Privacy Policy

Sources and categories of personal data

The personal data held by the undersigned organisation are collected directly from the people in question at their premises a7> collected directly from the data subjects.

Browsing data

The IT systems and software procedures used to operate the website acquire, during their normal operation, certain personal data whose transmission is implicit in the use of Internet communication protocols. This information is not collected to be associated with identified data subjects, but by its very nature could, through processing and association with data held by third parties, allow users to be identified. This category of data includes the IP addresses or domain names of the computers used by users connecting to the site, the URI (Uniform Resource Identifier) addresses of the resources requested, the time of the request, the method used to submit the request to the server, the size of the file received in response, the numerical code indicating the status of the response given by the server (successful, error, etc.) and other parameters relating to the user’s operating system and IT environment. This data is used solely to obtain anonymous statistical information on the use of the website and to check that it is functioning correctly, and is deleted immediately after processing. The data could be used to establish liability in the event of hypothetical computer crimes against the website.

Data used for profiling

No profiling data relating to the data subject’s habits or consumption choices is collected directly. It is, however, possible that such information may be collected by independent or separate entities via links or through the embedding of third-party elements. Please see the section on third-party cookies for further details.

Cookies

Like many other websites, this website stores cookies on the browser used by the user in question in order to transmit personal information and to enhance their experience. Cookies are small text strings that the websites visited by the user send to their device (usually the browser), where they are stored – sometimes for a long period of time – before being sent back to those same websites on the user’s next visit.

As explained below, you can choose whether and which cookies to accept, bearing in mind that refusing to accept them may affect your ability to carry out certain transactions on the website, the accuracy and relevance of certain personalised content offered, or the ability to recognise you from one visit to the next. If you do not make a choice in this regard, the default settings will apply and all cookies will be enabled; however, you may communicate or change your decisions in this regard at any time.

Technical cookies

In particular, we use so-called session cookies, which are not stored permanently on the user’s computer and are deleted when the browser is closed; their use is strictly limited to the transmission of session identifiers (consisting of random numbers generated by the server) necessary to enable the safe and efficient browsing of the website; these avoid the need for other IT techniques that could potentially compromise the confidentiality of users’ browsing and do not allow for the collection of personal data that could identify the user. We also use analytics cookies which help us understand how visitors interact with the website’s content, by collecting information (geographical and web origin, technology used, language, entry pages, pages visited, exit pages, time spent on the site, etc.) and generating website usage statistics without personally identifying individual visitors. All of these are to be considered technical cookies; as consent is not required, the opt-out mechanism applies. Technical cookies are not disclosed to third parties as they are necessary or useful for the functioning of the website; therefore, they are processed only by qualified individuals acting as data processors, data controllers or system administrators.

Third-party third-party third-party cookies

Finally, the website incorporates cookies and other elements (tags, pixels, etc.) from third parties (which operate independently and for which the Data Controller bears no responsibility) that also carry out profiling activities; for further information on these, please refer to the respective websites.

Data provided voluntarily by the user

The optional, explicit and voluntary sending of emails to the addresses listed on the website entails the subsequent collection of the sender’s email address – which is necessary to respond to enquiries – as well as any other personal data included in the email. Similarly, the explicit and voluntary submission of forms available on the website containing data relating to the data subject entails the processing of such data in order to fulfil pre-contractual obligations or to provide the services requested through the submission of the forms. Such information in the forms may relate to personal details, contact details, contact information, telephone numbers and email addresses of the data subjects and of identified and identifiable third parties with a legal interest in relation to the website user. In any case, specific summary privacy notices will be progressively provided or displayed on the pages of the website dedicated to particular services available on request.

Newsletter and Mailing-list

The email addresses used to send communications from the website are obtained either through voluntary subscriptions by the recipient – who is always asked to confirm their subscription – or from information collected in connection with the sale of the Data Controller’s products or services, or similar activities. This includes the sending of information, promotional communications and other material. It should be noted that these email addresses are not obtained from public subscriber directories. Should the recipient not be interested in these communications, they may opt out of any further contact by clicking the link provided in each message, or by writing to the contact details at the bottom of the message to exercise their right to unsubscribe from the newsletter.

