Personal data processing information
(Privacy Act – Legislative Decree No 196 of 30.6.2003, Article 13)
Smalvic S.p.A. with registered headquarters in Sarcedo, Via Ca’ Fusa, 1 – 36030 Vicenza states pursuant to Article 13 of the personal data protection act (Legislative Decree No 196 of 30.6.2003 – Privacy Act) that it is the holder of information on the user categorised as personal data under the Privacy Act and that it will process that information for the purposes and in accordance with the methods indicated below.
Personal data processing means any operation or set of operations, even if carried out without using electronic means, concerning the collection, registration, organisation, storage, consultation, processing, amendment, selection, extraction, comparison, use, interconnection, blocking, communication, dissemination, deletion and destruction of data, even if not recorded in a database.
These data shall be handled manually and/or with the aid of computer or telematics media for the following purposes.
A. Primary purposes of personal data processing
A.1 Purpose of allowing users to register on the Website
Accessing and browsing the website www.smalvic.it (hereafter the “Website”) are free, but certain services can only be accessed following registration of the user. The registration process involves compiling an on-line form in which the user is required to enter his/her personal data for the activation of authentication credentials (login + password) that the data subject can subsequently use to access all areas reserved for registered users.
The primary processing purposes are therefore the need to allow the completion of the required prior on-line registration procedures and the setting up of an account as well as to allow generation and subsequent technical and administrative management (including the purposes of providing technical support and assistance on request) of the account, of the Customer IDs, of the activation codes, of the passwords and similar authentication credentials as created by the user as part of the registration process. These primary and main registered user data processing purposes also include the purposes of allowing access to the webpages and access to online services, where provided. The purpose of the latter type of processing is also to handle any type of technical, marketing and/or contractual assistance request received by Smalvic S.p.A. and provide the relevant responses to users.
A.2 Purpose of fulfilling obligations under the law, regulations or EU legislation
Secondly, personal data shall also be processed to meet obligations provided by law, regulations or EU legislation and for civil, accounting and tax purposes.
B. Communication and dissemination of personal data to pursue the primary processing purposes
In all the above cases – and based on the applicable Privacy Act rules – Smalvic S.p.A. may disclose personal data externally: to third parties who are involved in pursuing the exclusive primary processing purposes as described above.
With reference to Article 13(1)(d) of the Privacy Act concerning the indication of persons or categories of persons who may become aware of personal user data in their capacity as data processors or persons in charge of data processing, the following list is provided:
– staff of Smalvic S.p.A.;
– companies that perform outsourcing activities on behalf of Smalvic S.p.A., including computer technicians who manage the websites and associated electronic communication infrastructures for this purpose, who are appointed as data processors and – in the case of third-party natural persons – who are in charge of processing;
– external suppliers who provide Smalvic S.p.A. with support services, appointed data processors;
– professionals and consultants (e.g. law firms, accountants and audit firms), appointed as data processors.
Personal data shall not be subject to disclosure.
B.1 Mandatory or optional nature of consent for pursuing the primary personal data processing purposes
In all cases set out above in Sections A and B (for disclosure to third parties) – and based on the applicable Privacy Act rules – Smalvic S.p.A. is not obliged to obtain specific consent from users for the processing of their data. All the processing described above pursues primary purposes for which Article 24 of the Privacy Code rules out the need to obtain specific consent from the data subject, either because the processing is necessary to comply with obligations laid down by law, regulations or EU legislation, or because the processing is necessary to meet the specific requirements of the data subject.
Where the user does not intend to provide the personal data that is required and necessary based on the foregoing, it would consequently be impossible to proceed, also making it impossible to register online and use all the services for which data registration and/or conferral are technically mandatory.
