Privacy Policy for Customers and Suppliers
Pursuant to Article 13 of Regulation (EU) 2016/679 (GDPR)
The company Esthelogue S.r.l., with registered office in Calenzano (FI), Via Baldanzese No. 17, Tax Code and VAT Code 04461390488, Tel. 055 7766691, e-mail: privacy@esthelogue.com, as Data Controller, informs you, pursuant to Article 13, EU Regulation 2016/679 (hereinafter, "GDPR"), that the processing of your personal data will be based on the principles of correctness, lawfulness, transparency and protection of your privacy and your rights.
Your data will be processed, in accordance with the above legislation, in the following manner and for the following purposes.
1. Purposes and methods of processing for the data
1.A) Without express consent, in accordance with the provisions of Article 6(1)(b) of the Privacy Regulation
Your personal data, freely communicated and acquired by us by reason of the activity carried out by Esthelogue S.r.l., will be used for institutional purposes, connected or instrumental to the activity of Esthelogue S.r.l., related to the fulfilment of legislative and contractual obligations, namely the following:
- fulfilling obligations under the law, regulations and EU legislation;
- fulfil specific requests from the customer or supplier, prior to the conclusion of the contract;
- select suppliers in relation to the needs of the company;
- acquire information prior to the conclusion of supply contracts;
- perform the obligations arising from the contract concluded between the parties;
- provide after-sales support;
- allow the administrative management of customers and suppliers;
- allow the management of orders, shipments, and invoices;
- fulfil the tax and/or accounting obligations as required by law;
- handle any complaints and litigation;
- resort to legal recourse if necessary.
The processing of data required for the fulfillment of the above purposes is necessary for the proper management of the relationship and its provision is mandatory. Therefore, your personal data will be processed without the need for your consent, in accordance with Art. 6(1)(b) of the GDPR.
The Controller would also like to notify you of the fact that your failure to provide, or incorrect communication of, any of the mandatory information may result in the Controller's inability to ensure the correctness of the processing.
1.B) With specific and individual consent, as provided for in Article 7 of the Privacy Regulations.
Only with your specific and individual consent (Articles 23 and 130 of the Privacy Code and Article 7 of the GDPR), your data will be processed for the following marketing purposes:
– sending you, via e-mail, mail and/or text message and/or telephone contact, newsletters, commercial communications and/or advertising material regarding products and/or services offered by the Controller and satisfaction survey on the quality of services;
– sending you, via e-mail, mail and/or text message and/or telephone contact, commercial and/or promotional communications from third parties (e.g., business partners, insurance companies).
The provision of data in connection with the abovementioned purposes is optional, and your refusal to consent to its processing does not affect the continuation of the relationship or the correctness of the processing itself.
We would like to notify you of the fact that if you are already our customer, we may send you commercial communications regarding services and products of the Controller similar to those you have already used, unless you express your refusal (Art. 130, par. 4 of the Privacy Code).
2. Methods of processing – Legitimate interests pursued by the Data Controller
The processing of your personal data will be based on principles of fairness, lawfulness and transparency, protecting your privacy and your rights, and will be carried out by suitable means and according to suitable company procedures for guaranteeing their security and confidentiality.
The methods of processing the data connected to you will involve the use of manual, computerized and electronic tools, with logics strictly related to the purposes indicated above. In particular, your personal data may be processed in the following ways:
– entrusting third parties with processing operations;
– creation of profiles related to customers and suppliers;
– data collection during organized events and/or trade shows;
– processing by electronic computers;
– processing by means of paper archives.
All processing is carried out in accordance with the modalities set out in Articles 6 and 32 of the GDPR and through the adoption of the appropriate security measures provided.
3. Duration of processing
The Data Controller, in accordance with the principles of lawfulness, purpose limitation and data minimization, pursuant to Article 5 of the GDPR, retains and processes Personal Data for as long as necessary to fulfill the stated purposes. As a general principle, therefore, the Personal Data will be retained for the entire period of the contractual relationship with the Data Controller. Once the contractual relationship, and, together with it, the related purposes of processing cease to exist, the Controller is nevertheless entitled to further retain the Personal Data, in whole or in part, for certain purposes, as expressly required by specific legal provisions (we are referring, for example, to the obligation to keep accounting records for a period of 10 years, provided for in Article 2220 of the Italian Civil Code) or to assert or defend a right in a court of law.
For marketing purposes, the Personal Data may be retained for a period of 24 months after consent is given for that purpose, unless the consent is renewed (except in cases of objecting to receiving further communications). The Data Controller will request the renewal of consent every two years starting from May 25, 2018.
