Personal data processing policy – [Cibus Exhibition]
Mutti S.p.A. , with registered office in Montechiarugolo (PR), Via Traversetolo no. 28 – 43022, TAX CODE and VAT NO. 02758310342, as the data controller (hereinafter, “Data Controller”), informs you pursuant to EU Regulation 2016/679 (hereinafter, “GDPR”) and current national legislation on the protection of personal data that your data will be processed in the following ways and for the following purposes:
1. Purpose of processing
The Data Controller will make available a QRcode at its stand during the Cibus Exhibition event. The QRcode redirects to the landing page https://mutti-parma.com/it/mutti-a-cibus-2021/ where your personal data will be collected such as name and surname, e-mail, telephone number, country, area of geographical origin, company of origin and company role/profession (hereinafter, “Data”).
2. Purpose and legal bases of the processing
Your Data is processed without your prior consent for the following purposes and legal bases:
• fulfilment of pre-contractual measures, in particular to:
– send you an e-mail following registration containing the link to download the Data Controller’s product catalogue and certain featured services or events;
In this case the registration takes place in order to download Mutti’s catalogue and to be contacted to show the news.
– be contacted following registration and sending of the catalogue to illustrate the products and services offered by the Data Controller;
– management of contact requests from you relating to services and products offered by the Data Controller;
– management and conclusion of negotiations and possible conclusion of an agreement for the supply of products and services of the Data Controller;
• fulfilment by the Data Controller of legal obligations, such as:
– fulfilment of specific obligations provided for by law, by company regulations, by national and EU regulations as well as deriving from provisions issued by authorities legitimately entitled to do so by law.
• the pursuit of a legitimate interest of the Data Controller, and, in particular, for the exercise of the Data Controller’s rights in judicial proceedings and the management of litigation, as well as the prevention and repression of unlawful acts: the interest of the Data Controller corresponds to the constitutionally guaranteed right of action (Article 24 of the Italian Constitution) and, as such, is socially recognised as overriding with respect to the interests of the individual concerned.
Your Data is processed only with your consent for the following purposes and legal basis:
• sending commercial and promotional communications relating to products, services, special initiatives and invitations to events as well as carrying out market research and surveying the degree of customer satisfaction through newsletters and/or automated (e-mail, fax, sms, mms, social media, social chat, etc.) and traditional (telephone calls with an operator and via traditional mail) tools.
3. Methods of data processing
The processing of your data is carried out in electronic form, by means of the operations of collection, recording, organization, storage, consultation, processing, modification, selection, extraction, comparison, use, interconnection, blocking, communication, cancellation and destruction of data. Your Data is processed electronically and, if necessary, automatically. Data is protected to minimize the risk of destruction, loss (including accidental loss), unauthorized access/use, or use incompatible with the original purpose of collection. This is achieved by means of the technical and organizational security measures implemented by the Data Controller.
4. Data retention
The Data Controller will process your personal data for the time necessary to fulfil the above purposes and in any case for marketing purposes, subject to your explicit and voluntary consent, for no longer than 24 months from collection and until consent is revoked.
The Data Controller will process your data after the Cibus Exhibition in order to contact you and illustrate the products in the catalogue for no more than 30 days after data collection in order to receive an e-mail containing the link from which to download the Data Controller’s catalogue. If, at the end of the contact, no consent is given for marketing purposes and you have not shown any interest in entering into negotiations with the Data Controller, your data will be erased or made anonymous.
If you are contacted and negotiations are started and/or a contract is concluded, your data will be stored until the end of the commercial negotiations and, in the event of the establishment of a contractual relationship, for 10 years from the termination of the relationship.
For purposes related to legal obligations and to the exercise of one’ s own legitimate interest, the Data Controller will process the Data until the end of the terms provided for the fulfilment of such legal obligations and until the end of the terms for legal action.
5. Data provision
The provision of Data for purposes that do not require your prior consent is necessary to illustrate the Data Controller’s products and initiatives, to respond to your requests and initiate negotiations and, if necessary, to establish the working relationship.
The provision of your personal data for marketing purposes that require your prior consent is voluntary and optional; any refusal to provide consent will not affect the processing necessary to respond to your requests, initiate business negotiations and, possibly, to establish the working relationship.
6. Access to Data
Your data may be made accessible for the above purposes to:
• – employees and/or collaborators of the Data Controller, in their capacity as officers in charge of processing and/or in-house data processors and/or system administrators;
• Mutti Group companies and third parties (e.g. IT providers, etc.) carrying out activities in outsourcing on behalf of the Data Controller, in their capacity of external data processors.
An up-to-date list of the data processors, the persons in charge of the processing and system administrators is kept at the Data Controller’s head office.
7. Disclosure of Data
Your personal data may be communicated, without your prior consent, for the above purposes to public bodies or competent authorities, to supervisory authorities, police forces or the judiciary that will process the data at their request as autonomous data controllers.
8. Data transfer
The Data Controller may transfer the Data outside the European Union. For this purpose, in accordance with privacy legislation, the Data Controller assesses the consequences of Data transfers and adopts, if applicable, the most appropriate safeguards (for example, adequacy decisions or standard contractual clauses).
9. Rights of the data subject
The Data Controller informs you that, as a data subject, if the limitations provided for by law do not apply, you have the right to:
• obtain confirmation of the existence or not of personal data, even if not yet recorded, and that such data be made accessible to you in an intelligible form;
• obtain an indication and, where appropriate, a copy of: a) the origin and category of the personal data; b) the logic applied in the case of processing carried out with the aid of electronic systems; c) the purposes and methods of processing; d) the identity of the data controller and data processors; e) the entities or categories of entity to which the personal data may be communicated or which may become aware of them, in particular if they are recipients in third countries or international organisations; e) where possible, the period of storage of the data or the criteria used to determine that period;
• obtain, without undue delay, the updating and correction of inaccurate Data or, when interested, the integration of incomplete data;
• obtain the erasure, anonymization or blocking of Data: a) processed unlawfully; b) no longer necessary in relation to the purposes for which they were collected or subsequently processed; c) in the event of withdrawal of the consent on which the processing is based and if there is no other legal basis; d) if you have objected to the processing and there is no overriding legitimate reason to continue the processing; e) in the event of compliance with a legal obligation; f) in the case of data referring to minors. The Data Controller may refuse erasure only in the case of: a) exercise of the right to freedom of expression and information; b) fulfilment of a legal obligation, performance of a task carried out in the public interest or exercise of public authority; c) reasons of public health interest; d) archiving in the public interest, scientific or historical research or for statistical purposes; e) exercise of a right in court;
• obtain the restriction of processing in the event of: a) contesting the correctness of the personal data; b) unlawful processing by the Data Controller to prevent their deletion; c) exercise of a right in court; d) verification of whether the Data Controller’s legitimate reasons override those of the data subject;
• receive your personal data, if the processing is carried out by automated methods, without any impediment and in a structured, commonly used and readable format, in order to transmit them to another data controller or – if technically feasible – to obtain direct transfer by the data controller to another data controller;
• wholly or partly oppose, on legitimate grounds relating to your particular situation, the processing of personal data concerning you;
• revoke your consent at any time;
• lodge a complaint with the Data Protection Authority.
In the above cases, where necessary, the Data Controller will inform the third parties to whom your Data is communicated of the possible exercise of your rights, except in specific cases (e.g. where such fulfilment would be impossible or would require the use of a clearly disproportionate effort in relation to the right protected).
10. Method of exercising rights
You may exercise these rights at any time:
• by sending a registered letter with acknowledgement of receipt to the Data Controller’s address;
• by sending an e-mail to firstname.lastname@example.org.