Data Protection Policy
Pursuant to the national and European regulations governing the protection of personal data (i.e. EU Regulation no. 2016/679 of the European Parliament and the Council of 27 April 2016 regarding the protection of physical persons with reference to the processing of their personal data, as well as the free circulation of said data (GDPR), Italian Legislative Decree no. 196/2003, and any other regulations governing the protection of personal data applicable in Italy, including measures adopted by the Data Protection Authority), hereinafter, for the sake of brevity, also referred to as the “Data Protection Regulations”.
1) Introduction
Cartiere Carrara takes the protection of your personal data very seriously. The principles set out below form the foundations of Cartiere Carrara’s approach to data protection.
Your personal data will be:
- processed lawfully, properly and transparently;
- collected for the purposes established, set out and legitimated in paragraph 4) below, and subsequently processed in ways compatible with said purposes;
- adequate, pertinent and limited to the requirements necessary for the purpose for which they are processed;
- accurate and updated as necessary. To this end, Cartiere Carrara undertakes to adopt all the measures suitable to guarantee the timely rectification and/or removal of data that are inaccurate for the purposes for which they are processed;
- stored in such a way as to allow them to identify you for a period no longer than the time required for the purposes for which they are processed;
- processed in such a way as to ensure personal data remain secure, including the use of technical and organisational means suitable to guarantee protection from unauthorised or unlawful means of processing, and from loss, destruction or accidental damage.
2) Personal Data Controller and Supervisor
Pursuant to the Data Protection Regulations, CARTIERE CARRARA S.p.A., 55012 Tassignano (Lucca), e-mail infoprivacy@cartierecarrara.com, VAT no: 00385850474, in its capacity as Data Controller, is obliged to provide you with information regarding the use of your personal data.
Requests to exercise the rights set forth in the Data Protection Regulations in paragraph 10 below may be submitted in writing to the e-mail address of the Data Protection Officer (DPO), who can be contacted at: dpo@cartierecarrara.com.
3) Source of personal data
Personal data are collected by Cartiere Carrara S.p.A. in the course of its business activities, also by using remote communication techniques, such as the website, directly from the subject the personal data refer to (“Data Subject”).
Personal data may also be acquired by third parties for the following purposes: commercial information, market research, direct offers of products or services. In this last case, CARTIERE CARRARA S.p.A. will ensure the Data Subjects are provided with the information in the introduction at the time data regarding them are recorded, or in any case on the first occasion said data are communicated.
4) Purposes of processing
Personal data are processed in the course of CARTIERE CARRARA S.p.A’s normal business activity, for the following purposes:
to comply with the obligations deriving from contracts entered into with CARTIERE CARRARA S.p.A., and/or to meet, before contracts are concluded, the specific requests of the Data Subject;
to comply with obligations established by the law, regulations or EU legislation;
other activities of CARTIERE CARRARA S.p.A., carried out by letter, telephone, advertising material, automated communication systems, newsletters, etc., for which Data Subjects may give or fail to give their consent.
Specifically, CARTIERE CARRARA S.p.A. may carry out the following activities:
commercial information, offers of products/services, sending of its newsletters either directly or through specialised companies;
market research aimed at recording the Data Subjects’ level of satisfaction with the quality of the services provided and the activity carried out either directly or through specialised companies;
commercial information and offers of products/services of third-party companies provided directly by CARTIERE CARRARA S.p.A.
With regard to purposes a) and b), please note that your consent is not required for the processing of your personal data by CARTIERE CARRARA S.p.A., including the communication of said data to the subjects mentioned in paragraph 7 below, because this processing is necessary to comply with the obligations deriving from the contract and/or for carrying out the services you requested, as well as for compliance with legal obligations. As regards point c), each Data Subject is entitled, at any time, to withdraw the consent provided to CARTIERE CARRARA S.p.A. for the processing and/or communication of his/her data to the subjects mentioned in paragraph 7) below; this will not damage the contractual relationship in any way.
5) Means of data processing
For the purposes described in paragraph 4 above, personal data are processed by manual, IT and telematic means, using approaches strictly related to the purposes indicated above, and in such a way as to guarantee the security and confidentiality of said data (with particular reference to cases in which remote communication techniques are used).
