PRIVACY NOTICE ON THE PROCESSING OF PERSONAL DATA

PURSUANT TO ARTICLE 13 OF REGULATION (EU) 2016/679 (“GDPR”)

This privacy notice is provided by the Data Controller (as defined below) and is addressed to users (hereinafter the “Data Subject” or “User”) who complete the contact forms (“contact forms” or “lead forms”) available on the website www.acciaiterni.it.

  1. DATA CONTROLLER

The Data Controller of the personal data is:

Acciai Speciali Terni S.p.A.

V.le B. Brin, 218

05100 Terni – Italy

Tel. +39 0744 4901

Email: [email protected]

  1. CATEGORIES OF PERSONAL DATA PROCESSED

By voluntarily completing the contact form, the User provides the Data Controller with, and the Data Controller processes, the following categories of personal data:

  • Identification and contact data: name, surname, e-mail address, telephone number.
  • Professional and contextual data: company, country of origin, sector of business/professional activity.
  • Data relating to the request: reason for contacting us (e.g. commercial, technical or compliance information) and any further personal data voluntarily entered by the User in the body of the message.
  1. PURPOSES OF THE PROCESSING, LEGAL BASIS AND RETENTION

The processing of the personal data collected is structured around distinct purposes, each supported by a specific and appropriate legal basis pursuant to Article 6 of the GDPR:

  1. A) Management of and response to the contact request
  • Purpose: To enable the Data Controller to receive, examine, route to the relevant corporate function and respond to the User’s specific request (request for commercial information, quotations, assistance or otherwise).
  • Legal basis: The processing is necessary for the performance of a contract to which the Data Subject is party or for the implementation of pre-contractual measures taken at the Data Subject’s request (Article 6(1)(b), GDPR).
  • Retention period: The data will be retained for the time strictly necessary to handle the request and manage any related follow-up activities, in the absence of subsequent commercial or contractual relationships.
  1. B) Organisational centralisation in the database / CRM (Customer Relationship Management)
  • Purpose: To enable the centralised storage, organisation and historical recording of the User’s data within a database.
  • Legal basis: The processing is based on the Data Controller’s legitimate interest (Article 6(1)(f), GDPR) in optimising its commercial and commercial-administrative interaction flows, structuring the centralised management of potential customers (leads) and verifying the consistency of internal communications.
  • Retention period: The data will remain recorded in the CRM for a maximum period of 24 months from the last contact or active interaction with the Data Subject, unless a subsequent contractual relationship is established that justifies further retention.
  1. C) Sending newsletters and informational-promotional material (Direct Marketing)
  • Purpose: To send to the User’s e-mail address, through automated systems, newsletters, informational and commercial communications, invitations to events and promotional material relating to the products, services and initiatives of the Data Controller.
  • Legal basis: The Data Subject’s express, freely given, specific, informed and unambiguous consent (Article 6(1)(a), GDPR).
  • Retention period: The data will be processed for direct marketing purposes until the User withdraws consent (opts out), which may take place at any time and with the same ease with which consent was given.
  1. NATURE OF THE PROVISION OF DATA AND CONSEQUENCES OF REFUSAL

The provision of data for purposes A (Management of the request) and B (Database/CRM) is necessary. Fields marked with an asterisk (*) in the contact form are mandatory: failure to enter such data will make it impossible to submit the form and, consequently, for the Data Controller to handle the request.

The provision of data and consent for purpose C (Newsletter and Marketing) is entirely optional. Failure to give consent for this purpose will not have any negative consequences for the principal purposes, and the User will receive a regular response to the contact request.

  1. PROCESSING METHODS AND SECURITY

Personal data are processed both with the aid of electronic, IT and telecommunications tools and through analogue (paper-based) methods, using procedures strictly related to the purposes described and in compliance with the principles of data minimisation and storage limitation. The Data Controller implements appropriate technical and organisational security measures pursuant to Article 32 of the GDPR to protect the data against risks of destruction, accidental loss, alteration or unauthorised disclosure.

  1. RECIPIENTS OF PERSONAL DATA

The personal data collected will not be disseminated to unspecified parties. Within the limits of the purposes indicated above, the data may be disclosed or made accessible to:

  1. Authorised internal personnel: Employees and collaborators of the Data Controller who have been specifically instructed and belong to the commercial, marketing, IT, administration and compliance functions.
  2. Data Processors (external parties): Providers of technical and IT services, hosting providers, companies maintaining the CRM and database software, and external communication agencies, formally appointed in writing pursuant to Article 28 of the GDPR.
  3. DATA SUBJECT RIGHTS

Data Subjects have the right to exercise at any time the rights provided for under Articles 15 to 22 of the GDPR:

  • Right of access: To obtain confirmation as to whether or not processing of personal data concerning them is taking place and to receive a copy thereof.
  • Right to rectification: To obtain the updating or rectification of inaccurate or incomplete data.
  • Right to erasure (right to be forgotten): To request the erasure of their data where it is no longer necessary for the stated purposes or in the event of withdrawal of consent.
  • Right to restriction of processing: To request the temporary blocking of processing in the cases provided for under Article 18 of the GDPR.
  • Right to data portability: To receive the data in a structured, commonly used and machine-readable format, where technically feasible.
  • Right to withdraw consent: To withdraw consent given for marketing purposes at any time, without affecting the lawfulness of processing based on consent before its withdrawal.
  • Right to object to processing (Article 21 GDPR): The Data Subject has the right to object at any time, on grounds relating to his or her particular situation, to processing of personal data carried out on the basis of the Data Controller’s legitimate interest.
  1. PROCEDURE FOR EXERCISING RIGHTS AND LODGING A COMPLAINT

To exercise all the rights indicated above, the User may send a written request without any particular formalities to the Data Controller at the e-mail address: [email protected] or by sending a paper communication to the registered office of the Data Controller.

The Data Subject also has the right to lodge a complaint with the competent national supervisory authority (in Italy, the Italian Data Protection Authority, Piazza Venezia n. 11, Rome, www.garanteprivacy.it) if he or she considers that the processing infringes the applicable rules.