PRIVACY DISCLOSURE

Privacy Disclosure - Art. 13 Italian Legislative Decree 196/03 
“Code for the protection of personal data”

Pursuant to and for the purposes of article 13, of Italian Legislative Decree 196/2003 “Code for the protection of personal data” C.I.ME.S. SRL, with registered office in Via Castellotti no. 15, a Maranello (Mo), VAT no. 01871960363, as Data Controller, provide the following information with reference to the processing of your data:



A) PURPOSES AND METHOD OF PROCESSING FOR WHICH DATA IS INTENDED

"Personal data", defined by current legislation as "any information relating to an identified or identifiable natural person, also indirectly, by reference to any other information, including a personal identification number", provided by you by filling out the data collection form, will be processed to provide you with your request for information through our website www.cimes.it.

Please note that the following information is only provided for this website and not for other websites that may be viewed by the user through links. Furthermore, please note that the optional, explicit and voluntary sending of the e-mail address to the addresses listed on this site involves the subsequent acquisition of the sender's address, required to reply to requests for information, and any other personal data included in the message.

Your personal data will be processed in non-automated form (paper) and/or by means of automated tools (electronic, computerised and/or electronic), and however, with strictly indispensable logic and procedure in relation to the purposes of the processing.

Specific security measures have been adopted by the Data Controller to prevent loss of data, illegal or incorrect use and unauthorised access thereto. In particular, we inform you that processing shall occur in compliance with Appropriate Measures and Minimum Security referred to under "Title V - Data and Systems Security" of Italian Legislative Decree 196/03 (Art. 31 et. seq) and Annex B) of the aforementioned Code and that personal data referable to you shall be processed in compliance with the conditions specified in Art. 11 of the same Code.

Your personal data will be processed by the Data Controller in full compliance with the principles of fairness, legality, transparency and protection of confidentiality, with logic strictly related to the purposes specified in this disclosure and will be stored in a form which permits identification of the data subject for a period of time not exceeding that necessary for the purposes for which it was collected or subsequently processed, after which, if not expressly reconfirmed by the data subject, they will be cancelled, subject to their transformation in anonymous form.

Lastly, please note that your data will not be transferred abroad.

B) OPTIONAL OR MANDATORY NATURE OF DATA PROVISION

The provision of your personal data is optional, however, the provision of mandatory data (marked with * mandatory fields) is strictly necessary to fully and properly manage your request for information.

C) THE CONSEQUENCES OF ANY REFUSAL TO REPLY

Your refusal to provide the data and/or the provision of inaccurate and/or incomplete information will make it impossible for our Company to consider your request for information and/or the inability to comply with your requests.

D) THE ENTITIES OR CATEGORIES OF ENTITY TO WHOM OR TO WHICH PERSONAL DATA MAY BE COMMUNICATED OR WHO OR WHICH MAY GET TO KNOW SAID DATA IN THEIR CAPACITY AS THE DATA PROCESSOR OR PEOPLE IN CHARGE OF THE PROCESSING AND WITHIN THE CONTEXT OF DISSEMINATION OF THE DATA

Your personal data will be processed by individuals specifically appointed by the Data Controller as Data Processor and/or persons in charge of data processing; these subjects will process your data only when necessary for the purpose of the provision and only in relation to the performance of their duties by the Data Controller, undertaking to only process the data necessary for the performance of said duties and to solely perform the operation necessary for performance thereof.
Your personal data will not be subject to communication to third parties or dissemination.

