PRIVACY

Information on the Protection of Your Personal Data and Privacy "CUSTOMERS"

(provided pursuant to Article 13, obtained from you)

​

Those who fill out online forms and/or customers authorize the data controller (specified below) to process their personal data in their possession for the purposes provided in points 1-6.

​

Your personal data belongs to you. We are aware that we must handle the data you provide us in the most correct manner possible and with all the guarantees we can offer. For this reason, we have complied with the General Data Protection Regulation of 2016 number 679, LAW 196/2003,  and GPDR applicable regulations.

The privacy of our Customers is important to us.

Below you will find the information that will allow you to understand what data we collect, why we collect it, how we use it, and your rights regarding its processing.

​

1. Who is the Data Controller?
The Data Controller is the one who decides the purposes of the collected data processing. In this case, the Data Controller of personal data is: GRIMALDI S.R.L. with registered office at Via Monte Napoleone, 8, 20121 Milan (MI). You can contact the Data Controller at any time to exercise your rights (listed below) by filling out the form on the website's homepage. In the following information, the term "Company" is used as a synonym for "Data Controller."

​

 2. How do we collect your data?
We collect the data you normally provide directly and occasionally through:
- Personal direct contact
- Telephone contact or other remote means (e.g., email)
- Third parties, such as magazines, websites, or business activities
- Databases for monitoring financial and/or commercial risks

​

 3. For what purpose do we collect your data?
4. The purposes for which we process your data vary:
- To comply with a legal obligation, such as issuing an invoice, an accounting entry, or a communication to the Authorities
- For legal obligations related to the relationship between us and you to carry out the tasks assigned concerning products and services related to our activity
- For assistance or management of customer relationships and related communications, credit management, or any disputes
- To exercise a right in legal proceedings
- For the legitimate interest of our Company or third parties, such as internal company communications to facilitate the management of the relationship and communications with customers or similar
- For direct marketing purposes to provide you with information or promotions on products or services similar to those already purchased or of which you have shown interest, through postal mail, email, SMS messages, or other remote communication means made available by technology
- For general marketing purposes, to provide you with information on our or third parties' products or services or initiatives, promote them, conduct market research, and/or verify the quality of services offered to you (also through phone calls or sending questionnaires), optimize the offer itself (also through focused analyses). For this purpose, your explicit consent is required, which will be requested freely.

​

 5. How are your data processed?
All personal data is processed using paper, computer, or remote means (e.g., telematically). For personal data stored in archives at our Company, we ensure adequate security levels and limited access to relevant internal or external personnel.

​

 6. Why do we process your personal data?
To provide you with a certain service or to communicate information or promotions about it, it is necessary to use your data, such as your email address to send you a communication. Some data must be provided to us by law, such as the data on invoices. In some cases, the lack of certain personal data will prevent us from providing you with the requested service or the necessary support.

From time to time, we process data anonymously to create statistics that allow us to make business decisions, such as deciding which services to offer, their prices, and how to promote them.

​

 7. Whose data do we collect?
We collect the data of Customers or potential Customers who request quotes, offers, products, and services related to our activity.

​

8. What types of data do we collect?
The personal data we collect falls into the following categories:
- Names, surnames, addresses, emails, tax data, all relevant data for formulating a contractual or pre-contractual agreement.

​

9. Am I obliged to provide my personal data?
You are not obliged to provide your personal data, but in many cases, the lack of certain personal data will prevent us from providing you with the requested product or service or the necessary support.

​

10. For which processing is your explicit consent required?
For some purposes, merely providing your data is sufficient to proceed with their processing. For others, however, your explicit and informed consent is required.

Regulations indicate that, when not necessary, the processing of your personal data can also take place following your action of providing them to us to use our services.

When your consent is necessary, we will explicitly ask for it, informing you simultaneously of any different purposes not indicated here.

You can contact the Data Controller at any time to exercise your rights (listed below) by filling out the form on the website's homepage.

​

11. What are your rights concerning the processing of your data?
You can exercise your rights without any restrictions and free of charge, unless the requests are unfounded or excessive, by writing directly to us as the Data Controller, to:
- Request the Data Controller to access your personal data and information about its processing
- Obtain the correction of your data if you have detected errors
- Have your data anonymized and therefore no longer traceable to you
- Delete your data, except for data the Data Controller must have by law or to assert the right to defense
- Revoke previously given consent, in whole or in part
- Limit processing in the following cases:
  - If you dispute the accuracy of personal data, for the period necessary for the Data Controller to verify the accuracy of such data
  - If you believe the processing is unlawful and instead of deletion, you request that the data be retained but not further processed by the Data Controller
  - If your personal data is necessary for establishing, exercising, or defending a right
  - If you oppose the processing, for the waiting period of verification of the possible prevalence of legitimate reasons of our Company.

- Data portability, i.e., the right to receive in a structured, commonly used, and machine-readable format, the personal data concerning you and the right to transmit such data to another Data Controller without impediments from our Company to whom you provided them, when the processing is based on consent or a contract and is carried out by automated means
- Obtain, in the case your data is used in automated decision-making processes, information about the logic of the processing in question, and the possibility of requesting human intervention on our part. In the case of automated decision-making processes, it is also your right to express your opinion or contest the processing itself.

Any corrections, deletions, or processing limitations, made at your request, will be communicated - unless this proves impossible or involves disproportionate effort - by us to each third party (recipients) to whom your personal data has been transmitted. If you request it, we may communicate the list of such recipients.

 

12. How to exercise your right to object?
You have the right to object, at any time, to the processing of your personal data even when the processing is carried out for the legitimate interest of the Company, by submitting an objection to us as the Data Controller. The Company will not carry out further processing of your personal data unless there is a legitimate reason arising from a non-derogable obligation that prevails over your rights or for establishing, exercising, or defending a right in legal proceedings.

You also have the right to file a complaint with the Data Protection Authority if you believe your rights have not been respected, following the procedures and instructions published on the official website of the Authority at www.garanteprivacy.it.

​

13. To whom can my personal data be communicated?
In carrying out some activities related to the processing of your data, we may make communications to trusted external companies or entities, which operate as independent Data Controllers. In some cases, these external companies or entities are designated as "external processors" based on their competence. As "external processors," these companies or entities operate in close collaboration with us and follow precise directives we provide.

Generally, for conducting its activity and fulfilling obligations related to its activity, our Company collects personal data in computer databases for which we are directly Data Controllers.

For some services, our Company communicates data to other companies or external entities that operate on its behalf (e.g., internet service providers, banking service providers, IT service providers, debt collection companies, customer communication or document archiving companies related to customer relationships, auditing firms, legal firms, and professionals).

Within our Company, employees and collaborators, including external ones, who are authorized to process personal data may be aware of your data.

The list is constantly updated and can be easily and freely accessed by writing to the Data Controller as described above.

​

 14. Will my data be transferred to Third Countries or outside the European Union?
The transfer of personal data outside the European Union (EU) is not foreseen. All third-party companies involved in processing are based in Italy or the EU. Commercial partners operating also outside the EU (e.g., Google Inc) have one or more offices within the EU.

Your personal data within the EU are subject to the same protection rules in all member countries.

​

 15. How long are my personal data kept?
The personal data processed by our Company are kept for the time necessary to achieve the purposes indicated above, after which they are deleted following legal requirements.

In some cases, and with your consent, we will archive the collected data for archiving purposes only.

In particular, in the pre-contractual phase between the Company and potential customers, personal data will be kept for the time necessary to prepare and complete the signing or not of a contract.

If the pre-contractual phase results negatively, the Company will