Privacy Policy & Cookie Policy

PRIVACY POLICY

pursuant to art. 13 of European Regulation No. 679 of 2016 and art. 13 of Legislative Decree No. 196 of 30 June 2003

El.En. S.p.a. is committed to protecting the privacy and confidentiality of personal data and ensures them the necessary protection from any event that might put them at risk of a breach.

Pursuant to article 13 of Legislative Decree No. 196 of 30 June 2003 (“Privacy Code”), article 13 of European Regulation No. 679 of 2016 (“Privacy Regulation”), El.En. S.p.a. intends to inform all users and/or visitors to www.elengroup.com (respectively the “Users” or “Data Subject” and the “Site”), on the use of personal data, log files and cookies collected over the Site itself.

The term personal data refers to the definition contained in article 4, paragraph 1) of the Privacy Regulation, i.e. “any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;” ( “Personal Data”).

Data Controller, Data Processors and Data Protection Officer
The personal data processing controller is El.En. s.p.a., with registered office at Via Baldanzese, No. 17 – 50041 Calenzano (FI) – Italy, TAX and VAT No. 03137680488 (herein after referred to as the “Data Controller”).

The Data Protection Officer (37 of the Privacy Regulation) can be contacted at the following Email address: avv.paolagiovannelli@gmail.com (hereinafter referred to as the “DPO”).

The updated list of designated Data processors can be provided on request by the interested parties and/or users.

Information collected automatically by the website – Cookies
1. Information collected automatically
  Like all websites, our site also uses log files in which information is stored that is collected in an automated manner during users visit. In fact, the information systems and software procedures which perform the functions of the website automatically acquire, during their operation, some information, the transmission of which is implicit in the use of internet communication protocols.
  
  The following information is collected:
  - Internet Protocol (IP) address of the domain name of the device you are using;
  - the URI (Uniform Resource Identifier) addresses of the resources requested or the method used to submit the request to the server;
  - the name of the Internet service provider (ISP);
  - the size of the file obtained in response;
  - the numerical code indicating the status of the response given by the server (success, error, etc.);
  - other parameters related to your device’s operating system and digital environment.
  This information is processed in an automated manner and collected exclusively in aggregate form for the purpose of verifying correct operation of the website.
2. Cookies
  No personal users’ data is acquired by the site.
  
  The site doesn’t use cookies to transmit personal information, nor are used c.d. persistent cookies of any kind, or systems for tracing users.
  
  The use of session cookies (which are not permanently stored on the users’ computer and disappear when the browser is closed) is strictly limited to the transmission of the identification data for the session (consisting in a random numbers generated by the server) which are necessary for the safe and effective exploration of the site.
  
  The session cookies used on this site in order to avoid the use of other computer technologies which would be potentially harmful for the privacy of the user’s navigation and do not allow the acquisition of the users’ personal data.
  
  Visiting this site, users can also receive cookies that are sent by different web sites (hereinafter referred to as “third parties”). The use of third party cookies, both temporary and permanent, by the site is anonymous and solely for the purpose of allowing the owner of the site to make use of web analysis services provided by others. These cookies make it possible to anonymously collect and record information on the site pages that have been visited but do not permit the identification of the visitor and are in no way connected with other information. These data are used exclusively to trace and examine the use of the sites by the users, compile statistics on the basis of the information that has been collected anonymously and through the use of data in aggregate form.
  
  Specifically, users of the site should know that the analysis service that issues the cookies that we use is 'Google Analytics', which is described below.
  
  Google Analytics is a web analysis service that is supplied by Google, Inc. ('Google') which uses cookies that are deposited on the hard disk of the user’s computer in order to analyse the way in which the user visits the web site. The information that is generated by the cookies concerning the way in which the site was visited (including the IP address) are transmitted to Google and deposited in the Google servers in the United States. Google uses this information for the purpose of tracing and analysing the use of the web site by the user, compiling a report on the activities of the site for the site operators and supplying other services related to the activity of the web site and the use of Internet. Google may also communicate this information to third parties in those cases where it is required by law or where the third parties treat the information on behalf of Google. Google will not associate the IP addresses of the user with any other data possessed by Google. At any time the user may refuse to use the cookies by selecting the appropriate set up on their browser.
  
