CONTACTS

INFORMATION ON THE PROCESSING OF PERSONAL DATA

The company MAFRA International S.r.l. (hereinafter, for brevity, "MA-FRA", or the "Company") informs you that the personal data collected through the contact form available in the "Contact Us" section of this site will be processed in compliance with the law on the protection of personal data.

With reference to the methods of management and processing of personal data of users who contact the Company through the above-mentioned contact form, MA-FRA provides the following information, pursuant to Article 13 EU Regulation No. 679/2016 (so-called GDPR):

  1. Data of the Data Controller

MAFRA International S.r.l., P.IVA n. 09894580969, with registered office in Via Aquileia n. 44 - 20021 Baranzate (MI), is the Data Controller of the personal data that users who, consulting this site, contact the Company through the dedicated section.

The Society can be contacted at the e-mail address privacy@mafra.it

  1. Types of data collected

By completing and submitting the contact form, the Respondent voluntarily submits the following personal data:

  • First and last name (biographical data),
  • country,
  • e-mail address (contact information),
  • Any additional data given in the text of the message sent.

The Data Subject is requested not to provide personal data revealing his or her racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, as well as his or her genetic data, biometric data, data concerning health or sexual life or sexual orientation (also referred to as "sensitive data"). Such data will be deleted immediately in the absence of an explicit declaration of consent to their processing.

  1. Purpose and legal basis for processing

This data will be collected and processed by MA-FRA for the following purposes:

  1. To give feedback to the request or communication sent by the Data Subject through the contact form. The legal basis, which legitimizes the processing of personal data for this purpose, is provided by Art. 6(1)(b) GDPR, namely to provide the user with the requested service;
  2. To fulfill legal obligations, regulations or requests of the Judicial Authority. The legal basis, which legitimizes the processing of personal data for this purpose, is provided for in Article 6(1)(c) GDPR, i.e. in that the processing is necessary to fulfill a legal obligation to which the Data Controller is subject;
  3. To assert or defend a right of Ma-Fra in court. The legal basis, which legitimizes the processing of personal data for this purpose, is provided by Art. 6(1)(f) GDPR, i.e. insofar as the processing is necessary to establish, exercise or defend a right in court.

 

  1. Period of data retention

Personal data collected and processed through the contact form will be kept for the time necessary to provide feedback to the request or, in any case, to get in touch with the Data Subject. The data will then be deleted within a maximum period of 60 days after the exhaustion of this activity, except for data necessary to comply with tax, accounting and administrative regulations or to fulfill other legal obligations and to document the activities performed.

  1. Method of treatment

The personal data collected will be handled, stored and processed by electronic means and will be stored both on computer media and on paper media, organized in databases, and on any other type of suitable media.

Specific security measures are observed to prevent data loss, illegal or incorrect use, and unauthorized access.

The processing of personal data carried out by MA-FRA does not involve automated decision-making processes.

  1. Disclosure of personal data

Disclosure of the Data Subject's data via the contact form is a necessary requirement for providing the requested service (i.e., obtaining a response to a request or otherwise contacting the Company) and, therefore, it is the obligation of the Data Subject to provide such data.

Failure to provide the personal data identified above will result in MA-FRA's inability to receive communications via the contact form available on this site and thus to provide feedback to the Interested Party.

  1. Persons to whom personal data may be disclosed

Personal data collected will not be disseminated but may be disclosed to:

  • Authorized in-house personnel of the Company,
  • Subjects who are granted the right and interest to access users' personal data by law or secondary and/or EU regulations,
  • companies, associations or professional firms that provide services and activities on behalf of the Data Controller, as Data Processor, in particular for the provision of ICT services (e.g. web hosting services, cloud providers, etc.), for the fulfillment of legal obligations, as well as for any organizational and administrative needs for the activities carried out by the Data Controller.

The names of the individuals who, in their capacity as "Data Processors", may come to know the personal data of the users are listed in an updated list available from MA-FRA (to be requested from the contact details indicated in point 1).

  1. Transfer of data outside the European Economic Area or to international organizations

As part of the processing operations described in this policy, MA-FRA does not transfer personal data outside the European Economic Area or to international organizations.

  1. Rights of the data subject

In relation to the data processing regulated by this notice, the Data Subject is entitled to exercise at any time the rights provided for in EU Regulation No. 679/2016 (GDPR).

  • Right to be informed of any processing of your personal data (pursuant to Art. 13 GDPR). You have the right to obtain confirmation as to whether or not any processing of your personal data is taking place and, if so, you should be informed about any aspect of the processing operations, including, for example, information about:
  • The data processors (who process the data on behalf of the Controller),
  • Any other data recipients (to whom your personal data may be disclosed),
  • The purpose and legal basis,
  • The types of data processed,
  • The data retention period,
  • The transfer of personal data to third countries or international organizations.
  • Right of access to your personal data, as well as the right to rectification of inaccurate data and the right to supplement incomplete data.
  • Right to erasure (so-called right to be forgotten) under the conditions set forth in Article 17 GDPR, for example, when your personal data is no longer necessary in relation to the purposes for which it was collected or otherwise processed.
  • Right to limitation of processing to the purposes and/or manner for which your personal data were collected, under the conditions of Article 18 GDPR.
  • Right to data portability, i.e., the right to receive a copy of all personal data you have provided to the Data Controller or to transmit such data to another Data Controller without hindrance.
  • Right to withdraw consent when given to legitimize the processing of your personal data. This right may be exercised at any time, without affecting the lawfulness of the processing based on the consent given before its revocation.
  • Right to lodge a complaint with a Supervisory Authority, if he believes that the processing concerning him violates the legislation in force. In this case, he/she should address the Authority of the Member State where he/she normally resides, works or of the place where the alleged violation occurred. The contact details of the Italian Supervisory Authority (Garante per la Protezione dei Dati Personali) can be found on its website.

In addition, the Data Subject has the right to object to the processing of his or her personal data when the processing:

  • Is necessary for the performance of a task in the public interest,
  • Is necessary for the pursuit of a legitimate interest of the owner,
  • Has direct marketing purposes, including profiling.

In order to exercise the rights, listed above, the Interested Party may submit a request via email to privacy@mafra.it

The Company will respond to the User's requests within a maximum period of 30 days.