Privacy Policy for altamirahrm.com

ALTAMIRA S.R.L., with registered office at Via G. Marradi 1, 20123 Milan (Italy), Tax Code, VAT No. and Milan Company Register No. 12940250157, as data controller (hereinafter the “Controller”), hereby informs you, pursuant to Regulation (EU) 2016/679 (“GDPR”) and the data protection legislation, including national legislation, applicable from time to time (the “Privacy Legislation”), that your data will be processed in the manner and for the purposes set out below.

1. Subject matter of the processing

The Controller processes personal data — identifying and non-sensitive data (by way of example but not limited to: first name, surname, address, telephone number, email, etc. — hereinafter “personal data” or “data”) — that you provide when registering on the website www.altamirahrm.com (the “Site”) or on the Controller’s newsletter request form, when ordering and/or purchasing products online through the Site, when completing and submitting a contact form to the Controller, or otherwise in connection with any request you make to the Controller (e.g. a Demo request, etc.).

2. Purposes and legal basis of the processing

Your data are processed, without your prior consent, for the following purposes:

A. Service purposes

a) performance of a contract or fulfilment of pre-contractual measures:

• to fulfil the pre-contractual, contractual and tax obligations arising from our relationship with you;
• to allow you to register on the Site;
• to process and manage orders received and/or purchases made online;
• to allow you to use the Demo of the Controller’s products and any further Services you may request;
• to process a contact request;
• to allow you to apply online and to process your application;
• to manage and maintain the Site;
• to comply with obligations laid down by law, by regulation, by EU legislation or by an order of an Authority;
• to prevent or detect fraudulent activity or abuse harmful to the Site;
• to exercise the Controller’s rights, for example the right of defence in legal proceedings.

b) pursuit of a legitimate interest of the Controller, in particular:

• to analyse cookies — as described in the Cookie Policy — arising from your use of the Site;
• to prevent or detect fraudulent activity or abuse harmful to the Site;
• to comply with obligations laid down by law, by regulation, by EU legislation or by an order of an Authority;
• to exercise the Controller’s rights, for example the right of defence in legal proceedings;
• to send you commercial communications relating to the Controller’s services and products similar to those you have already purchased, if you are already our customer. You may object at any time.

B. Only with your prior consent, for Marketing purposes

• to send you, by email, newsletters, commercial communications and/or advertising material regarding the Controller’s products or services.

3. Method of processing

Your data are processed — by paper-based means (archives) and electronic means (the website and the management systems Salesforce, Zendesk, Office 365) — through the operations of collection, recording, updating, organisation, storage, consultation, processing, modification, selection, extraction, comparison, use, interconnection, blocking, erasure and destruction of the data.

4. Data retention

The Controller processes the data for as long as necessary to respond to your request and to fulfil the purposes set out above, and in any case for no longer than 5 years from collection for contact data and no longer than 6 months from collection for navigation data. Data processed for Marketing purposes will be processed for no longer than 2 years from collection.

5. Access to the data

The following may access your data for the purposes set out above:

• employees and/or collaborators of the Controller, in their capacity as persons authorised to process the data and/or internal data processing supervisors and/or system administrators;
• third-party companies or other parties (for example, website providers, e-payment service providers, suppliers, hardware and software support technicians, credit institutions, professional firms, etc.) that carry out outsourced activities on behalf of the Controller, in their capacity as external data processors.

6. Disclosure of the data

Your data may be disclosed, even without your consent, for the purposes set out above to supervisory bodies, law enforcement authorities or the judiciary, which will process them, upon their express request, as independent data controllers for institutional purposes and/or as required by law in the course of investigations and checks. Your data may also be disclosed to third parties (for example, partners, freelance professionals, agents, etc.), as independent data controllers, for the performance of activities ancillary to the purposes set out above.

