INTRODUCTION

In accordance with Regulation (EU) 2016/679 (hereinafter the "GDPR"), we hereby provide the following information regarding the processing of personal data supplied to us in connection with your relations with our Company. This notice is provided pursuant to Article 13 GDPR.

 

1.   IDENTITY AND CONTACT DETAILS OF THE DATA CONTROLLER

The Data Controller is MAC&NIL srl, with registered office at via L. Pasteur, 26 – 70024 Gravina in Puglia (BA) – VAT No. 05607900726 – Tel. +39 080.246.42.45 - Fax +39 080.214.56.83 - Email customercare@macnil.it - Certified Email (PEC) customerservice.macnil@pec.it.

 

2.   CONTACT DETAILS OF THE DATA PROTECTION OFFICER (DPO)

The Data Protection Officer is Dr. Luca Benedetto, tel. + 39 080 8916932 – email: luca@ncs.puglia.it; PEC: corrispondenza@pec.ncsonline.eu.

 

3.   PURPOSES OF PROCESSING, LEGAL BASIS AND DATA RETENTION PERIOD

Purpose	Categories of Data Processed	Legal Basis	Retention Period*
a)    Pre-contractual/contractual Providing information on products and services marketed by us, where requested by the data subject; performance of existing contractual relationships (administrative-accounting obligations, tax obligations, order management, invoicing, solvency checks, debt recovery; management of any disputes); sending mandatory communications relating to contracted products/services	Identification data and contact details (email address, landline and mobile phone number); data relating to the company you belong to and to the contractual relationship, as well as information relating to its performance and necessary for fulfillment of the contract itself; data relating to the economic relationship, amounts owed and payments, their periodic trend, and the summary of the account status of the relationship; data relating to your employees and collaborators	Performance of a contract to which you are a party or pre-contractual measures adopted at the data subject's request; Compliance with legal obligations   Art. 6 para. 1 lett. b) and c) GDPR.	As required by law
b)   Direct Marketing sending, by automated means of contact (email and instant messaging) and traditional means (phone calls with an operator and ordinary mail), of advertising material, newsletters, promotional and commercial communications relating to products and/or events and/or training courses, as well as carrying out market research and statistical analysis and assessing the level of customer satisfaction;	Identification data and contact details (email address, landline and mobile phone number);	Consent (requested via contract or specific request) (optional and revocable at any time) Art. 6 para. 1 lett. a) GDPR.	Until consent is withdrawn for this purpose and/or five years have elapsed since consent was given.
c)    Marketing to Existing Customers sending communications relating to contracted products/services and/or to products/services similar to those already contracted (newsletters, webinars, events, training activities)	Identification data and contact details (email address, landline and mobile phone number); data relating to the company you belong to and role held	Legitimate interest Art. 6 para 1 lett. f) GDPR.	Until consent is withdrawn
d)    Indirect Marketing Disclosure of your data to commercial partners/third parties so that they may send you marketing communications	Identification data and contact details (email address, landline and mobile phone number);	Consent (requested via contract or specific request) (optional and revocable at any time) Art. 6 para. 1 lett. a) GDPR.	Until consent is withdrawn for this purpose and/or five years have elapsed since your last interaction with the Data Controller.
e)    Collection and Publication of Content: creation of case studies and publication on social media, newspapers, magazines and websites of images, videos, reviews, ratings and other content that the data subject may freely decide to share with the Data Controller, as well as on any other communication channels used (as provided for by the specific consents requested from time to time)	Identification data; images, audio recordings, company affiliation, professional role and experience, nickname, social network profile	Consent (optional and revocable at any time) Art. 6 para 1 lett. a) GDPR.	Until consent is withdrawn for this purpose and/or five years have elapsed since your last interaction with the Data Controller
f)     Where necessary, to establish, exercise or defend the rights of the Data Controller before judicial authorities	Identification data and contact details (email address, landline and mobile phone number); data relating to the company you belong to and to the contractual relationship, as well as information relating to its performance and necessary for fulfillment of the contract itself; data relating to the economic relationship, amounts owed and payments, their periodic trend, and the summary of the account status of the relationship; data relating to your employees and collaborators	Legitimate interest (legal protection) Art. 6 para 1 lett. f) GDPR.	For the time necessary to exercise rights before judicial authorities.
g)    Registration on Online Portals	Identification data and contact details, data relating to the company you belong to and job position held	Explicit consent	Five years after the last interaction
h)    Assistance for Purchased Products and Services	Identification data, contact details, personal data relating to the contracted product/service	Performance of a contract to which you are a party (for resolving anomalies and malfunctions) Legitimate interest (for analysis aimed at service improvement)	Five years after the last interaction

*Upon deletion, data may be retained for a further period of up to one year, in accordance with backup retention policies.

