DigiTouch S.p.A., with registered office in Milan, viale Vittorio Veneto, 22, VAT No. 05677200965 (hereinafter, the “Company”) and the subsidiaries listed at the following link www.gruppodigitouch.it/societa-del-gruppo (hereinafter, jointly, the “Digitouch Group”), owners of the website www.gruppodigitouch.it (hereinafter, the “Website”), hereby provide the following privacy notice pursuant to Article 13 of EU Regulation 2016/679 of 27 April 2016 (hereinafter, the “Regulation”, or the “Applicable Law”).

• The Digitouch Group attaches the utmost importance to the right to privacy and to the protection of the personal data of its Users.
  For any information relating to this privacy notice, Users may contact the Digitouch Group at any time using the following methods:

   -          By sending a registered letter with return receipt to the Group’s registered office in Milan, addressed to the Legal Affairs Office, at viale Vittorio Veneto, 22, 20122 Milan;

  -          By sending an e-mail to the following address: privacy@gruppodigitouch.it.

  Users may also contact the Data Protection Officer (DPO) of the Digitouch Group, whose contact details are set out below: dpo@gruppodigitouch.it.

By browsing the Website, the User may view informational content relating to the services offered, understand the business model of the Digitouch Group and contact the Digitouch Group (hereinafter, the “Service”).

The User’s personal data will also be used by the Digitouch Group for the sole purpose of verifying the User’s identity.

This Website and any services offered through the Website are reserved for persons who are at least eighteen years of age. The Digitouch Group therefore does not collect personal data relating to persons under the age of 18. At the request of Users, the Digitouch Group will promptly delete any personal data inadvertently collected relating to persons under the age of 18.

In particular, Users’ personal data will be lawfully processed for the following purposes:

a) Provision of the Service: namely, to allow the User to browse the Website. The User data collected by the Digitouch Group for this purpose include all personal data whose transmission is implicit in the use of Internet communication protocols, which the IT systems and software procedures used to operate the Website acquire during their normal operation: the IP addresses or domain names of the computers used by Users, the addresses in URI (Uniform Resource Identifier) notation of the requested resources, the time of the request, the method used to submit the request to the server, the size of the file received in response, the numerical code indicating the status of the response provided by the server (successful, error, etc.) and other parameters relating to the User’s operating system and IT environment. These data are used solely to obtain anonymous statistical information on the use of the Website and to enable its proper operation;

b) Handling contact requests: Users’ personal data (specifically, first name, surname, company, e-mail address, telephone number, as well as any personal information that the User may voluntarily provide) will be lawfully processed by the Digitouch Group pursuant to the Applicable Law in order to allow the individual User to contact the Digitouch Group. The User’s personal data will also be used by the Digitouch Group for the sole purpose of verifying the User’s identity;

c) Allowing the User to submit an unsolicited application: Users’ personal data may be collected and processed by the Digitouch Group in order to handle their request regarding the possibility of establishing a working relationship with the Digitouch Group. The User data collected for this purpose include the e-mail contact details and any further data voluntarily provided by the User and/or included in the Curriculum Vitae and/or in any other documents shared;

d) Administrative and accounting purposes: namely, to carry out organisational, administrative, financial and accounting activities, such as internal organisational activities and activities necessary for the fulfilment of contractual and pre-contractual obligations;

e) Legal obligations: namely, to comply with obligations imposed by law, an authority, a regulation or European legislation.

Without prejudice to anything provided elsewhere in this privacy notice, under no circumstances will the Digitouch Group make Users’ personal data accessible to other Users and/or third parties.

The provision of personal data for the processing purposes referred to above (set out in paragraph 3, points a), d) and e)) is optional but necessary, since failure to provide such data will make it impossible for the User to browse the Website.

The personal data necessary to pursue the processing purposes described in this paragraph 3 are marked with an asterisk in the data collection form.

Certain personal data of the User (specifically, first name, surname, company and e-mail address, as well as, where provided, mobile telephone number) may also be processed by the Digitouch Group for marketing purposes, namely so that the Digitouch Group may contact the User by e-mail or telephone (landline and/or mobile, using automated calling or call communication systems, with and/or without the intervention of an operator) in order to offer comprehensive consultancy services in the digitalisation process for Users and/or partner companies.

If consent is not given, the ability to browse the Website will not be affected in any way. 

If consent is given, the User may withdraw it at any time by submitting a request to the Digitouch Group using the methods set out in paragraph 8 below. 

The User may also easily object to further promotional communications by e-mail by clicking the specific consent withdrawal link included in each promotional e-mail. Once consent has been withdrawn, the Digitouch Group will send the User an e-mail confirming the withdrawal of consent. If the User wishes to withdraw consent to receiving promotional communications by telephone while continuing to receive promotional communications by e-mail, or vice versa, the User is requested to submit a request to the Digitouch Group using the methods set out in paragraph 8 below. 

The Digitouch Group informs Users that, following the exercise of the right to object to the sending of promotional communications by e-mail, it is possible that, for technical and operational reasons (e.g. contact lists having already been prepared shortly before the Digitouch Group received the objection request), the User may continue to receive some additional promotional messages. If the User continues to receive promotional messages more than 24 hours after exercising the right to object, the User is requested to report the issue to the Digitouch Group using the contact details set out in paragraph 8 below. 

Provision of the Service (as described in paragraph 3, point a) above): the legal basis is Article 6(1)(b) of the Regulation, namely the processing is necessary for the performance of a contract to which the User is party or in order to take steps at the request of the User prior to entering into a contract.

Handling contact requests (as described in paragraph 3, point b) above): the legal basis is Article 6(1)(b) of the Regulation, namely the processing is necessary for the performance of a contract to which the User is party or in order to take steps at the request of the User prior to entering into a contract.

