Privacy Policy
Introduction
This information on the processing of personal data (hereinafter, ‘Information Notice‘) is provided pursuant to Article 13 of EU Regulation 679/2016 (General Data Protection Regulation – hereinafter, ‘GDPR‘).
The Information Notice describes in detail how and for what purposes your personal data will be processed during your navigation on the website www.engitel.com (hereinafter, ‘Site’) and the use of the various functions and services made available within it.
For the purposes of this Information Notice, the term ‘You’ (and the adjectives ‘Your’, ‘Your’, ‘Your’, ‘Your’) shall identify the user/user of the Site and of its functions/services, as the data subject to whom the personal data processed refer.
A) Data Controller and Data Protection Officer
The co-owners of the processing of your personal data are Engitel S.p.A. and Citec Ingénieurs-Conseils S.A.
(hereinafter, ‘Co-processors’).
You can contact the Co-owners, for questions, requests or clarifications regarding this Policy or in general regarding the processing of your personal data, at the following addresses:
Engitel S.p.A.
- e-mail address (indicating ‘Privacy’ in the subject line): privacy@engitel.com
- physical address: Milan, via Zarotto 6
- telephone number: 02 / 6693337
Citec Ingénieurs-Conseils S.A.
- 47, route des Acacias P.O. Box 1711 – CH- 1211 Geneva 26 (Switzerland)
B) Categories of personal data processed
The Data Controller processes the following categories of personal data during your navigation on the Site and use of its functions/services
- information and data relating to your navigation on the Site and the devices used by you to navigate on the Site and use its functions and services (by way of example but not limited to, information about the pages and sections of the Site visited, your activities on the Site, the time spent on the individual pages and sections of the Site, IP address, browser used, type of device used, data relating to your geographical location – only on condition that you have given your prior consent to such processing, information from cookies or similar tools released by the pages of the Site);
- if you would like to receive a demo of our products by filling in a specific form on the Site (or by sending communications to the Co-owners’ contacts), the personal data and information required therein to send the contact request and to manage your communication (by way of example but not limited to, first name, last name, e-mail address for any feedback, as well as the content of the information or request you transmitted)
- if you wish to respond to job advertisements on the Site by sending an email to the address indicated, the personal data and information requested therein in order to manage your communication (by way of example but not limited to, name, surname, email address for any feedback, as well as the content of the information or requests transmitted by you)
- should you wish to interact in any capacity or for any reason with our Company by sending an email to the address provided, the personal data and information requested therein in order to manage your communication (by way of example but not limited to, name, surname, email address for any feedback, in addition to the content of the information or requests transmitted by you)
- in the event of recourse, on your part, to the possibilities of interaction between the contents of the Site and your profiles on social networks (e.g. ‘like’ buttons, ‘tweet’), data and information relating to said profiles will also be processed.In addition and more generally, the Co-Owners may process the following categories of personal data collected outside the Site:
- information and personal data taken from business cards (both paper and digital), collected from the data subject or through third parties;
- information and personal data acquired at events, meetings and conventions, on the basis of specific information made available to the data subject at the place of collection;
- curricula vitae also acquired in paper form, for the same purposes as those set out in point c) above.
The personal data referred to in category a) are collected automatically by the Co-owner in the course of your navigation on the Site. This is information that is not collected in order to be associated with identified interested parties, but which by its very nature could, through processing and association with data held by third parties, allow users to be identified. This data is in any case used for the sole purpose of obtaining anonymous statistical information on the use of the site and to check its correct operation.
Personal data belonging to all other categories are provided directly and voluntarily by you.
C) Consequences of not providing personal data
The processing of personal data in category a) of the previous section is necessary for the Data Controller in order to guarantee you the best possible browsing experience and to provide you with all the functions and services provided through the Site. However, it is possible to limit the processing of such personal data through the use of certain functionalities made available by the Site (with reference, in particular, to the transmission of cookies or similar tools – on this point, please refer to the Site’s cookie policy)
or from your device or browser / browsing application. In this event, navigation on the Site may be limited and some of its functions / services may be inaccessible.