 

4.   MANDATORY NATURE OF DATA PROVISION

The data necessary for the performance of the contractual relationship must be provided to the Data Controller, as well as the data necessary to comply with obligations under laws, regulations, EU legislation, or provisions of authorities legally empowered to do so and of supervisory and control bodies (referred to in purposes a) and f) above).

Data that is not essential for the performance of the contractual relationship shall be considered supplementary information, and its provision, if requested, is optional and subject to consent. Consent may be withdrawn at any time by sending an email to: info@macnil.it | PEC macnil@pec.it. Such withdrawal shall not in any way affect the lawfulness of processing based on consent given prior to the withdrawal.

 

5.   METHODS OF PROCESSING

Personal data will be recorded, processed and stored in our paper and electronic archives, in compliance with the appropriate technical and organizational measures referred to in Article 32 of the GDPR. The processing of your personal data may consist of any operation or set of operations among those listed in Article 4(1)(2) of the GDPR.

The processing of personal data will be carried out using tools and procedures suitable for ensuring security and confidentiality, and may be carried out, directly and/or through authorized third parties, either manually using paper records or with the aid of IT tools or electronic devices. For the proper management of the relationship and the fulfillment of legal obligations, the data may be included in the Data Controller's internal documentation and, if necessary, also in registers and records required by law.

Your data may be processed by employees of the Data Controller's business functions assigned to pursue the purposes indicated above, who have been expressly authorized to carry out the processing and have received adequate operational instructions pursuant to and for the purposes of Article 29 of the GDPR.

 

6.   CATEGORIES OF RECIPIENTS OF PERSONAL DATA

The data may be disclosed to and processed by external parties acting as independent data controllers pursuant to Articles 4 and 24 of the GDPR, such as, by way of example, supervisory and control authorities and bodies and, in general, public or private entities entitled to request the data, and/or to parties acting as Data Processors pursuant to Article 28 of the GDPR, such as, by way of example, consulting firms and/or professional practices and/or professionals, for instance legal, tax advisors and insurance companies.

The data may also be disclosed to our business partners/dealers for the performance of activities connected with the execution of the contract or for the carrying out – by them – of commercial activities, subject to your express consent.

 

7.   TRANSFER OF DATA TO NON-EU COUNTRIES

The data you provide will be processed only in Italy or in countries within the European Union. Should your data, during the course of the contractual relationship, be processed in a state outside the EU, the rights granted to you under EU legislation will be guaranteed and you will be promptly informed.

 

8.   RIGHTS OF THE DATA SUBJECT

Pursuant to Articles 15 et seq. of the GDPR, you may exercise the following rights:

a.     access: confirmation as to whether or not a processing of your personal data is under way and the right to access such data; requests that are manifestly unfounded, excessive or repetitive may not be responded to;

b.     rectification: correct/obtain the correction of personal data if inaccurate or outdated, and complete it if incomplete;

c.     erasure/right to be forgotten: obtain, in certain cases, the erasure of the personal data provided; this is not an absolute right, as the Data Controller may have legitimate or legal grounds for retaining it;

d.     restriction: the data will be stored but may not be further processed or elaborated, in the cases provided for by law;

e.     portability: move, copy or transfer the data from our databases to others. This applies only to data you have provided, where the processing is based on the performance of a contract or on consent and is carried out by automated means;

f.      object to direct marketing;

g.     withdraw consent at any time, where the processing is based on consent.

Pursuant to Article 2-undecies of Italian Legislative Decree No. 196/2003, the exercise of your rights may be delayed, restricted or excluded, with a reasoned communication provided without delay, unless such communication could compromise the purpose of the restriction, for the time and to the extent that this constitutes a necessary and proportionate measure, taking into account the fundamental rights and legitimate interests of the data subject, in order to safeguard the interests referred to in paragraph 1, letters a) (interests protected in relation to money laundering), e) (the conduct of defensive investigations or the exercise of a right before judicial authorities) and f) (the confidentiality of the identity of an employee reporting wrongdoing of which they became aware by reason of their office). In such cases, your rights may also be exercised through the Italian Data Protection Authority (Garante) in the manner set out in Article 160 of the same Decree. In this case, the Garante will inform you that it has carried out all necessary checks or conducted a review, as well as of your right to lodge a judicial appeal.

 

Please note, moreover, that – prior to responding to such requests – the Data Controller may verify your identity in order to assess the legitimacy of the requests.

 

To exercise these rights, you may contact our Company as "Data Controller of personal data": tel. 0802464245; email info@macnil.it - PEC macnil@pec.it.

The Data Controller will respond within 30 days of receipt of your formal request.

Please be advised that, in the event of a violation of your personal data, you may lodge a complaint with the competent authority: the "Garante per la protezione dei dati personali" (Italian Data Protection Authority).