Information on the processing of personal data pursuant to art. 13 of (EU) Regulation 2016/679 (“GDPR”)

Information on the processing of personal data pursuant to art. 13 of (EU) Regulation  2016/679 (“GDPR”) - TECHNICAL ASSISTANCE

DATA CONTROLLER 
Elica S.p.A. - Via Ermanno Casoli, no. 2, 60044 Fabriano (AN), V.A.T. number AN 00096570429, Pec: elicaspa@sicurezzapostale.it, Phone: +39-07326101 ( hereinafter referred to as “Company” or “Data Controller”).

DATA PROTECTION OFFICER (DPO)
The Company has appointed its  Data Protection Officer (“DPO”) that can be contacted at  dpo@elica.com.

SOURCE OF PERSONAL DATA
Personal data is provided directly by the data subject via the contact form available on the elica.com website or collected by the call centre should data subject request after-sales assistance by  accessing the 'customer care' service.

PERSONAL DATA PROCESSED  
The Company will process personal data such as, included but not limited to: first name, last name, e-mail, country, telephone/cell phone number (hereinafter referred to as 'Data')

PURPOSES OF DATA PROCESSING
Data will be processed by the Company for the following purposes:
a.    provide after-sales and technical assistance services, product repair/replacement;
b.    handle information requests, including complaints and communications received through the call centre and the interactive chat service, as well as the contact form available on the website
c.    comply with regulations and legal provisions, as well as exercise our rights in court;
d.    verify the quality level of the service provided; 
e.    send communications related to product safety;
f.    research activities and statistical analysis of Data both in general and aggregate form, aimed at directing the Company's strategic choices;
g.    direct marketing activities; to email commercial communications on offers, discounts, promotions and news about the Company's products and/or services, via automated or telephone contact methods;
h.    profiled marketing activities; analysis of interests inferred by the matching of the Data provided by the data subject, in order to send personalised commercial communications, via automated or telephone contact methods.

LEGAL BASIS FOR DATA PROCESSING 
The legal bases for aforementioned data processing purposes , are the following:

  • purposes a) and b), fulfilment of specific requests made by the data subject. The legal basis for data processing is therefore the implementation of pre-contractual or contractual measures in which the data subject is a party, as pursuant to Art. 6.1 point (b) of  GDPR; 
  • purposes c), d) e) and f), the legitimate interest of the Data Controller, as pursuant to art. 6, par.1, point f) of GDPR;
  • purpose g), the consent by the data subject, as pursuant to art.6.1 point a) of GDPR;
  • purpose h), the consent by the data subject, as pursuant to art.6.1 point a) of GDPR;

DATA RETENTION PERIOD 
With reference to aforementioned data processing purposes, Data will be stored as follows:

  • purposes a), b), and c), for the time strictly necessary for the achievement of the purposes indicated herein ;
  • purposes d), e) and f), for the time strictly necessary for the achievement of the purposes indicated herein and, in any case, until the data subject objects to it ; 
  • purposes g) and  h),  personal and contact data will be stored until consent is revoked and, in any case, until the end of the relationship with the data subject. Data concerning details of the data subject's interactions with the Company, will be stored for 5 years from interaction-related Data collection (e.g. information and technical assistance requests, contact for product registration or warranty extension) for both direct marketing and profiled marketing purposes.

After the expiry of the aforementioned retention periods, Data will be destroyed or rendered anonymous, subject to technical deletion and backup procedures.

DATA PROVISION 
The provision of Data for the purposes under letters a) b) is compulsory for the handling of information requests, complaints,  after-sales services and technical assistance requests. Therefore, failure to provide the Personal Data in such cases , will make it impossible to provide the service requested. The provision of data for the purposes under letters c) d) e) and f) is necessary to pursue the legitimate interests of Elica, which will be appropriately balanced with your own interests.
The provision of data for the purposes under letters g) and h) is purely optional; should the data subject refuse to provide such Data, the Company will not process the Data for abovementioned purposes.

DATA RECIPIENTS 
Data may be communicated to autonomous data controllers and processed by subjects designated by the Company as data processors, who provide the Company with performances or services instrumental to the purposes indicated in this information notice, such as, including but not limited to: companies providing call centre services, the company in charge of the maintenance/management of the Company's website and of the electronic and/or telematic tools used by the same; the company that manages the sending of commercial communications, as well as the company that provides and maintains the CRM.

SUBJECTS AUTHORIZED TO DATA PROCESSING 
Data may be processed by employees of the Company who have been expressly authorised to process it and who have received appropriate operating instructions, as pursuant to Article 29 of GDPR.

TRANSFER OF PERSONAL DATA TO EXTRA- EUROPEAN UNION COUNTRIES 
Data is not currently being transferred to countries outside the European Union. Anyway, should Data be transferred to countries outside the European Union (EU) or the European Economic Area (EEA) that had not been deemed adequate by the European Commission, the transfer mechanisms set forth in Article 46 of GDPR (such as standard contractual clauses) will be implemented, with consideration given to whether 'additional measures' need to be provided in order to ensure a protection level substantially similar to the one required by EU laws.

RIGHTS OF THE DATA SUBJECT - COMPLAINT TO THE SUPERVISORY AUTHORITY 
To exercise their own rights, the data subject may contact the Company at privacy@elica.com .
The data subject may ask Data Controller to access their own Data for deletion, amendment of inaccurate data, integration of incomplete Data and limitation of data processing in the cases provided for by Article 18 of GDPR .
Furthermore, should data processing be based on a consent or contract and performed by automated tools, the data subject is entitled to receive the Data in a structured, commonly used and machine-readable format, and, if technically possible, to transmit it to another controller without any hindrance.
The data subject is entitled to object to the processing of their Data at any time, in an easy and free manner, for reasons relating to their particular situation, in cases of legitimate interest on the part of the Data Controller.
The data subject is entitled to revoke consent, at any time, and to object to the sending of promotional communications by contacting the Data Controller or clicking on the unsubscribe link found at the bottom of each email.
Should the data subject intend to exercise their rights, the Company  - in case of reasonable doubts as to their identity -  may ask them to identify before handling their request.
The data subject is also entitled to lodge a complaint with the competent supervisory authority in the Member State where he or she normally resides or works, or in the State where the alleged violation has occurred.