C. Secondary personal data processing for general promotional, advertising and marketing purposes
Personal data collected may also be processed in paper form (e.g. compilation of forms, coupons and similar paperwork at the point of sale and subsequent use in electronic form) and using automated/computerised methods for the purposes of sales promotion, advertising communications, soliciting buying behaviour, market research, surveys (including telephonic, on-line or by means of forms), statistical processing (in identified form) and general marketing of products and/or services referring to Smalvic S.p.A. (hereafter generally referred to as “Processing for Marketing Purposes”). By granting consent to Processing for Marketing Purposes, the data subject specifically acknowledges the said general promotional, sales and marketing purposes of the processing (including consequent management and administrative activities) and expressly authorises such treatment under the terms of article 23 of the Privacy Act (where the methods used for Processing for Marketing Purposes are a telephone with operator or other non-electronic means, not telematic or not supported by automatic, electronic or telematic mechanisms and/or procedures) and also pursuant to article 130 of the Privacy Act (where the methods used for Processing for Marketing Purposes are email, fax, text messages, MMS messages, automatic systems without operator intervention and so on, including electronic platforms and other telematic means). For the purposes of fulfilling privacy obligations for the holder in compliance with principles of simplifying obligations (Article 2 of the Act), we inform you that the specific consent form will be standard and general and will refer to all possible marketing processing methods and Articles 23 and 130 of the Act, without prejudice to the data subject’s ability to notify Smalvic S.p.A. (at email: email@example.com) that he or she wishes to use certain methods and not others for receiving marketing communications with prior consent. Furthermore, again for the purposes of fulfilling privacy obligations for the holder in compliance with principles of simplifying obligations (Article 2 of the Act), we also inform you that the specific consent form will be standard and general and will also refer to all possible marketing processing methods set out herein (i.e. without using separate consent forms for each different marketing purpose pursued by the holder), without prejudice to the data subject’s ability to notify Smalvic S.p.A. (at email: firstname.lastname@example.org) that he or she wishes to use certain methods and not others for receiving marketing communications with prior consent.
Under the terms of the General Revision of the Privacy Authority of 15 May 2013 entitled “Consent to the processing of personal data for ‘direct marketing’ purposes through traditional and automated contact tools”, we specifically draw users’ attention to the fact that:
1. Any consent provided for the sending of commercial and promotional communications based on Article 130(1) and (2) of the Act (i.e. using email, fax, text message, MMS and automatic systems without operator intervention etc., including electronic platforms and other telematic methods) will involve receiving the said communications by traditional methods such as ordinary mail or calls via an operator as well as by means of automated contact methods;
2. The user’s right to object to the processing of his or her personal data for the purposes of direct marketing through the above automated contact methods shall in any case extend to conventional methods and, even in this case, it is nevertheless possible to exercise this right in part, as provided by Article 7(4) of the Act with regard to certain media as well as certain types of processing;
3. Any user who does not intend to consent in the terms indicated above is free to express a wish to receive communications for the aforementioned marketing purposes solely through conventional means of contact, where provided: this desire can be exercised free of charge by sending an ordinary email to email@example.com.
In order to proceed with processing for marketing purposes, it is obligatory to obtain a specific, separate, express, documented, advance and entirely optional consent.
Consequently, where the data subject decides to give this specific consent, he or she shall be informed in advance and be aware that the pursued processing purposes are of a specific commercial, advertising, promotional and marketing nature in a broad sense. In the interests of absolute transparency, we would like to inform you that the data will be collected and subsequently processed on the basis of a specific consent provision:
1. To send advertising and informative material (e.g. newsletters) of a promotional nature or in any case for marketing purposes to persons who have previously knowingly consented, within the meaning of Article 23 and 130 of the Privacy Act;
2. To carry out activities intended for the sales or placement of Smalvic S.p.A. products or services;
3. To send commercial information; to conduct interactive commercial communications, including in accordance with Legislative Decree 206/2005, through the use of email;
4. To process market studies, research and statistics;
5. To send unsolicited commercial communications within the meaning of Article 9 of Legislative Decree No 70 of 9 April 2003 implementing “E-Commerce Directive” 2000/31/EEC, which provides that unsolicited commercial communications must be immediately and unambiguously identifiable as such and contain the indication that the message recipient may opt out of receiving such communications in the future.
By granting the optional consent, the data subject therefore specifically acknowledges and authorises such additional possible secondary processing actions.