The processing of personal data referred to in categories other than a) contained in the previous section, is necessary in order to fulfil contractual obligations (i.e. to allow you to access and use specific functions/services of the Site, such as for example but not limited to the receipt of Demos) and legal obligations (with reference to the fulfilment of regulatory obligations of the Co-Owners); you are consequently obliged to provide said personal data in order to use the services and functions of the Site, as requested from time to time.
In the event that you fail to provide the aforementioned data, it will not be possible for the Co-owners to provide the functions and services of the Site requested by you.
D) Purposes of the processing and related legal bases
Your personal data will be processed for the following purposes and according to the following legal bases.
Purpose | Legal basis | |
1. | To allow you to browse the Site, access its pages and sections, use its functions and services (including interactions with social network profiles) | Processing necessary on a contractual basis (Art. 6(i)(b) GDPR) |
2. | Allow your request for Products in Demo mode | Processing required on a contractual basis (Art. 6(i)(b) GDPR) |
3. | Acknowledgement of your response to our job advertisements by interaction with the email indicated and/or by forwarding hard copy CVs of the data subject | Processing necessary on a contractual basis (art. 6(i)(b) GDPR) |
4. | To enable the Co-Owners to respond to requests made by administrative, judicial or public security authorities (by way of example but not limited to, pursuant to art. 210 c.p.c. and 248 c.p.c.) | Processing necessary to comply with legal obligations to which the Controller is subject (art. 6(i)(c) GDPR) |
5. | To enable Co-Owners to ascertain, exercise or defend their rights in or out of court, or otherwise in the context of disputes or litigation (whether initiated by you, the Controller, third parties or judicial or administrative authorities) | Processing necessary for the pursuit of the legitimate interest of the Controller (art. 6(i)(f) GDPR) |
6. | Check the proper functioning of the Site to make interventions and updates, and provide a better browsing experience | Processing necessary for the pursuit of the legitimate interest of the Owner (art. 6(i)(f) GDPR) |
7. | Allow the Co-owners or third parties appointed by the Co-owner to verify the correct navigation of users on the Site | Processing necessary for the pursuit of the legitimate interest of the Owner (art. 6(i)(f) GDPR) |
8. | Allowing Co-Processors to contact the data subject following the latter’s request (manifested by means of delivery of a business card, provision of data at events, meetings and conventions, etc.) | Processing necessary for the pursuit of the legitimate interest of the Data Controller (Art. 6(i)(f) GDPR) |
With specific reference to the processing purposes set out in nos. 5., 6., 7., we specify the following:
Purpose | Legitimate interest pursued | |
5. | To enable the Co-Co-Owners to ascertain, exercise or defend their rights in or out of court, or in the context of disputes or controversies (whether initiated by you, the Controller, third parties or judicial or administrative authorities) | Interest of the Controller in protecting its rights in the event of disputes |
6. | Check the proper functioning of the Site in order to carry out interventions and updates, and provide a better browsing experience | Interest of the Owner in improving the Site to provide users with a better browsing experience |
7. | Allow the Co-owners or third parties appointed by the latter to verify the correct navigation of users on the Site and/or the correctness of the transactions carried out | Interest of the Owner to protect itself from fraud and fraudulent or culpable conduct by users of the Site |
8. | Allowing the Co-owners to get in touch with the data subject following the latter’s request (manifested through the handing over of business cards, submission of data to events, meetings and conventions, etc.). | Interest of the Data Controller in receiving requests from potential partners, customers or persons interested in its products or services |
If you would like more specific information on the assessment carried out by the Co-owners as to the balance between the legitimate interests pursued and the interests or fundamental rights and freedoms of the data subjects, you may contact the Co-owners at the contact details set out in section A).
E) Categories of recipients of personal data processed
In order to fulfil the above purposes, your personal data will also be processed by third parties other than the Co-owners.
These subjects will process your personal data both on behalf of the Data Controller (therefore, in their capacity as data processors) and as autonomous data controllers, upon specific communication by the Co-owners.
