REFERENCE LEGISLATION
The European General Data Protection Regulation 2016/679 (GDPR), published in the Official Journal of the European Union on May 4, 2016, went into effect on May 25, 2018 and has the force of law for all European countries. The GDPR establishes rules related to the protection of natural persons regarding the processing of personal data, as well as rules on the free movement of these data. The GDPR protects the fundamental rights and freedoms of natural persons, particularly the right to the protection of personal data.
The principle of accountability shapes the entire structure of the GDPR, and this new regulation repeals Directive 95/46/EC (the Data Protection Directive).
CCI SpA has an organizational, technological, and process model that meets GDPR requirements. Based on these management systems, CCI SpA has put in place controls, procedures, information, and continuous improvement mechanisms aimed at ensuring that the processing of personal data by the company and by any possible data processors that, in its name or on its behalf, must carry out processing, takes place according to the provisions of the European regulation. CCI SpA promotes the respect, by its employees and collaborators, for high moral values and integrity of conduct, requiring the proper use of the personal information that comes into their possession in the performance of their working activity. As a result of their activities and their requests, service users, suppliers, and employees of CCI SpA may provide personal data that are processed in order to carry out the relevant activities.
The data processor is:
CCI SpA Via Regona, 3 – 26026 Pizzighettone (CR), Italy
ABOUT US
CCI SpA is a leading company in the national and international markets for semi-finished copper products. With a production capacity of over 270,000 tons/year and more than 60 years of experience, we are an ideal partner thanks to our workmanship, business experience, flexibility, and competitiveness, for all manufacturing and commercial companies in the electromechanical, electronic, and plant engineering industries. Our GDPR data protection officer can be contacted directly:
DEFINITIONS (ARTICLE 4 GDPR)
- Personal data: any information relating to an identified or identifiable natural person (“data subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
- Special categories of personal data: personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation.
- Data controller: the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law.
- Data subject: any living natural person who is the subject of personal data held by an organization.
- Processing: any operation or set of operations performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
- Lawfulness (Article 6 GDPR): The processing carried out by CCI SpA takes place exclusively in compliance with the criteria for lawfulness set out in the GDPR (Article 6) and in particular only with consent from the data subject or for the performance of a contractual or legal obligation. For special categories of personal data, express consent will also be requested in a clear and explicit way.
- Consent: In the cases in which the processing is based on consent, this must be given in writing or in digital form via the institutional website or in any case in a demonstrable way and only after having carefully read the relevant information. In the case of special categories of data to which the exceptions mentioned in paragraph 2 of Article 9 GDPR refer, explicit consent will be requested. Consent from the holder of parental responsibility will be necessary in the case of children under 16 (Article 8). It is possible to revoke consent at any time.
- Transfer of data to third parties: CCI SpA will not transfer your data to third parties without having first obtained your consent.
- Storage period: Carlo Colombo Spa will process the personal data for [state how long it is intended to process the data subject’s personal data] and will archive the personal data [state the storage period of the personal data and provide additional information on how the storage period was established].
- Cookies: no personal data of users is acquired in this regard by the CCI SpA site “www.cci.eu.” Cookies are not used to transfer information of a personal nature, nor are persistent cookies of any kind used, or systems to track users. The use of session cookies (which are not permanently stored on the user’s computer and disappear when the browser is closed) is strictly limited to the transmission of session identifiers (consisting of random numbers generated by the server) necessary to enable safe and efficient browsing of the site. The session cookies used on this site avoid the use of other IT techniques that are potentially detrimental to the privacy of users’ browsing and do not enable the acquisition of the user’s personal identification data.
YOUR RIGHTS AS DATA SUBJECT
At any time, while we hold or process your personal data, you, the data subject, have the following rights:
- Right of access: You have the right to request a copy of the information we hold on you.
- Right to rectification: You have the right to correct any data we hold on you that are inaccurate or incomplete.
- Right to be forgotten: In some cases, you can ask for the data we hold on you to be erased from our files.
- Right to restriction of processing: Where certain conditions apply to have the right to restrict processing.
