiality, and the rights of the Data Subject, as established by Art. 5 of EU Regulation 2016/679. Finally, both the personal data of natural person Customers and the personal data of natural persons acting in the name and on behalf of legal entity Customers will be included in the Controller’s archives and used to send communications concerning products, services, news, and promotions (pursuant to Art. 130, paragraph 4 of Legislative Decree 196/2003 as amended and supplemented, and the General Provision of the Italian Data Protection Authority Official Gazette July 1, 2008, n. 188c, formulation 6, points a, b, c) and will be processed in accordance with the principles of fairness, lawfulness, transparency, protection of confidentiality, and the rights of the Data Subject, as established by Art. 5 of EU Regulation 2016/679. The Controller will not use the personal data of the data subject for purposes other than and additional to those described in this privacy policy without previously informing them and, where necessary, obtaining their consent.

MANDATORY OR OPTIONAL NATURE OF DATA PROVISION

The legal bases on which the processing of common data is grounded, according to Art. 6 of the GDPR Regulation, are: legitimate interest, law, contract, and consent. The scope and adequacy of the Data provided will be assessed on a case-by-case basis in order to determine subsequent decisions and avoid the processing of data that are excessive in relation to the purposes pursued. The provision of data is mandatory for everything required by legal and contractual obligations; therefore, any refusal to provide them, in whole or in part, may result in the impossibility of providing the requested services. Consent for the data referred to in point 7 is not required as they are collected to preserve and protect company assets and to guarantee safety in the workplace. Conversely, the data referred to in point 8 and point 1 (Note: presumably a typo in the original text, likely meaning point 10) do not derive from an obligation, and providing the relevant data is optional. The company processes the optional data of users based on consent, i.e., through the explicit approval of this privacy policy and in relation to the methods and purposes described below. The data subject may refuse to provide personal data to the Controller or revoke consent. Failure to provide data, or partial provision, will result in the partial or total impossibility of pursuing the aforementioned purposes due to reasons not attributable to the writer. The data in point 9 do not need to be processed subject to prior consent, as they are processed for the legitimate interest of the controller. The data subject may object to the processing of their data for this purpose at any time.

CATEGORIES OF RECIPIENTS

Personal data processed by the Data Controller will not be disseminated—meaning they will not be disclosed to unspecified subjects in any possible form, including making them available or open to simple consultation. Instead, they may be communicated to the Controller’s employees and to certain external entities collaborating with them. Personal data may be communicated to other group companies. Finally, they may be communicated to subjects authorized to access them by virtue of provisions of law, regulations, or EU legislation. Furthermore, in the management of your data, authorized persons and/or internal and external processors, identified in writing and provided with specific written instructions regarding data processing, may become aware of the data. The data may be transferred to duly appointed recipients based abroad only if the third country guarantees an adequate level of safeguard and protection, or subject to the signing of Standard Contractual Clauses.

DATA TRANSFER

Personal data may be transferred to countries located outside the European Economic Area (EEA) exclusively for purposes related to the sale of products and post-sales assistance services. Such transfers take place in compliance with Articles 44–49 of the GDPR.

RIGHTS OF THE DATA SUBJECT

In relation to the data themselves, the data subject may exercise the rights provided for by the articles of EU Regulation 2016/679 and current national legislation, within the limits and under the conditions provided for by Article 12 of the Regulation itself, such as: Right of access by the data subject, Right to rectification, Right to erasure (Right to be forgotten), Right to restriction of processing, Right to data portability, Right to object, Right to lodge a complaint, Right to object to an automated decision-making process, and Right to withdraw consent at any time. The Data Subject shall exercise their rights by writing to the Data Controller at the address indicated above or via certified email (PEC), specifying the subject of their request, the right they intend to exercise, and attaching a photocopy of an identity document to verify the legitimacy of the request.

RETENTION PERIOD

The data will be processed for as long as necessary to carry out the existing commercial relationship and for the subsequent ten years from the date of their acquisition (pursuant to Art. 43 of Presidential Decree 600/73; Art. 2946 of the Italian Civil Code on ordinary limitation periods; Title I, Chapter III, of Legislative Decree 81/08, as amended and supplemented). The images captured by the cameras are retained for a period of 24 hours following recording, except for special needs for further retention in connection with holidays or office closures, as well as in the event that a specific investigative request from the Judicial Authority or Judicial Police must be complied with; after this period, the images will overwrite the previous ones, deleting them. The images can only be viewed by authorized personnel, the judicial authority, or the police.

THE DATA CONTROLLER

MOLINO PIANTONI S.A.S.

DI MICHELANGELO PIANTONI & C.