Specifically, the following categories of recipients will process your personal data
- service providers necessary for the proper functioning of the Site and its functions/services (by way of example but not limited to, ICT service providers, hosting service providers, suppliers of IT platforms and applications)
- ajurisdictional, administrative and/or public security authorities, in accordance with legal provisions, for the purposes of investigating and prosecuting criminal offences, preventing and safeguarding risks or threats to security and public order, as well as for any reason connected with the protection of the rights and freedoms of individuals.
Should you wish to know in detail the identification details of all the recipients listed above by category, you may contact the Co-owners at the addresses given in section A).
F) Transfer of personal data outside the European Economic Area
IPersonal data will only be transferred outside the European Economic Area to countries that ensure an adequate level of protection for the personal data of the data subjects, on the basis of an adequacy decision adopted by the European Commission (e.g. United States).
In the event of a transfer to countries outside the European Economic Area which do not ensure an adequate level of protection for the personal data of the data subjects, the transfer will take place only:
(i) subject to the adoption of appropriate or adequate safeguards (such as, but not limited to, the conclusion of data transfer agreements incorporating standard contractual clauses approved by the European Commission);
(ii) where it is necessary for the conclusion of a contract or the performance of contractual obligations between you and the Joint Holders.
In any event, in such eventualities the Joint Holders will take care to provide you, upon your simple request, with detailed information about the modalities of the transfer of data to third countries, any appropriate or adequate safeguards adopted and the means to obtain a copy of such data or the place where they have been made available.
G) Retention period of processed personal data
Your personal data will be kept for a period that varies according to the type and purpose of the processing. At the end of the retention period, the personal data will be erased or made irreversibly anonymous. The periods of retention of personal data are set out below:
- data relating to your navigation on the Site and/or the devices used by you, except in cases where they are used to ascertain liability in the event of hypothetical offences against the Site or third parties, will be retained for no more than 7 (seven) days;
- data relating to commercial transactions carried out on the Site (including payment data): shall be retained until the finalisation of all administrative, fiscal, civil law obligations (by way of example but not limited to, the time limit for exercising the right of withdrawal or contesting payment). Invoicing data will be stored for 10 (ten) years;
- data relating to your registration in the Reserved Area: they will be kept until you request the cancellation of your account (or exercise any other right recognised by current legislation)
- data and information relating to contacts between you and the Controller: they will be kept until your requests have been dealt with and satisfied;
- data relating to the transmission of commercial communications relating to news, initiatives and offers from the Data Controller about products/services already purchased: will be kept until you exercise your right to object to or cancel the data processed (including by selecting the appropriate function within the communications sent – the so-called unsubscribe link)
- data relating to the transmission of commercial communications (including by third party business partners), market research and statistical surveys, carried out with the consent of the data subject: will be retained until the data subject exercises his/her right to object or to cancel the data processed (including by selecting the appropriate function within the communications sent – the so-called unsubscribe link). And in any case once 2 (two) years have elapsed since your last interaction with the Site.
If, at the end of the above period, your personal data is processed for specific purposes (e.g. to protect the rights of the Co-owners in the context of a litigation), it will be retained until such purposes are fulfilled (e.g. until the litigation is settled).
At the end of the aforementioned retention periods, your personal data will be deleted, or otherwise rendered unintelligible by the Joint Holders.
H) Processing of personal data by automated decision-making processes
Your personal data will not be processed by means of automated decision-making processes (including profiling within the meaning of Article 22(1) and (4) of the GDPR).
I) Your rights concerning the processing of personal data
You have the right to request from the Co-owners access to personal data concerning you, pursuant to Article 15 GDPR.