- Right to data portability: You have the right to transfer the data in our possession to another organization as long as these data are stored in digital format.
- Right to object: You have the right to object to certain types of processing such as e.g. direct marketing.
- Right to object to automated processing, including profiling.
- Right to appeal to the judicial authority: If CCI SpA refuses your request based on rights of access, we will give you the reasons. You will have the right to appeal to the judicial authority, as described in the next clause.
COMPLAINTS
Contact details are provided below:
Data protection officer contact details
Roberto Franchi
Via Regona 3 – 26026 Pizzighettone (CR)
E-mail: GDPR@cci.eu
Telephone: +39 0372 738311
Italian national data protection authority contact details
E-mail: garante@gdpd.it
PRIVACY POLICY
Personal Data
According to the European General Data Protection Regulation (GDPR), personal data are defined as: “any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.”
How we use your information
This privacy policy explains how CCI SpA will collect and use your personal data to outline further information on services and activities that collect personal data, e.g.: cookies, profiling, complaints, subscriptions, etc.
Why does CCI SpA need to collect and store my personal data?
To enable us to provide you with a service, we need to collect personal data for the purpose of matching and/or providing detailed services. In any case, we undertake to guarantee that the information we collect and use is appropriate for this purpose and does not intrude on your privacy. If you are contacted for marketing purposes, CCI SpA will ask you for further consent.
Will CCI SpA communicate my personal data to others?
We may transfer your personal data to third parties that provide services on behalf of the company in the course of the relationship (data processors). Any third parties with which we share your data are obliged to store them safely and use them only to provide the service they are providing on our behalf. When they no longer need your data to provide this service, they will erase them in line with CCI SpA’s procedures. If we need to transfer your sensitive personal data to third parties, we will only do so after having obtained your consent, unless legally required to do otherwise.
How does CCI SpA use the personal data concerning me?
CCI SpA will process (collect, store, and use) the information provided in a way compatible with the European General Data Protection Regulation (GDPR). We will do everything possible to keep your information accurate and up to date and not hold it for a period longer than necessary. CCI SpA is required to keep certain information in accordance with the law, such as the information required for income tax or for investigations. The period during which some types of personal data are stored may also be stipulated by specific requirements of the business sector or by agreed practices. Personal data may be kept beyond these periods depending on specific business needs.
Under what circumstances will CCI SpA contact me?
Our aim is to avoid interfering and we are committed to only asking relevant and useful questions. Moreover, the information provided will be subject to rigorous measures and procedures to minimize the risk of unauthorized access or disclosure.
Can I access the personal data the organization holds on me?
Upon your request, CCI SpA can confirm what information we hold on you and how it is processed.
If CCI SpA holds personal data concerning you, you can request the following information:
- Identity and contact details of the person or organization that has determined how and why the data are processed.
- Contact details of the data protection officer, where appropriate.
- The purposes of the processing as well as the legal basis for the processing.
- If the processing is based on the legitimate interests of CCI SpA or a third party, information concerning these interests.
- The categories of personal data collected, archived, and processed.
- Recipients or categories of recipients to whom the data may or might be communicated.
- If we intend to transfer the personal data to a third country or international organization, information on how we ensure that this occurs securely. The EU has approved the sending of personal data to some countries because they meet minimum data protection standards. In other cases, we will ensure that specific measures are in place to protect your information.
- How long your data will be stored.
- Details on your rights to rectify, erase, restrict, or object to processing.
- Information on your right to withdraw consent at any time.
- How to file a complaint with the supervisory authority.
- If the provision of personal data is a statutory or contractual requirement, or a requirement necessary to enter into a contract, as well as whether the data subject is obliged to provide the personal data and of the possible consequences of failure to provide such data.
- The source of the personal data if they were not collected directly from you.
- All the details and information on the automated decision-making process, such as profiling, and meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing.
Which identity documents will I need to provide to access this service?
CCI SpA accepts the following documents when information about your personal data is requested:
To exercise your right of access, you may use the data access form provided.
How can I withdraw my consent to the processing of my personal data?
To exercise your right of access, you may use the data withdrawal form provided.