In any case, even when the data subject has consented to authorise Smalvic S.p.A. to pursue all the purposes mentioned in points 1 to 5 above, he or she nevertheless remains free to revoke his or her consent at any time by sending Smalvic S.p.A. a clear notification for this purpose without any formalities. After receiving this opt-out request, Smalvic S.p.A. shall promptly proceed to the removal and deletion of the data from databases used for processing for marketing purposes and inform any third parties to which the data may have been communicated for the same purposes. Simple receipt of a cancellation request shall automatically denote confirmation of cancellation.
C.1 Communication and dissemination of personal data for pursuing secondary processing purposes of a promotional, advertising and marketing nature in the broad sense.
For the purposes set out in points 1 to 5 of Section C above, Smalvic S.p.A. states that the data may also be disclosed to third-party business partners. Consent to processing for marketing purposes by Smalvic S.p.A. – where provided by the data subject – does not cover different and additional marketing represented by communication of the data to third parties for the same purposes. In order to make this disclosure to third parties, it is compulsory to obtain a further, separate, additional, documented, express and fully optional informed consent from the data subject.
This is set out in the Garante’s General Provision of 4 July 2013 concerning Guidelines on Marketing and against spam:
1. for communications made generally to third parties for marketing purposes, it is not permitted to communicate or transfer personal data to third parties for marketing purposes based on a single, unspecific statement of consent obtained from data subjects for marketing purposes;
2. a data controller planning to collect personal data also with a view to communicate (or transfer) such data to third parties for the third parties’ marketing purposes must first inform data subjects beforehand by issuing them with an information notice that specifies the individual third parties or else the respective (business or commodity) categories;
3. the data controller must obtain specific consent to communicate (and/or transfer) the personal data to third parties for marketing purposes; such consent must be obtained separately from the consent requested by the data controller in order to perform marketing activities of its own;
4. where a data subject gives his/her consent to communicate the personal data to third parties, those third parties may use the data for marketing activities of the type mentioned in Article 130(1) and (2) of the Privacy Code vis-à-vis the data subject without obtaining an additional consent statement for such marketing purposes.
This communication to third parties may have the following characteristics, according to circumstances:
– disclosure of the data subject’s data by Smalvic S.p.A. to third parties in general in order that the latter may carry out separate processing compatible with processing for marketing purposes; in this case, the communication recipients may be based on the same specific marketing consent (and on the consent for disclosure to third parties for the same purpose) that the data subject has already provided to Smalvic S.p.A.;
– disclosure of the data subject’s data by Smalvic S.p.A. to third parties in general in order that the latter may carry out separate processing compatible with processing for marketing purposes; in this case the data subject’s consent covers only the processing represented by external disclosure while the communication recipients are personally bound – as independent processing data controllers independent from Smalvic S.p.A. – provision of its information notice to the data subject and obtaining optional and specific marketing consent;
– disclosure of the data subject’s data by Smalvic S.p.A. to third parties in general who may collaborate with Smalvic S.p.A. (for example, within the scope of co-branded marketing campaigns) or data that may be outsourced based on a service contract to send commercial communications to the data subject or they may be outsourcers contractually appointed (and appointed data processors) to carry out processing for marketing purposes on behalf of Smalvic S.p.A.: in this case the communication recipients may refer to the same specific marketing consent (and the consent for disclosure to third parties for the same purposes) that the data subject has already provided to Smalvic S.p.A.
Under the Garante’s General Provision of 4 July 2013 concerning Guidelines on Marketing and against Spam, third parties to which the personal data of data subjects are disclosed for subsequent processing for marketing purposes can be identified with reference to the following commodity or financial categories: publishing, furnishing, appliance and general home supplies companies, suppliers of electronic communication goods and services, Internet service providers, communication agencies, companies supplying insurance and financial services, banks and credit institutions, companies providing personal and home services and goods.
Personal data shall not be subject to disclosure.
If, for the purposes set out in sections C and C.1, optional indication of the data subject’s telephone subscriber number has been requested and the latter has given his or her optional and specific consent to the processing of this personal data for the purposes of commercial promotion and general marketing, we hereby inform you that Smalvic S.p.A. and any third parties can legally process the telephone subscriber for marketing purposes even if the number is registered with the Telephone Preference Service as it is from a source other than public telephone directories and covered in the event of conferral by specific consent.