4. Compulsory or optional nature of providing data
The provision of your personal data is necessary for the establishment, performance and proper management of the contractual relationship and is also mandatory for the fulfillment of legal obligations.
Therefore, failure to provide data will result in the inability to establish and perform the contract.
On the other hand, the provision of data for the purposes referred to in Article 1.B) is optional. Therefore, you may decide not to provide any data or to subsequently deny the possibility of processing data already provided: in this case, you will not be able to receive newsletters, commercial communications and advertising material related to the Services offered by the Data Controller. You will, however, continue to be entitled to the Services referred to in Article 1.A).
5. Categories of subjects to whom the personal data may be communicated or who may gain access to them as data processors.
Your personal data may be made accessible to:
- a) individuals, employees and/or contractors of the Data Controller who have been entrusted with specific processing activities in their capacity as persons assigned and/or internal data processors and/or system administrators. Such individuals have been given specific instructions regarding the security and proper use of the personal data;
- b) third parties (IT service providers, consultants and consulting companies, freelancers, lawyers and law firms, banking and insurance institutions, auditors and auditing firms, agents, etc.) that carry out part of the processing activities and/or activities related and instrumental to the same on behalf of the Data Controller, in the capacity of autonomous data controllers or data processors appointed by the Data Controller.
- c) other companies of the El.En. s.p.a. group for the management of intercompany services.
Without the need for your express consent, in accordance with the provisions of Article 6, letter b) and c) of the GDPR, the Data Controller may communicate your personal data to the competent authorities, public and/or private entities, law firms, as well as to those entities entitled to access them by virtue of provisions of the law, regulations and current norms.
Your data shall not be disseminated in any way.
6. Transfer of data
Depending on each particular case, Esthelogue S.r.l. may transfer the data acquired through this Site to companies of the El.En. Group or to third parties located in other countries, including outside the European Union, which do not offer the same level of protection of Personal Data. The European Commission lists the countries deemed "adequate", i.e. those that provide adequate protection, in an updated list which can be consulted at: https://www.garanteprivacy.it/home/provvedimenti-normativa/normativa/normativa-comunitaria-e-intenazionale/trasferimento-dei-dati-verso-paesi-terzi#1.
Transfers of personal data outside the European Union and to countries not on the above list will be made exclusively following specific agreements between Esthelogue S.r.l. and the companies involved, through the use of instruments deemed appropriate by the European Commission.
7. Rights of the data subject – how to exercise your rights
In your capacity as a data subject, you enjoy the rights set forth in Articles 15 (right of access), 16 (right to rectification), 17 (right to erasure), 18 (right to restrict processing), 20 (right to data portability), 21 (right to object) and 22 (right to object to automated decision making) of the GDPR, as well as the right to file a complaint with the Supervisory Authority, and, in particular, the following rights:
- to request access to your personal data and information relating to them; the correction of inaccurate data or supplementation of incomplete data; the deletion of personal data relating to you (upon the occurrence of one of the conditions indicated in Article 17(1) of the GDPR and in compliance with the exceptions provided for in paragraph 3 of the same article); to the limitation of the processing of your personal data (upon the occurrence of one of the cases indicated in Article 18(1) of the GDPR);
- to request and obtain – in cases where the legal basis of the processing is a contract or consent, and the processing is carried out by automated means – your personal data in a structured, machine-readable format, including for the purpose of communicating such data to another data controller (so-called right to personal data portability);
- to object at any time to the processing of your personal data in the event of specific situations that involve you;
- to revoke consent at any time, limited to cases where the processing is based on your consent for one or more specific purposes and involves regular personal data (e.g., date and place of birth or place of residence) or special categories of data (e.g., data revealing your racial origin, political opinions, religious beliefs, health status or sex life). In any event, processing based on consent and carried out prior to the revocation of consent remains lawful;
- to file a complaint with a supervisory authority (Italian Data Protection Authority – www.garanteprivacy.it).
You may exercise your rights at any time by sending:
- a registered letter with return receipt to Esthelogue S.r.l. at 50041 – Calenzano (FI), Via Baldanzese No. 17 or via Certified E-mail to esthelogue@pec.uipservizi.it;
- an e-mail message to the following address: privacy@esthelogue.com
8. Automated decision-making processes
The Controller does not carry out any processing that consists of automated decision-making on the data processed.
9. Identification information for the Data Controller – Data Processors
The Data Controller for the aforementioned Processing is
Esthelogue S.r.l.
Via Baldanzese n. 17, 50041 Calenzano (FI),
Tax Code and VAT Code 04461390488
Tel. 055 7766691
e-mail: privacy@esthelogue.com
The updated list of data processors and authorized persons is kept at the Data Controller's office.
Last modified July 12, 2018
