This information is provided in compliance with Articles 13 and 14 of the EU Regulation 2016/679 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (hereinafter “GDPR”) to the persons affected by the processing of their personal data underlying the supply and/or collaboration relationship in place with them.

This document explains to you the purposes and methods by which your personal data are processed, what personal data are processed, what rights the data subjects have and how these rights can be exercised.

1.      Data Controller and Data Protection Officer

Pursuant to Article 4 of the GDPR, the data controller of your personal data referred to in this information notice is the Engineering Group Company with which you or your company entertains the contractual relationship (“Data Controller”).

The Data Controller has appointed a Data Protection Officer or “DPO”, who can be reached at the following e-mail address: dpo.privacy@eng.it.

2.      Categories of personal data processed

The Controller shall collect, and process personal data of a common nature directly related to the customer/partner or to the persons concerned in the customer/partner’s structure, such as the customer/partner’s collaborators, employees and/or referents. If the personal data of the customer’s/partner’s collaborators/employees/referents are communicated to the Controller by the customer/partner, the customer/partner undertakes to pass on this information to the persons whose personal data it communicates.

The data collected and processed are personal and identification, contact (telephone number, e-mail address) and financial data of the persons concerned in their capacity as contact persons in the performance of supply and/or cooperation relations, insofar as such data are necessary for the proper conduct of said relations or voluntarily provided by the person concerned.

3.      Purpose of processing and legal basis

The Data Controller will process your data for the execution of supply/partnership contracts, for internal customer/partner management as well as for the purpose of fulfilling the legal obligations incumbent on the Data Controller.

In particular, your personal data will be processed:

a.      for the purposes of the performance of the contract to which the data subject is party or the execution of pre-contractual measures taken at the data subject’s request [Art. 6(1)(b) GDPR];

b.      to comply with legal obligations to which the Data Controller is subject [Art. 6(1)(c) GDPR];

c.      for creditworthiness checks to protect the company’s economic and reputational interests [Art. 6(1)(f) GDPR],

d.      for verifications about the necessary requirements for participation in public tenders, if there is a partnership or outsourcing agreement between you and the Data Controller [Art. 6(1)(f) GDPR];

e.      for the purpose of communication and management of events designed and/or proposed by the Controller (e.g. sending of communications relating to events, publication of information), in pursuit of the legitimate interest of the Controller in ensuring effective management of events and effective communication with its customers/partners [Art. 6(1)(f) GDPR];

f.        to ascertain, perform data and network security audits and to prevent and counter possible cybercrimes, thus in the pursuit of the legitimate interest of the Controller to maintain the protection of internal IT systems and apply appropriate security measures, as well as to assert, exercise or defend a right in court [Art. 6(1)(f) GDPR];

g.       to carry out customer satisfaction surveys, statistical analysis and related services, thus in pursuit of the legitimate interest of the Controller to ensure the possibility of conducting and improving its business [Art. 6(1)(f) GDPR].

h.      to send commercial and/or promotional communications to the data subject regarding products and/or services offered by the Data Controller. The legal basis for the processing of the data referred to in this point is the specific consent expressed by the data subject pursuant to Article 6(1)(a) of the GDPR;

i.        to send commercial and/or promotional communications to the data subject regarding products and/or services by other Engineering Group companies. The legal basis for the processing of the data referred to in this point is the specific consent expressed by the data subject pursuant to Article 6(1)(a) of the GDPR;

j.        for conducting market analysis and research carried out by the Data Controller or its partners. The legal basis for the processing of the data referred to in this point is the specific consent expressed by the data subject pursuant to Article 6(1)(a) of the GDPR;

k.       for sending commercial and/or promotional communications via e-mail concerning products or services similar to those already purchased (so-called “soft spam”). You always have the right to object to the sending of such communications by writing to the addresses indicated in this notice. The legal basis for sending soft spam is identified in the legitimate interest of the Data Controller [art. 6(1)(f) GDPR] to pose products or services similar to those already purchased.

Any consents given for the pursuit of purposes h), i) and j) may be revoked at any time, thereby discontinuing the conduct of said commercial and promotional activities, by writing to the addresses indicated in this notice.

