INFORMATION ON THE PROCESSING OF PERSONAL DATA OF WEBSITE USERS

The owner of this site, Mario Caimi srl, in compliance with its obligations under national law^[1] and Community (hereinafter GDPR^[2] or Regulation) as amended, respects and protects the confidentiality of users/visitors by implementing appropriate and proportionate security measures so as not to infringe their rights.

This policy applies exclusively to the online activities of this site, in particular the filling in of forms, requests for information or any other form of interaction with the site that involves the communication of personal data by the user. With it, the Data Controller pursues the objective of providing maximum transparency regarding the information that the site collects and how it uses it.

The processing will be based on the principles of lawfulness, correctness, transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity, confidentiality and accountability.

Pursuant to articles 13 and 14 of the GDPR and current legislation, the following information is provided regarding the processing that Mario Caimi srl will carry out with your personal data:

1. Subjects of treatment

The Data Controller is Mario Caimi srl, having its registered office in Via Villoresi 64/G – 20029, Turbigo (MI), C.F./P.IVA IT07990070158, who can be contacted using the e-mail address info@caimi.net, or the certified e-mail address (PEC) caimi@megapec.eu.

2. Method of processing and type of data collected

The Data Controller adopts all the technical and organisational measures suitable for securing the personal data processed. In particular, these measures are aimed at preventing unauthorised access, disclosure, modification or destruction of the data, which will be collected, processed and stored in the archives, both hard copy and electronic, of the Data Controller and/or internal authorised parties and external Managers expressly authorised for this purpose. The processing will be carried out with the aid of both hard copy and computerised or electronic means, with personal data being organised and processed in such a way as to guarantee their security and confidentiality.

The Data Controller may process certain personal data of users who interact with the site’s web services, in particular:

• browsing data: IP addresses, URI notation addresses, etc. may be automatically acquired by computer systems when using the site^[3], the type of browser and the parameters of the device used to connect to the site, the name of the Internet Service Provider (ISP), the web page the visitor came from^[4] and exit, as well as details of the date and time of the visit, the requests sent to the site’s server and which make navigation possible. Browsing data may also be used to compile anonymous statistics in order to understand the use of the site and to improve its structure. Surfing data may possibly be used for the detection of illegal activities, such as computer crimes, to the detriment of the site;
• contact details (name and surname, e-mail address, company name and telephone number), possibly of an economic and fiscal nature (in the event, for example, that an invoice is requested), necessary for the performance of existing or future contractual relationships with users.

No ‘special categories’ of personal data, i.e. data that can be qualified as sensitive, are collected and processed in any way^[5].

3. Purpose of processing

The data provided by the user or communicated by third parties will be processed for the following purposes:

1. registration to the website, to the services developed or made available by the Controller, use of related information services, handling of contact or information requests;
2. Establishment of contractual relations and consequent administrative, legal and tax obligations, as well as to enable effective management of financial and commercial relations;
3. fulfilment of obligations under EU and national regulations;
4. verification of the proper functioning of the site and for security reasons, in order to block attempts to damage the site or cause damage to other users and in any case to ascertain and repress harmful or criminal activities.

By accessing the “Contacts” section, the site allows the visitor/user to enter messages and other information. The voluntary and explicit forwarding of such information does not require any request for consent, and the filling in of specifically prepared forms entails the subsequent acquisition of the address and data of the visitor/user, necessary to respond to the requests made and/or to provide the service requested.

The information that users of the site decide to make public by means of the services and tools made available to them is provided by the user knowingly and voluntarily, with the Owner exempt from any liability in respect of possible violations that may be committed as a result. In fact, it is up to the user to obtain any permissions to enter personal data of third parties or content protected by national and international regulations.

4. Legal basis of personal data processing

The provision of personal data for the purposes referred to in points 3-a) and 3-b) is compulsory, as the processing is connected to a pre-contractual and/or contractual phase or is functional to a request made by the Data Subject or required by a specific regulation. Failure by the Data Subject to provide certain personal data in relation to the aforesaid purposes may prevent the Controller from providing its services.

The data collected and processed for the purposes of security of the site and for the prevention of abuse and unlawful activities referred to in point 3-e), as well as data for the analysis of site traffic (statistics) in aggregate form, are processed on the basis of the legitimate interest of the Owner to protect the proper functioning of the site, as well as to protect the users themselves. In such cases, the user may exercise the right to object at any time (see section 9. ‘Rights of the Data Subject’).

