Information on the processing of personal data

pursuant to Articles 13-14 EU Reg. 2016/679

Ecopack S.p.a., a company based at via della Masolina, 24 – 10040 Piobesi T.se (TO), in its capacity as the Data Controller pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of individuals with regard to the processing of personal data and on the free movement of such data, and Legislative Decree no.101 of 10 August 2018 concerning the “Provisions for the adaptation of national legislation to the provisions of Regulation (EU) 2016/679” repealing Directive 95/46/EC (General Data Protection Regulation) henceforth are referred to as the Applicable Legislation, recognizes the importance of the protection of personal data and considers their protection to be one of the main objectives of its activity. Pursuant therefore to Art. 13 of the Regulation (EU) 2016/679, it provides the following information:

Ecopack S.p.a., via della Masolina, 24 – 10040 Piobesi T.se (TO) VAT no. 05469550015 Tel. +39 011 9657657 e-mail: info@ecopack.com

The data, mainly of a non-specific nature, may be communicated within the limits strictly relevant to the obligations, tasks and purposes referred to in point 2 above to the following categories of third parties exclusively for purposes related to the provision of the services of the Data Controller:

• workers who work for the Data Controller; in particular, based on the roles and duties performed, some of them have been entitled to process personal data, within the limits of their competences and in accordance with the instructions given;

• public and private bodies, also as a result of inspections or verifications or for the fulfilment of obligations deriving from the Law or from mandatory Regulations, from Community Regulations or from National Regulationse;

• external natural and/or legal persons who provide services to the activities of the Data Controller, data processing centres and/or service companies external to our organization but strictly related to it for operational purposes for the aforementioned purposes and who act as Data Processors pursuant to Article 28 of Regulation (EU) 2016/679;

• affiliated companies and subsidiaries of Ecopack S.p.a. in order to provide the services, depending on the geographical location from which the Clients request the services. Some personal data of Clients may be transmitted to foreign companies of the group. Upon registration on the platform, we inform all the customers from any place in Italy that the data will be stored in the database of the data controller located in Italy;

• Transfer of property. In the event that the ownership of Ecopack S.p.a. changes or that most of its assets are acquired by third parties, Customers will be informed that Ecopack S.p.a. will transfer the data to the purchasing companies in order to continue to provide the services subject to data processing.

The updated list of any Data Processors, pursuant to Article 28 of Regulation (EU) 2016/679, is available by contacting the administrative office of the Data Controller, upon legitimate interest of the data subject to receive such information. The Data Controller does not intend to transfer the personal data it holds to a third country or to international organizations. However, we reserve the right to use cloud technology services. In this case, cloud service providers will be selected from those who provide appropriate and appropriate guarantees, as required by art. 46 of Regulation (EU) 2016/679.
The Data Controller also guarantees that the commercial partners, technicians, suppliers, or independent third parties connected by contractual obligations with Ecopack S.p.a. in the processing of the information shared follow the instructions provided by the Data Controller, this Policy, as well as the applicable law on data protection. Personal data will not be transferred to any third party who is not subject to the instructions and none of the disclosures of the above data includes the sale, rental, sharing or disclosure of customer personal information for commercial purposes in terms contrary to the commitments made in this Privacy Policy.

The type of processed data is the following: Name, Surname, Email address, company name and other personal data indicated on the business card (exhibition context) or freely provided as they are included in the text of the message (website) sent to Ecopack S.p.a. In this case, the Data Controller learns that the personal data provided by the customer and referred to third parties who have expressly authorized him/her to provide them assumes all legal obligations and responsibilities. In this sense, the Client confers on this point the widest indemnity with respect to any objection, claim, request for compensation for damages from processing, etc. that should reach the Data Controller from third parties, whose personal data have been communicated by the Customer.

