PRIVACY POLICY

 

General information pursuant to articles 13 and 14 Reg. EU 2016/679___

and the Italian legislation pursuant to Legislative Decree 196/2003 and  

Legislative Decree 101/2018

 

Pontetorto Spa has always been active to ensure a high level of protection of your personal data and guarantees the protection and security of the same in a manner compliant with EU Regulation 2016/679 (hereinafter referred to as “GDPR”), to Legislative Decree 196 / 2003, as amended by Legislative Decree 101/2018. This information replaces all the previous ones and will be constantly updated as needed.

  

 1. Data Controller

 2. Data Protection Officer

 3. Data collected, purposes and legal bases for processing

 3.1. Data collection from the interested party

 

  

 Customer data (B2B)

 Data of service providers

 Personal data of agents

 Video surveillance and company access

 Newsletter and other occasional marketing initiatives

 Applications for job positions

  

  

 Job applications from a different source

 Personal images

 Data of legal representatives and similar figures

 Data of appointees

  

 4. Recipients of personal data

 5. Personal data storage period

 6. The rights of the interested party

 7. Extended cookie information on the  www.pontetorto.it  website

  

The Data Controller of your personal data is the company Pontetorto Spa, in the person of its legal representative pro tempore, with registered office in Via Roma, 15-23a – 59013 Montemurlo (PO), Italy, fiscal code 03461400487, VAT No. 00302940978, pec :  pontetorto@legalmail.it, ordinary email:  privacy@pontetorto.it  (hereinafter the “Data Controller”).

  

With reference to your personal data and to the processing performed and indicated below, the Data Controller shall not carry out any regular or systematic monitoring, nor large-scale data processing, not even simply connected or accessory to the main activities of the Data Controller. Consequently, no Data Protection Officer has been appointed pursuant to art. 37 GDPR. For any information you can always contact the Data Controller at the following email address:  privacy@pontetorto.it  .

  

All the collections and processing carried out by the Data Controller are based on compliance with the principles of minimization and privacy by design and by default, and is limited to what is justified by the legal bases, as well as strictly necessary for the pursuit of the aims and purposes indicated below. Furthermore, as a matter of principle, the Data Controller shall not collect any other personal data or information, nor does it use the data collected for purposes other than those indicated in this statement, or from any different information, specific to particular categories of Data Subjects (e.g. employees, regardless of the contractual framework). The interested party will always be updated, by revising this information, of any new and / or additional data collection or processing with different purposes.

The processing carried out by the Data Controller is explained below by categorization of the various possible interested parties: for more information you can contact the Data Controller at the following email address:  privacy@pontetorto.it  :

  

  

Data of the shareholders, directors, members of the Board of Statutory Auditors and other managers of Daidoh Limited

  

Personal data subject to processing: personal data, including personal identification codes and data of adults; and contact details, including residence and domicile addresses and computer or digital contacts; banking data.

Purpose of processing: the processing of these data is aimed at ensuring the functioning of the Data Controller’s corporate life, in particular of its decision-making and control bodies. The processing is also aimed at providing for the payment of the sums due to the interested parties, in accordance with the provisions of applicable legislation and the contract with them. The data processing is also in function of the judicial and extrajudicial protection of the Data Controller.

Legal bases of the processing: Art. 6 par. 1 letter c) GDPR, as this processing is necessary to fulfil numerous legal obligations to which the Data Controller is subject, among which it is possible to recall by way of example those imposed by Italian company law, e.g. in the civil code, or by fiscal and tax laws; by the articles of incorporation and by the statute of the Data Controller; by regulatory legislation on information obligations in the Chamber of Commerce. Furthermore, given that the Data Controller is a company subject to the control of a Japanese company, Daidoh Limited, these data are also collected and processed for the purposes of compliance with Japanese legislation regarding security, transparency and financial supervision and control over business activities. listed on the stock exchange, including the so-called internal control and audit mechanisms J-SOX, which is subject to the Data Controller’s parent company, Daidoh Limited (3-1-16 Sotokanda, Chiyoda-ku, Tokyo 101-8619, Japan). In the event that part of this data must be communicated to the parent company, the processing also uses the legal basis set out in the EU Commission’s adequacy decision of 23 January 2019. Art. 6 par. 1 letter b) GDPR, as the processing of these data is also necessary to fulfil the contract between the Data Controller and these interested parties, in particular to fulfil the obligations imposed on the Data Controller and in favour of the Data Subject.

