Pursuant to Article 13 of EU Regulation 2016/679
This notice is addressed to all parties who visit and interact with this website of GMA s.r.l., Via Fara, 39 – 20124 Milan (Tax Code/VAT No.: 03017070982), e-mail: info@gma.it, in its capacity as Data Controller, so that, as data subjects, they are aware of the processing activities carried out on the data acquired through browsing.
Please note from the outset that this notice is provided only for the website you are currently visiting, and not for any other websites that may be accessed via links contained herein.
Types of data processed:
1. Browsing data
The computer systems and software procedures used to operate this website acquire, in the course of their normal operation, certain personal data whose transmission is implicit in the use of internet communication protocols; this information is not collected in order to be associated with identified data subjects, but by its very nature could, through processing and association with data held by third parties, allow users to be identified.
This category of data includes the IP addresses or domain names of the computers used by users connecting to the website, the URI (“Uniform Resource Identifier”) addresses of the resources requested, the time of the request, the method used to submit the request to the server, the size of the file obtained in response, the numerical code indicating the status of the response given by the server (successful outcome, error, etc.) and other parameters relating to the user’s operating system and computer environment.
This data is used solely to derive anonymous statistical information on the use of the website and to monitor its correct functioning, and is deleted immediately after processing.
The data may be used to establish liability in the event of hypothetical computer crimes committed to the detriment of the website.
2. Cookies
Cookies are small text files that the website you visit sends to your device, where they are stored, before being sent back to the same website on your next visit.
Third-party cookies, on the other hand, are set by a website other than the one you, as a user, are visiting.
For your protection, please note that a cookie cannot retrieve any other data from the user’s hard drive, nor can it transmit viruses or acquire e-mail addresses.
Cookies fall into two categories: so-called “technical” cookies and “profiling” cookies.
The former are used to perform rapid computer authentication, maintaining the identification of the user within the session, as well as to allow secure browsing. For these purposes, this type of cookie is not stored persistently on the user’s PC, but rather disappears when the browser is closed. On the basis of the Guidelines of the Italian Data Protection Authority of 10 June 2021, such cookies may be used without the consent of the data subject.
For further information on the cookies applied, we recommend that you review the dedicated cookie notice.
3. Data voluntarily provided by the data subject
Should you decide, when connecting to this website and where applicable, to send your personal data (for example: first name, surname, e-mail address) in order to access certain services (for example “Work with us”), or to make requests by e-mail, the Data Controller will process such data in order to respond to your request, or to provide you with the requested service, in accordance with this notice and the specific privacy notices provided when subscribing to the individual services. The data will be retained for the time necessary to provide the requested service and to manage any disputes.
Your personal data will be disclosed to third parties only where disclosure is necessary to comply with the requests of the users themselves, as specified in the specific notices for the individual services, or to simplify – at your request – registration procedures on third-party websites/applications.
4. Purposes and legal bases
The Data Controller processes:
- your browsing data, referred to under Point 1) above, in order to monitor the technical functioning and performance of the website, to understand how to improve the services and how to develop them further. The legal basis for processing this type of data is the legitimate interest of the Data Controller (Article 6(1)(f) of EU Regulation 2016/679);
- your browsing data, referred to under Point 2) above, solely for the purpose of monitoring the correct functioning of the website. The legal basis for processing this type of data is the legitimate interest of the Data Controller (Article 6(1)(f) of EU Regulation 2016/679);
- your data referred to under Point 3), instead, on the basis of the specific provisions set out in the relevant notices, which we invite you to review individually.
5. Methods of processing
Processing will be carried out electronically, in compliance with Article 32 of EU Regulation 2016/679, by the Data Controller or by persons specifically appointed and authorised by the Data Controller.
In particular, the Data Controller has adopted and maintains organisational measures (allocation of roles and responsibilities in carrying out activities and controls), as well as appropriate procedural and technical measures (firewalls, antivirus software and other technologies) to protect your data against loss, theft, and unauthorised use, disclosure or alteration.
Pursuant to Article 4(2), it is specified that processing may consist of any operation or set of operations such as collection, recording, storage, adaptation or alteration, retrieval, consultation, disclosure, restriction, erasure or destruction.
6. Retention period
The Data Controller will retain your data for the time strictly necessary to fulfil the purposes described above, as also set out in the specific notices published on the website.
7. Disclosure of data
In order to pursue the purposes described above, your data will be known to the employees, equivalent staff and collaborators of the Data Controller, who will act as persons authorised to process personal data.
The personal data collected may, insofar as relevant to their specific competence, be the subject of simple disclosure to public bodies in order to comply with justified requests from the Authorities, laws, regulations and/or EU legislation.
8. Transfer of personal data outside the EEA
The Data Controller does not intend to transfer your personal data outside the European Union.
Should this become necessary for technical or organisational reasons, any such transfer will in any case be preceded by a prior assessment of the existence of the lawfulness conditions and of the adequate safeguards required under Articles 44 et seq. of the GDPR. In such circumstances, you may request information from the Data Controller regarding the transfer of your personal data outside the European Union and obtain a copy of the protective measures adopted, by submitting a specific request to the Data Controller at the addresses indicated below.
What your rights are and how to exercise them
As a data subject, with regard to the processing described in this notice, you are granted the rights set out in Articles 15 to 22 of EU Regulation 2016/679, where applicable, namely:
- right of access: the right to obtain confirmation as to whether or not personal data concerning you are being processed and, where that is the case, to access your personal data – including a copy thereof – and the information referred to, among others, in Article 15 of the GDPR;
- right to rectification: the right to obtain, without undue delay, the rectification of inaccurate personal data concerning you and/or the completion of incomplete personal data pursuant to Article 16 of the GDPR;
- right to erasure (“right to be forgotten”): the right to obtain, without undue delay, the erasure of personal data concerning you, in the cases set out in Article 17 of the GDPR;
- right to restriction of processing: the right to obtain the restriction of processing, in the cases set out in Article 18 of the GDPR;
- right to withdraw consent at any time, without affecting the lawfulness of processing based on consent given prior to its withdrawal;
- right to lodge a complaint with the Italian Data Protection Authority (Garante per la Protezione dei Dati Personali), Piazza Venezia n. 11, 00187, Rome, Italy.
The above rights may be exercised against the Data Controller by contacting the details indicated at the bottom of this notice. The Data Controller will take charge of your request and will provide you, without undue delay and in any event within one month of receipt of the request, with information on the action taken in response to your request.
The exercise of your rights as a data subject is free of charge pursuant to Article 12 of the GDPR; however, in the case of manifestly unfounded or excessive requests, including by reason of their repetitive nature, the Data Controller may charge a reasonable fee, taking into account the administrative costs incurred in handling the request, or may refuse to act on the request.
Finally, we inform you that the Data Controller may request further information necessary to confirm the identity of the data subject.
The appointed Data Protection Officer (DPO) is Frareg s.r.l., who may be contacted at dpo@frareg.com
