Information notice on personal data processing

01 January 2020

INTRODUCTION

COROB S.p.A., with registered office in Via dell’Agricoltura, 103 – 41038 S. Felice s/P. (MO), Italy (hereinafter referred to as “COROB”), and which may be contacted by email at privacy@corob.com, in its capacity as data controller, hereby provides the following information notice (“Information Notice”) regarding the processing of personal data of users and/or customers (collectively referred to as “Users”) who visit and/or use the functions of the website www.corob.com (“Website”).

TYPES OF PERSONAL DATA PROCESSED

In accordance with this Information Notice, COROB process the following personal data of Users:

  1. Browsing data

The computer systems and software used to operate the Website acquire, during their normal operations, some personal data whose transmission is implicit in the use of Internet communication protocols. Such information is not collected in order to be associated with identified data subjects, but, by its very nature, it could make it possible to identify Users by means of processing and cross-referencing with data held by third parties.

This category of data includes IP addresses or domain names of the computers used by the Users who connect to the Website, the URI (Uniform Resource Identifier) addresses of the resources requested, the time of the request, the method used to submit a request to the server, the size of the file obtained in response, the numerical code indicating the status of the response given by the server (successful, error, etc.), and other parameters relating to the User’s operating system and computer environment.

These data are used for the sole purpose of obtaining anonymous statistical information on the use of the Website and to check its proper functioning and are deleted immediately after processing.

COROB may also process other browsing data relating to Users in accordance with the Cookie Policy available on the dedicated page of the Website.

  1. Data provided voluntarily by Users

Users browsing the Website may disclose the following types of personal data to COROB:

  • identification and contact information such as name, surname, telephone number, e-mail.

PURPOSES AND LEGAL GROUNDS OF PROCESSING

The above-mentioned data are processed by COROB for the following purposes:

  1. allow Users to browse the Website and use its features (including accessing the reserved area, requesting to be contacted by COROB or requesting the sending of the newsletter);
  2. for handling complaints and disputes;
  3. in order to comply with applicable national and European legislation;

(hereinafter jointly referred to as the “Contractual Purposes”)

  1. to assert and defend its rights;
  2. to carry out a potential merger, transfer of assets, transfer of business or branch of business or any other corporate transformation, by transferring Users’ personal data to the third party/ies involved;

(hereinafter the “Legitimate Interest Purposes”)

  1. with the prior consent of Users, for accessing the reserved area, the management of contact requests, for receiving promotional communications relating to products and services offered by COROB through traditional communication channels such as paper mail, or through automated communication tools, emails, automatic messages and other remote communication tools.

(hereinafter the “Marketing Purposes”).

LEGAL GROUNDS FOR THE PROCESSING

The processing of Users’ personal data is necessary with reference to the Contractual Purposes, as it is essential in order to:

  1. provide the service requested by a User through the functionalities available on the Website in the cases provided for in Section 2(a) and (b);
  2. comply with the provisions of the applicable legislation as set out in Section 2(c).

If a User does not provide the personal data necessary for the Contractual Purposes, it will not be possible for COROB to provide the services referred to on the Website.

The processing of a User’s personal data for the Legitimate Interest Purposes referred to in Section 2(d) and (e) is carried out in accordance with Article 6(f) of the European General Data Protection Regulation 2016/679 (the “Data Protection Regulation”) for the pursuit of the legitimate interest of COROB, which is equally balanced with the interest of the User, as the processing of personal data is limited to what is strictly necessary for the performance of the required financial transactions.

Processing for the Legitimate Interest purposes is not mandatory and the User may object to such processing in the manners set out in this Information Notice, but if the User objects to such processing, his or her data may not be used for the Legitimate Interest purposes, except in the event that COROB proves compelling legitimate reasons or the exercise or defense of a right pursuant to Article 21 of the Data Protection Regulation.

The processing of Personal Data for Marketing Purposes is optional and subject to the User’s consent. Therefore, in case of opposition to marketing communications or refusal to give consent, or withdrawal of such consent, the User will not receive the marketing communications referred to in Section 2(f) and (g). In any case, Users may withdraw their consent to the processing of Personal Data and oppose the sending of all marketing communications at any time, through the methods provided for in this information notice.

