In accordance with D. Lgs. June 30, 2003, No. 196 (following “Privacy Code”) and art. 13 EU Regulation No. 2016/679 (following “GDPR”), we hereby supply you all due information concerning the purposes and methods for your personal data processing by CRASE s.r.l., related to your navigation in the website www.crase.com and the use of offered services.
B) DATA PROCESSING
1. Object of the process
The Data Controller shall handle your personal identifying but not sensitive data (including but not limited to name, surname, company name, address, phone number, e-mail – following “Personal Data” or just “Data”) communicated during your request of information via telephone/e-mail, access to the website www.crase.com (following “Website”), on-line request of explanation or help, and newsletter’s dispatch.
2. Data Controller, person in charge and appointees
The processing’s Data Controller is CRASE s.r.l. with legal and operational headquarters in Via Primo Villa 15/F, 20875 Burago di Molgora (MB), Italy,
VAT 06555520961 E-mail email@example.com
The updated list of persons in charge and appointees of the data processing is kept at Data Controller’s headquarters.
3. Processing purposes
Your Personal Data are handled:
without your expressed consent (art. 24 lett. a), b), c) Privacy Code and art. 6 lett. b), e) GDPR), for the following Service Purposes:
• manage and maintain the Website;
• allow you to make use of potentially requested Services;
• participate through the Website to initiatives organized by the Data Controller (for example events);
• process a contact request;
• fulfill the duties provided for by law, by a regulation, by Community Legislation or by an Authority’s order;
• prevent or find out fraudulent activities and damaging violations to the Website;
• exercise the rights of the Data Controller, for example the claim to exercise a right in a court of law;
• send you via e-mail opinion and satisfaction surveys, newsletters and/or invitations to events or register you to occurrences organized by the Data Controller, or in which it takes part.
4. Consent annulment
The person concerned can immediately annul his own consent to receive promotional and commercial communications, sending a cancellation request to the e-mail address firstname.lastname@example.org or clicking on the specific “unsubscrive”
link placed in the header of every received promotional e-mail.
5. Methods of data processing
Your Personal Data processing is carried out through the procedure indicated in the art. 4 Privacy Code and art. 4 No. 2) GDPR, and specifically: collection, registration, organization, retention, consultation, handling, modification, selection, extraction, comparison, use, interconnection, block, communication, cancellation and destruction of Data. Your Personal Data are treated both on paper and in an electronic and/or automatized way.
6. Data retention
The Data Controller shall handle your Personal Data as long as it takes to fulfill the above-mentioned purposes and anyway, referring to the Service Purposes, for no
more than 10 years from the suspension of the rapport.
The subscription to the newsletter and the related data processing are valid till the user’s unsubscription through the specific link present in each promotional e-mail, or after 12 months from the last evidence of direct interaction with any communication (click, opening, answer).
7. Security measures
The Data Controller has been adopting a great amount of security measures in order to protect your Data against any loss, violation or forgery risk.
8. Access to Personal Data
Your Data could be made accessible for the purposes indicated in art. 3:
• to Data Controller’s employees and collaborators, as internal appointees
and/or persons in charge of data processing;
• to third societies or other persons which make outsourcing on behalf of
the Data Controller, as persons in charge of data processing.
9. Data communication
The Data Controller can communicate your Data for purposes indicate in art. 3 to surveillance Entities, legal Authorities as well as any other person which is mandatory by law to communicate to for the above-mentioned purposes, without your expressed consent (art. 24 lett. a), b), d) Privacy Code and art. 6 lett. b) and c) GDPR). Your Data will be not spread.
10. Data transfer
Management and retention of Personal Data shall be in Europe. Data spread and transfer out of EU area is anyway excluded.
11. Nature of Data conferment and effects of refusal to reply
The conferment of Personal Data for the purposes indicated in art. 3 is mandatory. If missing, we shall not guarantee neither the registration to the Website nor the Services in art. 3.
The conferment of Personal Data for newsletter’s dispatch in art. 3, instead, is optional. So you can decide to deny the possibility to treat the already supplied data: if this is the case, you will not receive any invitation to events, newsletter and opinion and satisfaction surveys by e-mail. Anyway you will continue to be entitled to the Services in art. 3.
12. Rights of the user
As your being the person concerned, you have the rights indicated in art. 7 Privacy Code and art. 15 GDPR, and specifically you are entitled to:
• know whether your Personal Data exist or they do not, even if they are not registered yet, and obtain communication of them in an intelligible form;
• obtain information: a) about the origin of the Data; b) about processing purposes and methods; c) about the applied logic in the event the processing is carried out with use of electronic instruments; d) about identification details
of Data Controller, persons in charge and of the nominated representative as indicated in art. 5, clause 2 Privacy Code and art. 3, clause 1, GDPR; e) about persons or persons’ categories which could receive communication of Personal Data or could learn about them as nominated representative within the State’s area, as persons in charge or appointees;
• obtain: a) the updating, the correction or, whenever you want, the integration of your Data; b) the removal, the transformation in anonymous or the block of Personal Data if treated breaking the law, including Data that are not necessary to be stored for the purposes they had been collected and handled; c) the certification that everyone who has come to learn the Data knows the procedures in points a) and b) and their contents too, except in the event this
fulfillment reveals itself to be impossible or it involves such an effort that is excessive compared to the protected right;
• entirely or in part, take position against: a) your Personal Data processing for legal reasons, although pertaining to collection’s purposes; b) your Data processing for the dispatch of advertising and direct sale material or for market researches and commercial communications through automated calling systems with no operator, e-mail and/or traditional marketing actions via telephone and paper-based mail. Please note that the right to object
explained in point b), for direct marketing purposes through automated systems, is extended to traditional ways and that the right to object only partially is still possible. So the person concerned can choose to receive either traditional communications or automated ones or none of the two modalities. If applicable, you also shall have the rights indicated in art. 16-21 GDPR (right to rectification, right to be forgotten, right to restriction of processing, right to data portability, right to object), as well as the right to complaint with the Competition Authority.
13. Modality to exercise the rights
You can exercise anytime the rights explained in point 12) above, sending:
• a registered mail to CRASE s.r.l., Via Primo Villa 15/F, 20875 Burago di Molgora (MB), Italy;
• an e-mail to the address email@example.com.
This Website and Data Controller’s Services are not addressed to underage persons and Data Controller does not collect and store personal information
about minors. In the event any minor’s personal data are involuntarily registered, the Data Controller will delete them promptly on user’s request.
15. Changes to the Privacy Statement
Upgrade date: 06/11/2018