  

  

  

Personal data subject to processing: Company name, including identification codes; physical and digital contact details, such as phone numbers, cell phones and email addresses; billing information, bank details.

Purpose of the processing  : the processing is aimed at the formulation of estimates or other pre-contractual measures requested by the client, the conclusion and execution of the contracts with the same, the maintenance of the contact, the execution of the order and delivery of the goods, billing and maintenance accounting and, by way of example only, compliance with fiscal and tax laws. The data can also be used in order to provide post-sales and / or marketing services and / or promotion of new products or dedicated discounts. The data processing is also in function of the judicial and extrajudicial protection of the Data Controller.

Legal bases of the processing: Art. 6 par. 1 letter b) GDPR, as the processing of these data is necessary to carry out pre-contractual measures required by the Data Subject or the contract between the Data Controller and the same. Art. 6 par. 1 letter c) GDPR, as this processing is necessary to fulfil a number of legal obligations to which the Data Controller is subject including, for example, those arising from fiscal and tax laws. Art. 6 par. 1 letter a) GDPR, with reference to the processing of only the data necessary to enable the interested party to take advantage of post-sales and / or marketing services and / or promotion of new products or dedicated discounts. For this purpose, the interested party will be asked to indicate their express consent, by means of specific forms.

  

 1. Data of service providers

Personal data subject to processing: Personal data / Company name, including identification codes; physical and digital contact details, such as phone numbers, cell phones and email addresses; billing information, bank details.

Purpose of the processing: the processing is aimed at the conclusion and execution of contracts with suppliers, contractors, professionals and external consultants, as well as any other service provider, to maintain contact with them, invoicing and keeping the accounts and, solely, by way of example, to be in compliance with fiscal and tax regulations. The data processing is also in function of judicial and extrajudicial protection of the Data Controller. Finally, the processing is also aimed at obtaining and maintaining voluntary certifications by the Data Controller or to allow inspections by Customers for the same purposes or to verify compliance with their Code of Ethics (e.g. compliance with social security legislation; environmental certifications, etc.), upon appropriate provision of information to this end on the part of the Customer who carries out the inspection.

Legal bases of the processing: Art. 6 par. 1 letter b) GDPR, as the processing of these data is necessary to fulfil the contract between the Data Controller and the Data Subject. Art. 6 par. 1 letter c) GDPR, as this processing is necessary to fulfil a number of legal obligations to which the Data Controller is subject including, for example, those arising from fiscal and tax laws. Art. 6 par. 1 letter f) GDPR, in that the processing is necessary for the pursuit of the legitimate interests of the Data Controller, where the interests, rights and fundamental freedoms of the Data Subject do not prevail. In particular, the inspection activities carried out by the Data Controller or by some Customers for the purpose of obtaining or maintaining voluntary certifications or verifying compliance with any Code of Ethics, and are carried out within the framework of specific written confidentiality agreements, with disclosure of information not being of a secret nature and after an appropriate pseudonymisation procedure, to the extent that it is strictly necessary for the fulfilment of the training obligation and therefore exempting any irrelevant data with respect to the purposes examined above and completely limited to obtaining or maintaining voluntary certifications or verifying compliance with any Code of Ethics.

  

  

  

Personal data subject to processing: Personal data / Company name, including identification codes; physical and digital contact details, such as phone numbers, cell phones and email addresses; billing information, bank details; information concerning contribution and insurance aspects.

Purpose of the processing: the processing is aimed at the conclusion and execution of contracts with the agents, the maintenance of contacts with them, billing and keeping of the accounting and, by way of example only, the respect of fiscal and tax laws, as well as of those on contribution and insurance matters, where applicable. The data processing is also in function of the judicial and extrajudicial protection of the Data Controller.

Legal bases of the processing: Art. 6 par. 1 letter b) GDPR, where the processing of these data is necessary to fulfil the contract between the Data Controller and the Data Subject. Art. 6 par. 1 letter c) GDPR, as this processing is necessary to fulfil a number of legal obligations to which the Data Controller is subject including, for example, those arising from the tax, insurance or social security tax laws.

  

  

  

Personal data subject to processing: Name and surname; personal image.