By exercising your right of access, you may request information about:
- the purpose of the processing;
- the categories of personal data concerned
- i destinatari o le categorie di destinatari cui i dati personali sono stati o saranno comunicati, in particolare se destinatari di paesi terzi o organizzazioni internazionali;
- where possible, the intended storage period of the personal data or, where not possible, the criteria used to determine that period
- the existence of the right to ask the Controller to rectify or erase your personal data or to restrict the processing of your personal data or to object to their processing
- the right to lodge a complaint with a supervisory authority,
- if personal data are not collected from you, all available information on their origin;
- the existence of an automated decision-making process, including profiling as referred to in Article 22(1) and (4) of the GDPR, and, at least in such cases, meaningful information on the logic used, as well as the significance and expected consequences of such processing for you.
You are also guaranteed the following rights:
- the right to revoke the consent given, pursuant to Article 7(3) GDPR, without affecting the lawfulness of processing carried out prior to revocation, and the lawfulness of processing based on a different legal basis
- the right to obtain from the Co-owners the rectification of inaccurate personal data, or the integration of incomplete personal data, pursuant to Article 16 GDPR;
- the right to obtain from the Co-owners the deletion of personal data, pursuant to Article 17 GDPR. The exercise of this right may not be guaranteed by the Co-Holders (or the Co-Holders may only partially comply with the requests) to the extent that the processing of the personal data subject to the request for erasure is required in order to comply with legal obligations or for the establishment, exercise or defence of a legal claim;
- the right to obtain from the Co-owners the restriction of processing, pursuant to Article 18 GDPR;to the extent provided for by law, the right to obtain from the Joint Data Controllers the portability of personal data processed pursuant to consent or on a contractual basis pursuant to Article 6(1)(a) and (b) of the GDPR; in the event of the exercise of this right, the Joint Data Controllers will provide you with all the data relating to you, acquired with your consent or in performance of a contractual obligation, in a structured and interoperable format; where technically possible, such personal data may be transferred, in the same manner
- to the extent provided for by law, the right to obtain from the Joint Data Controllers the portability of personal data processed pursuant to consent or on a contractual basis pursuant to Article 6(1)(a) and (b) of the GDPR;
in the event of exercising this right, the Co-owners will provide you with all data concerning you, acquired with your consent or in performance of contractual obligations, in a structured and interoperable format; where technically possible, these personal data may also be transferred, in the same manner, to third parties selected by you and indicated by means of a specific request - the right to object to the processing of your personal data pursuant to Article 21 GDPR, unless the Controller demonstrates, upon receipt of a request to that effect, the existence of compelling legitimate grounds for processing that override your interests, rights and freedoms, or for the establishment, exercise or defence of legal claims.
The aforementioned requests should be addressed to the addresses in section A).
The Co-owners will comply with requests without undue delay.
With specific reference to the right to withdraw consent, this may also be exercised by selecting the appropriate functions made available at the foot of each communication of a commercial nature (or relating to participation in market research or statistical surveys).
If you do not receive a reply or a negative, untimely or unsatisfactory response to your request, or if you believe in any event that the Controller is processing your data in an unlawful or non-transparent manner, you may refer the matter to a supervisory authority.
If you are an Italian citizen, reside habitually or work in Italy, or if you believe that the alleged breach of the Co-owners with regard to the processing of your personal data has taken place in Italy, you may apply to the Garante per la protezione dei dati personali – www.garanteprivacy.it – in order to obtain adequate protection of your rights.
If you are a citizen of another EU member state, or if you habitually reside or work in another EU member state, or if you believe that the alleged breach by the Controller with regard to the processing of your personal data has taken place in another EU member state, you may consult the following webpage http://ec.europa.eu/justice/article-29/structure/data-protection-authorities/index_en.htm for more information about the competent supervisory authority.
J) Amendments and updates to the Policy
QShould this Privacy Policy be amended or supplemented, the Co-owners shall make every reasonable effort to inform the interested parties of such amendments (e.g. by means of specific notices for the users registered to the Reserved Area, or by means of specific notices – in the form of banners or similar tools – on the homepage of the Site).
We invite you, in any case, to periodically check the section of the Site where this Privacy Policy is hosted, and to consult the most recent text of the Privacy Policy (whose entry into force is indicated in the epigraph).