Privacy policy

Notice to Itema S.p.a.’s Customers

ITEMA S.p.A. (hereinafter, also the “Company” or the “Data Controller”), as data controller wishes to inform you, pursuant to the applicable law on personal data protection, including the European Regulation 679/2016 concerning the protection of personal data (the “Regulation”), that the personal data provided by you during the establishment of the contractual relationship and during its execution, will be processed in compliance with the legislative and contractual provisions in force for the purposes and with the modalities indicated here below. In some circumstances, some data may also be collected from third parties, where necessary and always in compliance with applicable legislation.

1. Identity and contacts of the Data Controller
The Data Controller is Itema S.p.A., with registered office in Via Cav. Gianni Radici 4, Colzate (BG).

2. Personal Data collected and processed, purposes and legal grounds for processing
The Data Controller may process:
• identification data and contact details: name and surname or business name, fiscal code or VAT registration, residence or registered office, email address, telephone number;
• fiscal data or any data needed to make or receive payments.

The above-mentioned personal data are processed for the following purposes and on the basis of the following legal grounds:
a. to fulfil the obligations provided for by the law and/or by the existing contract with the Data Controller, to which this notice is attached; in this case, the data processing is lawful as it is needed to fulfil legal obligations connected to the establishment and management of the contractual relationship (Article 6, Paragraph 1, letters b) and c), of the Regulation);
b. the management of any possible litigation and the safeguard of Company’s rights; in this case, the data processing is lawful as it is needed to pursue a legitimate interest of the Company (Article 6, Paragraph 1, letter f) of the Regulation).
For these purposes your consent is not required.
c. the data can be also processed for the purposes of sending newsletters, advertisement and communications, or for marketing purposes; in this case, the data processing requires your consent (Article 6, Paragraph 1, letter a) of the Regulation).

3. Modalities of data processing and nature of data communication
Personal data will be processed by the Company through IT and paper systems, according to accuracy, fairness and transparency principles set by the applicable legal provision on data protection and safeguarding your privacy and your rights by adopting appropriate technical and organisational measures aimed at ensuring a level of safety that is adequate to the risks.
The communication to us and the updating of your personal data is mandatory according to current legislation (related to taxation or others) or for the execution of the contractual relationship. Lacking such data, it will not be possible to establish or – in some cases – proceed with the contractual relationship.
The communication of your personal data for the purposes et out at point 2.c. is facultative and not providing the connected data or revoking the consent will have no effect on the contractual relationship, but will result only in the impossibility of processing the data for the above mentioned purposes.

4. Data retention period
All the data related to you will be retained in pursuance of the civil and fiscal obligations (e.g., civil obligation to store financial records and company mail for 10 years) and in any case only for the duration of the existent contract. After the termination of the contractual relationship, in order to safeguard Company’s rights, data will be retained – in a manner in which they will be available only in case it is necessary – for a period of time equal to the statute of limitation period of any right you may claim against the Company. This period changes depending on the kind of data and on any act interrupting or suspending such period.
In case you give your consent to the data processing for the purposes set out at point 2.c. such data will be retained for a maximum period of 24 months form the data collection.

5. Communication of the data processed
Your data will not be disclosed but, for the purposes above and pursuant to the principles set by the Regulation, they may be communicated to: the employees of the Company, its collaborators, consultants and professionals (in particular, but not limited to: accountants, company database provider etc.). In fulfilling the obligations arising from the law and from the contractual relationship or upon your request, data may be disclosed to public bodies or public authorities.

6. Data transfer
Your data will be stored at the registered office of the Company and on its servers, located in Italy. Your data may be also stored, in digital format, at the server of the company of the Itema Group, Itema (Switzerland) Ltd, located in Switzerland. The Company informs you that a specific agreement based on the standard contractual clauses approved by the European Union Commission is in place with this company.

7. Rights of the Supplier
With reference to the data processing above, the Supplier may exercise the rights provided by the applicable law concerning personal data protection, including the rights to:
• obtain confirmation as to whether or not personal data concerning him/her are being processed, and, where that is the case, access to the personal data and the following information (right of access);
• update, modify and/or correct his/her personal data (right to rectification);
• ask for the erasure or the limitation of the processing of the data processed against the law, including those for which storage is not required by the purposes for which data were collected or otherwise processed (right to erasure and right to restriction of processing);
• revoke the consent, if provided, without prejudice to the lawfulness of the data processed on the basis of the consent given before the revocation;
• raise a claim in front of the Supervisory authority in case of violation of the rules concerning personal data protection;
• receive an electronic copy of the data related to him/her that the Employee provided during the employment contract (e.g., data related to salary and internal mobility services) and ask that such data are transferred to another data controller (right to data portability).
In order to exercise the rights above you can contact Data Controller at any time, sending your request to the following email address privacy@itemagroup.com via registered mail to the following address: Via Cav. Gianni 4, Colzate (BG).

8. Processing of data relating to individuals other than the Supplier connected with its organization and the existing contract
When processing the personal data you communicated to us, the Data Controller and the other subjects as per clause 5 above, may occasionally also process data, mainly identification data and contract details, relating to other individuals who are part of your business organisation. If so, you declare, under your own responsibility, that you showed the content of this notice to such individuals and that they fully understand and accepted it, if needed. Also, you undertake to inform the Data Controller on any update relating to such data.

Data Controller
Itema S.p.A.