7. Data transfer

The data are not disseminated, nor will they be transferred to countries outside the EU. Personal data will be managed and stored on servers located within the European Union. It remains understood in any event that the Controller, where necessary, may relocate the servers to Italy and/or the European Union and/or non-EU countries. In such a case, to ensure an adequate level of protection of personal data, the transfer of data to non-EU countries will take place on the basis of adequacy decisions adopted by the European Commission or through the adoption by the Controller of the Standard Contractual Clauses drawn up by the European Commission.

8. Provision of the data

Providing the data is mandatory for the Service purposes. Should you decide not to provide the data, we will not be able to act on your request.

Providing the data for Marketing purposes is, however, optional. You may therefore decide not to provide the data, or to subsequently withdraw permission to process data already provided: in that case, you will not be able to receive personalised commercial communications about the Controller’s products, but you will continue to be entitled to use the Site’s services.

9. Rights of the data subject

As a data subject, the Controller informs you that you have the right to:

• obtain confirmation as to whether or not your personal data exist, even if not yet recorded, and to have such data made available to you in intelligible form;
• obtain an indication and, where applicable, a copy of: a) the origin and category of the personal data; b) the logic applied in the case of processing carried out with the aid of electronic tools; c) the purposes and methods of the processing; d) the identifying details of the Controller and of the data processors; e) the parties or categories of parties to whom the personal data may be disclosed or who may become aware of them, in particular where they are recipients in third countries or international organisations; f) where possible, the data retention period or the criteria used to determine that period; g) the existence of automated decision-making and, in such a case, the logic involved, as well as the significance and the envisaged consequences for the data subject; h) the existence of adequate safeguards in the event of transfer of the data to a non-EU country or to an international organisation;
• obtain, without undue delay, the updating and rectification of inaccurate data or, where you have an interest, the integration of incomplete data;
• obtain the erasure, transformation into anonymous form or blocking of data: a) processed unlawfully; b) no longer necessary in relation to the purposes for which they were collected or subsequently processed; c) in the event of withdrawal of the consent on which the processing is based, where there is no other legal ground; d) where you have objected to the processing and there is no overriding legitimate ground to continue the processing; e) in the case of compliance with a legal obligation; f) in the case of data relating to minors. The Controller may refuse erasure only in the case of: a) exercise of the right to freedom of expression and information; b) compliance with a legal obligation, performance of a task carried out in the public interest or exercise of official authority; c) reasons of public health interest; d) archiving in the public interest, scientific or historical research or statistical purposes; e) establishment of a legal claim before the courts;
• obtain restriction of processing in the case of: a) contesting the accuracy of the personal data; b) unlawful processing by the Controller, to prevent erasure; c) exercise of a right of yours before the courts; d) verification of whether the Controller’s legitimate grounds override those of the data subject;
• receive, where the processing is carried out by automated means, without hindrance and in a structured, commonly used and machine-readable format, the personal data concerning you, in order to transmit them to another controller or — where technically feasible — to obtain their direct transmission by the Controller to another controller;
• object, in whole or in part: a) on legitimate grounds, to the processing of personal data concerning you, even if relevant to the purpose of the collection; b) to the processing of personal data concerning you for the purpose of sending advertising material or for direct selling, or for carrying out market research or commercial communication, through the use of automated calling systems without operator intervention, by email and/or through traditional marketing methods by telephone and/or paper mail;
• lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali).

In the cases above, where necessary, the Controller will inform the third parties to whom your personal data are disclosed of any exercise of your rights, save in specific cases (e.g. where doing so proves impossible or would involve a manifestly disproportionate effort in relation to the right protected).

10. How to exercise your rights

The data controller is:

ALTAMIRA S.R.L., Via G. Marradi 1, 20123 Milan.

The person responsible for internal data processing is:

John Martelli

The appointed Data Protection Officer is: Giovanni Galimberti, Attorney-at-law Email: DPO@altamirahrm.com Certified email (PEC): dpo.altamirasrl@legalmail.it

The updated list of internal and external data processors is kept at the Controller’s registered office in Milan, Via G. Marradi 1, 20123.

Milan, [21/05/2018]

ALTAMIRA S.R.L.