Pursuant to Article 13 of the General Data Protection Regulation – Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (hereinafter “GDPR”), we are hereby providing you with some information relating to the processing of your personal data provided in the context of the relationship with Aermec s.p.a.
| Data Controller |
|---|
| The Data Controller is Aermec sp.a., with registered office in Via Roma, 996-37040 Bevilacqua (VR), registered in the Verona Companies Register: 00234050235 - AEE Register: IT08020000002435 - PA Register: IT09060P0000074, Tax Code / VAT Number: 00234050235 (hereinafter also “Owner” or “Company”) |
| Purpose | Legal basis for processing |
|---|---|
| Manage the execution of pre-contractual measures, as well as manage the execution and fulfillment of mutually assumed contractual obligations. | (Art. 6, paragraph 1, letter (b), GDPR) Fulfillment of a contract |
| Commercial and direct marketing through the transmission to the email addresses provided by you of communications relating to the sale of products and/or services similar to those already provided, provided that you, adequately informed, do not refuse such use, initially or on the occasion of subsequent communication. | (Art. 6, paragraph 1, letter (f), GDPR) Processing necessary for the pursuit of the legitimate interest of the Data Controller connected to the organizational and commercial management of its organization |
| Manage the archiving and storage of data, information, communications, including electronic ones, and documents relating to the relationship with the Company. | (Art. 6, paragraph 1, letter (c), GDPR) Processing necessary to fulfill a legal obligation to which the Data Controller is subject |
| Purpose | Legal basis for processing |
|---|---|
| The Data Controller may process personal data related to geolocation data through the App. The App allows you to identify whether you are within or outside a certain radius (determined by you through the App) from the place where the thermostat is installed, without mapping your movements for any reason. The processing of geolocation data relating to you is necessary for the performance of some of the services entrusted to us. | (Art. 6, paragraph 1, letter (f), GDPR) Consent |
For the pursuit of the purposes indicated above, your personal data may be communicated to:
| Third parties or categories | Purpose | Notes |
|---|---|---|
| IT companies | Management, maintenance, updating of systems and software used by the Data Controller | Appointment as data processor (art. 28, GDPR) |
| Suppliers of networks, electronic communication services and IT and telematic services for archiving, storage and computer management of data | Hosting, housing, Cloud, SaaS and other remote IT services essential for the provision of the Data Controller's activities; electronic document archiving and storage services in compliance | Appointment as data controller (art. 28, GDPR). Cloud services may involve data processing in non-EU countries, which guarantee appropriate confidentiality rights. |
| Consultants, professionals, law firms, arbitrators, insurance companies, experts, brokers; other service providers connected to the activity of customers/suppliers | Judicial, extrajudicial, insurance activities in the event of accidents. Organizational, administrative, financial and accounting management | Appointment as data controller (art. 28, GDPR). |
| Public Security Authorities and Judicial Authorities | Management of investigations by the investigating bodies in the event of accidents |
The companies of the GRIG Group and the third parties to whom your personal data may be communicated act as:
We illustrate below the period of retention of personal data or, if this is not possible, the criteria used to determine this period.
| Personal data and documents | Period of retention or criteria to determine it |
|---|---|
| Personal data and documents relating to the contractual relationship | For the duration necessary to pursue the purposes of the processing and also subsequently, within the limits allowed by law, for administrative, accounting and tax purposes, as well as to assert or protect the rights of the Data Controller, where necessary |
| Geolocation data | For the duration strictly necessary to pursue the purposes of the processing and also subsequently, within the limits allowed by law or special provisions on the matter, except for needs to protect the rights of the Owner, where necessary |
We inform you of the existence of some rights provided by the GDPR in relation to personal data and the related processing that you can request from the Data Controller.
| Right | Description | How to make it effective |
|---|---|---|
| Right of access to data (art. 15) |
You can request: a) the purposes of the processing; b) the categories of personal data in question; c) the recipients or categories of recipients to whom the personal data have been or will be communicated, in particular if recipients in third countries or international organizations; (d) where possible, the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period; (e) the existence of the right to request from the controller rectification or erasure of personal data or restriction of processing of personal data concerning the data subject or to object to such processing; (f) the right to lodge a complaint with a supervisory authority; (g) where the personal data are not collected from the data subject, any available information as to their source; (h) the existence of automated decision-making, including profiling, referred to in Article 22(1) and (4) and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject. You have the right to request a copy of the personal data being processed | Forms on the website or available from the Data Controller |
| Right to rectification (art. 16) |
You have the right to request the rectification of inaccurate personal data concerning you and to obtain the integration of incomplete personal data | Forms on the website or available from the Data Controller |
| Right to be forgotten (art. 17) |
You have the right to obtain from the Data Controller the erasure of personal data concerning you if the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed | Forms on the website or available from the Data Controller |
| Right to restriction of processing (art. 18) |
You have the right to obtain from the Data Controller the restriction of processing when you have contested the accuracy of the personal data (for the period necessary for the Data Controller to verify the accuracy of such personal data) or if the processing is unlawful, but you oppose the erasure of the personal data and instead request that their use be limited or if they are necessary for the establishment, exercise or defense of a right in court, while the Data Controller no longer needs them. | Forms on the website or available from the Data Controller |
| Right to portability (art. 20) |
You have the right to receive the personal data concerning you provided to us in a structured, commonly used and machine-readable format and have the right to transmit them to another controller if the processing: (i) is based on consent, (ii) on the contract and (iii) if the processing is carried out by automated means, unless the processing is necessary for the performance of a task carried out in the public interest or in connection with the exercise of public authority and such transmission does not infringe the rights of a third party. | Forms on the website or available from the Data Controller |
| Right to object (art. 21) |
You have the right at any time to object, in whole or in part, to the processing of your personal data if the processing is carried out for the pursuit of a legitimate interest of the Data Controller or if the processing is carried out for direct marketing purposes. In this case, the personal data will no longer be processed for these purposes. | Forms on the website or available from the Data Controller |
| Right to lodge a complaint with the Supervisory Authority (art. 77) |
You have the right to lodge a complaint with the Supervisory Authority if you believe that the processing concerning you violates the GDPR. |
The exercise of the aforementioned rights is subject to the limits, rules and procedures provided for by the GDPR and that the Data Subject must know and implement. Furthermore, in accordance with the provisions of Article 12, paragraph 3, the Data Controller will provide the data subject with information relating to the action taken without unjustified delay and, in any case, no later than one month after receiving the request. This deadline may be extended by two months, if necessary, taking into account the complexity and number of requests. The Data Controller shall inform the data subject of such extension, and of the reasons for the delay, within one month of receiving the request.
This information may be subject to changes and/or additions, also as a consequence of the applicability of the GDPR and any future regulatory changes and/or updates. The updated information is constantly available on the website of the Data Controller.
**********
The personal data provided may be processed by the Data Controller with and without the aid of IT tools.
We also inform you that the communication of your personal data for the mandatory purposes indicated is a legal or contractual obligation or a necessary requirement for the execution of contractual obligations, therefore you have the obligation to provide personal data, because in their absence it will not be possible to manage the relationship with the Company.
AERMEC S.P.A. - Copyright © 2024