C.2 Obligatory or optional nature of consent for pursuing secondary processing purposes of a promotional, advertising and marketing purpose in the broad sense.
We particularly note that the conferral of personal data to Smalvic S.p.A. and the provision of consent to processing for marketing purposes and the separate consent for communication to third parties for processing for marketing purposes for the above purposes and by the above procedures are absolutely preferential and optional (and can in any case be revoked without any formalities even after the provision) and non-conferral will not have any consequences other than the fact that it will be impossible for Smalvic S.p.A. and any third parties to carry out the above processing for marketing purposes.
If marketing consent is denied, there will be no interference and/or consequence with regard to the business, contractual or other type of relationship covered by the Contract and the personal data processing shall fall within the primary processing purposes referred to in Sections A and B of this privacy disclaimer.
With exclusive regard to the use of the email indicated by the user upon finalisation of the Contract, Smalvic S.p.A. may send informative and advertising material (without the need to obtain specific consent, as provided for in Article 130(4) of the Privacy Act) only if it relates solely to products similar to those covered by the Contract. In this specific instance, the user retains the right to opt out of the processing at all times (by notifying firstname.lastname@example.org of the opt out) at the time of reception. In any event, when Smalvic S.p.A. sends any email communication for the purposes set out herein, the data subject will be duly informed of the possibility of simply opting out of the processing at any time without any charge. This opt-out will have no consequences on the Contract.
In other different cases where the user’s email is used to send different information and advertising material that is not similar to products covered by the Contract already drawn up, the obligation to obtain a specific separate consent still stands under Article 130(1) and (2) of the Privacy Act.
Lastly, when Smalvic S.p.A. intends to process the user’s personal data for additional and different purposes (such as profiling for marketing purposes or outsourcing of data to third parties) it will inform the user in advance and collect its explicit and separate consent.
D. Type of personal data subject to processing on the website
Without prejudice to the fact that “personal data” means “any information relating to natural persons, identified or identifiable, even indirectly, by reference to any other information including a personal identification number” and that “sensitive data” means “personal data allowing the disclosure of racial and ethnic origin, religious, philosophical or any other kind of beliefs, political opinions, membership of parties, trades unions, religious, philosophical, political or trades union associations or organisations and also personal data allowing the disclosure of personal data on health or sex life”, Smalvic S.p.A. states that sensitive data will not be processed on the website.
Where a foreign data subject indicates a name that reveals his or her nationality at the time of registration, we hereby specify that this data is not sensitive as it is different from data revealing the person’s actual racial or ethnic origin.
- Any indication by the data subject of the personal data of third-party subjects
The user acknowledges that the indication (for example when completing the website registration form) of any third party other than the data subject represents the processing of personal data in relation to which he or she becomes an independent data controller, assuming all the obligations and responsibilities set out in the Privacy Code. In this regard, the user guarantees to Smalvic S.p.A. that any data on third-party subjects indicated in this way by the user (which will then consequently be processed as though the third-party subject had supplied his or her own informed consent to processing, where obligatory) has been acquired by the user in full compliance with the Privacy Act. With regard to this point, the user offers the fullest indemnity against any complaint, claim, processing damage compensation request etc. that may be directed against Smalvic S.p.A. by any third party data subject due to the provision of data indicated by the user in violation of applicable personal data protection rules.
F. Data controller and data processor
Details identifying Smalvic S.p.A. as the data controller of the user’s data.
Sarcedo, Via Cà Fusa, 1 – 36030 Vicenza
An updated list of the data processors (if appointed) can be found at the Smalvic S.p.A. headquarters.
G. Exercising of rights by the data subject
The user may at any time – without any formalities – exercise the rights set out in Article 7 of the Privacy Code (if necessary using the appropriate claim form provided by the Garante at www.garanteprivacy.it), which is set out in full below for convenience. The exercise of rights is not subject to any form of constraint.