RIGANTI SPA, as Data controller, located in Solbiate Arno (VA), Via Vittorio Veneto 1, hereby intends to provide the appropriate information to natural persons who operate in the name and on behalf of customers, suppliers, partners and other parties involved in contractual or pre-contractual activities (e.g. control authorities, public administration bodies) of RIGANTI SPA, pursuant to art. 13 of GDPR 679/16 – European “General Data Protection Regulation” and national regulations regarding personal data protection.

1. Data processed

Personal data being processed consist of personal and contact details provided or received from persons involved in the following situations:

• visits or phone calls or emails;
• direct contacts collected during participation in events, trade shows, etc.
• commercial information requests, submission of proposals;
• requests received through our website or through websites of customers, suppliers, partners or other parties;
• communications and transactions following the purchase order for the supply of goods or services (supplied/purchased);
• invitations to marketing and commercial events;
• collaboration offers, c.v. submissions, etc.

2. Purposes of processing

Personal data of natural persons who operate in the name and on behalf of clients, suppliers, partners and other parties are processed for the following purposes:

• forward contacts by any communication medium (phone, mobile phone, sms, email, fax, mail, ecc.);
• submit requests or fulfill received requests;
• exchange of information necessary for the execution of a contractual relationship, including pre- and post- contractual activities, which also comprise assistance;
• to engage Public or Private institutions to fulfill obligations/Requirements related or instrumental to the contract;
• to fullfill obligations prescribed by the law, regulations or European legislation, furthermore to comply with measures enacted (enforced) by public authorities or by controlling bodies which RIGANTI SPA is subject to;
• for ancillary purposes such as “News Alert” via email or sms

The interested party may accept or refuse to provide his/her personal data to the Data controller. However, the provision of personal data is necessary for correct and efficient management of contractual relationship with clients, suppliers, partners and other parties involved in Data controller’s activities. Therefore a refusal to provide the data could compromise the contractual relationship itself or pre- and post-contractual activities in whole or in part.

3. Legal basis

The processing is necessary for the execution of a contract to which every subject is a party or for the execution of pre- or post-contractual measures adopted upon request of supplier, client, partner, other parties or RIGANTI SPA in accordance with art. 6.1 lett. b) of GDPR), or for the fulfillment of a legal obligation in accordance with art. 6.1 lett. c) of GDPR).

4. Methods of processing

The data of the interested parties shall be processed with fairness, transparency and legality principles, using manual or automated instruments, also through the input into the databases, registers and lists suitable for recording, management and transfer of the data, in the ways and within the limits necessary to reach the indicated purposes.

RIGANTI SPA has provided the appropriate security measures in order to protect the data of natural persons who operate in the name and on behalf of clients, of suppliers, of partners and of other parties.

The data shall be processed only by the persons authorized to process the data inside RIGANTI SPA, as per the purposes of processing.

Personal data will neither be a target of an automatic decisional process nor of a profiling process.

5. Recipients of data

Personal data processed by the Data controller shall not be disclosed, i.e. shall not be communicated to unspecified parties, in any possible form, including that of their availability or simple consultation. On the other hand, the data can be communicated to the Data controller’s employees and to some external parties that collaborate with them, always in compliance with the indicated purposes. In particular, these are employees/collaborators who for their job positions  and work tasks carried out have been authorized to process personal data within the limits of their competency and in accordance with the instructions given to them by the Data controller. Also the data can be communicated, only if strictly necessary, to the parties that for the purposes of issuing our orders or information and quotation requests or formulation of proposals, on site or off site assistance activities, have to supply goods and/or perform professional services on our behalf. Also the following parties can access the data (with the purpose of providing assistance for SW applications, for information networks and for connectivity, within the imposed limits): our technicians in charge or external consultants or technicians appointed by the enterprises who provide such services. In the end, the data can be communicated to the parties authorized to access it pursuant to the statements of laws, regulations, European norms.

The updated list of data treatment persons in charge, if requested, is available at RIGANTI SPA headquarters.

6. Transfer of personal data

Although currently all the counterparts who treat data on behalf of RIGANTI SPA as external treatment persons in charge are established within The European Borders, in the future it could be necessary to provide this data to parties located outside the EU, in countries that don’t assure a data protection level compliant to GDPR. RIGANTI SPA will potentially transfer personal data outside EU implementing all the security measures required by GDPR, verifying that the involved counterparts provide the necessary guarantees and receiving the consent of the interested natural persons.

7. Personal data storage

The Data controller keeps and processes personal data for the period of time necessary to comply with the indicated purposes. Afterwards personal data will be stored, and not further processed, in accordance with the content reported in RIGANTI Data Treatment Registry. The storage period could be different considering: the purposes, the category of processed data, the legal obligations. When not necessary anymore to keep the personal data, these shall be securely deleted or deindexed or destroyed in accordance with our rules.

8. Rights of the interested party

In accordance with Art. 7 of the Italian legislative decree no. 196 of 30 June 2003 and to arts. 15 – right of access, 16 – right to rectification, 17- right to erasure, 18 – right to restriction of processing, 20 – right to data portability, 21- right to object, 22 – right to object to automated decision-making process of GDPR 679/16, the interested party exercises his/her rights by writing to the Data controller to the address indicated above or to the following email address: privacy@riganti.com (phone number: 0331988704) specifying the subject of the request, the right the interested party intends to exercise and attaching a copy of identity document that certifies the legitimacy of the request.

9. Lodging a complaint

The interested party has the right to lodge a complaint with the supervisory authority of his/her home State. To get more information on the right to lodge a complaint you can visit this web page: https://goo.gl/GLbTN9

10. Information update

The Data controller reserves the right to update this notice by making public its contents in the most suitable forms

Version released May 2018

Update December 2020