Dear Sirs,
we wish to inform you that your personal data (the "Personal Data") will be processed in accordance with the
Regulation (EU) 2016/679 on the protection of individuals with regard to the processing of personal data
(hereinafter, the "General Data Protection Regulation" or "GDPR") and Legislative Decree no. 196/2003 as amended
(the "Privacy Code").
Pursuant to Article 13 of the General Data Protection Regulation, please note that the Data Controller is IMQ S.p.A. ("IMQ"), a single-member company, subject to the direction and coordination of IMQ Group S.r.l., with registered office in Milan, Via Quintiliano no. 43, Tax Code and VAT no. 12898410159, fax: 02 5099 1500, PEC address: direzione.imq@legalmail.it.
As data controller, IMQ processes the Personal Data provided by the customer (the "Customer") in accordance with this privacy policy. The Personal Data shall be processed in compliance with the principles of lawfulness, correctness and transparency and shall be collected to an extent that is adequate, relevant and limited to the purposes, previously determined, explicit and legitimate, of the processing. The contact address of the Data Protection Officer (hereinafter, the 'DPO') is: dpo@imqgroup.it.
Personal Data will be processed for the following purposes:
Personal Data will be processed for the following purposes:
a) without the need for express consent, Personal Data shall be processed::The provision of Personal Data for Contractual Purposes is necessary to execute the Service requested; therefore, in their absence, IMQ will not be able to execute the Service requested. The processing of Personal Data for the Legitimate Interest Purposes is carried out pursuant to Article 6, letter f), of the General Data Protection Regulation for the pursuit of IMQ's legitimate interest that is fairly balanced with the interest of the Customer, since the processing of Personal Data is limited to what is strictly necessary for the performance of the Service. Lastly, the processing of Personal Data for Marketing Purposes is optional and, therefore, the Customer may decide not to provide any data for such purposes or to subsequently deny the consent previously provided by sending an e-mail to the DPO address indicated in point 7 of this Policy. In this case, the Customer will not be able to receive newsletters, commercial communications and advertising material related to the services offered by IMQ. He will however continue to be entitled to the Service for Contractual Purposes. Withdrawal of consent shall not affect the lawfulness of the processing based on the consent before the withdrawal.
The processing of Personal Data is carried out by means of the operations indicated in Article 4 no. 2) of the General Data Protection Regulation, namely: collection, recording, organisation, structuring, storage, consultation, processing, adaptation or modification, selection, retrieval, comparison, use, interconnection, blocking, communication by transmission, dissemination or any other form of making available, restriction, erasure and destruction of data. The Personal Data will be stored on electronic and paper media using the measures deemed most appropriate by the Data Controller to guarantee their security, confidentiality and to prevent unauthorised access, dissemination, modification and misappropriation of the data through the adoption of appropriate technical, physical and organisational security measures.
For the Contractual Purposes, Personal Data may be disclosed to the following categories of recipients, within the limits set out in Section 6 below: a) providers of assistance and consultancy services in the technological, accounting, administrative, legal and insurance sectors; b) credit institutions; c) counterparties and their defenders; d) business partners that carry out outsourcing activities on behalf of IMQ, in their capacity as external data processors pursuant to art. 28 of the GDPR; e) Accreditation Bodies, Certification Bodies, Ministries, Institutes and Associations and, in general, to any public or private entity with respect to which the communication is mandatory by law or by virtue of bilateral agreements for the performance of the aforementioned purposes. For Legitimate Interest Purposes, Personal Data may be transferred to the following categories of recipients: (a) suppliers of assistance and consulting services for IMQ with reference to credit recovery and assignment activities in their capacity as external data processors; (b) competent authorities. For Marketing Purposes, Personal Data may be transferred to the following categories of recipients, located within and, within the limits set out in Section 6 below, outside the European Union: (a) third party providers of support and consulting services for IMQ with reference to the activities of sending commercial communications; and (b) other companies of the IMQ GROUP. A complete list of the persons in charge can be obtained, upon request, through the methods indicated in this Policy.
TPersonal Data may be transferred for Contractual Purposes outside the national territory to countries within the European Union but may also be transferred outside the European Union and in particular to countries where IMQ GROUP companies, Accreditation Bodies and other Certification Bodies are located. With reference to transfers outside the territory of the European Union to countries not considered adequate by the European Commission, IMQ adopts appropriate and adequate security measures to protect Personal Data. Accordingly, any transfer of Personal Data to countries outside the European Union shall take place, in any case, in compliance with the appropriate and adequate safeguards for the purposes of such transfer, such as the standard contractual data protection clauses, in accordance with the applicable legislation and in particular with articles 45 and 46 of the General Data Protection Regulation. In any case, the Customer is entitled to obtain a reference to the appropriate or adequate safeguards adopted for the transfer of the Personal Data and the means to obtain a copy of such Personal Data or the place where they have been made available. For Marketing Purposes, the Personal Data, related exclusively to the email address, will be used for sending communications through the platforms managed by Growens S.p.A. ("MailUp") and SurveyMonkey. Both companies act as external data controllers pursuant to Article 28 of the General Data Protection Regulation.
Personal Data will be kept for as long as it is strictly necessary to fulfil the purposes for which such data was collected, as stated in this policy. In any event, the following retention periods will apply in relation to the processing of Personal Data for the purposes set out below: - for Contractual Purposes and Legitimate Interest Purposes, Personal Data shall be retained for a period equal to the duration of the provision of the Service (including any renewals) and for 10 years after termination, cancellation or withdrawal thereof, except where retention for a later period is required for litigation, requests by competent authorities or under applicable law; - for Marketing Purposes relating to the sending of commercial communications, the Personal Data shall be retained for a period of 24 months following the last contact with IMQ intended as the last Service requested, participation in events or initiatives organised by IMQ or opening of commercial communications sent by IMQ, it being understood that the Customer may at any time request not to receive any further commercial communications from IMQ.
Pursuant to Articles 15-21 of the General Data Protection Regulation, the Customer may at any time exercise the rights of access, rectification or erasure (the so-called 'right to be forgotten'), restriction of processing, and portability of Personal Data by sending a request to the DPO's address: dpo@imqgroup.it
The Customer has the right to lodge a complaint with a Supervisory Authority, which for the Italian territory is the Guarantor for the Protection of Personal Data according to the procedures provided on the website www.garanteprivacy.it.