Information on the processing of personal data

pursuant to Articles 13-14 EU Reg. 2016/679

Ecopack S.p.a., a company based at via della Masolina, 24 – 10040 Piobesi (TO), in its capacity as the Data Controller pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of individuals with regard to the processing of personal data and on the free movement of such data, and Legislative Decree no.101 of 10 August 2018 concerning the “Provisions for the adaptation of national legislation to the provisions of Regulation (EU) 2016/679” repealing Directive 95/46/EC (General Data Protection Regulation) henceforth are referred to as the Applicable Legislation, recognizes the importance of the protection of personal data and considers their protection to be one of the main objectives of its activity. Pursuant therefore to Art. 13 of the Regulation (EU) 2016/679, it provides the following information:

1. Identity of the Data Controller

Ecopack S.p.a., via della Masolina, 24 – 10040 Piobesi (TO) VAT no. 05469550015 Tel. +39 011 9657657 e-mail:

2. Purpose and lawfulness of processing

The personal data obtained may be legitimately processed for the purpose of direct contact. These data have been voluntarily communicated via the channels described below.

• Ecopack S.p.a. uses the data collected by the persons who freely decide to enter their personal data in the contact form available on the company website page, or within the company contact email;

• Ecopack S.p.a. uses the data collected during trade fairs, exhibitions, shows, exhibitions, and any industry event through the collection of business cards both in paper and digital format voluntarily left by the attending guests.

• If the petitioner wishes to be contacted by telephone, the company will contact the number or the business card provided by the petitioner.

• Ecopack S.p.a. uses third-party technology, integrated into company systems, in order to collect data and preferences and use them with CRM systems and advanced technologies for the benefit of customers. In this way, the following data processing is carried out in the use of the information collected: archiving in the registry by contact after the date of communication of personal references.

With your consent, your personal data may also be used for the following purposes:

• Sending e-mail messages containing information, promotions and/or offers relating to products and services that may be of interest to the customer. Ecopack S.p.a. reserves the right to manage and customize the offers, the subjects of the communications according to the preferences of the Customers. If the customer no longer wishes to receive the information and/or commercial communications, he/she can at any time choose the “Unsubscribe” option in the email or by clicking on the appropriate space located at the bottom of the contact section on the site, consequently, Ecopack S.p.a. will immediately stop sending the aforementioned information.

The provision of data is optional with regard to the purposes inherent to commercial communications, and any refusal to process does not compromise the continuation of the relationship or the adequacy of the processing itself, from which only the activities related to the promotion of products and/or services and the consequent activities (marketing) would be excluded.

3. Access, communication, and data transfer.

The data, mainly of a non-specific nature, may be communicated within the limits strictly relevant to the obligations, tasks and purposes referred to in point 2 above to the following categories of third parties exclusively for purposes related to the provision of the services of the Data Controller:

• workers who work for the Data Controller; in particular, based on the roles and duties performed, some of them have been entitled to process personal data, within the limits of their competences and in accordance with the instructions given;

• public and private bodies, also as a result of inspections or verifications or for the fulfilment of obligations deriving from the Law or from mandatory Regulations, from Community Regulations or from National Regulationse;

• external natural and/or legal persons who provide services to the activities of the Data Controller, data processing centres and/or service companies external to our organization but strictly related to it for operational purposes for the aforementioned purposes and who act as Data Processors pursuant to Article 28 of Regulation (EU) 2016/679;

• affiliated companies and subsidiaries of Ecopack S.p.a. in order to provide the services, depending on the geographical location from which the Clients request the services. Some personal data of Clients may be transmitted to foreign companies of the group. Upon registration on the platform, we inform all the customers from any place in Italy that the data will be stored in the database of the data controller located in Italy;

• Transfer of property. In the event that the ownership of Ecopack S.p.a. changes or that most of its assets are acquired by third parties, Customers will be informed that Ecopack S.p.a. will transfer the data to the purchasing companies in order to continue to provide the services subject to data processing.

The updated list of any Data Processors, pursuant to Article 28 of Regulation (EU) 2016/679, is available by contacting the administrative office of the Data Controller, upon legitimate interest of the data subject to receive such information. The Data Controller does not intend to transfer the personal data it holds to a third country or to international organizations. However, we reserve the right to use cloud technology services. In this case, cloud service providers will be selected from those who provide appropriate and appropriate guarantees, as required by art. 46 of Regulation (EU) 2016/679.
The Data Controller also guarantees that the commercial partners, technicians, suppliers, or independent third parties connected by contractual obligations with Ecopack S.p.a. in the processing of the information shared follow the instructions provided by the Data Controller, this Policy, as well as the applicable law on data protection. Personal data will not be transferred to any third party who is not subject to the instructions and none of the disclosures of the above data includes the sale, rental, sharing or disclosure of customer personal information for commercial purposes in terms contrary to the commitments made in this Privacy Policy.

4. Type of data processed

The type of processed data is the following: Name, Surname, Email address, company name and other personal data indicated on the business card (exhibition context) or freely provided as they are included in the text of the message (website) sent to Ecopack S.p.a. In this case, the Data Controller learns that the personal data provided by the customer and referred to third parties who have expressly authorized him/her to provide them assumes all legal obligations and responsibilities. In this sense, the Client confers on this point the widest indemnity with respect to any objection, claim, request for compensation for damages from processing, etc. that should reach the Data Controller from third parties, whose personal data have been communicated by the Customer.

