Privacy policy

1. Who we are

This document is prepared in accordance with Article 13 of European Regulation (EU) 2016/679 on the protection of personal data (the “Regulation” or “GDPR”) and Italian Legislative Decree N. 196 of 30 June 2003 (the “Privacy Code”), as amended and supplemented by Legislative Decree N. 101/2018 and subsequent amendments and additions, by PROMAPLAST srl, with registered address in Centro Direzionale Milanofiori, Palazzo F/3, 20057 ASSAGO (Milan), VAT N. 06128590152 (hereinafter also the “Company”), in its capacity as Controller of your personal data.

The purpose of this Privacy Notice is to inform data subjects about how their personal data are processed.

The contact person for personal data protection can be reached by email at privacy@promaplast.org

2. How personal data are processed

Personal Data provided or obtained will be processed in accordance with the principles of fairness, lawfulness, transparency and confidentiality under applicable legislation. The Controller processes Users’ Personal Data by adopting appropriate security measures to prevent unauthorised access, disclosure, alteration or destruction of Personal Data. Processing is carried out using IT and/or electronic means, with organisational procedures and methods strictly related to the stated purposes.

3. Tools used to process personal data

By entering their Data in the contact form, Users consent to the use of such Data to respond to requests for information or for any other purpose indicated in the form heading. Personal Data collected through the contact form: email address, telephone number, first name and surname.

4. Categories of data processed

The website provides informational and, at times, interactive content.

This Website uses cookies, which are small text files that websites may use to make the user experience more efficient and to personalise content and advertisements, provide social networking features and analyse traffic (cookie policy).

While visitors browse the website, the Company may therefore collect information about them in the following ways:

Browsing data

The IT systems and software procedures used to operate this website acquire, during their normal operation, certain personal data whose transmission is inherent in the use of Internet communication protocols. These data include: IP addresses, browser type, operating system, domain name and the addresses of websites from which the user accessed the site, information on pages visited by users within the website, access time, time spent on individual pages, analysis of navigation paths within the website, and other parameters relating to the user’s operating system and IT environment.

Other categories of data

These include all personal data provided by visitors through the website, for example by:

completing a form to request a quotation and/or information about the services offered and/or to request contact;
writing to the email addresses listed on our website to request information;
accessing a restricted area and/or a service.

In addition to the categories of Personal Data listed above, further data collected by the Controller through tracking tools may be processed, including pixels and marketing tags used to analyse the effectiveness of advertising campaigns. These tools collect information only in aggregate form concerning users’ browsing activity, the device used, pages visited and actions performed on the website.

5. Purposes of processing and legal basis

Personal Data may be collected directly by the Controller or through third parties. In the latter case, the IT systems and software procedures used to operate this Website acquire certain technical Personal Data relating to Users (e.g. IP address, browser type, operating system, domain name and the addresses of websites from which the user entered or exited the site, etc.), the transmission of which is inherent in the normal operation of the Internet. These Data may be processed solely to obtain anonymous statistical information on website use and/or to check that the website is functioning correctly and will be deleted immediately after processing.

Data that the Data Subject chooses to provide voluntarily will be processed in accordance with the conditions for lawful processing under Article 6 GDPR, to enable the Website to provide its services and for the purposes indicated below and will be retained for the time necessary to fulfil those purposes.

The Data provided are processed for the following purposes:

to provide the service requested by the User, manage contracts entered into by the User, fulfil the related administrative, accounting, tax and legal obligations, and respond to requests submitted by the User. Processing for these purposes is necessary to fulfil contractual obligations or the requests of the Data Subject and does not require specific consent;
to assess the user experience of our platforms and the products and services we offer, and to ensure that web pages and their content function correctly. Processing for these purposes is based on the Controller’s legitimate interest;
soft-spam activities, allowing the Controller to send the User promotional emails concerning Products and/or Services already purchased, without the User’s prior express consent, as provided for by Article 130 (4) of the Privacy Code, provided that the User does not exercise the right to object. This processing is based on the Controller’s legitimate interest, as provided for by Article 130 (4) of the Privacy Code, as amended by Legislative Decree N. 101 of 2018;
to carry out statistical analyses of aggregated and anonymous data in order to analyse User behaviour, improve the products and services provided by the Controller and meet Users’ expectations. Processing for these purposes is based on the Controller’s legitimate interest.

The Data collected by the Controller will be shared only for the purposes stated above; we will not share or transfer personal data to third parties other than those identified in this Privacy Notice.