Allowing the User to submit an unsolicited application (as described in paragraph 3, point c) above): the legal basis is Article 6(1)(b) of the Regulation, since the processing is necessary for the performance of a contract and/or in order to take steps at the request of the User prior to entering into a contract.

Administrative and accounting purposes (as described in paragraph 3, point d) above): the legal basis is Article 6(1)(b) of the Regulation, since the processing is necessary for the performance of a contract and/or in order to take steps at the request of the User prior to entering into a contract.

Legal obligations (as described in paragraph 3, point e) above): the legal basis is Article 6(1)(c) of the Regulation, since the processing is necessary for compliance with a legal obligation to which the Data Controller is subject.

Further processing purposes: for processing relating to marketing activities (as described in paragraph 4 above): the legal basis is Article 6(1)(a) of the Regulation, namely the data subject’s consent to the processing of his or her personal data for one or more specific purposes.

The Digitouch Group will process Users’ personal data using manual and electronic tools, according to logic strictly related to the purposes themselves and, in any event, in such a way as to guarantee the security and confidentiality of the data.

Users’ personal data will be retained for the period strictly necessary to fulfil the primary purposes described in paragraph 3 above, or in any event for as long as necessary to protect the civil-law interests of both Users and the Digitouch Group.

The e-mail contact details and personal data referred to in paragraph 4 will be used by the Digitouch Group until the User objects or withdraws consent and, in any event, for a maximum period of 12 (twelve) months from the User’s last activity on the Website or activity attributable to the services offered by the Digitouch Group (activity on the Website includes browsing the Website, interacting with communications sent by the Digitouch Group, with the content and Services of the Website, etc.).

Where necessary, for example where the data subject exercises the right to restriction, in the event of requests from the competent Authorities or pursuant to a legal obligation, the strictly necessary personal data will be processed for the period strictly necessary to guarantee the rights of the data subject or to comply with a legal obligation or an order of the Authorities.

The User’s personal data may be transferred outside the European Union and, in such case, the Digitouch Group will ensure that the transfer takes place in compliance with the Applicable Law and, in particular, in accordance with Articles 45 (Transfers on the basis of an adequacy decision) and 46 (Transfers subject to appropriate safeguards) of the Regulation.

Employees and/or collaborators of the Digitouch Group responsible for managing the Website and Users’ requests may become aware of Users’ personal data. Such persons, who have been instructed accordingly by the Digitouch Group pursuant to Article 29 of the Regulation, will process Users’ data exclusively for the purposes indicated in this notice and in compliance with the provisions of the Applicable Law.

Third parties may also become aware of Users’ personal data and may process personal data on behalf of the Digitouch Group as Data Processors pursuant to Article 28 of the Regulation, such as, by way of example, providers of IT and logistics services necessary for the operation of the Digitouch Group’s Website, providers of outsourcing or cloud computing services, professionals and consultants.

The User has the right to obtain a list of any data processors appointed by the Digitouch Group by submitting a request to the Digitouch Group using the methods set out in paragraph 8 below.

Users may exercise the rights guaranteed to them by the Applicable Law by contacting the Digitouch Group using the following methods:

- By sending a registered letter with return receipt to the Group’s registered office in Milan, addressed to the Legal Affairs Office, at viale Vittorio Veneto, 22, 20124 Milan;

- By sending an e-mail to the following address: privacy@gruppodigitouch.it.

By contacting the Data Protection Officer (DPO) of the Digitouch Group, whose contact details are set out below: dpo@gruppodigitouch.it.

Pursuant to the Applicable Law, the Digitouch Group informs Users that they have the right to obtain information concerning (i) the source of the personal data; (ii) the purposes and methods of the processing; (iii) the logic applied in the event of processing carried out with the aid of electronic tools; (iv) the identification details of the data controller and data processors; (v) the persons or categories of persons to whom the personal data may be communicated or who may become aware of them in their capacity as data processors or persons in charge of processing.

Furthermore, Users have the right to obtain:

a) access to, updating, rectification or, where they have an interest therein, integration of the data;

b) erasure, anonymisation or restriction of data processed unlawfully, including data whose retention is unnecessary in relation to the purposes for which the data were collected or subsequently processed;

c) certification that the operations referred to in points a) and b) have been brought to the attention, also as regards their content, of those to whom the data have been communicated or disseminated, except where this requirement proves impossible or involves a manifestly disproportionate effort compared with the right being protected.

 Furthermore, Users have:

a) the right to withdraw consent at any time, where the processing is based on their consent;

b) the right to data portability (the right to receive all personal data concerning them in a structured, commonly used and machine-readable format);

c) the right to object:

-  in whole or in part, on legitimate grounds, to the processing of personal data concerning them, even where such data are relevant to the purpose of the collection;

-  in whole or in part, to the processing of personal data concerning them for the purposes of sending advertising material or direct selling, or for carrying out market research or commercial communications;

-  where personal data are processed for direct marketing purposes, at any time, to the processing of their data for such purposes, including profiling to the extent that it is related to such direct marketing.

d) where they consider that the processing concerning them infringes the Regulation, the right to lodge a complaint with a supervisory authority (in the Member State in which they habitually reside, in which they work, or in which the alleged infringement occurred). The Italian supervisory authority is the Italian Data Protection Authority (Garante per la protezione dei dati personali), with registered office at Piazza Venezia no. 11, 00187 – Rome (http://www.garanteprivacy.it/).

***

The Digitouch Group is not responsible for updating all links displayed in this Notice; therefore, whenever a link is not working and/or up to date, Users acknowledge and accept that they must always refer to the document and/or section of the websites referred to by such link.