Elica Connect privacy policy
INFORMATION RELATING TO THE PROCESSING OF PERSONAL DATA PURSUANT TO ARTICLE 13 OF REGULATION (EU) 2016/679 ("GDPR")
Elica S.p.A., as data controller, pursuant to article 13 of the GDPR, provides information relating to the processing of personal data (hereinafter the "Data") of users, as data subjects, collected and processed through the Elica Connect application (hereinafter the "APP").
DATA CONTROLLER
Elica S.p.A.
Via Ermanno Casoli, n.2, 60044 Fabriano (AN) Pec address: elicaspa@sicurezzapostale.it Telephone: +39-07326101
("Company" or "Owner")
DATA PROTECTION OFFICER (DPO)
The DPO can be contacted at the following e-mail address: dpo@elica.com
PROCESSED DATA
By Data we mean, by way of example but not limited to:
- Personal data, such as name and surname.
- Contact data, such as telephone number, country of origin, e-mail address.
- Data relating to registration and access to the reserved area, such as user name, password and User ID.
- Data relating to the use of products connected to the devices via the APP and IP address.
- App tracking/operation data: information relating to the mobile device on which the APP is installed and some parameters relating to the Android or iOS operating system (e.g. log files, which may contain, for example, date and time of access, browser used) whose transmission is implicit for the normal operation of the same. In particular, the authorisations requested may concern, by way of example: the position of the device to allow the phone's operating system to manage the initial configuration of the products connected to the APP, the device's camera to be able to scan the QRCODEs of the products with the APP (through which it is possible to identify the type of product), access to wi-fi.
PURPOSE OF PROCESSING, LEGAL BASIS FOR PROCESSING AND STORAGE PERIOD
Data are processed in order to allow registration to the APP, the use of related services, as well as, if the user has activated them, to send push notifications on the functionalities of the products connected to the APP (e.g. filter maintenance, air quality monitoring).
The processing is necessary to fulfil specific requests made by the data subject. The legal basis for the processing is, therefore, the execution of pre-contractual measures or contractual measures to which the data subject is a party, pursuant to Art. 6.1 letter b) GDPR.The Data is stored
- until they are deleted by the data subject, through removal of their profile or, alternatively, directly by contacting the Company;
- in the event of inactivity on the part of the data subject for a period of 12 months, the Data will be deleted, informing the user in advance 30 days before deletion, unless the data subject accesses his or her private area within the period indicated.
B. The Data may be used by the Company to obtain statistical information on the use of the products related to the APP.
The legal basis for the processing is the legitimate interest of the Company, pursuant to Article 6.1 lett. f) of the GDPR.
The Data provided will be kept for the duration corresponding to that strictly necessary for the achievement of the purposes indicated.
C. Data is processed for the management of assistance or specific requests by the data subject.
The processing is necessary to fulfil specific requests of the data subject. The legal basis for the processing is therefore the execution of pre-contractual measures or contractual measures to which the data subject is a party, pursuant to Article 6.1 letter b) GDPR.
The Data provided will be kept for the duration corresponding to that strictly necessary for the achievement of the purposes indicated.
D. Data are processed for purposes connected with the activity of research and statistical analysis of Data in general and aggregate form aimed at directing the Company's strategic choices.
The legal basis for the processing is the legitimate interest of the Data Controller pursuant to Article 6.1 lett. f) of the GDPR.
The Data provided will be kept for the time necessary to achieve the purposes and, in any case, until the data subject objects.
E. The Data are processed for purposes related to direct marketing activities, to send, by e-mail, commercial communications in relation to offers, discounts, promotions and news on the Company's products and/or services using automated or telephone contact methods.
The legal basis for the processing is the consent of the data subject pursuant to Article 6.1 lett. a) of the GDPR.
The Data provided will be stored, as far as personal and contact data are concerned, until the consent is revoked and, in any case, until the end of the relationship with the data subject.
With regard to the Data relating to the details of the data subject's interactions with the Company will be kept for 5 years from the collection of the Data relating to the interaction (e.g. participation in an event, contact for technical assistance, contact for product registration or warranty extension).
F. Data are processed for purposes related to profiled marketing activities, in particular the analysis of interests inferred by combining the Data provided by the data subject in order to send personalised commercial communications, using automated or telephone contact methods.
The legal basis for the processing in this case is the consent of the data subject pursuant to Article 6.1 lett. a) of the GDPR.
The Data provided will be kept, as far as personal and contact data is concerned, until the revocation of the consent and, in any case, until the end of the relationship with the data subject.