Purpose of the processing: the processing, carried out by means of a video surveillance system duly authorized by the competent authorities and checks at the entrance (guardhouse and reception) is aimed at monitoring the entrances within the Data Controller’s property and adequately receiving visitors. Furthermore, the processing is also functional to the defence of the Data Controller’s tangible and intangible assets, to the prevention and possible repression of crimes, as well as to the judicial and extrajudicial protection of the rights and interests of the same.

Legal bases of the processing: Art. 6 par. 1 letter f) GDPR, in that the processing is necessary for the pursuit of the legitimate interests of the Data Controller, where the interests, rights and fundamental freedoms of the Data Subject do not prevail. In particular, video surveillance and access to the company are limited to external areas only, to the entrance and to the waiting room to the exclusion of any other area; the images are not subject to preservation beyond 24 hours, except in strict and exceptional cases such as weekends, company closures, holidays, requests by judicial or police authorities; the images are not accessible to individuals without written authorization from the top management and within the limits of the specific instructions given therein. Art. 6 par. 1 letter a) GDPR, to the extent that the voluntary entry of the interested party and his / her presentation for the purpose of being received and announced in the company are valid as express consent, possibly confirmed by specific forms.

  

  

  

Personal data subject to processing: Name and surname; email address. For data relating to the website  www.pontetorto.it,  please refer to point 7 of this Policy.

Purpose of processing  : the processing, carried out directly by the Data Controller without the intervention of third parties, is aimed at commercial marketing, the dissemination of news, updates and press reviews concerning the Data Controller or its activities and initiatives, the presentation and promotion of new products or discounts and any other promotional initiative of an occasional nature such as, for example, competitions, calls for ideas and the like.

Legal bases of the processing  : Art. 6 par. 1 letter a) GDPR, as the service is made available to any interested party who subscribes to the newsletter by giving appropriate written consent to this effect and up to revocation thereof in accordance with the instructions contained in the analogical and / or digital forms made available to the Interested.

  

  

 Applications for job positions

  

Personal data subject to processing: personal data, including personal identification codes; physical and digital contact details, such as phone numbers, cell phones and email addresses; information concerning training and work experience; information possibly belonging to the particular categories of data pursuant to art.9 GDPR or data relating to criminal convictions and offenses pursuant to art.10 GDPR.

Purpose of the processing: the processing is aimed at hiring new workforce, with direct hiring or through personnel selection procedures.

Legal bases of the processing: Art. 6 par. 1 letter a) GDPR, as only the personal data contained in the resumé, or accompanied by other documents, written and signed by the interested party in which the consent to the processing in question is expressly given, are the object of collection, processing and storage. The Data Controller could develop his / her own forms, to the extent that this makes it easier to monitor the management of these personal data.

  

3.2 Data collection from sources other than the data subject

  

  

Sources: common acquaintances of the Data Controller and Data Subject; temporary, employment, job placement and similar agencies.

Personal data subject to processing: personal data, including personal identification codes; physical and digital contact details, such as phone numbers, cell phones and email addresses; information concerning training and work experience; information possibly belonging to the particular categories of data pursuant to art.9 GDPR or data relating to criminal convictions and offenses pursuant to art.10 GDPR.

Purpose of the processing: the processing is aimed at hiring new workforce, with direct hiring or through personnel selection procedures.

Legal bases of the processing: Art. 6 par. 1 letter a) GDPR, as only the personal data contained in the resume, or accompanied by other documents, written and signed by the interested party in which the consent to the processing in question is expressly given, are the object of collection, processing and storage. The Data Controller could develop his / her own forms, to the extent that this makes it easier to monitor the management of these personal data.

  

  

  

Sources: customers, agents and employees of the Data Controller or other companies; the press and media.

Personal data subject to processing: personal images.

Purpose of processing: the processing is aimed at promoting the Data Controller’s activity on its websites and social networks, through the authorized publication of images that depict people wearing clothing and accessories made with the products of the Data Controller. Consequently, in most cases, publication takes place after eliminating physical details that allow the unambiguous identification of the subject portrayed.

