Privacy Policy

Updated to 07/03/2022

This privacy policy has been written specially for visitors to the website www.cersaie.it. This document supersedes and replaces the previously published cookie policy.

WEBSITE PRIVACY POLICY PURSUANT TO ARTICLES 13 AND 14 OF EUROPEAN REGULATION 2016/679 (GDPR)

Specific summary information will be provided or displayed on the website pages dedicated to providing specific services on demand and complete with data collection forms. Please note that to provide a complete service our website may contain links to other websites not managed by Edi.Cer. S.p.A. Edi.Cer. S.p.A. is not responsible for errors, content, cookies, publication of unlawful content, advertising, banners or files that do not comply with applicable regulations and the Personal Data Protection Code on the part of websites not managed by the Controller.

In its capacity as Controller for your personal data pursuant to articles 13 and 14 of European Regulation 2016/679, Edi.Cer. S.p.A. hereby informs you that the aforementioned Regulation protects the rights of data subjects with regard to the processing of their personal data and that said data will be processed in accordance with principles of fairness, lawfulness and transparency and in such a way as to respect your confidentiality and rights. The information and personal data submitted by you or otherwise acquired during use of the website will be processed in accordance with the provisions of the aforementioned regulation and the privacy obligations contained therein.

DATA SUBJECTS AND RETENTION TIME
A) users (visitors) of the website www.cersaie.it.

Type of data processed

• Browsing data: IP addresses or domain names of computers and other devices employed by users who connect to the website; the addresses in URI (Uniform Resource Identifier) notation of the requested resources and any relevant timestamps; parameters relating to the user’s operating system and computer environment; departure and arrival pages; navigation index and identifying behaviour while viewing website pages.
• Personal data submitted voluntarily by the user: the optional, explicit and voluntary sending of e-mail to the addresses indicated on this website and the filling out of the forms on the site will result in the acquisition of the sender’s personal data (for example, first name, last name and e-mail address). Specific summary information is provided on pages containing forms.

Purposes of data processing: your data collected while browsing will be used for the following purposes:

1. performing operations closely related to and necessary for the management of relations with users or visitors to the website;
2. collection, storage and processing of your data for statistical analysis, including in anonymous and/or aggregate form; statistical analyses for verifying the quality of the services provided by the website;
3. sharing of interaction and usage data with social network operators in connection with pages where cookies incorporating software products or features are installed;
4. improving your browsing experience by providing services and sending advertising messages in line with the preferences expressed while browsing.

The processing of your data for the purpose referred to in point 1 is necessary in order to fulfil your request. Refusal to allow processing may limit and/or prevent you from making full use of the functions and services present on the website. The legal basis for the processing of your data for the purposes set out in point 1 is the fulfilment of one of your requests, in accordance with Article 6.1.b.) of the GDPR; refusal to submit such data will make it impossible for you to consult the website. Provision of the data indicated in purposes 2, 3 and 4 is optional on the legal basis of consent, and refusal to grant permission for your data to be processed will not affect the functions or services present on the website. The legal basis for the processing of your data for the purposes set out in points 2, 3 and 4 is consent, in accordance with Article 6.1.a) of the GDPR. Consent is granted by clicking on the words “ACCEPT SELECTED” in the cookie banner. With regard to optional provision of data, further information on the cookies used by the website is provided in the cookie policy, which is also accessible from the cookie banner.
Browsing data is retained for the time periods indicated in the cookie policy available on the website.

COOKIES AND OTHER TRACKING SYSTEMS
Your data may also be collected using tools and services provided by third parties and stored by them. For further information on the use of cookies, please refer to the “cookie policy”.
Please note that Edi.Cer. S.p.A. acts solely as an intermediary for links provided in the Cookie Policy and will accept no responsibility in the event of changes.

PERSONAL DATA PROCESSING METHODS
Your personal data will be processed manually, electronically and/or telematically, through the use of cookies (as indicated in the cookie policy available on the website), by means of computers using third-party software and automated contact methods (e.g. automated email campaigns, SMS text messaging, automated telephone contact, instant messaging, social networks, etc.), in accordance with the methods set out in articles 6 and 32 of the GDPR and through the adoption of appropriate security measures.

USE OF SOCIAL MEDIA PLATFORMS
Edi.Cer. S.p.A. may provide links to other social media platforms that connect to servers installed by individuals or organisations over which it has no control. Edi.Cer. S.p.A. does not make any representation or accept any responsibility regarding the accuracy or any other aspect of the information available on such websites. A link to a third party website may not be construed as an endorsement, either by Edi.Cer. S.p.A. or by that third party, of the products and services of others or of that third party. Edi.Cer. S.p.A. does not issue statements or guarantees regarding the use or storage of the user’s data on third party websites. You are invited to carefully read the privacy policy of third party websites linked to our website in order to gain a complete overview of the way in which your personal data may be used.

