Privacy Policy

Privacy Notice Regarding the Processing of Personal Data

This privacy notice describes, pursuant to Article 13 of European Regulation (EU) 2016/679 (hereinafter the “GDPR”), the processing of personal data of those who, as customers or in any other capacity (hereinafter “Data Subjects”), have legal relationships with, come into contact with, or otherwise provide their personal data to Pleion S.p.A.

1) Data controller.
The Data Controller is Pleion SpA – Società con unico Socio (the “Controller”), with registered office at Cerea, Via Venezia 11, 37053, Italy. The Controller can be contacted at info@pleion.it. An updated list of any Data Processors (those who may be assigned to process or process data on behalf of the Controller) is available at the registered office indicated above. The Controller has not appointed a Data Protection Officer (DPO), having determined that, given the type of processing performed, appointing one is neither mandatory nor appropriate.

2) Location and methods of processing. Data processing related to the web services of the Data Controller’s website, currently http://www.pleion.it, as well as data processing carried out by Pleion S.p.A. — a company with a sole shareholder in any other capacity pursuant to this privacy policy — take place at the Data Controller’s headquarters and are handled by appropriately designated internal technical staff (Data Processors), in accordance with the GDPR, and/or by personnel external to the Data Controller’s organization, following appropriate written appointment as Data Processor, pursuant to Article 28 of the GDPR.
All personal data is processed both in paper format and, primarily, electronically. Such data will be stored in a form that allows for the identification of the user only for the time strictly necessary to achieve the purposes for which the data was originally collected and, in any case, within the limits established by law. Specific security measures are in place to prevent data loss, unlawful or improper use, and unauthorized access, in accordance with the provisions of the GDPR.
The Data Controller has adopted appropriate security measures to protect your data against the risk of loss, misuse, or alteration. The Data Controller will not transfer your personal data to a third country or to an international organization.
In order to ensure that personal data is always accurate, up-to-date, complete, and relevant, data subjects are invited to report any changes to the email address indicated above in point 1.

3) Purpose of the processing
The processing of personal data is aimed at:

• Primarily to ensure the proper and complete performance of the contract and other assignments and mandates—including even the mere preparation of estimates—entrusted by the Data Subject.
• Within the limits and solely for the purpose of providing the services accessible through the company’s website, to enable users to learn about or gain a deeper understanding of the Data Controller’s activities and other initiatives.
• To enable the Data Controller to comply with its tax and accounting obligations.
• Compliance with the Data Controller’s obligations under other applicable laws (e.g., regarding security).
• Subject to the data subject’s express consent, for the purpose of sending—including via email through automated systems—communications containing information regarding the Data Controller and the activities organized by the Data Controller (such as invitations to conferences and events in general, including the management of participation in such events), as well as updates and/or informational material of a legal and/or promotional nature, such as, for example, newsletters, presentations, in-depth analyses, and updates on topics related to the Data Controller’s activities, including the profiling of the Data Subject for these purposes, with the aim of tailoring, improving, or personalizing the Data Controller’s initiatives by taking into account the Data Subject’s specific needs or interests;

4) Legal basis for processing
Personal data is processed lawfully, as:
The performance of the activities described in subparagraphs (a) and (b) of point 3 above does not require the consent of the Data Subject, as these are services or actions carried out, in most cases, in response to requests made directly by the Data Subject pursuant to Article 6, (c)(1)(B) of the GDPR.
The processing of data for the purposes set forth in subparagraphs (c) and (d) likewise does not require the consent of the data subjects, as it is necessary to fulfill a legal obligation of the Data Controller, pursuant to Article 6, (c)(1), subparagraph C) of the GDPR
The processing of personal data for the purpose described under e) requires the consent of the data subject pursuant to Article 6, paragraph 1, subparagraph a) of the GDPR.

5) Consequences of failure to communicate personal data
Providing personal data for the purposes listed above is optional, and failure to provide such data will only make it impossible for the Data Controller to manage and process the interested party’s requests or send the communications indicated above.

6) Data retention
Personal data will be retained for the time strictly necessary to achieve the purposes for which they are collected and processed. Once the purpose of the processing has been fulfilled, or if the right to object to processing is exercised or consent is withdrawn, the Data Controller will still be entitled to retain the personal data, in whole or in part, for the purposes permitted by the GDPR (e.g., to enforce a legal claim). Personal data processed for the purposes indicated above will be retained for the period during which we are subject to retention obligations for tax purposes, which is currently 10 years.

7) Disclosure of Data
Personal data may be disclosed to:

1. Contractors and employees of the company who perform duties related to the purposes indicated above (Authorized Persons);
2. Accountants, external consultants, or outsourced service providers that process data in compliance with specific legal obligations (bound parties, such as data processors appointed by the Data Controller, who provide services necessary for the purposes indicated above);
3. Administrative or Judicial Authorities, for the purpose of fulfilling the contract and legal obligations.

8) Types of Data Processed

• Browsing Data

The computer system and software procedures used to operate the Data Controller’s website (web address indicated above) acquire, during their normal operation, certain personal data whose transmission is implicit in the use of Internet communication protocols.
This information is not collected to be associated with identified data subjects but, by its very nature, could—through processing and association with data held by third parties—allow for the identification of users.
This category of data includes the IP addresses or domain names of the computers used by users connecting to the Site, the URI (Uniform Resource Identifier) addresses of the requested resources, the time of the request, and the file size

Pleion S.p.A. – Single-Shareholder Company – Via Venezia 11 – Cerea, VR

zzzzzzzzzzzzzzx received in response, the numerical code indicating the status of the response provided by the server, and other parameters related to the user’s operating system and computing environment.
This data may be used solely to obtain anonymous statistical information on the use of the Site and to verify its proper functioning, and is deleted immediately after processing. The data may be used to determine liability in the event of hypothetical cybercrimes against the Site.
This category also includes data processed through the use of cookies. For this purpose, please refer to the provisions of the Cookie Policy available via the “Privacy” link on this Site.

• Data provided voluntarily by the user or collected from third parties

9) Recipients and Categories of Recipients
No data will be disclosed or transferred to third parties without the consent of the data subject. Should disclosure to third-party suppliers or partners of the Data Controller be necessary for organizational, administrative, or service support purposes, the Data Controller will ensure that such third parties are designated as data processors in accordance with the GDPR. The personal data provided to us is not subject to disclosure or automated decision-making processes.

10) Rights of the interested party
Each interested party is granted the rights set forth in Articles 15 to 20 of the GDPR. For example, each interested party may request from the Data Controller:

• access to personal data and information related thereto; the rectification of inaccurate data or the completion of incomplete data; the erasure of such data (upon the occurrence of one of the conditions set forth in Article 17, paragraph 1 of the GDPR and in compliance with the applicable exceptions); restriction of processing (where one of the circumstances set forth in Article 18, paragraph 1 of the GDPR applies);
• to exercise the so-called “data portability” right regarding your personal data (i.e., to receive them in a structured, machine-readable format, including for the purpose of transmitting such data to another data controller);
• to object at any time to the processing of your personal data in specific situations that concern you;
• Withdraw your consent at any time, provided that the processing is based on your consent for one or more specific purposes and concerns general personal data (such as date and place of birth or place of residence), or special categories of data (such as data revealing racial origin, political opinions, religious beliefs, or health status). This does not affect processing based on consent that took place prior to the withdrawal;
• file a complaint with a supervisory authority (Italian Data Protection Authority – www.garanteprivacy.it).

Privacy Notice, Version 1, May 25, 2018