Notice pursuant to art. 13 GDPR (in force since 25 May 2018)
Dear User
pursuant to article 13 of the GDPR (EU regulation 2016/679), the following information is provided, in accordance with the principle of transparency, in order to make the user aware of the characteristics and methods of data processing:
a) Identity and contact details
We inform you that the data ‘Controller’ is UPM MODENA spa, with registered office in Modena, Via Bottego 50, VAT number 00941030363. Legal representative: Gian Carlo Bertazzoni.
The following contact details are reported: telephone: 059-346699; email address: info@upm-modena.it; certified e-mail box (Pec): upmmodenaspa@pec.it
The representative in the territory of the State is Gian Carlo Bertazzoni. Contact details: Via Bottego 50, 059-346699, info@upm-modena.it
b) Contact details of the Data Protection Officer (DPO), if mandatory or if present
We hereby inform that the agency has appointed, pursuant to article 37 GDPR, the data protection officer: Massimo Pancini, who can be contacted at address Via Bottego 50; mail info@upm-modena.it; telephone 059-346699.
We hereby inform that the agency has NOT appointed, pursuant to article 37 GDPR, the Data Processor or DPO
c) Purpose of the processing, legal basis and legitimate interest
The data processing requested from the interested party is carried out pursuant to article 6, par. e) of EU regulation 2016/679:
1) product sale
2) provision of services
3) marketing
The legal basis of the processing is the intention to execute the contract and it is constituted, pursuant to article 2-ter of the Privacy Code as amended with Legislative Decree 101/2018, according to the law. The personal data indicated shall be processed by the Data Controller, thus implementing measures connected to contractual or pre-contractual obligations and/or, in the absence of a contract, in the legitimate interest of the Data Controller for free enterprise (pursuant to Article 41 of the constitution). The treatment is necessary for the pursuit of the legitimate interest of the data Controller to comply with the contractual obligations signed between the parties.
d) Recipients and any categories of recipients of personal data
The data are processed within the agency by the persons in charge of data processing, under the responsibility of the Data Controller and for the purposes indicated above.
The data may be communicated to the following external data processors who have entered into specific agreements, conventions or protocols of understanding, and contracts with the data Controller.
The data may be disclosed to the following categories of recipients: suppliers, production managers, business office, administrative office
e) Transfer of data to third countries
The Data Controller shall not transfer data to a third country or to an international organization.
f) Data retention period
The data shall be retained for a period of time not exceeding the achievement of the purposes, (‘principle of storage limitation’, Article 5 of the EU Regulation) or according to the deadlines provided under the law. In particular, we point out that, in compliance with the principles of lawfulness, purpose limitation and data minimisation, pursuant to article 5 of the GDPR, said storage time also results from the requirement of a legal obligation to keep accounting registers.
It should be noted that, with reference to personal data, it is possible to exercise the following rights:
- right to access your personal data; right to obtain the rectification or cancellation of the data themselves or the limitation of the relevant processing;
- right to object to the processing;
- right to data portability (law applicable only to electronic format data), as governed under article 20 of the GDPR.
We hereby inform that since the data processing is based on article 6, paragraph 1, letter a), or on article 9, paragraph 2, letter a) of EU regulation 2016/679, it is possible to withdraw the consent at any time, without prejudice to the lawfulness of the processing based on consent before revocation.
As regards the methods of exercising the aforementioned rights, the interested party can write to: info@upm-modena.it
h) Complaint
The interested party is informed to be vested with the right to lodge a complaint with the supervisory authority by contacting: privacy@upm-italy.com
For further information, please refer to the institutional website of the Data Protection Authority www.garanteprivacy.it
i) Data communication
We hereby inform that the communication of personal data is a legal or contractual obligation, or a necessary requirement for the conclusion of a contract.
j) Provision of data
The provision of data is mandatory, as the communication of data is a contractual obligation or a necessary requirement for the conclusion of the contract.
Should the interested party fail to provide the data, the same party shall not be allowed to proceed with the completion of the procedure.
k) Different purpose of the processing
Should the data Controller intend to further process personal data for a purpose other than the one for which data were collected, before such further processing, the Controller shall provide information regarding such other purpose and any further relevant information to the interested party.
l) Profiling
The Controller does not use automated processes aimed at profiling.