Pursuant to Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, ("GDPR"), the following information is provided pursuant to Art. 13 and Art. 14 concerning the processing of Your personal data as a potential customer (so-called "prospect") interested in products and/or services offered by the Company (as defined below).

The personal data you provide at trade fairs, conferences, and events, on any online and/or paper forms, or acquired from third parties, may be processed, in accordance with the following, in order to be able to send you promotional communications.

In the event that the relationship relates to a legal person, this privacy notice is addressed to the company contact persons acting for that legal person.

1.      Data Controller and Data Protection Officer

Pursuant to Article 4 of the GDPR, the data controller of your personal data referred to in this notice is the Engineering Group Company for which you or your company have shown interest in products and/or services offered (“Data Controller”).

The Data Controller has appointed a Data Protection Officer or “DPO”, who can be reached at the following e-mail address: dpo.privacy@eng.it.

2.      Categories of personal data processed

The data that the Data Controller may process, within the limits of the purposes and methods described in this privacy notice, include only your so-called common personal data, which includes your identification data (first name and surname) and contact data (such as, for example, your e-mail address).

3.      Purpose of processing and legal basis for processing

Your personal data will be processed by the Controller:

a.      for the purpose of sending commercial and/or promotional communications to the data subject concerning products and/or services offered by the Company with respect to which the recipient has given his/her consent [Art. 6(1)(b) GDPR]. Consent may be revoked at any time resulting in discontinuing the performance of said commercial and promotional activities through communication to be sent to dpo.privacy@eng.it;  

b.      for the purpose of complying with legal obligations incumbent on the Data Controller (e.g., accounting and tax, anti-money laundering, procurement, occupational health and safety, for the purpose of ascertaining the requirements of good standing, as well as relating to Model 231 and the Data Controller's Code of Ethics) [Art. 6(1)(c) GDPR];

c.      to ascertain, exercise or defend in judicial and/or extrajudicial proceedings the rights or interests of the Controller and/or third parties, including the need to protect oneself in pre-litigation [Art. 6(1)(f) GDPR].  

The provision of your personal data for the above-mentioned purposes is mandatory and in default the Controller will be prevented, in whole or in part, from sending commercial and/or promotional communications concerning products and/or services offered by the same.

4.      Recipients, processing methods and retention periods 

The Data Controller will share your personal data with its employees and collaborators specifically identified and instructed by written deed pursuant to Article 29 of the GDPR (“Data Processors”), who will process it, under the authority of the Data Controller, exclusively for the purpose of performing their respective job duties.

Your personal data may also be shared with third parties, appointed as data processors by the Data Controller in writing pursuant to Article 28 of the GDPR, or, where required by applicable law, as autonomous data controllers.

With reference to these categories of third-party recipients, it is specified that your data may be shared with public authorities if this is mandatory in compliance with legal provisions or orders of the competent authorities.

The processing will be carried out on paper and with the aid of electronic tools.

5.      Transfer of data outside the EU

In pursuit of the above-mentioned purposes, some of your personal data may be shared with recipients located outside the European Union/European Economic Area. In such circumstances, the Data Controller ensures that the transfer of such data takes place in compliance with the provisions of Chapter V of the GDPR (Transfers of Personal Data to Third Countries or International Organisations), therefore on the basis of an adequacy decision of the European Commission pursuant to Article 45 GDPR or, failing that, with the adoption of the appropriate safeguards referred to in Article 46 of the GDPR, such as the Standard Contractual Clauses in the latest version published by the European Commission.

6.      Data Retention Period

The data will be kept for the time strictly necessary to achieve the purposes of the processing, applying the principles of minimisation and proportionality. In particular, they will be kept for the time required by the specific obligation or rule of law applicable, to assert or defend a right or legitimate interest, and will be deleted when the purposes for which they were collected no longer apply. Contact data processed to conduct promotional activities (purpose A), will be processed for twenty-four months (24) from the date consent was given, unless revoked. This period may be extended by the data subject by renewing consent to the processing for that purpose.

7.      Data subject’s rights

Pursuant to current legislation, you have the following rights.

• Access: you have the right to access at any time the data concerning you that are available to the Data Controller, as well as any useful information concerning the processing carried out by the latter;
• Rectification: you have the right to obtain the rectification and/or correction of inaccurate data concerning you that is available to the Controller;
• Deletion: in the event of specific reasons, you have the right to request and obtain, without undue delay, the deletion of your data in the possession of the Controller;
• Restriction: in special cases, you have the right to have the processing of your data restricted;
• Portability: in the event of automated processing of data based on your consent or the performance of a contract, you have the right to receive, in a structured, commonly used, and machine-readable format, your personal data provided to the Controller, as well as the right to transmit such data to another controller without hindrance;
• Objection: you have the right to object at any time, on grounds relating to your particular situation, to the processing of your personal data based on the pursuit of the legitimate interests of the controller, unless the controller proves the existence of compelling legitimate grounds that override your interests, rights and freedoms;
• Automated decision-making: you have the right not to be subject to a decision based solely on automated processing of your data, including profiling, where such a decision significantly affects you.

You may exercise your rights, in the manner set out in Article 12 of the GDPR and within the limitations set out in Article 23 of the GDPR, by writing to the Controller’s contact details set out in this notice or to the DPO’s address: dpo.privacy@eng.it.

Without prejudice to any other administrative or judicial remedy, you are also guaranteed the right to lodge a complaint with the competent supervisory authority where you believe there has been a violation of your data protection rights. Further information is available at https://www.garanteprivacy.it.