pursuant to Article 13 of Regulation (EU) 2016/679
General Data Protection Regulation
By means of this information notice (“Notice”), the Data Controller, as defined below, wishes to inform You on the purposes and methods of the processing of Your personal data and on the rights that Regulation (UE) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (“GDPR”) entrusts You.
- THE DATA CONTROLLER
Conceria Montebello S.p.a., with registered office in Via Lungo Chiampo, 123 - 36054 Montebello (Vicenza), is the Data Controller of Your personal data (“Montebello” or the “Data Controller”).
You may contact the Data Controller by e-mail at the following address: email@example.com, or by regular mail at the office indicated above, to the attention of the Privacy Office.
- PERSONAL DATA SUBJECT TO PROCESSING
2.1 Specific requests
Pursuant to Your specific request, and for the purposes set forth in article 3 of this Notice, the Data Controller processes the following personal data: common data and contact details such as family name and surname, address, phone number, e-mail and other addresses.
For the processing of Your personal data in connection to Your interest to a career in Montebello, we refer to our specific information notice at the following link: information notice for candidates.
2.3 Browsing data
The IT systems and programs used for the functioning of the Website collect some personal data whose transmission is implicit in the usage of the Internet communication protocols (e.g. IP addresses or domain names of computers used by users who connect to the Website, URI addresses – Uniform Resource Identifier – of the requested resources, timing of the request, method used in submitting the request to the server, size of the file obtained in response, numerical code related to the status of the response sent by the server – favorable outcome, error, etc. - and other parameters related to the operating system and the user’s IT environment). Although those are information that are not collected to be associated with identified data subjects, by their nature they could, through processing and association with data held by third parties, allow identification of data subjects.
Through the Website, the Data Controller may also process Your personal data through the use of "cookies".
- PURPOSES OF PROCESSING AND LEGAL BASIS
3.1 Management of Your requests
The processing is necessary to allow browsing on the Website and to respond to Your specific requests, such as sending You technical information on Montebello products.
The legal basis for the processing is hence the execution of Your request, pursuant to Article 6, first paragraph, letter b), of the GDPR; therefore, Your consent is not necessary to allow the processing.
3.2 Sending Curriculum Vitae
Through the "Careers” section of the Website, You can provide Your personal data and Your CV to the Data Controller in order to apply for open positions or for any future position in Montebello.
Your personal data is processed exclusively for the management of Your application and related activities, as better specified in the specific information notice available at the following link: information notice for candidates.
Your personal data may be used by the Data Controller to satisfy Your registration request on the Website.
Failure to provide the required data will make it impossible for the Data Controller to proceed to register You on the Website.
The legal basis for the registration on the Website and the provision of related services is the need to execute your request, pursuant to Article 6 (1) (b), GDPR; therefore, Your consent is not necessary to allow the processing.
In case You have given us Your consent, we may process Your personal data to provide You with promotional information on the products and services offered by Montebello (e.g. through newsletters or invitations to special events) or involve You in market surveys.
The legal basis for the processing activity is Your consent, pursuant to Article 6, first paragraph, letter a), of the GDPR.
Even if You grant us Your consent, You may at any time revoke it and request us to cease the processing for marketing purposes by sending an email to the following address: firstname.lastname@example.org, or by clicking on the specific link contained in the promotional e-mails You will receive.
3.5 Regulatory Compliance
The processing of Your data in order to comply with any Italian, European or other EU Member State legislation (e.g. invoicing, accounting, etc.) is based on the need to fulfill a legal obligation to which the Data Controller is subject, pursuant to art. 6, first paragraph, lett. c) of the GDPR, and, therefore, does not require your consent.
- NATURE OF THE PERSONAL DATA PROCESSING AND CONSEQUENCES OF YOUR FAILURE TO PROVIDE THEM
The processing of Your personal data is required for the management of Your requests, and, therefore, Your failure to provide the personal data from time to time expressly indicated as necessary will result in the impossibility for the Data Controller to do so.
If You refuse to grant us Your consent to process Your personal data also for marketing purposes, we will not be able to provide You with special offers and/or information on new products and services offered by Montebello or invite you to special events; however, this will not impair the management of any different request from You.
