Data protection (privacy)

The Controller handles personal identity data (for example name, surname, company name, address, telephone number, e-mail, bank and payment details - henceforth "personal data" or simply "data") provided by you when defining the contract for the Controller's products or services.

Your personal data is handled:

2. A) Pursuant to Art. 6, chap. b) and c) of the GDPR, for the following purposes:

• Implementation of the contractual agreement with you, or the execution of pre-contractual measures adopted on your request;
• Fulfillment of pre-contractual, contractual and fiscal obligations deriving from the existing relationship with you;
• Fulfillment of legal obligations, regulations, EC norms or orders from an authority (such as for example under anti-laundering rules);
• Execution of the Controller's rights, for example, the right of defense by the judiciary;

We would like to inform you that if you are already one of our customers, we may send you commercial material relating to the Controller's products or services, similar to those already purchased by you from our company in a previous transaction unless you have requested otherwise.

2. B) Only if your explicit consent has been given (GDPR Art. 7), for the following marketing purposes:

• Send you e-mails, internet, social media, post and/or SMS and/or telephone calls, newsletters, marketing communication and/or advertising material on products or services offered by the Controller, as well as satisfaction surveys relating to the quality of products/services;
• Send you e-mails, internet, social media, post and/or SMS and/or telephone calls, marketing and/or advertising communications from third parties (for example business partners, insurance companies, companies of the VMC group).

In case you have given consent to authorize a specific processing, You are free to withdraw the consent to the processing at any moment, by contacting the Controller in the modes indicated in art. 9).

Such withdrawal, anyhow, does not compromise the lawfulness based on the consent given before the withdrawal.

The processing of your personal data is by one of the methods indicated in Art. 4, point 2) of the GDPR, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction of data. Your personal data is processed both electronically or as a hard copy, whether or not by automated means.

The Controller will process personal data for the period required for the execution of the purposes detailed in art. 2.A), and in any case for no more than 10 years from the end of the relationship in the purpose above, and for no longer than 5 years from the collection of the data for marketing purposes di in art.2.B).

Your personal data may be made accessible for the purposes detailed in Art. 2 paragraphs A) and B):

• to employees and collaborators of the Controller or companies of the VMC group, in Italy and abroad, in so much as authorised parties and/or internal representatives for processing and/or system administrators;

to third party companies or other subjects (for example, credit brokers, professional studios, consultants, insurance companies providing insurance services, etc.) that carry out outsourcing activities on behalf of the Controller, in their role as external processing managers.

Without the requirement for express consent (as per Art. 6 par. b) and c) of GDPR), the Controller may communicate your data for the purposes indicated in Art. 2 A9 to security organisations, judicial authorities, insurance companies providing insurance services, as well as subjects to which communication is required by law for the completion of the aforementioned purposes. These subjects will process the data autonomously as data Controllers.

Your data will not be diffused.

Personal data is kept on a company server, located in Italy, inside the European Union. It should be noted however that the Controller, if it deems necessary, reserves the right to move data outside of the European Union. In that case, the Controller shall ensure that the transfer of data outside of the European Union will be in compliance with applicable legal requirements, and subject to the adoption of the standard contractual clauses required by the European Commission.

The provision of data for the purposes indicated in Art. 2 par. A) is obligatory. Without them, we cannot guarantee execution of the contract detailed in Art. 2 A).

The provision of data for the purposes detailed in Art. 2 B) is optional. You can decide to not provide any data or withdraw consent at a later date for data already provided: in this case you will not receive any newsletters, commercial communications and advertising material relating to the Controller's products and services. Your rights to products and services detailed in Art. 2 A). remain unchanged.

In accordance with the G.D.P.R.:

• The data subject shall have the right to obtain from the controller restriction of processing in situations foreseen by art. 15 of the GDPR, possibly receiving a copy where this does not harm others’ rights and freedom;
• The data subject shall have the right to obtain from the controller without undue delay the rectification of inaccurate personal data concerning him or her. Taking into account the purposes of the processing, the data subject shall have the right to have incomplete personal data completed, including by means of providing a supplementary statement;
• The data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay and the controller shall have the obligation to erase personal data without undue delay;
• The data subject shall have the right to obtain from the controller restriction of processing in one the cases foreseen by’art. 18 of the GDPR;
• Right to data portability, meaning that the data subject shall have the right to receive the personal data concerning him or her, which he or she has provided to a controller, in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller without hindrance from the controller to which the personal data have been provided;
• The data subject shall have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her. This right does not apply in the cases regulated by art. 22, paragraph 2 of the GDPR.

In order to exercises the above mentioned rights, You can contact in any moment the Controller as indicated in art. 9).

RIGHT TO OBJECT
Pursuant to art. 21, paragraph 4 of the GDPR, the Controller reminds that:

The data subject shall have the right to object, on grounds relating to his or her particular situation, at any time to processing of personal data concerning him or her which is based on point (e) or (f) of Article 6(1), including profiling based on those provisions. The controller shall no longer process the personal data unless the controller demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defence of legal claims. Where personal data are processed for direct marketing purposes, the data subject shall have the right to object at any time to processing of personal data concerning him or her for such marketing, which includes profiling to the extent that it is related to such direct marketing.

Where the data subject objects to processing for direct marketing purposes, the personal data shall no longer be processed for such purposes.

In order to exercises the above mentioned right of opposition you can contact in any moment the Controller as indicated in art. 9).


RIGHT TO LODGE A COMPLAINT WITH A SUPERVISORY AUTHORITY
Without prejudice to any other administrative or judicial remedy, every data subject shall have the right to lodge a complaint with a supervisory authority.

You may, at any time, exercise your rights by sending:

- A letter by registered mail to the headquarters of the Controller;

- a request, by filling in the form “exercise your rights” at the following link 

The Controller of processed data is VMC S.p.A., having headquarters in 36051 Creazzo (VI), Via Palazzon, n. 35; contact information is available on the company website www.vmcitaly.com.

The updated list of responsible and authorised parties is kept at the headquarters of the data Controller.