Webinar

Please note that participation in the webinar will take place via a third-party platform, which is not owned by the Data Controller; we therefore invite you to read carefully any messages that may appear before accessing the video conference (e.g. accepting cookies and downloading the app if participating via a mobile phone or tablet). We recommend that you consult the relevant Privacy Policy. The Data Controller and all organisations involved in the Project accept no liability whatsoever.

The data controller, however, may, subject to prior notice, record the webinar for the purposes of reporting on and documenting the initiative, as well as for further information, training and promotional activities. Those who do not wish to appear in the recording must use the platform’s functions to render their data, including audio and video, unrecognisable, or download the content after the live broadcast.

Work with us

You can apply for a job by sending your details and an up-to-date CV, including authorisation for the processing of sensitive personal data.

Purposes and legal bases for processing

Personal data is processed (see Article 6(b) of the GDPR):

• (a) to enable you to browse the website and
• b) where necessary to carry out the service or task requested as part of the normal activities carried out by the undersigned organisation

Furthermore, all personal data may be processed:

• (c) for purposes relating to obligations laid down by law, as well as by instructions issued by authorities authorised by law to do so (see Articles 6(c) and 9(b), (g) and (h) of the GDPR);
• d) for the establishment, exercise or defence of a right in proceedings before the courts and out of court (legitimate interest) of the undersigned organisation (ref. Articles 6(f) and 9(f) of the GDPR);
• e) for direct marketing purposes in accordance with the Data Controller’s legitimate interests, in particular: for cookies and advertising IDs used to display advertisements; for email addresses used to send the newsletter; for browsing and usage logs to protect the website and the service from cyber-attacks; in such cases, the data subject may always withdraw their consent, in which case the Data Controller will cease processing (see Article 6(f) of the GDPR);
• f) for purposes related to the business activities for which the data subject has the right to give or withhold consent, such as subscribing to the newsletter to receive information and promotional messages and details regarding the sale of products and services, conducting satisfaction surveys, and disclosing data to third parties for the purpose of receiving or sending information, promotional and marketing communications (GDPR Article 6(a))
• g) with the consent of the data subject, in the case of sensitive data (see Article 9(a) of the GDPR)
• (h) with the data subject’s consent, for the purpose of profiling the data subject (see Article 6(a) of the GDPR)

Consequences of refusing to provide data

The provision of data collected from the data subject is optional but essential for the processing of such data for the purposes set out in points (a) and (b). Should data subjects fail to provide their essential data and not consent to its processing, it will not be possible to carry out and implement the services offered or to fulfil the contractual obligations undertaken, which will consequently prejudice the proper fulfilment of regulatory obligations, such as accounting, tax and administrative obligations, etc.

Apart from what has been specified regarding browsing data, the user is free to provide personal data for cookies and specific requests via forms, e.g. regarding products and/or services. Failure to provide such data may make it impossible to obtain what has been requested. For all non-essential data, including sensitive data, provision is optional. In the absence of consent, or in the event of incomplete or incorrect provision of certain data, including sensitive data, the required processing may be so incomplete as to cause prejudice – whether in the form of penalties or loss of benefits – either due to the impossibility of ensuring that the processing itself complies with the obligations for which it is carried out, or because the results of the processing may not comply with the obligations imposed by the legal provisions to which it is subject, with this organisation being exempt from any and all liability for any penalties or punitive measures.

Methods of data processing

Data processing relating to the website’s web services is carried out using automated tools for the time strictly necessary to achieve the purposes for which it was collected; this takes place on a server in Italy or the EU and is handled only by technical staff responsible for data processing, or by any personnel entrusted with maintenance and administration tasks. Specific security measures are in place to prevent data loss, unlawful or improper use, unauthorised access and breaches of confidentiality.

