Privacy Policy
GENERAL INFORMATION ON THE PROCESSING OF PERSONAL DATA
Information provided pursuant to Article 13 of Regulation (EU) 2016/679 (hereinafter GDPR)
General Information
We inform the data subjects (as per Article 4, paragraph 1 of the GDPR) of the following general aspects, which apply to all areas of data processing:
- All data are processed in compliance with the applicable privacy regulations (EU Regulation 2016/679 and Legislative Decree 196/2003, as amended and supplemented by Legislative Decree 101/2018);
- All data are processed lawfully, fairly, and transparently with respect to the data subject, in accordance with the general principles set out in Article 5 of the GDPR;
- Specific security measures are observed to prevent data loss, unlawful or incorrect use, and unauthorized access (GDPR, Article 32).
Data Controller
The Data Controller is the undersigned Company (represented by the legal representative pro tempore), which can be contacted for any privacy-related requests or to exercise the rights listed below, using the following contact details:
DATA CONTROLLER:
Name: Mecal Srl
Email: info@mecal.org
DATA PROTECTION OFFICER
Name: Galli Data Service Srl
Email: dpo@gallidataservice.com
Rights of Data Subjects
- Right to request the presence and access to personal data concerning them (Art. 15 “Right of Access”)
- Right to obtain the rectification/integration of inaccurate or incomplete data (Art. 16 “Right to Rectification”)
- Right to obtain, if there are justified reasons, the erasure of data (Art. 17 “Right to Erasure”)
- Right to obtain the restriction of processing (Art. 18 “Right to Restriction”)
- Right to receive data concerning them in a structured format (Art. 20 “Right to Data Portability”)
- Right to object to processing and automated decision-making processes, including profiling (Art. 21, 22)
- Right to withdraw previously given consent
- Right to lodge a complaint with the Data Protection Authority if no response is received
Below are the following specific details regarding: Data processing related to the operation of this website
- Data processing of clients/suppliers of the Data Controller
- Other types of processing
- Video surveillance
1. DATA PROCESSING RELATED TO THE OPERATION OF THIS WEBSITE
1.1 Browsing Data
The information technology systems and software procedures used to operate this website acquire, during their normal operation, some personal data whose transmission is implicit in the use of internet communication protocols.
These are information that is not collected to be associated with identified data subjects, but which, by their nature, could, through processing and association with data held by third parties, allow the identification of users. This category of data includes IP addresses or domain names of the computers used by users connecting to the site, URI (Uniform Resource Identifier) addresses of the requested resources, the time of the request, the method used to submit the request to the server, the size of the file obtained in response, the numerical code indicating the status of the response given by the server (success, error, etc.), and other parameters related to the user’s operating system and computing environment.
Purpose and Legal Basis of Processing (GDPR – Art. 13, paragraph 1, letter c)
These data are used solely for obtaining anonymous statistical information on the use of the site and for monitoring its proper functioning. The data may also be used for the investigation of potential computer crimes against the site (legitimate interests of the data controller).
Scope of Communication
(GDPR – Art. 13, paragraph 1, letters e, f)
The data may be processed exclusively by authorized internal personnel, trained for processing (GDPR – Art. 29), or by external parties responsible for maintaining the web platform (designated as external processors). The data will not be communicated to other parties, disseminated, or transferred to non-EU countries (unless required by the provisions of Chapter V of the GDPR). Only in case of investigation, data may be made available to the competent authorities.
Data Retention Period
(GDPR – Art. 13, paragraph 2, letter a)
The data are normally retained for short periods of time, except for any extensions related to investigation activities.
Provision of Data
(GDPR – Art. 13, paragraph 2, letter f)
The data are not provided by the data subject but are automatically acquired by the website’s technological systems.
1.2 Cookies
The management of cookies is in accordance with the applicable regulations:
- “Guidelines on Cookies and Other Tracking Tools” of June 10, 2021 (Published in the Official Gazette No. 163 of July 9, 2021);
- Guidelines 5/2020 on consent pursuant to Regulation (EU) 2016/679, adopted by the European Data Protection Board;
- Transnational agreements on the extra-EU flow of data, entered into under Title V of the GDPR.
The user can analytically check the types of cookies and set preferences through the dedicated banner (if provided; if not, it means the site only uses technical cookies). Below are some general information about cookies and similar technologies.
What are Cookies
Cookies are small text fragments (letters and/or numbers) that allow the website to store information on the client (the browser) for reuse during the same session (session cookies) or later, even after several days (persistent cookies). Cookies are stored by the individual browser on the specific device used (computer, tablet, smartphone), depending on the user’s preferences. Similar technologies, such as web beacons, transparent GIFs, and all forms of local storage introduced with HTML5, can also be used to collect information about the user’s behavior and service addresses. In this notice, we will refer to cookies and all similar technologies simply as “cookies.”
