Source: https://www.pibiplast.com/privacy-policy/?lang=en
Timestamp: 2019-04-19 04:18:30+00:00

Document:
The Data Controller processes personal data of a non-sensitive nature (for example name, surname, tax code, VAT number, email, telephone number – hereinafter, “personal data” or even just “data”) provided by you during registration for web services offered by the Data Controller (for example: website, newsletter, social network).
– to exercise the rights of the Data Controller, for example the right of defence in court.
– to enable you to subscribe to the newsletter provided by the Data Controller and any additional services you may request; Please be informed that if you are already our customer, we may send you commercial communications regarding services and products offered by the Data Controller that are similar to those you have already made use of, unless you specifically object (art. 130 paragraph 4 of the Privacy Code).
The processing of your personal data is carried out by means of the operations indicated in art. 4 of the Privacy Code and art. 4 n. 2) of the GDPR, specifically: collection, registration, organisation, retention, consultation, processing, modification, selection, extraction, comparison, use, interconnection, blocking, communication, deletion and destruction of data. Your personal data may be processed using electronic, manual and/or automated means.
The Data Controller shall process the personal data for the time necessary to fulfil the aforementioned purposes and in any case for no longer than 10 years from the termination of the relationship for Service Purposes and for no more than 2 years from the collection of the data for Marketing Purposes.
– to companies of the Pibiplast Group to which the Data Controller belongs (for example, for marketing or promotional activities or for collecting opinions, for storage of personal data, etc.) or to third parties (for example, service providers for management and maintenance of the website, suppliers, credit institutions, professional studios, etc) who perform outsourced activities on behalf of the Data Controller, in their capacity as external data processors.
Without your express consent (ex art. 24 lett. a), b), d) of the Privacy Code and art. 6 lett. b) and c) of the GDPR), the Data Controller may communicate your data for the purposes referred to in art. 2.A) to supervisory authorities, judicial authorities as well as to all other subjects to whom the communication is mandatory by law for the fulfilment of the purposes indicated above. Your data shall not be disclosed.
Personal data is managed and stored on servers within the European Union belonging to the Data Controller and/or third party companies entrusted with processing and duly appointed as data processors. Servers are currently located in ITALY + mailchimp servers. Data shall not be transferred outside the European Union. In any case, it is understood that the Data Controller, where necessary, shall be entitled to move servers located in Italy and/or the European Union and/or non-EU countries. In this case, the Data Controller hereby ensures that the transfer of data outside the EU shall take place in accordance with applicable legal provisions, stipulating agreements, if necessary, to guarantee a suitable level of protection and/or adopting the standard contractual clauses of the European Commission.
The provision of data for the purposes referred to in art. 2.A) is mandatory. Without said data, we shall not be able to guarantee registration on the website or the services outlined in art. 2.A).
The provision of data for the purposes referred to in art. 2.B), meanwhile, is optional. You can therefore decide not to provide any data or to subsequently revoke consent to the processing of data already provided: in this case, you shall not receive newsletters, commercial communications and advertising material related to the services offered by the Data Controller. However, you shall continue to be entitled to the Services referred to in art. 2.A).
iv. oppose, in whole or in part: a) for legitimate reasons, the processing of your personal data, even if it is pertinent to the purpose of its collection; b) the processing of personal data concerning you for the purpose of sending advertising material or direct sales material, for the completion of market research or for commercial communication, through automated calling systems without human intervention, through email and/or traditional marketing communications by telephone and/or physical post. It should be noted that the interested party’s right of opposition, outlined above at point b), for the purposes of direct marketing by automated means also extends to traditional means and that in any case the interested party remains entitled to exercise the right of opposition even only in part. Therefore, the interested party may decide to receive communications through traditional means only or automated communications or neither of the two types of communication.
Where applicable, you also have the rights outlined in articles 16-21 of the GDPR (Right to rectification, right to be forgotten, right to restriction of processing, right to data portability, right to object), as well as the right to lodge a complaint with the supervisory authority.
This website and the services provided by the Data Controller are not intended for minors (under 18 years of age) and the Data Controller does not knowingly collect personal information relating to minors. In the event that information relating to minors is inadvertently recorded, the Data Controller shall delete it promptly, at the request of the user.
The up-to-date list of data processors and data handlers is kept at the Data Controller’s headquarters.

References: art. 4
 art. 4
 art. 24
 art. 6
 art. 2
 art. 2
 art. 2
 art. 2
 art. 2