6) Categories of data that may be processed
For the purposes described in paragraph 4 above, CARTIERE CARRARA S.p.A. processes personal data different from the particular categories of “sensitive” data set forth in art. 9 of the GDPR (e.g.: personal data that may reveal racial or ethnic origin, religious convictions, political opinions, personal data that may reveal indications on a person’s health or sexual activity) and from “legal” data relating to criminal convictions or offences, as set forth in art. 10 of the GDPR. Specifically, CARTIERE CARRARA S.p.A. processes personal data – referring to customers and potential customers – such as name, address, personal identification data, tax ID code, etc. For this reason, we ask you not to provide us with “sensitive” and/or “legal” data. However, should CARTIERE CARRARA S.p.A., in order to conduct its business, need to process data of a “sensitive” nature, the company will provide you with a supplement to this Information and the pertinent request for your consent for processing.
7) Categories of subjects to whom data may be transmitted, or who may learn of said data in their capacity as Data Supervisors or persons in charge of data processing
For the purposes described in paragraph 4), CARTIERE CARRARA S.p.A., needs to transmit your personal data to third parties in Italy and abroad, belonging to the following categories:
supervisory authorities and bodies and, in general, public or private subjects with public law functions;
other companies of the group CARTIERE CARRARA S.p.A. is part of, or parent companies, subsidiaries and affiliates;
subjects that provide services for the acquisition and processing of data necessary for carrying out the instructions received from customers;
subjects that provide services for the management of CARTIERE CARRARA S.p.A.’s information system and telecommunication networks (including e-mail);
subjects that transmit, place in envelopes, transport and sort communications with Data Subjects;
subjects involved in filing documentation and data entry;
subjects that carry out customer care activities (e.g.: call centres, help desks, etc.);
firms or companies that provide assistance and consulting services;
subjects that carry out market research to identify levels of customer satisfaction with the quality of the services and the activity carried out by CARTIERE CARRARA S.p.A.;
subjects that promote and sell products/services of the company and of the other companies in the group CARTIERE CARRARA S.p.A. is part of;
subjects that certify, revise and certify the activities carried out by CARTIERE CARRARA S.p.A., also in the interest of customers
The subjects belonging to the categories above operate entirely independently as separate data controllers, or as data supervisors or persons nominated for the purpose by CARTIERE CARRARA S.p.A., a constantly updated list of which is available from CARTIERE CARRARA S.p.A., in this section of the website www.tuscanytissue.it. Data processed by CARTIERE CARRARA S.p.A. will not be made public.
8) Period for which data may be stored
Your personal data will be stored:
for the purposes set out in paragraph 4 letter a), for the ordinary ten-year period starting from the end of the contractual relationship;
for the purposes set out in paragraph 4 letter b, for the time strictly necessary to carry out the aforementioned purposes, and in any case, no longer than the time provided for by law;
for the purposes set out in paragraph 4 letter c), for 24 months
9) Transfer of personal data abroad
We may transfer your personal data to the third parties indicated in paragraph 7 above, based in other countries, so that they may process the personal data on our behalf.
Please note that not all countries offer the same legal protection for the processing of personal data. In these cases, Cartiere Carrara S.p.A. undertakes to ensure adequate guarantees are offered for the protection of your personal data, in observance of the regulations in force, and to provide timely notification to Data Subjects with reference to the aforementioned guarantees and on how to obtain a copy of said data or information on the place where they have been made available.
10) Rights of the Data Subject
Finally, please note that the Data Protection Regulations grant Data Subjects the possibility to exercise a number of specific rights. Specifically, Data Subjects may:
obtain confirmation of the existence of data regarding them, even if not yet recorded, and the communication thereof in an intelligible form, as well as a copy of the data processed
request information regarding the origin of personal data, the purposes for which and the means by which they are processed, as well as the logic applied in the event data are processed using electronic tools, if they are collected by third parties
have their personal data rectified or supplemented without undue delay.
have their personal data removed, without undue delay, in the cases provided for by the regulations in force
obtain the blocking or anonymisation of data and other limits to the processing thereof in the cases provided for by law
oppose the processing of their personal data. Specifically, Data Subjects may oppose the processing of their personal data for the purposes of sending advertising or direct sales material, or for carrying out market research or for commercial communications
submit complaints to the supervisory authority to report an unlawful use of their personal data.
11) Mandatory or non-mandatory provision of data
Please note that providing your data for the purposes in paragraph 4, letters a) and b) is not mandatory, but it is necessary for carrying out the contractual activities and measures required by law.
Please also note that providing your data for the purposes set forth in paragraph 4, letter c) is not mandatory, because the legal principle governing the processing of your data for the aforementioned purposes is founded upon specific, unequivocal, freely given consent. However, failure to provide your data will make it impossible for Cartiere Carrara to process your data.
