Privacy Policy Personal Data Processing Notice pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (GDPR).
In force from 22 May 2023
INTRODUCTION
This notice has been drafted in accordance with the GDPR and the Italian Privacy Code (Legislative Decree no. 196 of 30 June 2003), as well as the Guidelines issued by the Italian Data Protection Authority (in particular, the Anti-Spam Guidelines issued on 4 July 2013).
Data Controller: CMP s.r.l., registered office in Osimo (AN), Via Cola, 12 (60027), Telefono 071 71 00 171, Email info@cmp-italy.com, registered with the Chamber of Commerce of Ancona, a company subject to the management and coordination of Cantori s.r.l.
Website to which this privacy policy applies: https://www.cantorigroup.it (the “Website“).
The Data Controller has not appointed a Data Protection Officer (DPO). You may therefore direct any enquiries directly to the Data Controller.
GENERAL INFORMATION
This document describes how the Data Controller processes the personal data you provide on the Website.
The main personal data processing activities are described below, including the legal basis for each, whether the provision of data is mandatory, and the consequences of not providing it. Where relevant, we have also specified whether and when a particular processing activity does not take place.
Website registration
The Website does not offer a registration facility. The Data Controller therefore does not process your personal data for this purpose.
Purchases on the Website
It is not possible to make purchases on the Website. Your personal data will therefore not be processed for this purpose. The Data Controller does not process user data to send purchase reminder emails for its own products and/or services.
Responding to your enquiries
Your data will be processed in order to respond to your information requests. Provision of data is optional; however, declining to provide it will prevent the Data Controller from responding to your enquiries. The legal basis for this processing is the Data Controller’s legitimate interest in following up on user requests, which is equivalent to the user’s own interest in receiving a response.
General marketing
Subject to your consent, the Data Controller may process the personal data you provide in order to send you promotional material and/or newsletters relating to its own or third-party products. The legal basis for this processing is your consent. Provision of data for this purpose is entirely optional. Withholding consent will mean you are unable to receive promotional material relating to the Data Controller’s and/or third parties’ products or services, and the Data Controller will be unable to conduct market research — including user satisfaction surveys — or send you newsletters. Such communications will be sent to the email address you provide on the Website.
Profiling
The Data Controller does not carry out “profiling” based on your personal data. You will therefore not receive targeted promotional material and/or newsletters relating to products of specific interest to you.
Data transfer to third parties
The Data Controller does not sell your personal data to third parties.
GeolocaTION
The Website does not implement IP address geolocation tools.
CVs and job applications
You can submit applications and resumes on the website. The privacy policy is available on the dedicated page.
Disclosure of personal data
In the course of its ordinary activities, the Data Controller may disclose your personal data to certain categories of recipients. Article 2 lists the parties to whom the Data Controller may disclose your data. Where applicable, Article 2 also specifies when your data is not shared with third parties.
The “disclosure” of personal data to third parties differs from a “transfer” of ownership (addressed above). In a disclosure, the recipient may only use the data for the specific purposes defined within its relationship with the Data Controller. In a transfer of ownership, the third party becomes an independent Data Controller. Your consent is always required before your personal data may be transferred to third parties in this way.
Notwithstanding the above, the Data Controller may in any case use your personal data to comply with applicable legal obligations.
SPECIFIC PRIVACY NOTICE
Art. 1 Processing methods
1.1 Your personal data will be processed primarily by electronic or automated means, using methods and tools designed to ensure security and confidentiality in accordance with the GDPR.
1.2 The information collected and the processing methods used will be relevant and not excessive in relation to the type of services provided. Your data will also be managed and protected in secure IT environments appropriate to the circumstances.
1.3 No “special categories” of personal data are processed through the Website. Special categories include data revealing racial or ethnic origin, religious, philosophical or other beliefs, political opinions, membership of parties, trade unions, associations or organisations of a religious, philosophical, political or trade union nature, health status, or sexual life.
1.4 No criminal or judicial data is processed through the Website.
Art. 2 Disclosure of personal data
The Data Controller may disclose your personal data to certain categories of recipients, as listed below:
- The Data Controller may disclose your personal data to any parties (including public authorities) who are entitled to access it under applicable laws or administrative measures.
- Your personal data may also be disclosed to public and/or private entities, whether individuals or legal persons (legal, administrative and tax consultants, judicial offices, Chambers of Commerce, employment offices, etc.), where such disclosure is necessary or required for compliance with legal obligations.
- The Data Controller employs staff and/or engages collaborators in various capacities. For the proper functioning of the Website, the Data Controller may disclose your personal data to such employees and/or collaborators.
- In the ordinary management of the Website, the Data Controller engages companies, consultants or professionals responsible for the installation, maintenance, updating and general management of its hardware and software. Your data may therefore also be processed by these parties, but solely for these purposes.
- For sending its communications, the Data Controller uses third-party companies that manage this type of communication (CRM platforms). Your personal data (in particular your email address) may therefore be shared with these companies.
- The Data Controller does not use external companies to provide customer care services.
- Purchasers’ personal data is not shared with couriers or shipping companies.
The Data Controller reserves the right to amend the above list in the course of its ordinary operations. You are therefore encouraged to review this notice regularly to stay informed of any changes to the parties with whom your data is shared.
Art. 3 Retention of personal data
3.1 This article describes how long the Data Controller retains your personal data.
- Your personal data will be retained only for as long as necessary to ensure the proper provision of the services offered through the Website.
- For customer care purposes, data will be deleted once the support service has been completed.
- For marketing purposes, personal data will be retained until consent is withdrawn. For inactive users, personal data will be deleted one year after the last email was opened.
3.2 Notwithstanding Article 3.1, the Data Controller may retain your personal data for as long as required by applicable legislation, as amended from time to time.
Art. 4 Transfer of personal data
4.1 The Data Controller is based within the European Union. Your data is therefore processed in a legally secure environment governed by the GDPR. Where your personal data is transferred to a country outside the EU for which the European Commission has issued an adequacy decision, the transfer is likewise considered legally secure. This Article 4.1 identifies the countries to which your personal data may be transferred and for which an adequacy decision has been issued.
- Your personal data may be transferred to the USA pursuant to the European Commission’s adequacy decision, under which the Commission has determined that the United States provides a level of personal data protection essentially equivalent to that of the European Union.
4.2 Notwithstanding Article 4.1, your data may also be transferred to countries outside the EU for which no adequacy decision has been issued. You are therefore encouraged to review this Article 4.2 regularly to stay informed of any such transfers.
4.3 In this article, the Data Controller identifies any countries to which it specifically directs its activities. This may result in the application of the national legislation of the relevant country alongside the GDPR.
- Upon request, the Data Controller will apply any more favourable provisions of the user’s own national legislation to the processing of their personal data.
Art. 5. Rights of the data subject
Pursuant to Art. 13 of the GDPR, the Data Controller informs you that you have the right to:
- request access to your personal data, as well as its rectification or erasure, restriction of processing, or to object to processing, in addition to the right to data portability;
- withdraw your consent at any time, without affecting the lawfulness of processing carried out on the basis of consent given prior to withdrawal;
- lodge a complaint with a supervisory authority (e.g. the Italian Data Protection Authority — Garante per la protezione dei dati personali).
These rights may be exercised by sending an informal request to the contacts indicated in the Introduction.
Art. 6. Amendments and miscellaneous
The Data Controller reserves the right to amend this notice at any time, giving appropriate notice to Website users and ensuring adequate and equivalent protection of personal data in all cases. You are encouraged to review this notice regularly. In the event of material changes, the Data Controller may also notify you by email.