E) THE RIGHTS REFERRED TO IN "TITLE II - RIGHTS OF THE DATA SUBJECT" OF ITALIAN LEGISLATIVE DECREE 196/2003 "CODE CONCERNING THE PROTECTION OF PERSONAL DATA"

At any time, you may exercise the rights provided by "Title II - Rights of the data subject” of Italian Legislative Decree 196/2003 "Code regarding the protection of personal data" as shown below, in detail:

  • Art. 7. Right of access to personal data and other rights
    1. The data subject is entitled to obtain confirmation of whether or not personal data concerning him/her, even if not yet recorded and their communication in intelligible form
    2. The data subject has the right to obtain information regarding:
      • the origin of personal data;
      • the purposes and methods of treatment;
      • the logic applied in case of processing carried out with the aid of electronic instruments;
      • the identity of the Data Controller, Data Processors and representative appointed pursuant to article 5, paragraph 2;
      • the data subject or categories thereof to whom personal data may be communicated or who can learn about them as appointed representative in the country of the data processor or people in charge.
    3. The data subject shall have the right to obtain:
      • updating, rectification or, where interested therein, integration of the data;
      • erasure, anonymisation or blocking of data that has been processed unlawfully, including data whose retention is unnecessary for the purposes for which they have been collected or subsequently processed;
      • certification to the effect that the operations as per letters a) and b) have been notified, as also related to their contents, to the entities to whom or which the data were communicated or disseminated, unless this requirement proves impossible or involves a manifestly disproportionate effort compared with the right that is to be protected.
    4. The data subject shall have the right to object, in whole or in part:
      • on legitimate grounds, to the processing of personal data concerning him/her, even though they are relevant to the purpose of the collection;
      • to the processing of personal data concerning him/her, where it is carried out for the purpose of sending advertising materials or direct selling or else for the performance of market or commercial communication surveys.
  • Art. 8. Exercise of rights
    1. The rights referred to in article 7 may be exercised by making a request to the Data Controller or Data Processor without formalities, also by a person in charge of the processing to which a suitable response shall be provided to said request without delay.
    2. The rights referred to in article 7 may not be exercised by making a request to the Data Controller or Data Processor, or else by lodging a complaint pursuant to article 145, if the personal data is processed:
      • pursuant to the provisions of Italian Decree-Law 3 May 1991, no. 143 as converted, with amendments, into Italian Law 5 July 1991, no. 197 and subsequently amended, concerning money laundering;
      • pursuant to the provisions of Italian Decree-Law of 31 December 1991, no. 419,as converted with amendments into Italian Law of 18 February 1992,no, 172 and subsequently amended, concerning support for victims of extortion;
      • by Parliamentary Inquiry Committees set up as pursuant to article 82 of the Italian Constitution;
      • by a public body other than a profit-seeking public body, where this is expressly required by the provisions of law for purposes exclusively related to currency and financial policy, system of payments, control of brokers and credit and financial markets and protection of their stability;
      • pursuant to article 24, paragraph 1, letter f), limited to the period during which the performance of the investigations by defence or the establishment of the legal claim might be actually and concretely prejudiced;
      • by providers of publicly available electronic communications services with regard to incoming telephone calls, unless this may be actually and concretely prejudicial to performance of the investigations by defence counsel as per Italian Law of 7 December 2000 no. 397;
      • for reasons of justice by judicial authorities at all levels and of all instances as well as by the Higher Council of the Judiciary or other self-regulatory bodies, or else by the Ministry of Justice;
      • pursuant to art. 53, without prejudice to Italian Law of 1 April 1981, no. 121
    3. In the cases referred to in paragraph 2, letters a), b), d), e) and f), the Authority, also following a report submitted by the data subject, shall act with reference to article 157, 158 and 159; and, in the cases referred to in letters c), g) and h) of said paragraph, the Authority shall act as per article 160.
    4. Exercise of the rights referred to in article 7 may be permitted with regard to data of non-objective character on condition that it does not concern rectification of, or additions to personal evaluation data in connection with judgments, opinions and other types of subjective assessment, or else the specification of policies to be implemented or decision-making activities by the Data Controller.
  • Art. 9. Method to exercise rights
    1. The request addressed to the Data Controller or Data Processor may also be sent by registered letter, facsimile or e-mail. The Authority may identify other suitable system with reference to new technological solutions. If the request is related to the exercise of the rights referred to in article 7 paragraph 1 and 2, the request may also be made verbally; in this case, it will be annotated in summary form by either the person in charge of the processing or the Data Processor.