Possible Types of First-Party Cookies and Preference Management Methods
Purpose: To ensure normal browsing and use of the site
Purpose: To gather information on the number of visitors and the pages viewed
Purpose: To enable browsing based on a series of selected criteria
Purpose: To create user profiles for sending advertisements in line with preferences
Through the main browsing browsers, it is possible to:
• Block by default the reception of all (or some) types of cookies
• View the detailed list of cookies used
• Remove all or some of the installed cookies
For information on setting preferences in individual browsers, see the specific section. Please note that blocking or deleting cookies may impair the website’s usability.
CATEGORY
PURPOSE
PREFERENCE MANAGEMENT
Navigation or Session Cookies
Ensure normal navigation and use of the site
Through the main browsers, it is possible to:
Analytical Cookies
Collect information on the number of visitors and the pages viewed
- Block by default the reception of all (or some) types of cookies
Functionality Cookies
Enable browsing based on a series of selected criteria
- Display the detailed list of cookies used
- Remove all or some of the installed cookies
Profiling Cookies
Create user profiles to send advertisements in line with preferences.
For information on setting preferences in individual browsers, see the specific section. Please note that blocking or deleting cookies may impair the website’s usability.
Managing Preferences via Main Browsers
The user can decide whether to accept cookies or not by using the settings of their browser (please note that, by default, almost all web browsers are set to automatically accept cookies). The settings can be modified and defined specifically for different websites and web applications. In addition, most browsers allow the definition of different settings for “first-party” cookies and “third-party” cookies. Typically, cookie settings are configured in the “Preferences,” “Tools,” or “Options” menu. Below are links to guides for managing cookies in the main browsers:
Microsoft Edge
https://support.microsoft.com/
Internet Explorer
http://support.microsoft.com/
Chrome
http://support.google.com/
Safari
https://www.apple.com/
Firefox
https://support.mozilla.org/
Further Information
- www.garanteprivacy.it/cookie (collection of the main regulatory interventions in this area by the Italian Data Protection Authority)
- www.allaboutcookies.org (For more information on cookie technologies and how they work)
- www.youronlinechoices.com/it/a-proposito (Allows users to object to the installation of the main profiling cookies)
Correlation with Portals and Social Networks
On the website pages, there may be buttons, widgets, plug-ins, links, and cookies from Social Networks to facilitate interaction with social platforms and content sharing. Examples include but are not limited to: Facebook Pixel, Facebook Remarketing, Facebook Segmentation, etc. (which still use technologies and tools that reduce the identifying power of cookies, such as anonymization or hashing/encryption systems). It is important to note that the processing of data entered by the user on various social channels occurs according to the privacy rules and settings of the respective social network, which the user accepts upon registration. For informational purposes, here are some links to the main social networks, where users can manage their privacy settings and cookie acceptance:
– Youtube:
https://www.youtube.com/
– Linkedin (information):
https://www.linkedin.com/
– Linkedin (configuration):
https://www.linkedin.com/
1.3 Specific Functions of the Website
Some pages of the website may require the submission of information from the user regarding specific services (e.g., request information, user registration, work with us, etc.).
Purpose and Legal Basis of Processing (GDPR – Art. 13, paragraph 1, letter c)
Only the data necessary for the proper delivery of the service and for providing accurate and comprehensive responses to the users will be requested. Processing is subject to the acceptance of specific, free, and informed consent (GDPR – Art. 6, paragraph 1, letter a).
Scope of Communication
(GDPR – Art. 13, paragraph 1, letters e, f)
The data will be processed exclusively by authorized personnel who are regularly trained for processing (GDPR – Art. 29), or by any individuals assigned to maintain the web platform (designated as external processors). The data will not be disclosed or transferred to non-EU countries (unless in compliance with the provisions of Chapter V of the GDPR).
Data Retention Period
(GDPR – Art. 13, paragraph 2, letter a)
The data will be stored for periods consistent with the purpose of the collection.
Provision of Data
(GDPR – Art. 13, paragraph 2, letter f)
Providing data for the mandatory fields is necessary to receive a response, while the optional fields are intended to provide staff with additional useful information to facilitate contact.
1.4 Data Provided Voluntarily by the User
The optional, explicit, and voluntary submission of messages to the contact addresses, private messages sent by users to institutional profiles/pages on social media (where this option is provided), as well as the completion and submission of any forms, will result in the collection of the sender’s contact data, necessary to respond, as well as any personal data included in the communications. The sender is therefore personally responsible for the accuracy of the provided data, as well as their relevance and non-excessiveness in relation to the requests at hand.
2. DATA PROCESSING RELATED TO RELATIONSHIPS WITH CLIENTS AND SUPPLIERS (current and potential)
2.1 Subject of Processing
The company processes personal identification data of clients/suppliers (e.g., name, surname, business name, personal/tax data, address, phone, email, banking and payment details) and their operational contacts (name, surname, and contact details) acquired and used in the provision of the services offered.
2.2 Purpose and Legal Basis of Processing
The data are processed for:
- Concluding contractual/professional relationships and providing related services;
- Fulfilling pre-contractual, contractual, and tax obligations arising from ongoing relationships, as well as managing the necessary communications related to them;
- Fulfilling legal, regulatory, EU, or Authority-imposed obligations;
- Exercising a legitimate interest and a right of the Data Controller (e.g., the right to defense in judicial proceedings, protection of creditor positions, routine internal operational, management, and accounting needs).