5. Using Cookies

Cookies are small text files that the site sends to users’ terminals and are used to perform computer authentication, session tracking, storing information on specific configurations, storing preferences and more. This site uses cookies mainly to improve the browsing experience by measuring and analysing aggregated and anonymised browsing data.

For information on the cookies used, as well as on the management, setting and deactivation of cookies, users can consult the appropriate section of the site and follow the procedures provided for this purpose.

6. Destinatari dei dati personali

The data will not be disclosed by the Controller to unspecified parties in any way, not even by making them available or consulting them.

The data will be stored at the Controller’s premises and may instead be disclosed to specific persons so defined:

• authorised persons involved in the organisation of the site^[6];
• external subjects^[7] delegated for this purpose to specific processing activities and duly appointed as Data Processors pursuant to Article 28 of the Regulation, in accordance with the applicable legislation and limited to the purposes of the professional services required and necessary;
• subjects whose right to access the data is recognised by law or by orders of the authorities;
• any third countries or international organisations, if for technical and/or operational reasons it is necessary to transfer some collected data to technical systems and cloud-managed services located outside the European Union area^[8]. In this case, processing will be regulated in accordance with the provisions of Chapter V of the GDPR and authorised on the basis of specific decisions of the European Union and the Data Protection Authority.

The full list of all persons responsible for and authorised to process personal data can be requested by writing to the e-mail address info@caimi.net, or by ordinary mail to Via Villoresi 64/G – 20029, Turbigo (MI).

7. Place of processing

The data collected by the site are processed at the Data Controller’s premises and at the Web Hosting’s datacenter. The Web Hosting (Serverplan srl societá unipersonale), in its capacity as Data Processor, processes personal data on behalf of the Data Controller in accordance with European standards.

8. Personal data retention period

The data collected will be processed exclusively for the purposes indicated above and stored for the time strictly necessary to provide the requested service. In any case, this period of time will not extend beyond 10 years, after which the Data Controller will automatically delete the personal data collected.

9. Rights of the Data Subject

The Rules reserve specific rights to users/interested parties. In particular, the Interested Party may at any time exercise the right to:

• access their personal data, obtain confirmation as to whether or not personal data relating to them are being processed and, if so, be informed as to the purposes pursued by the Controller, the categories of data involved, the recipients to whom the data may be disclosed, the applicable retention period, the existence of automated decision-making processes;
• obtain the rectification of inaccurate personal data concerning him/her without undue delay;
• obtain, where applicable, the deletion of personal data concerning him/her without undue delay;
• obtain, in the cases provided for, the restriction of the processing;
• request the portability of the data he/she has provided to the Controller, i.e. to receive them in a structured, commonly used and machine-readable format, also for the purpose of transmitting such data to another Data Controller without hindrance from the Controller to whom he/she has provided them, within the limits established by Article 20 of the Regulation;
• to object at any time, on grounds relating to his particular situation, to the processing of personal data concerning him, in the cases provided for by the Regulation;
• withdraw his or her consent at any time, with the same ease with which it was given;
• to lodge a complaint with the Data Protection Authority;
• obtain all available information on the origin of the personal data, if they have not been collected from the data subject himself;
• receive notice without undue delay in the event of a ‘data breach’, i.e. if the breach of their personal data presents a high risk for their rights and freedoms
  to be informed of the existence of adequate safeguards if personal data are transferred to a third country or to international organisations.

All of the above rights may be exercised at the request of the interested party by writing directly to info@caimi.net.

This notice may be subject to periodic updates.

Personal data controller
Mario Caimi srl

__________________

[1] D. Legislative Decree No. 196/2003, Personal Data Protection Code, as amended by Legislative Decree 101/2018;

[2] European Data Protection Regulation No. 2016/679;

[3] Uniform Resource Identifier;

[4] referral;

[5] pursuant to Article 4 of the Code and Article 9 of the GDPR;

[6] e.g. employees of the Data Controller and possibly of the Data Processor, including administrative staff, sales staff, system administrators;

[7] e.g. third-party technical service providers, lawyers, hosting providers, IT companies, communication agencies;

[8] in particular with Google, Facebook, Twitter, Microsoft, LinkedIn, via social plugins and the Google Analytics service.