Legal bases of the processing: Art. 6 par. 1 letter f) GDPR, in that the processing is necessary for the pursuit of the legitimate interests of the Data Controller, as the interests, rights and fundamental freedoms of the Data Subject do not prevail. In particular, the processing in question proceeds with the republication of contents already made available to the public, upon specific authorization of the holders of the rights, possibly minimizing the processing with the expulsion of physical details that allow the identification of the subject portrayed. Furthermore, the Data Controller has provided on its website also a notice & take down policy made available to interested parties and rights holders.

  

  

  

Sources: companies and client companies, suppliers, contractors; service providers; their websites; public databases.

Personal data subject to processing: personal data; professional information; financial information.

Purpose of the processing  : the processing in question is aimed at verifying the signing powers of the negotiating counterparties of the contracts that involve the Data Controller and, with reference to sole proprietorships and partnerships, to assess the solvency profiles useful for the conclusion of contracts or to the assignment of services. Processing is therefore also intended for judicial and extrajudicial protection of the Data Controller.

Legal bases of the processing: Art. 6, par. 1, let. b) GDPR, as the processing is necessary for the correct establishment and execution of the contract. Art. 6, par. 1, let. c) GDPR, as the processing is necessary for the fulfilment of specific legal and regulatory obligations imposed on the Data Controller, such as those resulting from Italian legislation on anti-money laundering. Art. 6, par. 1, let. a) and f) GDPR, as the data is taken from sources in which the interested party may have given his consent to the insertion of personal data and because the processing is necessary to satisfy the legitimate interests of the Data Controller to obtain the exact performance contractually agreed upon with the negotiating counterparty and / or the full and effective protection of its credit rights, including those of a compensatory nature, not precluding the interests, rights or fundamental freedoms of the Interested party as these data are contained in public databases, freely knowable in compliance with the legal and regulatory provisions applicable from time to time.

  

  

 Data of appointees

  

Sources: companies and client companies, suppliers, contractors; service providers; their websites.

Personal data subject to processing: name and surname; professional and work contact information.

Purpose of data processing: the Data Controller collects and processes this data in the context of the execution of its contracts with customers, suppliers, contractors and other service providers in general, in order to allow secondary activities that constitute the implementation of contractual obligations, such as ex. maintaining the contact to monitor an order, shipping and receiving the ordered goods, the goods or services requested, and any other ancillary practices.

Legal bases of the processing: Art. 6, par. 1, let. b) GDPR, as the processing is necessary for the correct establishment and execution of the contract.

  

Except as illustrated below and to the extent that this is necessary for the concrete pursuit of the aforementioned purposes, the Data Controller does not transfer or communicate the personal data of the Interested Party to third parties. In any case, the Data Controller ensures that personal data are not subject to any type of dissemination and, indeed, will always be stored in a secure and confidential manner using analog and digital modes, also through encryption, back-up and disaster recovery processes.

In consideration of the corporate control exercised by Daidoh Limited, with registered office at 3-1-16 Sotokanda, Chiyoda-ku, Tokyo 101-8619, Japan, the data considered in the previous point 3 can be communicated to the parent company. It should be noted that this communication with transfer outside the EU occurs occasionally, to the extent that this is necessary for the correct and full pursuit of the purposes already indicated, within a system of protection of personal data compliant with the GDPR, as well as with the Decision of adequacy of the EU Commission of January 23, 2019.

The data of the shareholders, directors and members of the Board of Statutory Auditors can also be communicated to the Chamber of Commerce, to professionals in order to protect the Data Controller in extra-judicial and judicial proceedings, in the context of administrative and / or judicial proceedings, before competent public authorities from time to time. The data may also be communicated to other professionals or companies that provide services in favour of the Data Controller, for example in the performance of outsourced activities, such as bookkeeping, tax returns and other obligations imposed by legal or regulatory obligations. Finally, these data may be subject to communication limitation within the scope of the inspection procedures for obtaining / maintaining the voluntary certifications of the Data Controller and / or Customers, including verification of compliance with their Code of Ethics.

Customer data (B2B), data of service providers, personal data of agents and data of legal representatives and similar figures can also be communicated to freelancers in the performance of outsourced activities, such as bookkeeping, tax declarations and other obligations imposed by legal or regulatory obligations, or by other professionals in the context of credit recovery proceedings or other types of judicial or extrajudicial protection. The communication of these data to Public Authorities, investigative, insurance, credit recovery companies or banking institutions is also conceivable.