As far as data relating to the details of the data subject's interactions with the Company are concerned, they will be kept for 5 years from the collection of the Data relating to the interaction (e.g. participation in an event, contact for technical assistance, contact for product registration or extension of warranty).
G. If necessary, to ascertain, exercise or defend the Company's rights in court.
The legal basis for the processing is the legitimate interest of the Company, pursuant to Article 6.1(f) of the GDPR.
The Data will be processed for the duration of the possible litigation, until the time limit for appeals is exhausted. Once the aforementioned retention periods have expired, the Data will be destroyed or rendered anonymous, compatibly with the technical procedures of deletion and backup.
PROVISION OF DATA
The provision of the Data indicated with an asterisk (*) is necessary for the registration and consequent use of the APP and to satisfy the requests of the person concerned. Without it, it will not be possible for the data subject to use the APP and benefit from the services connected to it.
On the contrary, the provision of Data not marked with an asterisk (*) is purely optional, therefore, the failure to provide it, or the partial or incorrect provision of it, will not preclude the use of the services requested.
It is understood that the provision of Data for processing purposes based on the consent of the data subject is optional; in the event of failure to provide such Data, the Company will not process the Data for such purposes.
RECIPIENTS OF THE DATA
The Data may be communicated to autonomous data controllers and processed by subjects designated by the Company as data processors who provide the Company with services instrumental to the purposes indicated in this information notice, such as, for example, the companies that provide the maintenance service of the APP; the company in charge of the maintenance/management of the Company's website and of the electronic and/or telematic tools used by the same; the company that manages the sending of commercial communications, as well as the company that supplies and maintains the CRM.
PERSONS AUTHORISED TO PROCESS DATA
The Data may be processed by employees belonging to the corporate functions assigned to the pursuit of the above-mentioned purposes, who have been expressly authorised to process them and who have received adequate operating instructions.
TRANSFER OF PERSONAL DATA TO COUNTRIES OUTSIDE THE EUROPEAN UNION
Data are currently not transferred to countries outside the European Union. In any case, where data is transferred to countries outside the European Union (EU) or the European Economic Area (EEA) that have not been deemed adequate by the European Commission, the transfer mechanisms set out in Article 46 of the GDPR (such as standard contractual clauses) will be used, assessing the possible provision of "additional measures" to ensure a level of protection substantially equivalent to that required by EU law.
RIGHTS OF THE DATA SUBJECT - COMPLAINT TO THE SUPERVISORY AUTHORITY
The data subject may exercise the rights recognised by Articles 15-22 of the GDPR and, in particular, may request access to the Data concerning him/her, their deletion, the rectification of inaccurate Data, the integration of incomplete Data, the restriction of processing in the cases provided for by Article 18 GDPR1.
1 Pursuant to Article 18 of the GDPR, the data subject has the right to obtain from the controller the restriction of processing when one of the following cases occurs:
- the data subject disputes the accuracy of the personal data, for the period necessary for the controller to verify the accuracy of that personal data;
- the processing is unlawful and the data subject objects to the erasure of the personal data and requests instead that their use be restricted
- although the controller no longer needs the personal data for processing purposes, the personal data are necessary for the establishment, exercise or defence of legal claims by the data subject
- the data subject has objected to the processing pursuant to Article 21(1), pending verification as to whether the legitimate reasons of the data controller prevail over those of the data subject.
- Where processing is restricted pursuant to paragraph 1, such personal data shall, except for storage, only be processed with the consent of the data subject or for the establishment, exercise or defence of legal claims or the protection of the rights of another natural or legal person or for reasons of substantial public interest of the Union or a Member State.
- A data subject who has obtained a restriction of processing pursuant to paragraph 1 shall be informed by the controller before the restriction is lifted.
The data subject, moreover, in the event that the processing is based on consent or contract and/or is carried out by automated means, has the right to receive in a structured, commonly used and machine-readable format the Data, as well as, if technically feasible, to transmit it to another data controller without hindrance.
The data subject has the right to object at any time, easily and free of charge, for reasons related to the particular situation, to the processing of Data in cases of legitimate interest of the Data Controller.
The data subject has the right to revoke the consent given at any time by contacting the Company or by clicking on the unsubscribe link at the bottom of each e-mail.
To exercise their rights, data subjects may contact the Company at the e-mail address privacy@elica.com.
When the data subject intends to exercise his or her rights, the Company - in case of reasonable doubt as to identity - may ask for identification before proceeding to process the request.
The data subject may lodge a complaint with the competent control authority (art. 77 GDPR), as well as take legal action (art. 79 GDPR).