RECIPIENTS OF PERSONAL DATA AND DISSEMINATION OF DATA
Your data will be processed by duly appointed personnel and will be transmitted to external companies acting as independent controllers or data processors:

• external parties providing cloud services;
• providers of technical support services;
• group companies providing services for the administration of the computer system, including server hosting and backup services;
• in the case of public and/or private entities for which data disclosure is obligatory or necessary in accordance with legal obligations or is otherwise required for managing the relationship.

The complete list can be requested by writing to the Controller’s contact address.

Your data will not be made publicly available.

TRANSFER OF PERSONAL DATA
Your data may be transferred to countries outside the European Union as indicated in the Cookie Policy of the companies providing the third party cookie services. For further information, write to cersaie@cersaie.it.

For technical and/or organisational requirements, your data will be transferred to countries within the European Union.

For the purpose of sending business communications, your data may be transferred to countries within the European Union: such transfer is in any case legitimate as it is guaranteed by the existence of adequacy decisions issued by the European Commission and/or standard protection clauses based on the models adopted by the European Commission pursuant to Article 46 of the GDPR.

You may ask the Controller for a copy of the safeguards adopted for the transfer of your personal data outside the EU, as well as information on the places where such safeguards have been made available, by submitting a specific request to the Controller by e-mail at cersaie@cersaie.it.

MINORS
The website is not intended for use by minors and no data relating to minors are collected by the Controller. If the Controller becomes aware that such data have been collected (e.g. via the contact form), it will delete them immediately. The Controller will respond to requests for information in accordance with applicable laws. Please be advised that in the event of a request for information, the person exercising parental responsibility will be obliged to provide us with consent to collect the minor’s personal data.

CONTROLLER
The Controller is Edi.Cer S.p.A., with registered offices in Viale Monte Santo 40 - 41049 Sassuolo (MO) Italy, email: cersaie@cersaie.it, in the person of its pro tempore legal representative.
You have the right to obtain from the Controller the erasure (“right to be forgotten”), restriction, information, rectification, portability and objection to processing of your personal data, and in general you may exercise all the rights established in Article 15 et seq. of European Regulation 2016/679 by writing to cersaie@cersaie.it.
You have the right to lodge a complaint with the supervisory authority.

APPLICATION OF THIS PRIVACY NOTICE
If you have any queries about this Privacy Notice, please contact Edi.Cer. S.p.A. by sending an e-mail to cersaie@cersaie.it or by contacting the Controller at the contact address provided in this document.

CHANGES TO THIS PRIVACY NOTICE
Edi.Cer. S.p.A. reserves the right to update this privacy policy according to changes in law and taking due account of suggestions made by employees, customers, associates and users. In the event of changes made by Edi.Cer. S.p.A., the Privacy Policy on the main privacy page and on the Homepage of the website www.cersaie.it will be updated immediately.

RIGHTS OF DATA SUBJECTS
EU Regulation 2016/679: Articles 15, 16, 17, 18, 19, 20, 21, 22 – Rights of the Data Subject

1. The data subject is entitled to receive confirmation of the existence of personal data regarding him or her, even if such data have not yet been recorded, and to be sent these data in an intelligible form, as well as to lodge a complaint with the supervisory authority.
2. The data subject has the right to obtain the following information:
   1. the origin of personal data;
   2. the purpose and methods of processing;
   3. the rationale followed in the case of processing carried out with the aid of electronic equipment;
   4. the identification details of the controller, data processors and designated representative pursuant to article 5, subsection 2;
   5. the parties or categories of parties to whom the personal data may be disclosed in their capacity as designated representatives in the state territory, as data processors or as appointees.
3. The data subject is also entitled to request:
   1. that the data be updated, corrected or, if in his/her interest, supplemented;
   2. that unlawfully processed data be erased, transformed into an anonymous form or blocked; this includes data that do not need to be stored for the purposes for which they were collected or subsequently processed;
   3. a declaration that the parties to whom said personal data have been communicated or disclosed have been informed about the operations indicated in points (a) and (b) and their contents, unless this operation should prove impossible or requires the use of resources that are manifestly disproportionate to the rights that are being protected;
   4. data portability.
4. The data subject has the right to totally or partially oppose:
   1. the processing of his/her personal data for valid reasons, even if such data are relevant to the purposes of collection;
   2. the processing of his/her personal data for the purposes of sending out advertising or direct sales material or for the conducting of market surveys or commercial communications.