    2. The data subject may grant, the power of attorney or representation, in writing to natural persons, bodies, associations or organisations in connection with exercise of the rights as per article 7. The data subject may also be assisted by a person of his/her choice.
    3. The rights as per article 7, where related to the personal data concerning a deceased, may be exercised by any entity that is interested therein or else acts to protect the data subject or for family-related reasons deserving protection.
    4. The data subject’s identity shall be verified on the basis of suitable information, also by means of available records or documents or by producing or attaching a copy of an identity document. The person acting on behalf of the data subject must produce or attach a copy of the proxy or the letter of attorney, which shall have been undersigned by the Data Subject in the presence of a person in charge of the processing signed and submitted together with a copy of a photocopy non ID document belonging to the data subject.
    5. The request referred to in article 7, paragraph 1 and 2 may be worded freely without any constraints and may be renewed at intervals of not less than ninety days, unless there are well-motivated reasons.
  • Art. 10. Response to Data Subjects
    1. With a view to effectively exercising the rights referred to in article 7, the Data Controllers shall adopt suitable measures in order to, in particular,
      • facilitate access to personal data by the data subjects, even by means of ad hoc software allowing accurate retrieval of the data concerning individual identified or identifiable data subjects;
      • simplify the method and reduce response time, also with regard to departments or services for public relations.
    2. The data processor or the person(s) in charge of the processing shall be responsible for retrieval of the data, which may be communicated to the requesting party even verbally, or else displayed by electronic means - on condition that the data i easily intelligible in such cases also in the light of the nature and amount of the information. If requested, the data shall be reproduced on paper or magnetic media, or else transmitted via electronic networks.
    3. Unless the request refers to either a specific processing operation or specific personal data or categories of personal data, the response provided to the data subject shall include all the personal data concerning the data subject that are processed by the Data Controller. If the request is made to a health care professional or health care body, the provision referred to n article 84, paragraph 1 shall apply.
    4. If data retrieval is especially difficult, the response to the data subject’s request may also consist in producing or delivering copy of records and documents containing the personal data at stake.
    5. The right to obtain communication of the data in intelligible form does not apply to personal data concerning third parties, unless breaking down the processed data or eliminating certain items from the latter prevents the data subject’s personal data from being understandable.
    6. Data is communicated in intelligible form also by using legible handwriting. If codes or abbreviations are communicated, even by the persons in charge of the processing, the criteria for understanding the relevant meanings shall be made available.
    7. Where it is not confirmed that personal data concerning the data subject exist, further to a request as per article 7, paragraph 1 and 2, letters a), b) and c), the data subject may be charged a fee which shall not be in excess of the costs actually incurred for the inquiries made in the specific case.
    8. The fee referred to in paragraph 7 may not be in excess of the amount specified by the Authority in a generally applicable provision, which may also refer to a lump sum to be paid in case the data are processed by electronic means and the response is provided verbally. Through said measure the Authority may also provide that the fee may be charged if the personal data are contained on special media whose reproduction is specifically requested, or else if a considerable effort is required by one or more data controllers on account of the complexity and/or amount of the requests and existence of data concerning the data subject can be confirmed.
    9. The fee referred to in paragraphs 7 and 8 may also be paid by bank or postal draft, or else by debit or credit card, if possible upon receiving the relevant response and anyhow within fifteen days of said response.

Users are informed that, to exercise the foregoing rights, they can send a specific request to the Data Controller, at the following addresses:

MAIL cimes@cimes.it – FAX + 39 0536 943403

The right to complain to the Authority can be exercised at any time (http://www.garanteprivacy.it/).

THE IDENTITY OF THE DATA CONTROLLER, AND IF DESIGNATED THE REPRESENTATIVE IN THE COUNTRY’S TERRITORY PURSUANT TO ARTICLE 5 AND THE DATA PROCESSOR

The Data Controller is C.I.ME.S. SRL, with registered office in Via Castellotti no. 15, a Maranello (Mo), VAT no. 01871960363, in the personal of it legal representative pro tempore. The Data Processor has not appointed a Data Processor.

Date last modified ......................................................