- PERSONAL DATA RETENTION
The Data Controller will process Your personal data, for the purposes indicated above, only for the time necessary for the management of Your request, as well as for the fulfillment of any legal obligation provided by Italian, European and/or other Member State’s law if applicable.
Your personal data will be subsequently retained by the Data Controller for a period equal to the statute of limitation applicable from time to time and then deleted.
As to the direct marketing activities under paragraph 3.4 above, Your data will processed until You revoke Your consent or until You decide to oppose to the processing.
With regard to the sending of CV, we refer to article 7 of the specific information notice available on the following link: information notice for candidates.
- METHODS BY WHICH YOUR PERSONAL DATA WILL BE PROCESSED
Your personal data will be processed, pursuant to the provisions of the GDPR, by means of paper, computerized and telematics tools, for the purposes indicated above and with adequate methods to guarantee their security and confidentiality in accordance to Article 32 of the GDPR.
The processing activities with direct marketing purpose under paragraph 3.4 above shall be carried out by e-mail, regular mail, telephone and sms.
- DATA TRANSFERS TO SUBJECTS BASED WITHIN AND WITHOUT THE EUROPEAN UNION
For the purposes described in paragraph 3 above, Your personal data will be disclosed to employees, external consultants and, in general, Montebello’s personnel, who will act as persons authorized to the processing of personal data specifically appointed.
In addition, Your personal data may be processed by the following third parties:
- IT service providers for the management of the IT system;
- legal, tax and accounting consultants;
- authorities and public administrations to fulfill legal obligations or establish, exercise or defend a right in Court or through an administrative proceeding;
- arbitrators, mediators, technical consultants and other subjects who may be involved in the prevention or resolution of disputes relating to the management of the relationship with You or Your employer;
- logistics providers, carriers, shippers;
- providers of marketing services for sending newsletters and organizing events or promotional campaigns;
- other service providers.
The above subjects shall act, in some cases, as autonomous data controller, in other cases as data processors specifically appointed by the Data Controller pursuant to Article 28 of the GDPR. You may request a list of our data processors at the contact details indicated at article 1 above.
Your personal data will not be disclosed to the public.
- YOUR RIGHTS AS DATA SUBJECT
With regard to the processing activities described in this Notice, You may exercise any of the rights described in this section, pursuant to Articles 15 through 21 of the GDPR, within the limits provided by law. In particular:
- Right of access – Article 15 of the GDPR: to obtain confirmation as to whether or not Your personal data are being processed, and, where this is the case, to receive information regarding, inter alia: the purposes of the processing, the categories of personal data concerned, the retention period, the recipients to whom such personal data may be disclosed.
- Right of rectification – Article 16 of the GDPR: to obtain, without undue delay, the rectification of inaccurate personal data or the integration of the same if incomplete.
- Right to erasure – Article 17 of the GDPR: to obtain, without undue delay, the erasure of Your personal data in the cases provided for by the GDPR.
- Right to restriction of processing – Article 18 of the GDPR: to obtain from the Data Controller the restriction of the processing activities in the cases provided for by the GDPR.
- Right of portability – Article 20 of the GDPR: to receive, in a structured format commonly used and readable by an automatic device the personal data concerning Yourself, and to have them transmitted to another data controller without impediment, in the cases provided for by the GDPR.
- Right to object – Article 21 of the GDPR: to object, in any moment, to the processing of Your personal data, save if the Data Controller has legitimate grounds to continue the processing activities.
- Revocation of consent – Article 7 of the GDPR: to revoke the consent previously granted with the same easiness with which it has been given.
- Complaints: to file a complaint to the Supervisory Authority for the protection of personal data, by sending a notice to one of the following addresses: Piazza di Monte Citorio n. 121 - 00186 Roma, Italy, email: email@example.com, or to the Supervisory Authority for the protection of personal data of Your habitual residence, place of work, or place of the alleged violation.
The above rights may be exercised by contacting the Data Controller at the contact details indicated under article 1 above. Please note that we may require to verify Your identity before taking further action on Your request.
* * *