  By using this site, the user automatically consents to the treatment of his/her data by Google for the purposes described above. To consult the privacy policy of Google in connection with the service of Google Analytics, please visit the internet site http://www.google.com/intl/en/analytics/privacyoverview.html.

The personal data that Data Subject provide to us using the Site
The following categories of personal data could be collected through the use of the Site:
- Contact details: name, address, telephone number, email address;
- Interests: information provided by users about their interests, including type of product they are interested in;
- References of the contract: customer number, contract number, etc.;
- Registration data of the online accounts;
- Information about sale and maintenance: purchasing and information, information relating to assistance, including complaints;
- Data relating to the request for participation in training courses: data and place of birth, nationality, passport, Visa, inquiries and special requirements relating to transport, residence, etc..
In certain circumstances we may also collect:
- Data concerning family members and partners;
- Biometric data, such as digital images and video;
- Pictures, video and audio via surveillance cameras placed in public areas of our facilities.

Purposes of the processing
The personal data of the Data Subject is processed exclusively for the following purposes:
1. Without express consent (art. 6 Privacy Regulation)
  - to fulfil obligations required by law, rules, European regulations or authorities;
  - to meet, prior to the conclusion of a contract, specific requests of the Data Subjects (e.g. request for information, quotations, etc.);
  - to execute the contract concluded between the parties;
  - to provide after-sales service;
  - to manage requests and reports received through the Site, including any complaints and disputes;
  - to establish, exercise of defend a legal claim;
2. Only with declared consent (art. 7 Privacy Regulation)
  - to improve and customize Users experience on the Site;
  - to allow the recording to restricted areas of the Site and such initiatives (e.g. events, contests);
  - to manage applications;
  - to manage requests for participation in training courses;
  - to allow subscription to the newsletter provided by the Data Controller;
  - to send by e-mail, mail and/or text message, newsletter, commercial communications and/or advertising material about products or services offered by the Data Controller and customer satisfaction surveys on the quality of services;
  - to send by e-mail, mail and/or text message, newsletter, information about events, contests, educational activities organised by the holder;
  - to send by e-mail, mail and/or text message, newsletter, promotional and/or commercial communications of third partied (e.g. business partner).
  - to send information and updates about the results and the activities of the Data Controller.
  The legal basis of the processing is the consent freely given.
  
  The Data Subjects have the right to revoke the consent given at any time and without any particular formality: in any commercial communication there will be a section that will allow to easily revoke the consent given.
  
  The Data Subjects can also revoke the consent given by sending a simple communication to the addresses referred in art. 11 below.
Legal basis of the processing
Apart from what is specified for cookies and browsing data, the Data Subjects are free to provide personal data contained in the forms on the Site or in any case indicated on the occasion of contacts with the Data Controller to request the sending of informative material or other communications or to access specific services. The absence of this data may make impossible to fulfil the request.
Processing methods
Pursuant to art. 5 of the Privacy Regulation, the personal data will be:
- processed in a lawful, proper and transparent toward the Data Subject;
- collected and recorded for specified, explicit and legitimate purposes and subsequently processed in a time frame compatible with that purpose;
- adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed;
- accurate and, where necessary, kept up to date;
- processed by manual, cyber and telematics tools and with logics that are appropriate to ensure an adequate level of security.
Data retention
The Data Controller, in accordance with the principles of legality, purpose limitation and data minimisation, pursuant to art. 5 of Privacy Regulation, stores and processes personal data for the time strictly necessary to fulfil the purposes identified above and until the Data Subjects parties to revoke the consent given.

For the purpose of determining the appropriate retention period, the Data Controller shall consider the quantity, nature and sensitivity of the Personal Data, the purposes for which they are processed and if the same purposes can be achieved by means of other instruments.