The data of service providers, personal data of agents and data of legal representatives and similar figures may be subject to limited communication as part of the inspection procedures for obtaining / maintaining the voluntary certifications of the Data Controller and / or their customers, including verification of compliance with their Code of Ethics.

Video surveillance images and company access information can be communicated, in the event of a motivated request, to Judicial or Police Authorities, in the context of investigations for the prevention and suppression of criminal activities damaging the Data Controller’s rights and interests, as well as its tangible and intangible assets.

The Personal Images for promotional purposes or contained in the press review are the object of communication to the recipients of the newsletter and to the followers of the sites and social networks of the Data Controller.

  

Except as illustrated below and to the extent that this is necessary for the concrete pursuit of the purposes already indicated, as a general rule your personal data will be processed and stored for the entire duration of your contractual relationship with the Data Controller and for the entire period necessary for the full and complete execution of the contract with the same, including any related activities necessary to verify and also obtain the fulfilment of all obligations imposed on the interested party. To this end, the Data Controller will keep all documentation relating to relations with the interested party, including tax documentation and that relating to the execution of the contract, also for trial purposes in court, for the periods imposed by Italian and European legislation. This period, as a rule, is equal to 10 (ten) years from the conclusion of the contract, except for the fulfilment of any prescriptions or forfeitures provided for by the applicable legislation, if prior.

The video surveillance images, and the company access information are kept for 24 hours, with the exception of weekends, company closures, holidays and express requests by the judicial or police authorities.

                           The data for targeted marketing for Customers (B2B) and those relating to Newsletters and other occasional marketing initiatives will be stored and processed for these purposes until the consent is withdrawn or the occasional marketing initiative is exhausted.

                           The data relating to applications for job positions, regardless of the source, will be the object of immediate destruction in the event that the interested party has not provided suitable consent. In the event of express consent to the processing of data for the evaluation of the candidacy, the same will be kept for a period of 12 months, after which the data will be destroyed unless the Data Controller asks the Data subject to update his / her data, to be able to keep them for a further 12 months.

Personal Images for promotional purposes or contained in the press review republished by the Data Controller remain in the archive of the same and in that of its recipients, unless they proceed to the relative deletion of the copy present on their database.

In the event of a motivated and admissible request for deletion of data by the Data Subject, the Data Controller will proceed to do so no later than 30 (thirty) days after receiving the request.

  

 6. The rights of the interested party

The interested party can exercise all of the following rights:

 1. Access his/her own personal data pursuant to art. 15 GDPR. This right also includes the right to obtain a copy of the personal data collected and processed by the Data Controller. After verifying the legitimacy of the request, the Data Controller will release the requested information and copy of the data. In the event of manifestly unfounded or excessive requests, also due to the repetition of the same, the Data Subject must pay the Data Controller a reasonable fee, comparable to the administrative costs incurred by the Data Controller for processing the request and which will be quantified case by case.

 2. Request the rectification of his / her personal data pursuant to art. 16 GDPR. The Data Controller will communicate this correction to any recipients of personal data pursuant to art.19 GDPR, unless this is impossible or involves disproportionate efforts, the faculty of the interested party remaining aware of the identity of the recipients themselves.

 3. Request the deletion of his /her personal data (the so-called right to be forgotten) pursuant to and within the limits established by art. 17 GDPR. The Data Controller will communicate this deletion request to any recipients of personal data pursuant to Art.19 GDPR, unless this is impossible or involves disproportionate efforts, with the data subject’s right to know the identity of the recipients themselves.

 4. Request the limitation of the processing of personal data pursuant to and within the limits established by art. 18 GDPR. The Data Controller will communicate this limitation request to any recipients of personal data pursuant to art.19 GDPR, unless this is impossible or involves disproportionate efforts, with the data subject’s right to know the identity of the recipients themselves.

 5. Oppose the processing of personal data pursuant to and within the limits of art. 21 GDPR.

 6. Request the portability of his /her personal data, in accordance with and within the limits established by art. 20 GDPR. The Data Controller reserves the right to verify the technical feasibility of transmission to another data controller indicated by the Data Subject on a case by case basis.

 7. Without prejudice to the processing that has already taken place, revoke any consent already given at any time for the processing based on this legal basis.