The infrastructure is equipped with devices for intrusion prevention, firewalls, logging and disaster recovery. Specific encryption and segregation mechanisms are used for the data and for authentication and authorisation of users.

Data processing refers to the collection, recording, organisation, storage, processing, modification, erasure and destruction of data, or a combination of two or more of these operations. In relation to the aforementioned purposes, the processing of personal data is carried out using manual, IT and telecommunications tools, in accordance with criteria strictly related to those purposes and, in any event, in such a way as to ensure the security and confidentiality of the data. Personal data will therefore be processed in accordance with the procedures set out in Article 5 of EU Regulation 2016/679, which provides, among other things, that data must be processed lawfully and fairly; collected and recorded for specified, explicit and legitimate purposes; accurate and, where necessary, kept up to date; relevant, complete and not excessive in relation to the purposes of the processing; and in accordance with the fundamental rights and freedoms, as well as the dignity of the data subject, with particular reference to confidentiality and personal identity, through appropriate safeguards and security measures. This organisation has established and will further refine its security system for data access and storage.

No automated decision-making process (e.g. involving profiling) is carried out.

Transfers outside the EU

Data processing will take place primarily in Italy and the EU, but may also take place in countries outside the EU and the EEA where this is deemed necessary for the efficient fulfilment of the purposes pursued, whilst respecting the safeguards in place for data subjects. In particular, processing takes place in the EU, the UK, the USA, Singapore and Australia, where the website’s servers are located, as this is deemed necessary for the efficient fulfilment of the purposes pursued, whilst respecting the safeguards in place for data subjects. Finally, processing that takes place in non-EU and non-EEA countries when, at the data subject’s request, connections to the website originate from such countries, falls outside the Data Controller’s responsibility.

Shelf life of storage

Personal data will generally be retained for as long as the purposes of the processing remain valid, depending on the category of data being processed.

The data (only that which is strictly necessary) is disclosed to data processors and persons in charge of processing, both within the undersigned organisation and externally, who carry out specific tasks and operations (website administration, analysis of browsing and traffic data, profiling, management of emails and forms voluntarily submitted by the user, processing of enquiries and e-commerce orders, etc.); in the cases and to the parties provided for by law.

Target audience categories

The data will not be disclosed unless otherwise required by law or following anonymisation. Subject to the provisions regarding cookies and third-party elements, without the data subject’s prior general consent to the disclosure of data to third parties, only those services that do not involve such disclosure may be provided. Where necessary, specific and precise consents will be sought, and the parties receiving the data will use it in their capacity as independent data controllers.

In certain cases (which do not fall within the scope of this website’s day-to-day operations), the Authority may request details and information for the purposes of monitoring the processing of personal data. In such cases, a response is mandatory, failing which an administrative penalty may be imposed.

Rights of the data subject

At any time, you may: exercise your rights (access, rectification, erasure, restriction, data portability, objection, and the right not to be subject to automated decision-making) where applicable, vis-à-vis the data controller, in accordance with Articles 15 to 22 of the GDPR; lodge a complaint with the Data Protection Authority; where the processing is based on consent, withdraw the consent you have given, bearing in mind that the withdrawal of consent does not affect the lawfulness of processing based on consent prior to its withdrawal.

Disabling cookies

Almost all browsers allow you to manage and disable cookies, in order to respect users’ preferences. In some browsers, you can set rules to manage cookies on a site-by-site basis, an option that offers more precise control over user privacy; another feature available on some browsers is incognito mode, which ensures that all cookies created whilst in this mode are deleted once the browser is closed.

For information on managing cookies in your browser, please refer to the help documentation provided by the browser’s manufacturer.

Contact details

The data controller is Balzac s.r.l.

The head office is at Via Valfrè 14 – 10121 Turin (Italy).

The contact details are:
telephone +39 011 18899029
email oui@balzac.it

The complete list of data controllers for data processing is available on request.