Privacy policy

GDPR Privacy Policy pursuant to Legislative Decree 196/03 and Regulation EU 679/2016.

Pursuant to Article 13 of Legislative Decree 196/03 and following the entry into force of Regulation EU 679/2016 in accordance with the provisions of Article 14 of the aforementioned European Regulation, we provide you with the following information:

Data Controller

The Data Controller is:

IBP SRL

Via Bartolomeo Cristofori, 4

35020 Sant’Angelo di Piove (Padua)

VAT Reg. No.: 05514000289

Email: [email protected]

The data will be processed lawfully and fairly for the following purposes:

Contact form

Requests via social networks

Phone calls

Email

The data processed are relevant, complete and not excessive in relation to the purposes listed above for which they are collected or subsequently processed;

The data could come from automatic or voluntary sources, as well as from public sources.

Purpose of processing

The personal data of Users of the Website, as described above, will be processed in the manner and in the form as required under the GDPR, in general for the purpose of performing the Website’s functions, viewing its contents and using its services.

More specifically, the processing of personal data pursues the following purposes:

  1. Visiting the Website, viewing the information published therein and using the related services, including the e-commerce services provided therein and the related services of sale of goods and services as offered on the Website, delivery and similar services;
  2. Managing browsing data and for functional or technical reasons that make it possible to deliver contents to the users, including through technical cookies, for reasons related to aggregate statistical data collection, including through analytics cookies, for the delivery of personalised contents or services, including through profiling cookies, if applicable provided and subject to prior consent; in any case, the data will be processed under the conditions set out in the Cookie Policy linked in the footer, which complies with the Guidelines of the Authority dated 10 June 2021 and published on 9 July 2021;
  3. Meeting the requests made by the User through the Website and its communication tools (e.g. contact forms, information request forms and the like) and for any subsequent, related, connected, consequential and similar communication and processing for a smoother management of such requests;
  4. Subscribing to the newsletter, where applicable, and ensuing delivery of different information communications concerning the industry in which the Controller operates;
  5. Complying with legal requirements and other mandatory purposes, such as invoicing or anti-money laundering profiles;
  6. For other purposes ancillary to or connected with or arising from those mentioned above and forming part of the Website’s activities;
  7. Processing the email address provided by the User as part of a previous business relationship (i.e., supply, delivery, returns and similar) involving the sale of goods or services, including for the purpose of sending, without further consent, communications for subsequent similar information, pursuant to and within the limits of Article 130(4) of the Privacy Code (Legislative Decree 196/2003); the data subject may in any case express his or her refusal and object to such processing, both initially and subsequently, conveniently and free of charge, by following the instructions given in any such subsequent communication;
  8. Receiving resumes from candidates wishing to apply with the Data Controller.
  9. Regarding the IP address, for the sole purpose of checking the origin of the order, most notably to prevent fraud or other crimes.

Legal basis for processing

Regarding all personal data, the processing of personal data is based on the following conditions of lawfulness (legal bases):

  • Article 6 (1)(a) GDPR = Consent: for the management of profiling cookies referred to in purpose 2 and for other processing subject to consent, including purposes ancillary to the main ones that do not fall under the other legal bases, as per purpose 6; for subscription to the newsletter referred to in purpose 4, if ancillary or additional to other processing;
  • Article 6 (1)(b) GDPR = Contractual or pre-contractual obligation: for the same visit to the Website or for access to the services, including information-related, published on the Website itself and for the processing of the related browsing information, as well as for all the e-commerce services carried out therein and the related services of sale of goods and services as offered on the Website, delivery and the like, as per purpose 1; for the management of cookies as per purpose 2 other than profiling cookies; for the processing of requests submitted by the data subject and related replies, as per purpose 3; for subscribing to the newsletter when this is the sole or main purpose of providing personal data, with special reference to the email address, as per purpose 4; for other processing operations connected with, related and consequential to those just mentioned, as per purpose 6; for the management of resumes and related requests, as per purpose 8;
  • Article 6 (1)(c) GDPR = Fulfilment of a legal obligation: for the processing of all data necessary to fulfil legal obligations, including the processing of tax data related to invoicing profiles or other processing required by law, such as those related to anti-money laundering, as per purpose 5; for other processing operations related and consequential to those just mentioned, as per purpose 6;
  • Article 6 (1)(f) GDPR = Legitimate interest, for all processing operations included in information society services, as well as for the pursuit of Controller’s information purposes. In this regard, the Controller will rely on legitimate interest for further communications sent to the email address of the data subject pursuant to Article 130(4) of the Privacy Code as per purpose 7, subject to the free right of objection of the data subject as explained therein.

With regard to special data within the meaning of Article 9 GDPR that may be provided spontaneously by the data subjects while browsing and completing contact forms or the like, the Data Controller sets out the following additional conditions of lawfulness pursuant to Article 9 GDPR:

  • Article 9 (2)(a) GDPR: Consent, for processing for which it has been expressly given
  • Article 9 (2)(e) GDPR: Data manifestly made public by the data subject, for data independently communicated or disclosed by the data subject
  • Article 9 (2)(f) GDPR: Establishment, exercise or defence of a legal claim or whenever courts are acting in their judicial capacity, for the exercise of a right by the Controller.

