Policy per Article 13 of Regulation (EU) 2016/679 on the Protection of Personal Data (GDPR)
Before communicating any personal data, the Company invites you to carefully read this Privacy Policy (“Privacy Policy”), as it contains important information on the protection of personal data and on the security measures taken to ensure confidentiality in full compliance with Regulation (EU) 2016/679 (“Regulation”) and Legislative Decree 196/2003 et seq. (“Privacy Code”) and jointly “Applicable Regulations”. This Privacy Policy is also:
- Intended only for the website www.ursus.it (hereinafter, the “Website”) while it does not apply to other websites that may be consulted through external links;
- To be understood as a Policy pursuant to Article 13 of the Regulations Applicable to those who interact with the Website.
URSUS informs you that the processing of your personal data will be based on the principles of lawfulness, fairness, transparency, purpose and retention limitation, data minimisation, accuracy, integrity and confidentiality. Your personal data will therefore be processed in accordance with the legislative provisions of the Applicable Law and the confidentiality obligations provided therein.
1. DATA CONTROLLER AND CONTACT DETAILS
URSUS S.p.A. (hereinafter, “URSUS” and/or “Data Controller”) with registered office in Rosà (VI) at Via A. Manzoni 12, having VAT and Tax Code 00163050248, in the person of the legal representative pro-tempore, pursuant to and for the purposes of Article 13 of EU Regulation 2016/679, assumes the role of Data Controller of personal data that shall be processed in compliance with the rules set out in this Policy.
The Data Controller may be contacted via telephone at +39 0424 580007, fax sent to +39 0424 581313 or by emailing privacy@ursus.it.
2. PURPOSE OF PROCESSING, LEGAL BASIS AND DATA RETENTION PERIOD
| Purposes | Type of Data | Legal Basis | Data Retention Period |
| 1. Pre-contractual/contractual To provide information on products and services sold, if requested by the Data Subject; The execution of existing contractual relationships. |
Personal data and contact details; Data necessary for execution of the contractual relationship. | Execution of a contract to which you are party or pre-contractual measures adopted at the request of the Data Subject; Fulfilment of legal obligations. Article 6(1)(b) and (c) GDPR. |
According to legal regulations. |
| 2. After-sales Support | Personal data and contact details; Data necessary for execution of the contractual relationship. | Execution of a contract to which you are party. | Ten years since the last interaction. |
| 3. Direct marketing Availing of automated (email and instant messaging) and traditional (phone calls with operators and ordinary mail) contact methods to send advertising material, newsletters, promotional and commercial communications relating to products and/or events and/or relative training courses, as well as carrying out market studies and statistical analysis along with assessing the degree of customer satisfaction. |
Personal data, contact details. | Consent (required by contract or with specific request, being optional and revocable at any time) per Article 6(1)(a) GDPR. If the Data Subject has not given their consent to send commercial communications in an automated manner, they may still receive such through the traditional methods, if they have not expressed dissent through the ordinary methods and/or the Public Register of Oppositions. | Up until revocation of consent or no later than 24 months from the collection of consent. |
| 4. Marketing to existing customers Sending communications relating to contracted products or services and/or products/services similar to those already purchased. |
Personal data and contact details; Data necessary for execution of the contractual relationship. | Legitimate interest (legal protection); Article 6(1)(f) GDPR. |
For the time necessary to exercise rights in court. |
| 5. If necessary, to ascertain, exercise or defend the rights of the Joint Data Controllers in court. | Personal details and contact details, Data relating to the execution of the contract. | Legitimate interest (legal protection); Article 6(1)(f) GDPR. |
For the time necessary to exercise rights in court. |
| 6. To effectuate technical management of the Website. | Data relating to the user’s navigation and systems for connecting to the Website. | This does not involve the processing of the user’s personal data. |
3. COMPULSORY PROVISION OF DATA
The Data Subject must provide the Company with the data necessary for conducting the contractual relationship, as well as the data necessary to fulfil obligations set out by laws, regulations, community regulations or by the provisions of Authorities entitled to do so by law and by supervisory and control bodies (as referred to in Purposes a) and f) above). Data that is not essential for conducting the contractual relationship is qualified and considered additional, with its provision by the Data Subject, if requested, being optional and subject to consent. Consent provided may be revoked by the Data Subject at any time by sending an email to privacy@ursus.it. Such revocation shall in no way affect the lawfulness of the processing based on the consent granted before revocation.