Failure to provide the aforementioned data will make it impossible to establish a relationship with the Data Controller. These purposes represent, under Art. 6, paragraphs b, c, and f, valid legal bases for lawful processing. If processing for different purposes is intended (e.g., marketing communications, production of photo/video content, etc.), explicit consent will be required from the data subjects.
2.3 Modalità del trattamento e tempo di conservazione
Il trattamento dei dati personali è realizzato per mezzo delle operazioni indicate all’Art.4 n.2 GDPR e precisamente: raccolta, registrazione, organizzazione, conservazione, consultazione, elaborazione, modificazione, selezione, estrazione, raffronto, utilizzo, interconnessione, blocco, comunicazione, cancellazione e distruzione dei dati. I dati personali sono sottoposti a trattamento sia cartaceo che elettronico. Il Titolare tratterà i dati personali per il tempo necessario per adempiere alle finalità per cui sono stati raccolti e relativi obblighi di legge (di norma coincidenti con il rapporto con l’interessato, fatto salvo il prolungamento in riferimento agli obblighi di conservazione della documentazione amministrativa e della corrispondenza commerciale).
2.4 Scope of Processing
The data are processed by internal subjects regularly authorized and trained under Art. 29 of the GDPR. The scope of data communication can also be requested, providing precise details on external subjects acting as Data Processors or Independent Data Controllers (e.g., consultants, technicians, banks, carriers, etc.). The data may be communicated to any controlled/affiliated companies. The data will not be disseminated or transferred outside the EU (they may be transferred outside the EU only in compliance with the conditions outlined in Chapter V of the GDPR, ensuring that the level of protection of the data subjects is not compromised: “Art. 45 Transfer based on an adequacy decision, Art. 46 Transfer subject to appropriate safeguards, Art. 47 Binding corporate rules, Art. 49 Specific derogations). The data are not subject to automated processes that produce significant consequences for the data subject.
3. OTHER TYPES OF PROCESSING
It is noted that the company adopts further notices for specific categories of data subjects and processing activities (e.g., employee notice, candidate notice, video surveillance notice, etc.), usually made available to the data subjects in the manner required by law.
4. VIDEO SURVEILLANCE
To complete the information provided to the data subjects through signs displayed in areas where video surveillance systems are in operation, it is communicated that:
- The processing of personal data through video surveillance systems is carried out in accordance with current privacy regulations (EU Regulation 2016/679 “GDPR”; Legislative Decree 196/2003, as amended and supplemented by Legislative Decree 101/2018; General Provisions of the Data Protection Authority, expressly recognized by Art. 22, paragraph 4 of Legislative Decree 101/2018).
- The recording of images is carried out, as the Data Controller, by Mecal S.r.l., represented by the legal representative pro-tempore;
- The system is installed for the purpose of PROTECTING PROPERTY/SECURITY, and the use of the cameras is aimed at protecting goods, people, and assets against possible intrusions, fires, thefts, robberies, or acts of vandalism, and for the potential defense of the Data Controller’s rights in judicial proceedings (evidence collection);
- The access or passage of data subjects through the areas under video surveillance necessarily results in the recording of images that may concern them;
- le immagini rilevate possono venir registrate e conservate per il periodo di tempo strettamente necessario al raggiungimento dello scopo sopra indicato (quantified in 48 hours) e in ogni caso per un tempo non superiore ai termini previsti per legge (mai superiore ai 7 giorni), salvo il maggior termine eventualmente necessario per adempiere a specifiche richieste dell’autorità giudiziaria o di polizia giudiziaria in relazione ad attività investigative in corso; al termine del periodo di conservazione previsto, le immagini registrate vengono cancellate dai relativi supporti elettronici, informatici o magnetici;
- The images may only be processed by formally authorized and trained personnel or external companies that, as Data Processors, collaborate in the maintenance of the systems and surveillance activities; they will not be communicated or disseminated outside the Data Controller’s structure, except in the execution of orders from the judiciary or law enforcement or, in the case of unlawful acts, their use in judicial settings;
- The images will be processed with tools and methods suitable to ensure an adequate level of security and confidentiality, with particular regard to the measures outlined in Art. 32 of the GDPR and the General Provisions of April 8, 2010;
- Data subjects have the right to contact the Data Controller for any request for access to video-recorded data concerning them, in accordance with Articles 15 and following of the GDPR. Specifically, the data subject, if identifiable, has the right to obtain from the Data Controller the confirmation of the existence or non-existence of personal data concerning them and its communication in intelligible form; to know certain details about its processing (data source, purpose and method of processing; identification details of the Data Controller and, if appointed, the Data Processors, etc.); to obtain the deletion or blocking of data processed in violation of the law; as well as to object, for legitimate reasons, to the processing itself.
5. POLICY UPDATE
It is noted that this notice may be periodically reviewed, also in relation to the relevant regulations and jurisprudence. In the event of significant changes, appropriate notice will be given on the homepage of the site for a reasonable period of time. However, data subjects are encouraged to periodically consult this policy.