The provision of your personal data for the purposes a), b), c) and f) is mandatory. Failure to do so will make it impossible for the Controller to establish business relations with you or your company, either in whole or in part.

4.      Data processors and authorized persons

The Data Controller will share your personal data with its employees and collaborators specifically identified and instructed by a written deed pursuant to Article 29 of the GDPR (“Authorized Persons”), who will process them, under the authority of the Data Controller, exclusively for the purpose of performing their respective work duties.

Your personal data may also be shared with third parties, appointed as data processors by the Data Controller in writing pursuant to Article 28 of the GDPR, or, where required by applicable law, as autonomous data controllers.

With reference to these categories of third-party recipients, it is specified that your data may be shared with:

• public bodies and authorities where this is required by law or by order of the competent authorities;
  
• other Engineering Group companies;
  
• natural or legal persons, associations or professional firms providing consultancy and assistance services and activities to the Data Controller; 
  
• business partners that support the Data Controller in the execution and management of the illustrated purposes;
  
• banks, credit institutions and insurance companies.

5.      Transfer of data outside the EU

In pursuit of the above-mentioned purposes, some of your personal data may be shared with recipients located outside the European Union/European Economic Area. In such circumstances, the Data Controller ensures that the transfer of such data takes place in compliance with the provisions of Chapter V of the GDPR (Transfers of Personal Data to Third Countries or International Organisations), therefore on the basis of an adequacy decision of the European Commission pursuant to Article 45 GDPR or, failing that, with the adoption of the appropriate safeguards referred to in Article 46 of the GDPR, such as the Standard Contractual Clauses in the latest version published by the European Commission.

6.      Data Retention Periods

Your personal data will be stored, with logic strictly related to their security and to the resilience of the systems used for their processing, for the time strictly necessary to achieve the purposes for which they were collected. In particular, the storage and processing of your data will be carried out in full compliance with the principles of data minimisation and storage limitation pursuant to Article 5 of the GDPR.

Contact data processed for the purpose of conducting promotional activities on the basis of your consent will be processed for twenty-four (24) months from the date the consent was given, unless revoked. This period may be extended by the data subject renewing consent to the processing for this purpose.

In addition, the Controller may keep your personal data for a further period in order to fulfil contractual and legal obligations applicable to it and, where necessary, to assert, exercise or defend its own rights in and out of court, in any case for the maximum period permitted by the law in force at the time.

7.      Rights of data subjects

Pursuant to current legislation, you have the following rights.

• Access: you have the right to access at any time the data concerning you that are available to the Data Controller, as well as any useful information concerning the processing carried out by the latter;
• Rectification: you have the right to obtain the rectification and/or correction of inaccurate data concerning you that is available to the Data Controller;
• Deletion: in the event of special reasons, you have the right to request and obtain, without undue delay, the deletion of your data in the possession of the Data Controller;
• Restriction: in special cases, you have the right to have the processing of your data restricted;
• Portability: in the event of automated processing of data based on your consent or the performance of a contract, you have the right to receive, in a structured, commonly used and machine-readable format, your personal data provided to the Data Controller, as well as the right to transmit such data to another controller without hindrance;
• Objection: you have the right to object at any time, on grounds relating to your particular situation, to the processing of your personal data based on the pursuit of the legitimate interests of the controller, unless the controller proves the existence of compelling legitimate grounds that override your interests, rights and freedoms;
• Automated decision-making: you have the right not to be subject to a decision based solely on automated processing of your data, including profiling, where such a decision significantly affects you.

You may exercise your rights, in the manner set out in Article 12 of the GDPR and within the limitations set out in Article 23 of the GDPR, by writing to the Data Controller’s contact details set out in this notice or to the DPO’s address: dpo.privacy@eng.it

Without prejudice to any other administrative or judicial remedy, you are also granted the right to lodge a complaint with the competent supervisory authority (for Italy, the Garante per la protezione dei dati personali) if you consider that your data protection rights have been infringed. Further information is available on the website https://www.garanteprivacy.it.