5. Method and duration of the processing

The processing of your data is carried out through the operations indicated in article 4, paragraph 2 or Regulation (UE) 2016/679 and are, in detail: the collection, recording, organization, conservation, consultation, processing, modification, selection, extraction, comparison, use, interconnection, blocking, communication, erasure and destruction of the data. Your personal data may be processed both on paper and electronically and in any case in compliance with the appropriate security measures pursuant to Article 5 paragraph 1 letter f) of Regulation (EU) 2016/679 “by means of appropriate technical and organisational measures in order to protect them from unauthorised or unlawful processing, from loss, destruction or accidental damage thus preserving their integrity and confidentiality” and in accordance with the principles of correctness, lawfulness and transparency and protection of the rights of the data subject. The processing is carried out directly by the organisation of the Data Controller and by the Data Processors appointed by the Data Controller pursuant to Article 28 of Regulation (EU) 2016/679. The Data Controller will process personal data for the time necessary to fulfil the purposes described above in 2) of this policy. In order to guarantee the provisions of Article 13, point 2 letter a) of Regulation (EU) 2016/679 regarding the communication of the retention period of the processed data or the criteria used to determine this period, the Data Controller communicates that the data retention times comply with the provisions of the current provisions on civil and tax matters. Regarding the data retention times for commercial purposes, the duration of retention in the archives and the company CRM is 60 months from the date of receipt. The data subject has the right to request the Data Controller to delete the personal data concerning him/her, except in cases that do not fall under mandatory processing on a legal basis established by law or unless his/her consent is revoked, or the exercise of the rights indicated in point 9 below is exercised.

All processing is carried out in accordance with the procedures laid down in Articles 6, 32 of the GDPR and taking the appropriate security measures as required. Regarding the retention time, please note that, in accordance with the principles of lawfulness, purpose limitation and data minimisation, pursuant to Article 5 GDPR, the storage period of your personal data is set for a period of time not exceeding the duration of the services provided and the achievement of the purposes for which it is collected and processed.

6. Data location

The data processed in paper format are retained in special cabinets in the offices of the registered office of the Data Controller and made inaccessible to uninformed and/or authorised personnel on the methods of processing personal data. The data stored in digital format are allocated within the systems prepared by the Data Controller and digitally stored in environments and structures compliant with Regulation (EU) 2016/679 for protection and solidity, or, where the data processed requires so, they will be encrypted. Your personal data may also be transferred, limited to the purposes described above, to EU Member States. In the event that the data controller decides to use cloud services where to store personal data, they will be chosen from those who provide the maximum guarantees of security and adequacy with respect to the GDPR.

7. Automated decision-making processes, profiling

The Data Controller informs the data subjects that by communicating the data and information, they accept an analysis of the data entered therein and grant the Data Controller the possibility of using automated decision-making processes including profiling. These processes will not in any way affect the use of the service but will give the data controller the opportunity to perform profiling procedures as expressed in art.22 par. 1 and 4 of Regulation (EU) 2016/679 in order to provide a service as accurate as possible, aimed at customer satisfaction and better efficiency.

8. Security measures

Your personal data may be processed both in paper and digital form in compliance with the appropriate security measures pursuant to Article 5, point 1 letter f) of Regulation (EU) 2016/679.

9. Rights and methods of exercise by the data subject

With reference to Articles 15 (right of access), 16 (right of rectification), 17 (right to erasure), 18 (right to restriction of processing), 20 (right to portability), 21 (right to object), 22 (right to object to automated decision-making) of Regulation (EU) 2016/679, the data subject may at any time exercise their rights. All requests relating to the exercise of one or more rights must be completed by sending a registered letter with return receipt to:
Ecopack S.p.a., via della Masolina, 24 – 10040 – Piobesi (TO)
or an email to the address specifying the purpose of the request and the right to be exercised.

10. Expression of consent, revocation, and provision of data

The provision of personal data for the purposes listed above in point 2 is mandatory since failure to provide them would make it impossible to find a request or fulfil a legal and/or contractual obligation to which the Data Controller is subject with respect to the data subject.
If the treatment is based on art. 6, paragraph 1, letter a), or on art. 9, paragraph 2, letter a) of the Regulation (EU) 2016/679, the interested party may exercise the right to withdraw the consent given at any time without prejudice to the lawfulness of the treatment based on the consent given before the withdrawal.

11. Complaints

Without prejudice to any other administrative or judicial appeal, the interested party who considers that the processing that concerns him/her violates Regulation (EU) 2016/679, has the right to lodge a complaint with the competent supervisory authority as provided for by art. 77 or to appeal to the appropriate judicial offices as provided for by art. 79 of Regulation (EU) 2016/679.

Expression of consent to the sending of information material (profiled marketing)

Having read the privacy policy reported here and including all the information contained, I give my consent for the analysis of preferences aimed at sending promotional communications relating to products for which a specific interest has been expressed.