With regard to criminal data referred to in Article 10 GDPR, processing may take place, exceptionally, within the scope of and in compliance with the conditions set forth in Article 2-octies of the Privacy Code.

Legitimate interest

The processing of personal data is also based on the legitimate interest of the Controller under Article 6(1)(f) GDPR, such as the exercise of one’s information rights in the context of information society, the performance of the services stated on the Website or the conduct of direct marketing operations (if applicable) within the meaning of Recital 47 of the GDPR.

The Data Controller will also rely on this legitimate interest in relation to the use of the IP address for the mere purposes of control, order verification and prevention of fraud or other crimes against its assets.

The Data Controller will also rely on the right to make use of the processing of the data subject’s email address provided in the context of a sale of goods and services, in order to send further communications addressed to the data subject and relating to similar goods or services pursuant to Article 130(4) of the Privacy Code, subject always to the free right of objection of the data subject as per purpose 7.

Compulsory or optional nature of data provision

The provision of browsing data by Users for the purposes set out above depends on the degree of privacy that Users have enabled or disabled through their browser, or have managed through the appropriate Cookie Banner commands with regard to cookie management. With regard to technical cookies, disabling them may affect navigation on the Website.

The provision of certain data is in any case necessary due to the structure of the Website itself and for the delivery of some of its services. Specifically, by way of example:

  • to send messages via the contact form or subscribe to the newsletter, if any, minimum data are required to be provided, such as first name/surname and/or email address and/or other identification data of the sender and/or the USERNAME; in any case, the contact form will show which data are required (marked with an asterisk “*”) and which are not;
  • to register for and access the reserved area of the Website, if any, USERNAME and PASSWORD are in all cases required.

The provision of all other data is optional.

Consequences of failure to provide data

Failure to provide compulsory personal data will prevent the Controller from sending the information requested or performing the further processing requested by the User or, in some cases, from being able to provide the services offered by the Website.

Failure to provide optional data will not result in any such consequences, but it could affect the processing of the request submitted by the Users or their website browsing experience.

Recipients of any communications and data transfers

In any case, the data may be communicated to data processors and individuals authorised to process them, again for the same purposes as the Website or for purposes related to the services offered by the Website, as well as to any other independent data controllers within the limits of the related purposes.

The IP address may be communicated to the relevant authorities in all cases where they may request it, including for the purpose of preventing criminal offences. No general communication of data for further purposes and no dissemination of personal data will be carried out.

Retention period

The data provided voluntarily by the Data Subject will be retained until the consent given by the Data Subject is revoked, or until such time as the Data Subject can perform actions on his or her browser, including cleaning cookies.

Browsing data and technical cookies will be stored for the technical time required to fulfil the purposes for which they were collected.

For retention times of cookies in general, reference should be made to the relevant notice accessible from the Cookie Banner.

For any other personal data, the retention period is limited to the limitation period of the relevant rights or the expiry of the relevant legal or contractual obligations, including those relating to billing and the like.

Data subject rights

The Data Subject has the right of access, rectification, erasure (forgetting), restriction, receipt of notification in the event of rectification, erasure or restriction, portability, objection and not to be subjected to a decision based solely on automated processing, including profiling, which results in legal effects concerning him or her or significantly affects him or her in a similar way, pursuant to Articles 15 to 22 of the GDPR.

These rights may be exercised in the forms and under the conditions set out in Article 12 of the GDPR, by written notice sent to the Controller by email to the above-mentioned email address.

Email: [email protected]

The Controller will provide an appropriate response as soon as possible and in any event within 1 month of receipt of the request, except in the cases of extension or justified refusal referred to in Article 12 of the GDPR.

In the event that the Data Subject requests the deletion of his or her data, such deletion will take place within 24 hours and confirmation will be given to the Data Subject by email.

Right to withdraw any consent given

Where the processing is based on consent, the Data Subject may revoke it at any time by sending an email to the Data Controller’s email address as stated above, or by using the appropriate controls on the Website, notably for the management of profiling cookies, as well as in any case by express notice to be sent to the Data Controller’s registered office.

Right to lodge a complaint

The Data Subject has the right to lodge a complaint with a supervisory authority pursuant to Articles 77 et seq. of the GDPR, the Italian State recognising such authority to be the Authority for the Protection of Personal Data.

The forms, methods and time limits for lodging complaints are laid down and governed by the national legislation in force (a specific regulation of the aforesaid Authority being applicable in Italy).

Any complaint will be without prejudice to any other legal or administrative remedy; as to legal actions for damages, any such actions in Italy are brought before the court having jurisdiction.

Profiling

Personal data provided while visiting this Website may be subject to profiling by third-party providers through third-party profiling cookies, subject to the User’s consent given by using the appropriate Cookie Banner commands.

For more information, please read the Cookie Policy linked in the footer.