“Marketing” Information note for customers on the processing of data pursuant to art. 13 EU Regulation 2016/679

Data Controller

We wish to inform you that, pursuant to art. 13 of EU Regulation 2016/679 (hereinafter, “Regulation” or “GDPR”), your Personal Data will be processed by Municipia Spa acting as data controller (“Controller”).

The Personal Data Protection Officer (hereinafter, “DPO“) can be reached at the following address: dpo.privacy.municipia@eng.it.

Types of data subject to processing

The Controller will process your personal data, collected as part of the contractual relationships with you, including, by way of example and not limited to, name, surname, mobile phone number, email address and in general your contact details as the contact person for the business relationships established with you.

Purpose, legal basis and optional nature of the processing

Your personal data will be processed for the following purposes:

1. a) execution of the contract and/or of the pre-contractual measures;
2. b) to fulfil any legal obligations;
3. c) market analysis, statistics and related services;
4. d) verification of customer satisfaction;
5. e) pre-contractual and preliminary information regarding the conclusion of the contract.

The legal bases of the processing for purposes a) and b) are respectively Articles. 6 (1) (b) and 6 (1) (c)) GDPR.

The legal basis of the processing for purposes c), d) and e) is art. 6 (1) (f) GDPR.

The provision of your personal data for purposes a), b), c), d), e) indicated above is optional, but in its absence it will not be possible to execute the contract.

Recipients and transfer of personal data

Your personal data may be shared with:

– natural persons authorised by the Controller to process personal data pursuant to art. 29 GDPR by way of performing their job duties (e.g. employees and system administrators etc.);

– service providers (such as consultants, credit institutions, etc.) who typically act as data processors pursuant to art. 28 of the Regulation;

– parties, bodies or authorities to whom it is mandatory to communicate your personal data by virtue of legal provisions or orders of the authorities.

The data may be accessible to other companies of the Engineering group for the same purposes given above and/or for administrative-accounting purposes pursuant to art. 6 and Recitals 47 and 48 of the Regulation.

The complete and updated list of the data recipients can be requested from the Controller, at the addresses indicated above.

Transfer of data outside the EU

As regards the possible transfer of data to third countries, the Controller notifies you that the processing will take place according to one of the methods allowed by current legislation.

Retention of personal data

Your Personal Data will be retained only for the time necessary for the purposes for which they are collected, respecting the principle of data minimisation referred to in Article 5, paragraph 1, letter c) of the GDPR. The Controller may retain some data even after the termination of the contractual relationship, for the time necessary to comply with contractual and legal obligations. More information is available from the Controller.

Methods of data processing

In relation to the stated purposes, the processing of personal data takes place using manual, IT and electronic tools with logics strictly related to the purposes themselves and, in any case, with methods which ensure data security and confidentiality, in addition to compliance with the specific obligations established by law.

By signing the Contract, the Customer undertakes to transmit this information note to all its employees, whose data it will provide to us, and, where necessary, to acquire the relative consent to the data processing.

Your privacy rights

You have the right to ask the Controller, at any time, to access your personal data, to rectify or delete these or to oppose their processing; you have the right to request the limitation of processing in the cases provided for by art. 18 of the Regulation, to obtain the data concerning you in a structured format, commonly used and readable by an automatic device, in the cases provided for by art. 20 of the Regulation; as well as to lodge a complaint with the competent supervisory authority pursuant to Article 77 of the GDPR (Italian Data Protection Authority) in accordance with art. 77 of the Regulation, should you think that the processing is contrary to the legislation in force.

You can make a request for opposition to the processing of your Personal data pursuant to article 21 of the GDPR by evidencing the reasons which justify the opposition: the Data Controller reserves the right to evaluate your request, which would not be accepted should there be legitimate binding reasons to proceed with the processing which prevail over your interests, rights and freedoms.

Requests must be sent in writing to the Controller or to the DPO at the addresses indicated above.