The processing of your data is carried out through the operations indicated in article 4, paragraph 2 or Regulation (UE) 2016/679 and are, in detail: the collection, recording, organization, conservation, consultation, processing, modification, selection, extraction, comparison, use, interconnection, blocking, communication, erasure and destruction of the data. Your personal data may be processed both on paper and electronically and in any case in compliance with the appropriate security measures pursuant to Article 5 paragraph 1 letter f) of Regulation (EU) 2016/679 “by means of appropriate technical and organisational measures in order to protect them from unauthorised or unlawful processing, from loss, destruction or accidental damage thus preserving their integrity and confidentiality” and in accordance with the principles of correctness, lawfulness and transparency and protection of the rights of the data subject. The processing is carried out directly by the organisation of the Data Controller and by the Data Processors appointed by the Data Controller pursuant to Article 28 of Regulation (EU) 2016/679. The Data Controller will process personal data for the time necessary to fulfil the purposes described above in 2) of this policy. In order to guarantee the provisions of Article 13, point 2 letter a) of Regulation (EU) 2016/679 regarding the communication of the retention period of the processed data or the criteria used to determine this period, the Data Controller communicates that the data retention times comply with the provisions of the current provisions on civil and tax matters. Regarding the data retention times for commercial purposes, the duration of retention in the archives and the company CRM is 60 months from the date of receipt. The data subject has the right to request the Data Controller to delete the personal data concerning him/her, except in cases that do not fall under mandatory processing on a legal basis established by law or unless his/her consent is revoked, or the exercise of the rights indicated in point 9 below is exercised.

All processing is carried out in accordance with the procedures laid down in Articles 6, 32 of the GDPR and taking the appropriate security measures as required. Regarding the retention time, please note that, in accordance with the principles of lawfulness, purpose limitation and data minimisation, pursuant to Article 5 GDPR, the storage period of your personal data is set for a period of time not exceeding the duration of the services provided and the achievement of the purposes for which it is collected and processed.

The data processed in paper format are retained in special cabinets in the offices of the registered office of the Data Controller and made inaccessible to uninformed and/or authorised personnel on the methods of processing personal data. The data stored in digital format are allocated within the systems prepared by the Data Controller and digitally stored in environments and structures compliant with Regulation (EU) 2016/679 for protection and solidity, or, where the data processed requires so, they will be encrypted. Your personal data may also be transferred, limited to the purposes described above, to EU Member States. In the event that the data controller decides to use cloud services where to store personal data, they will be chosen from those who provide the maximum guarantees of security and adequacy with respect to the GDPR.

The Data Controller informs the data subjects that by communicating the data and information, they accept an analysis of the data entered therein and grant the Data Controller the possibility of using automated decision-making processes including profiling. These processes will not in any way affect the use of the service but will give the data controller the opportunity to perform profiling procedures as expressed in art.22 par. 1 and 4 of Regulation (EU) 2016/679 in order to provide a service as accurate as possible, aimed at customer satisfaction and better efficiency.

Your personal data may be processed both in paper and digital form in compliance with the appropriate security measures pursuant to Article 5, point 1 letter f) of Regulation (EU) 2016/679.

With reference to Articles 15 (right of access), 16 (right of rectification), 17 (right to erasure), 18 (right to restriction of processing), 20 (right to portability), 21 (right to object), 22 (right to object to automated decision-making) of Regulation (EU) 2016/679, the data subject may at any time exercise their rights. All requests relating to the exercise of one or more rights must be completed by sending a registered letter with return receipt to:
Ecopack S.p.a., via della Masolina, 24 – 10040 – Piobesi T.se (TO)
or an email to the address info@ecopack.com specifying the purpose of the request and the right to be exercised.

The provision of personal data for the purposes listed above in point 2 is mandatory since failure to provide them would make it impossible to find a request or fulfil a legal and/or contractual obligation to which the Data Controller is subject with respect to the data subject.
If the treatment is based on art. 6, paragraph 1, letter a), or on art. 9, paragraph 2, letter a) of the Regulation (EU) 2016/679, the interested party may exercise the right to withdraw the consent given at any time without prejudice to the lawfulness of the treatment based on the consent given before the withdrawal.

Without prejudice to any other administrative or judicial appeal, the interested party who considers that the processing that concerns him/her violates Regulation (EU) 2016/679, has the right to lodge a complaint with the competent supervisory authority as provided for by art. 77 or to appeal to the appropriate judicial offices as provided for by art. 79 of Regulation (EU) 2016/679.

Having read the privacy policy reported here and including all the information contained, I give my consent for the analysis of preferences aimed at sending promotional communications relating to products for which a specific interest has been expressed.