Protection of Personal Data (GDPR)

Information pursuant to Art. 13 of the Regulation (EU) 2016/679 on the protection of Personal Data (GDPR) and request for consent for the processing of Personal Data

1. Data Controller

IMA S.p.A. (hereinafter “IMA” or the “Company” or “Data Controller”), having its seat in Ozzano dell’Emilia (BO) IT, Via Emilia n. 428-442, on its own behalf and/or as the holding company of the Ima Group, which incorporates subsidiaries as defined in Article 2359 of the Italian civil code,  in its vest of the Data Controller of your Personal Data spontaneously communicated (hereinafter “Personal Data”) is providing you with the present notice pursuant  to Art. 13 of the GDPR. The updated list of the companies belonging to the IMA Group here available on: https://ima.it/ima-group/companies/  (hereinafter “IMA Group companies”)

1. Purposes of the processing for which the Personal Data are intended and related legal basis

Your Personal Data will be processed:
(i) without your consent (section 6, letters b) c) and  f)  GDPR), for the following purposes:

1. performance of contractual obligations or services requested by you;
2. compliance with legal obligations, as provided for by law and/or regulations (i.e. invoicing, accounts keeping, etc.);
3. exercise of the Company rights and/or of the companies belonging to the IMA Group with reference to judicial and non-judicial rights;

(ii) with your consent (Art. 7, GDPR), which can be subsequently revoked at any time, for the following purposes:

1. direct and/or indirect marketing and market research: by sending out (via e-mail, mail, telephone, fax and/or text and push messages) newsletters and commercial communications relative to products marketed by the Company and/or the IMA Group companies (and their commercial partners), events organized by IMA, open house, invitation to trade shows of your interest and for the purpose of making (via telephone, e-mail and on-line) statistical and marketing analysis and surveys, including customer satisfaction activities. In the event of your consent for the purpose of profiling as stated in the following lett. e) the Company and/or the IMA Group companies will be allowed to utilize the above mentioned information in order to send you commercial information of your interest.
2. Profiling: collection of information about behavior and commercial preferences related to your company field in order to improve services provided to our customers, and more specifically in order to analyze information relative to your choices preferences, interests and habits acquired by you in the context of the offered services.

1. Nature of provision of Personal Data and consequences of the eventual refusal
2. For the purposes under letters a), b) and c) of  (i) Art. 2 above, the collection of your Personal Data is necessary. In lack of the data or in case of any express refusal of consent to process such data it may cause the impossibility for IMA and the IMA Group companies to perform the undersigned contracts or the possible violation of requests coming from competent authorities.

For the purposes under Art. 2 letters d) and e) (ii) above, the collection of your Personal Data is made on voluntary basis; consequently, you may decide not to provide us with any express consent, or to waive it in any moment. The lack of any express consent to process such data may cause the impossibility for IMA and the IMA Group companies to perform the above-mentioned activities.

4.         Processed Categories of Personal Data

Within the purposes of processes mentioned under Art. 2  above, we shall exclusively process those Personal Data concerning:

1. Personal identification data (by way of example, your name and family name, tax code, VAT number, residence, email, certified email address, employers company, business role and/or position etc.)

Data updating

At any time you can verify that your Personal Data processed for the purposes set forth in the present notice are correct and, if violated, you can ask their update through the following e-mail address: privacy@ima.it or by mail to our Company headquarter.

1. Modalities of Data Processing

The processing of your Personal Data is carried out by means of the operations indicated in Art. 4, no. 2), GDPR and more precisely: collection, registration, organization, structuring, updating, preservation, adaptation or modification, extraction and analysis, consultation, use, communication by transmission, comparison, interconnection, limitation, cancellation or destruction.

IMA guarantees the logical and physical security of the data and, in general, the confidentiality of the processed Personal Data, putting in place all the necessary technical and organizational measures to prevent the loss of Personal Data, illicit use or, in any case, incorrect of the same, as well as unauthorized access by third parties.

The processing by IMA of your Personal Data will be based on correctness principles, lawfulness, transparency and protection of your privacy and your rights, in accordance with the principles expressed by the GDPR and the Privacy Code (Legislative Decree n. 196/2003).

Personal Data may be processed by paper-based instruments, computerized and telematics tools and it will include – in compliance with the limits and conditions laid down by the privacy legislation – all the operations or set of operations necessary for the processing at issue. The processing of Personal Data will be carried out in compliance with confidentiality and security rules provided by for European laws, by law, regulations and domestic provisions.