4. DATA PROCESSING METHOD
Pursuant to and for the purposes of Articles 12 et seq. of the Regulation, we wish to inform you that the personal data you communicate will be recorded, processed and stored in our archives, on paper and electronically, in compliance with the appropriate technical and organisational measures referred to in Article 32 of the Regulation. The processing of your personal data may consist of any operation or set of operations amongst those indicated in Article 4(1)(2) of the Regulation.
The processing of personal data will take place through the use of tools and procedures suitable for guaranteeing security and confidentiality and may be carried out directly and/or through delegated third parties, either manually with paper support or by using computer media or electronic tools. The data, for the purposes of the correct management of the relationship and the fulfilment of legal obligations, may be included in the Data Controller’s own internal documentation and also in the deeds and registers required by law, if necessary. The data shall not be subjected to profiling.
5. PERSONAL DATA RECIPIENTS
The Data Subject’s personal data may be communicated and processed by external subjects operating as autonomous data controllers pursuant to Articles 4 and 24 GDPR such as, for example, authorities and supervisory and control bodies and, in general, public or private subjects duly entitled to request the data and/or subjects operating as Data Processors pursuant to Article 28 GDPR, such as consulting companies and/or professional and/or professional firms (for example, legal, tax and insurance companies).
6. TRANSFER OF DATA TO NON-EU COUNTRIES
The data provided by the Data Subject will only be processed in countries within the European Union. If the Data Subject’s personal data is processed in a non-EU country, the rights granted to the latter by EU legislation will be guaranteed and the Data Subject shall be promptly notified.
7. RIGHTS OF THE DATA SUBJECT
Pursuant to Articles 15 et seq. GDPR, the Data Subject may exercise the rights of:
- Access – to confirm whether or not the Data Subject’s personal data is being processed and the right of access thereto, it not being possible to respond to manifestly unfounded, excessive or repetitive requests;
- Correction – to rectify/obtain the rectification of personal data if incorrect or obsolete or to complete the data if incomplete;
- Deletion/forget – to achieve, in some cases, the deletion of the personal data provided, not being an absolute right, as the Companies may have legitimate or legal reasons to keep them;
- Limitation – the data will be stored but may not be processed or processed further, in the cases set out in the legislation;
- Portability – moving, copying or transferring data from the Companies’ databases to third parties, applying only to data provided by the Data Subject for the execution of a contract or for which consent has been provided and expressed and whereby the processing is carried out by automated means;
- Opposition to direct marketing;
- Withdrawal of consent at any time, where processing is based on consent.
Pursuant to Article 2-undicies of Legislative Decree 196/2003, the exercise of the Data Subject’s rights may be postponed, limited or excluded, with motivated communication duly provided, unless the communication may compromise the purpose of the limitation, for the time and to the extent that this is a necessary and proportionate measure, taking into account the fundamental and legitimate interests of the Data Subject, in order to safeguard the interests referred to in paragraph 1(a) re protected interests concerning money laundering, (e) on conducting defensive investigations or exercising a right in court and (f) regarding the confidentiality of the identity of the employee who reports offences of which they have become aware by reason of their office. In such cases, the Data Subject rights can be exercised via the Supervisory Authority in compliance with Article 160 of the same Decree. In this case, the Supervisory Authority will inform the Data Subject that a review and all necessary checks have been carried out and that they have the right to take legal action.
Communications for the exercise of rights may be sent to the email address privacy@ursus.it.