In the course of our activities, and exclusively for the same purposes as those listed in this Privacy Notice, the personal data collected may be transferred to the following categories of recipients:

duly trained and authorised personnel involved in the operation of the Website (administrative and sales staff, legal advisers, system administrators);
service providers (e.g. IT system providers, cloud service providers, database providers and consultants);
public authorities for purposes required by law;
any public and/or private entity to which disclosure of your personal data is necessary in relation to the purposes indicated above.

An up-to-date list of Processors is available at the Controller’s registered office and will be provided upon written request.

Data are processed at the Controller’s operational premises. For further information, please contact the Controller. Data may be processed by individuals and/or legal entities acting on behalf of the Controller under specific contractual obligations and established in EU or non-EU countries. Where Data are transferred outside the EEA, the Controller will adopt all appropriate contractual measures to ensure adequate protection of the Data.

7. Protection of personal data

The Controller has implemented appropriate technical and organisational measures to ensure an adequate level of security and confidentiality for personal data.

These measures take into account:

the state of the art of technology;
the costs of implementation;
the nature of the data;
the risks associated with processing.

The purpose is to protect the data against accidental or unlawful destruction or alteration, accidental loss, unauthorised disclosure or access, and other forms of unlawful processing. Furthermore, the processing of personal data must be adequate, relevant and not excessive, and the Controller must ensure that such data remain up to date and accurate.

8. Data retention periods

Without prejudice to each User’s right to object to the processing of personal data and/or request their erasure, the Company will retain the personal data collected only for as long as necessary to achieve the purpose for which they were collected and received, or to comply with legal or regulatory requirements, as provided for in Article 5 (1) e) GDPR.

In particular:

Data collected in connection with contractual obligations will be retained for the time necessary to fulfil the purposes stated above and as required by law;
Data collected for purposes related to the Controller’s legitimate interest will be retained until that interest has been fulfilled; Users may obtain further information about the legitimate interest pursued by contacting the Controller.

Data may be retained by the Controller for a longer period in order to comply with legal obligations or an order issued by an authority.

At the end of the retention period, Personal Data will be erased and the corresponding rights can therefore no longer be exercised.

9. Exercising the rights of the data subject

L’Interessato ha diritto di esercitare le facoltà previste agli artt. 15-22 del Reg. Europeo 679/2016. In particolare gli viene riconosciuto il:

Right to rectification

Data Subjects may obtain the rectification of personal data concerning them or provided by them to the Company, which makes reasonable efforts to ensure that the personal data it holds are accurate, complete, up to date and relevant, on the basis of the most recent information available;

Right to restriction of processing

Users may obtain restriction of the processing of their personal data where:

they contest the accuracy of their personal data, for the period during which the Controller must verify their accuracy;
the processing is unlawful and they request restriction of processing or erasure of their personal data;
the Company no longer needs to retain the personal data collected;
the User objects to processing while the Controller verifies whether its legitimate grounds override those of the User.

Right of access

Data Subjects may request information from the Controller about their personal data held by the Company, including which categories of personal data the Company possesses or controls, the purposes for which they are used, where they were collected (if not directly from you), and to whom they may have been disclosed;

Right to data portability

Data Subjects may request that the Company transfer their personal data to another controller, where technically feasible, provided that the processing is based on the User’s consent or is necessary for the performance of a contract.

Right to erasure

Data Subjects may obtain the erasure of their personal data from the Controller where:
the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;
the User has the right to object to further processing of their personal data;
the personal data have been unlawfully processed.

Unless processing is necessary to comply with legal or statutory obligations or to establish, exercise or defend legal claims.

Right to object

Data Subjects may object at any time to the processing of their personal data where processing is not based on their consent but on the legitimate interests of the Controller or third parties. In such cases, the Company will no longer retain the User’s personal data unless compelling legitimate grounds, an overriding interest in processing or the establishment, exercise or defence of legal claims can be demonstrated. Where Users object to processing, they must specify whether they wish their personal data to be erased or processing to be restricted.

Right to lodge a complaint

In the event of an alleged breach of applicable privacy legislation, Users may lodge a complaint with the competent authorities in their country or in the place where the alleged breach occurred.

10. Changes to this privacy notice

Any future changes or additions to the processing of personal data as described in this Privacy Notice will be communicated through the usual communication channels used by the Controller (for example, through the website).

Please note that the Controller is not responsible for keeping all links displayed in this Privacy Policy up to date. Accordingly, whenever a link is not working and/or is outdated, Users acknowledge and accept that they must always refer to the document and/or section of the websites to which that link refers.