INFORMATION NOTE ON THE PROCESSING OF PERSONAL DATA (ART. 13 – ITALIAN LEGISLATIVE DECREE N. 196 / 2003 “PRIVACY ACT”) AND EUROPEAN REGULATION 2016/679 (“GDPR”).

1.    Introduction

CREO s.p.a., hereinafter referred to as Owner, wishes to inform and reassure you about the use of personal data provided or acquired by the Owner during the interaction with the pages of this website, in respect of the fundamental rights and freedoms of individuals, as well as in compliance with the provisions on personal data protection regulation.

2.    Owner and data collector

If you have any questions regarding this privacy policy, you can contact the Owner using the information below:

CREO s.p.a.
Piazza della Repubblica, 11/A
20124 Milan, Italy

Our users can send requests regarding the protection of personal data, privacy and security to the e-mail address info@creo.it.

3.    Types of data collected

You can visit our site anonymously. Among the personal data collected by this website, independently or through third parties, there are: name, surname, e-mail, phone, address, social security number, VAT number. Full details on each type of data collected are provided in the dedicated sections of this privacy policy or through specific information texts displayed before the data are collected. Personal data may be freely provided by the interested party or, in the case of technical necessities, collected automatically during use of the site.

If the data are considered optional, the interested party is free to refrain from communicating such data, without having any consequence on the availability of the service. Any use of cookies or other tracking tools used by the site or third-party service providers, unless otherwise specified, is intended to provide the service requested by the interested party, in addition to the other purposes described in this document and in the Cookie Policy. The interested party assumes the responsibility for the personal data shared through the website and guarantees to have the right to communicate or share them, freeing the owner from any responsibility towards third parties.

4.    Legal basis

The Owner processes personal data related to the Interested party in one of the following events:

• the interested party has given consent for one or more specific purposes;
• processing is necessary for the execution of a contract with the interested party and / or the execution of pre-contractual actions;
• the processing is necessary to fulfil a legal obligation to which the Owner is subject to;
• the processing is necessary for the execution of a task of public interest to which the Owner is invested;
• processing is necessary for the pursuit of the legitimate interest of the owner or third parties.

5.    Purposes of the processing

The Data of the Data Subject is collected to allow the Owner to provide its Services, as well as for the following purposes: (i) site statistics collection (e.g. Google Analytics), (ii) contacts with the Data Subject (contact forms), newsletter service and / or quote request) and (iii) displaying content from external platforms (e.g. social networks such as Facebook, YouTube, Instagram, LinkedIn etc.).

Site statistics

The services contained in this section allow the Data Controller to monitor and analyse traffic data and are used to keep track of the behaviour of the interested party.

Google Analytics (Google Inc.)

Google Analytics is a web analytics service provided by Google Inc. (“Google”). Google uses Personal Information collected for evaluating the use of this Site, compiling reports and sharing them with other services developed by Google. Google may use the Personal Data to contextualise and personalize the advertisements of its advertising network.

At the following link https://tools.google.com/dlpage/gaoptout?hl=it is made available by Google the browser add-on for the deactivation of Google Analytics.

Contact the interested party

Contact form / Quote request / Newsletter

The interested party, by filling in contact forms present on the site with his / her personal data, consents to their use to respond to requests for information, quotation, or any other kind indicated by the header of the form. By consenting to the registration to the mailing list or to the newsletter, the e-mail address of the interested party is automatically added to a list of contacts to which e-mail messages containing information, including commercial and promotional, relating to this Site may be transmitted. The e-mail address of the interested party could also be added to this list because of the registration to this Site or after making a purchase.

Contents of external platforms

These services allow you to interact with social networks, or other external platforms, directly from the pages of this site or allow you to view content hosted on external platforms directly from the pages of this site and interact with them. The interactions and information acquired from this site are in any case subject to the privacy settings of the interested party relating to each social network. If an interaction service with social networks is installed, it is possible that, even if the Users do not use the service, the same collect traffic data relating to the pages in which it is installed.

LinkedIn button and social widgets (LinkedIn Corporation)

The button and social widgets of Linkedin are services of interaction with the social network Linkedin, provided by LinkedIn Corporation.

Like button and Facebook social widgets (Facebook, Inc.)

The “Like” button and Facebook social widgets are services of interaction with the social network Facebook, provided by Facebook, Inc.

Youtube Video Widget (Google Inc.)

Youtube is a video content visualization service managed by Google Inc. that allows this Site to integrate such contents within its pages.

Google Font (Google Inc.)

Google Fonts is a service of visualization of styles of character managed by Google Inc. that allows this Site to integrate such contents within its pages.

Google Maps (Google Inc.)

Google Maps is a map visualization service managed by Google Inc. that allows this site to integrate such contents within its pages.

6.    Retention period and data handling procedures

Your data will be processed in compliance with the principles established by the legislation on personal data protection. The treatment will take place after the adoption of every measure of security, both technical and organizational, adequate to the risks for your rights and your fundamental freedoms. The data are processed at the operational headquarters of the Data Controller and in any other place where the parties involved in the processing are located. The personal data of the interested party may be transferred to a country other than the one in which the interested party is located.

The processing operations will be carried out by subjects authorized by the Company to access the information, which will be adequately trained on the protection of personal data and designated as persons in charge of processing. The data are processed and stored for the time required by the purposes for which they were collected. Therefore:

• Personal data collected for purposes related to the execution of a contract between the Data Controller and the Data Subject will be retained until the execution of the contract is completed.
• Personal data collected for purposes related to the legitimate interest of the owner will be retained until the satisfaction of this interest.
• When the treatment is based on the consent of the interested party, the Data Controller may keep the personal data longer until such consent is revoked. Furthermore, the Data Controller may be obliged to keep personal data for a longer period in compliance with a legal obligation or on the order of an authority.

At the end of the retention period, personal data will be deleted. Therefore, at the end of this term the right of access, cancellation, rectification and the right to data portability can no longer be exercised.

7.    Categories of Entities to which Data may be Communicated

The compulsory data provided will not be disseminated in any way and they will only may be communicated or made accessible, exclusively for the purposes described, to other companies that deal with the maintenance of the information systems, as well as to those who deal with specific stages of treatment, as autonomous and external Data Controllers, regularly designated by the Data Controller whose names and relative qualifications are available at the request of the interested parties, as well as to subjects to whom the right to access the data is recognized by provisions of law and secondary legislation.

The Company may also disclose your personal data to third parties (i) where required by EU or Member State legislation; (ii) in the case of legal proceedings; (iii) in response to a request from law enforcement agencies based on legitimate grounds; (iv) to protect the rights, privacy, security or property of the Company and again, to the extent permitted by law, to investigate, prevent or take measures concerning illicit activities, suspected fraud.

8.    Rights of the Interested party

The GDPR grants you a series of rights (articles 15 to 22) to protect your personal data: you will always have the right to access the information concerning you and to be informed about the methods and purposes of the processing to which this data is subject to; you have the right to rectify and to modify the data, if it is inaccurate or not updated; you have the right to request cancellation, to oppose the treatment or to obtain the limitation of the use of your data, if your request meet the conditions required by law; you have the right to obtain the portability of personal data supplied, if processed by automated means on the basis of a consent or the need to execute a contract.

We also remind you that, if your treatment is based on consent, you will always have the right to revoke it: please note that this (i) does not invalidate the treatment up to then delivered by the company, and that (ii) such revocation could prevent the company from pursuing the purposes you have requested.

Last update: 17/10/2020.