In particular, for the purposes of marketing, personal data may be kept for a period of 24 months from 25 may 2018, unless renewal thereof (expect the opposition to receive further communications). The Data Controller shall, every two years from the data of publication of this notice, to request the renewal of consent.

The Data Controller shall consider the periods for which he might need to retain the Personal Data in order to fulfil legal obligations (e.g. administrative tasks) or to examine Users’ requests, complaints and defend its rights where necessary.

The processing and retention of digital material, such as pictures or video, will be performed until the data subjects communicate the withdrawal of consent to data processing.
Access to personal data and to whom these can be communicated
Personal data may be brought to the attention of:
1. Data Controller’s employees or collaborators, that are formally appointed and authorized to process and their receive opportune operational instructions in this regards;
2. External companies and third parties which Data Controller may make use of in relation to the management of the contractual relationship with customers or for its own organisational needs and its activities (e.g. IT service suppliers, consultants, agents, etc.)
3. Other companies of the El.En. Group.
Pursuant to art. 6 of the Privacy Regulation, without the express consent of the Data Subjects the Data Controller can disclose the personal data to the supervisory bodies, judicial authorities and all other persons to whom that kind of communication is required by law and to the accomplishment of the purposes of art. 3. These subjects will process personal data as autonomous Data Controllers.

Personal data will not be disclosed, sold or exchanged with any third party without the express consent of the Data Subjects.

The management and conservation of personal data will happen on server (located within the European Union) of the Data Controller and/or of third parties appointed as data processors.
Rights of the Data Subject
Pursuant to articles 15-22 of the Privacy Regulation, the Data Subject is entitled:
1. To be inform of:
  - The source of the personal data;
  - The processing purposes and methods;
  - The logic applied when data are processed using electronic equipment;
  - The identity of the data controller, data processors and designated representative pursuant to article 5;
  - The parties or categories of parties to whom the personal data may be communicated;
2. To obtain:
  - The updating, rectification or, where he/she wishes, the integration of the data;
  - The cancellation, anonymization, or blocking of data processed unlawfully, including data that does not need to be retained for the purposes for which it was collected or subsequently processed;
  - Certification that the activities mentioned above, including their content, have been notified to those to whom the data was disclosed, unless this requirement proves impossible or implies manifestly disproportionate measures with respect to the protected right;
  - Data portability: the right to receive personal data in a structured, commonly used and automatically readable format, and to transmit such data to another data controller, only for cases where the processing is based on consent and for only data processed by electronic means;
3. To oppose, in whole or in part:
  - For legitimate reasons, to the processing of his/her personal data, even if it is pertinent for collection purposes;
  - For the purposes of this article, the Data Subject is entitled to request the cancellation, transformation into an anonymous form or blocking of data processed in violation of the law and, in any case, to abject, for legitimate reason, to their processing.
Data transfer
Appropriate El.En. S.p.a. could transfer personal data collected through the Site to other companies of the El.En. Group or to third parties located in other countries, even outside the European Union, which does not offer the same level of protection of personal data. The European Commission puts the countries deemed “adequate”, namely those that preparing an adequate protection, in a separate list, which can be viewed at: https://www.garanteprivacy.it/home/provvedimenti-normativa/normativa/normativa-comunitaria-e-intenazionale/trasferimento-dei-dati-verso-paesi-terzi#1.

Transfers of personal data outside the European Union and to countries not belonging to the above list, will be carried out exclusively under specific agreements between El.En. S.p.a. and the companies involved, through the use of tools accepted by the European Commission.
Contact details
To exercise all rights ad identified above and to request information about this privacy policy, Data Subjects can contact the Data Controller by sending an e-mail to privacy@elen.it.
Requests for the exercise of
If you request information about your data the Data Controller shall respond promptly – unless this proves impossible or involves a manifestly disproportionate effort compared with the right to be protected – and in any case no later than 30 days from the request. The Data Controller will justify any inability to meet the request, or delay in doing so.

Last amendment 12 July 2018