6.        Categories of Personal Data recipients

The Personal Data you will submit us for the purposes mentioned under Art. 2 above, could be transferred to:

• Employees and collaborators of IMA and/or IMA Group companies , who will act in their capacity as authorized data processing personnel (“Data Processor/s”) and/or to consultants appointed by the Data Controller who need to process Personal Data for the performance of their duties;
• third parties who carry out outsourced activities on behalf of the Data Controller providing specific services as Data Processors pursuant to Art. 28 GDPR. For information on the names and relative references of the Processors, you can contact IMA at the following address: privacy@ima.it or by mail at the Company headquarter;
•  to judicial or supervisory authorities, public administrations, public (national and foreign) bodies, in compliance with the provisions of the law and conforming with a  previous formal request from such subjects.

Personal Data will not be disclosed or transferred to third parties.

It is understood that, in the event of any extraordinary corporate transactions (e.g. transfer or lease of a company, merger, etc.) concerning the Data Controller, Personal Data could be transferred to third party (buyers/beneficiaries or successors in title to the Data Controller).

1.            Transfer of Personal Data to third countries

The complex business structure of IMA implies, necessarily, a cross-border circulation of data that under the law is seen as transfer of data abroad, even outside the territory of the European Union.

Your data, if transferred to countries outside the European Union, will always be processed in accordance with the principles set out in Art. 45 and 46 of the GDPR regarding the existence of an adequacy decision by the European Commission.

Personal Data are processed and stored on servers located in the Company headquarter.

The transfer to non EU-countries shall always be performed in compliance with the provisions of Art. 45 and 46 GDPR, by providing adequate guarantees and subject to an adequacy decision adopted by the  European Commission.

Your Personal Data will not be subject to dissemination.

1.  Personal Data Storage Period

Your Personal Data will be stored for the period of time strictly necessary for the pursuit of the purposes of the data processing indicated in Art. 2 above and, specifically:

• for the purposes indicated in Art. 2, (i): for the time necessary for the fulfillment of the contractual obligations and, in any case, no later than 10 (ten) years from the time of collection of your Personal Data for the fulfillment of regulatory obligations and, in any case, no later than the deadlines set by law for the limitation period of the afferent rights;
• for the purposes indicated in Art. 2, (ii) lett. d) (i.e. for direct and indirect marketing purposes and market research): 24 (twenty-four) months from the moment of acquired consent to the processing or until revocation of your consent or request for its cancellation;
• for the purposes indicated in Art. 2, (ii) lett. e) or for purposes of profiling: they will be kept for the maximum time identified by the Italian Guarantor for the protection of Personal Data. For purposes of personalized marketing: 12 (twelve) months from the time of the acquired consent or until withdrawal of consent or your request of cancellation.

1. Exercisable Rights

With reference to your Personal Data you can exercise, at any time, the rights pursuant  the GDPR as indicated below:

• Right of Access to Personal Data Art. 15– Obtain confirmation whether your data are processed or not and, in such a case, obtain information related, in particular, to: the purposes of such processing, the categories of the processed Personal Data, the storage period, the recipients to whom such data can be transferred, the right to send a complaint to the supervisory authority, the right to request the correction or cancellation or limitation of the processing or to file an opposition to the processing itself as well as the existence of an automated decision-making process.
• Right of Rectification 16– Obtain, without undue delay, the rectification of inaccurate Personal Data and to have incomplete Personal Data duly completed.
• Right of Erasure 17 – Obtain, without undue delay, the erasure of your Personal Data, in the cases provided for by the GPDR.
• Right to Restriction 18 – “limitation” means the marking of the data stored with the aim of limiting the processing in the future. This will imply the burden on the part of IMA and IMA Group companies to suspend the processing of your Personal Data.
• Right to Data Portability 20 – in case of automated processing carried out on the basis of consent or in execution of a contract, to receive your data in a structured format, commonly used and readable by automatic device.
• Right to object 21– Object to the processing of your personal data, unless there are reasons of legitimate interest for the Data Controller to continue processing such data. You also have the right to object to processing where your personal information are used for direct marketing purposes.
• Oppose the automated decision-making process, including profiling Art. 22 – your Personal Data must not be subject to any automatic decision-making process by IMA through the use of personal information or through the Customer profiling, unless you have expressed your consent.
• Withdrawal of consent – in the event that you have given consent to the collection, processing and transfer of your Personal Data, you have the right to revoke it for such specific processing at any time. Once we receive the notice of withdrawal of consent, we will no longer process your Personal Data, unless these are not based upon other legitimate interest-basis.

You may exercise your above listed rights by means of a request to be sent by e-mail to privacy@ima.it or by mail to the Company headquarter.

• File a complaint pursuant to Art. 77 to the competent supervisory authority based on your residence, workplace or place of violation of your rights; for Italy, is competent the Italian Guarantor for the protection of Personal Data, which can be contacted via its website: http://www.garanteprivacy.it/.