PROCESSING METHODS

In relation to the above-mentioned purposes, personal data will be processed both through computer and/or IT means and on paper and, in any case, by means of instruments suitable to guarantee their security, protection and confidentiality through the adoption of appropriate technical, physical and organizational security measures to prevent unauthorized access, loss, dissemination and theft of personal data.

 SCOPE OF DATA DISCLOSURE

For the Contractual Purposes referred to above, the personal data of Users may be disclosed to the following categories of recipients: (a) third party providers of assistance and consultancy services for COROB active in the technological, IT, accounting, administrative, legal, insurance sectors (merely by way of example); (b) companies of the COROB group, (c) persons and authorities for whom access to Users’ personal data is expressly recognized by law, regulations or measures issued by the competent authorities.

For the Legitimate Interest purposes mentioned above, the personal data of Users may be transferred to the following categories of recipients: (a) companies of the COROB group; (b) potential purchasers of COROB and entities resulting from the merger or any other form of transformation concerning COROB; (b) competent authorities.

Such recipients, depending on the circumstances, will process the personal data in their capacity as data controllers, data processors or persons in charge of processing. A complete list of the data processors appointed by COROB is available, upon request, via the methods indicated in this Information Notice.

ARE PERSONAL DATA TRANSFERRED ABROAD?

Users’ Personal Data will not be transferred to countries outside the European Union. Should COROB transfer the data of the Data Subjects to countries outside the European Union, it will, in any case, ensure compliance with the appropriate guarantees, suitably for the purposes of the transfer, such as the standard contractual clauses on data protection, in accordance with the applicable legislation and in particular Articles 45 and 46 of the Data Protection Regulation.

TIMEFRAME OF STORAGE

Users’ personal data will be stored for the period of time necessary to pursue the purposes for which such data have been gathered, in accordance with this information notice. In any case, the following storage terms will apply with reference to the processing of data for the purposes set out below:

  • for the Contractual and Legitimate Interest Purposes, the Personal Data of the Users are stored for a period equal to the provision of the service and for 10 years after its termination, resolution or withdrawal, except in cases where the storage for a longer period is required for any litigation, requests by the competent authorities, or under applicable law;
  • for the Marketing Purposes referred to in section 2(f), the Personal Data of Users are stored for a period equal to the provision of the services requested by the User, plus a further period of 24 months.

USER RIGHTS

Users may exercise the following rights at any time and free of charge, by sending an email to the address privacy@corob.com:

  1. obtain from COROB confirmation of the existence or non-existence of data concerning them and be informed about the content and source of the data, verify their accuracy and request their integration, updating or modification;
  2. obtain the deletion, anonymization or blocking of any data processed in violation of applicable law;
  3. object to the processing in whole or in part, for legitimate reasons, unless COROB has overriding legitimate reasons, or the need to assert or defend a right in any legal proceedings; and
  4. withdraw at any time their consent to the processing of data (in relation to processing for which such consent may be required), without this in any way affecting the lawfulness of the processing based on the consent given before the withdrawal;
  5. ask COROB to limit the processing of their personal data in the event that:
    • the accuracy of the personal data is challenged, for the period necessary for COROB to verify the accuracy of such data;
    • the processing is unlawful, and one objects to the deletion of one’s personal data, asking that their use be restricted;
    • although COROB no longer needs the data for the purposes of processing, the data are necessary to ascertain, exercise or defend a right in court; or
    • the User has objected to the processing pursuant to Article 21(1) of the Data Protection Regulation, pending verification of the potential prevalence of COROB’s legitimate compelling reasons for continuing the processing.
  6. request the deletion of Personal Data concerning them without undue delay;
  7. obtain the portability of Personal Data concerning them; and
  8. submit a complaint to the competent Supervisory Authority.

Under Article 2-terdecies of Legislative Decree No. 196/2003, in the event of the User’s death, the aforementioned rights relating to his/her personal data may be exercised by those who have an interest of their own, or act to protect the Data Subject as his/her representative, or for family reasons worthy of protection. Users may expressly forbid the exercise of any of the above rights by their successors by sending a written declaration to COROB to the e-mail address indicated above. Such declaration may be withdrawn or amended at a later stage in the same manner. 

AMENDMENTS AND UPDATES

This Information Notice may be subject to amendments and integrations, also as a result of any regulatory changes and/or additions. Changes will be notified in advance and Users may view the text of the constantly updated Information Notice on the Website.