 8. Propose a complaint to a supervisory authority pursuant to art. 77 GDPR.

  

 7. Extended cookie information on the  www.pontetorto.it  website

The Data Controller processes some navigation data on its website  www.pontetorto.it  . This data includes the technical data of its devices, the usage data relating to its actions and navigation models, the technical data of third parties, including analysis providers such as Google, technical data from affiliate networks or from social networks through who accessed the website and others.

                           This collection and processing take place through the use of cookies, that is, files that allow the Data Controller to keep track of visits made on the site and to study how they are navigated by the interested parties. Cookies then allow you to provide the interested party with the best browsing experience on the site possible, taking into account the devices chosen by the person concerned, and making improvements to the site for increasingly enjoyable browsing. Some cookies are used to allow the Data Controller to carry out targeted advertisements, based on the interests of the interested parties identified anonymously.

You have the ability to refuse all or some cookies through the special features made available to your web browser. If you disable or refuse cookies, the website of the Data Controller may become inaccessible or not working properly.

The website of the Data Controller may include links to third-party websites. If you follow one of these links, keep in mind that on these sites there are policies regarding privacy and protection of personal data for which we are not responsible, as the processing that is carried out there does not belong to us.

  

The cookies used by the Data Controller are basically of two categories:

  

 Technical cookies

  

These allow the activities of saving preferences, optimization and statistics aimed at saving the browsing preferences of the interested party and optimizing his / her browsing experience. Among these Cookies include, for example, those to set the language, the currency or for the management of statistics by the Data Controller.

  

  

 Aggregate statistics cookies

  

These cookies also include third-party tools in order to collect aggregate and anonymous statistics which, as such, do not necessarily require the consent of the interested party. Their purpose is to allow the Data Controller to monitor and analyse traffic data on their site and on the use of the same by the Data Subject. These cookies include those forming part of Google Analytics, Google Inc. Google Analytics service is a web analytics service provided by Google Inc. (“Google”). Google uses Personal Data collected for the purpose of tracking and examining the use of the site, compiling reports and sharing them with other services developed by Google. Google may use Personal Data to contextualize and personalize the ads of its own advertising network. The personal data collected in this way are processed by Google in the United States and not by the Data Controller, in compliance with the rules established by the  Privacy Shield  , with the possibility to  opt-out  of consent by the interested party.

  

Specifically, the cookies on this site are as follows:

Cookie

Domain

Deadline

Property

Type

IDE

.doubleclick.net

  

Part Three

Permanent

GPS

.youtube.com

  

Part Three

  

PREF

.youtube.com

  

Part Three

Permanent

VISITOR_INFO1_LIVE

.youtube.com

  

Part Three

Permanent

YSC

.youtube.com

  

Part Three

Permanent

_gat

.pontetorto.it

  

Data Controller

  

_gid

.pontetorto.it

  

Data Controller

  

_ga

.pontetorto.it

  

Data Controller

Permanent

wpml_browser_redirect_test

pontetorto.it

  

Data Controller

Permanent

uncodeAI.css

pontetorto.it

  

Data Controller

Permanent

uncodeAI.images

pontetorto.it

  

Data Controller

Permanent

uncodeAI.screen

pontetorto.it

  

Data Controller

Permanent

  

Last update 27 May 2019

The interested party can manage preferences for cookies directly from within his or her browser and prevent – for example – third parties from installing additional ones .Through the browser preferences it is also possible to delete the Cookies installed in the past, including the Cookie in which the consent to the installation of Cookies by this site is eventually saved. You can find information on how to manage cookies in your browser at the following addresses:  Google Chrome, Mozilla Firefox, Apple Safari and Microsoft Windows Explorer.    The Data Controller is not responsible for updating the instructions contained in the links above and invites the Interested party to inquire about the options and preferences regarding their browser’s cookies, including through the following  service  .

The Data Controller will proceed with the review of this information on a regular basis, in order to guarantee the topicality and correctness of the information contained herein. For further clarifications and for the exercise of the rights of the data subject referred to in paragraph 6 above, the interested party may send his written requests to the following addresses:

Pontetorto Spa

Via Roma, 15-23a – 59013 Montemurlo (PO), Italy

Fiscal Code 03461400487, VAT No. 00302940978

PEC:  pontetorto@legalmail.it  – ordinary email:  privacy@pontetorto.it