Data Controller

GeM Group Srls
Indirizzo email del Titolare: info@gemgroupsrls.it

Types of Data collected

Among the Personal Data collected by this Application, either independently or through third parties, are: Cookies; Usage Data. Complete details on each type of data collected are provided in the dedicated sections of this privacy policy or through specific informational texts displayed prior to the collection of the data. Personal Data may be freely provided by the User or, in the case of Usage Data, collected automatically during the use of this Application. Unless otherwise specified, all Data requested by this Application are mandatory. If the User refuses to provide them, it may be impossible for this Application to provide the Service. In cases where this Application indicates certain Data as optional, Users are free to refrain from communicating such Data without any consequences on the availability of the Service or its operation. Users who have any doubts about which Data are mandatory are encouraged to contact the Data Controller. Any use of Cookies – or other tracking tools – by this Application or by the owners of third-party services used by this Application, unless otherwise specified, is for the purpose of providing the Service requested by the User, in addition to the further purposes described in this document and in the Cookie Policy, if available. The User assumes responsibility for the Personal Data of third parties obtained, published, or shared through this Application and guarantees that they have the right to communicate or disseminate them, holding the Data Controller harmless from any liability to third parties.

Methods and location of Data processing

Methods of processing

The Data Controller takes appropriate security measures to prevent unauthorized access, disclosure, modification, or destruction of Personal Data. The processing is carried out using IT and/or telematic tools, with organizational methods and logics strictly related to the indicated purposes. In addition to the Data Controller, in some cases, other parties involved in the organization of this Application (administrative, commercial, marketing staff, legal advisors, system administrators) or external parties (such as third-party technical service providers, postal couriers, hosting providers, IT companies, communication agencies) may have access to the Data and may also be appointed, if necessary, as Data Processors by the Data Controller. The updated list of Data Processors can always be requested from the Data Controller.

Legal basis for processing

The Data Controller processes Personal Data related to the User if one of the following conditions applies:

• The User has given consent for one or more specific purposes; Note: in some jurisdictions, the Data Controller may be authorized to process Personal Data without the need for the User’s consent or another of the legal bases specified below, until the User objects (“opt-out”) to such processing. However, this does not apply when the processing of Personal Data is governed by European legislation on the protection of Personal Data;
• the processing is necessary for the performance of a contract with the User and/or for the execution of pre-contractual measures;
• the processing is necessary to comply with a legal obligation to which the Data Controller is subject;
• the processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the Data Controller;
• the processing is necessary for the purposes of the legitimate interests pursued by the Data Controller or by third parties.

It is always possible to request the Data Controller to clarify the specific legal basis of each processing and, in particular, to specify whether the processing is based on law, provided for by a contract, or necessary to conclude a contract.

Place

The Data are processed at the operational offices of the Data Controller and in any other location where the parties involved in the processing are located. For more information, contact the Data Controller. The User’s Personal Data may be transferred to a country other than the one in which the User is located. To obtain further information on the location of the processing, the User can refer to the section regarding details on the processing of Personal Data. The User has the right to obtain information regarding the legal basis for the transfer of Data outside the European Union or to an international organization of public international law or established by two or more countries, such as the UN, as well as regarding the security measures adopted by the Data Controller to protect the Data. The User can check if any of the aforementioned transfers take place by examining the section of this document regarding details on the processing of Personal Data or by requesting information from the Data Controller by contacting them using the contact details provided at the beginning.

Retention period

The Data are processed and stored for the time required to fulfill the purposes for which they were collected. Therefore:

• Personal Data collected for purposes related to the performance of a contract between the Data Controller and the User will be retained until the completion of that contract.
• Personal Data collected for purposes related to the legitimate interest of the Data Controller will be retained until the satisfaction of that interest. The User can obtain further information regarding the legitimate interest pursued by the Data Controller in the relevant sections of this document or by contacting the Data Controller.

When the processing is based on the User’s consent, the Data Controller may retain Personal Data for a longer period until that consent is revoked. Additionally, the Data Controller may be required to retain Personal Data for a longer period in compliance with a legal obligation or by order of an authority. At the end of the retention period, the Personal Data will be deleted. Therefore, upon the expiration of that term, the right of access, deletion, rectification, and the right to data portability can no longer be exercised.

Purposes of Processing the Collected Data

User Data is collected to allow the Data Controller to provide the Service, comply with legal obligations, respond to requests or execute actions, protect their rights and interests (or those of Users or third parties), identify any fraudulent or malicious activities, as well as for the following purposes: Statistics, Displaying content from external platforms, and Tag Management. For detailed information on the purposes of processing and the Personal Data processed for each purpose, the User can refer to the section “Detailed Information on the Processing of Personal Data.

Details on the Processing of Personal Data

Personal Data is collected for the following purposes and using the following services:

• Tag Management

  This type of service is functional for the centralized management of the tags or scripts used on this Application. The use of such services involves the flow of User Data through them and, if applicable, their retention.

  Google Tag Manager

  Google Tag Manager is a tag management service provided by Google LLC or Google Ireland Limited, depending on the location where this Application is used.

  Personal Data collected: Usage Data. Location of processing: United States – Privacy Policy; Ireland – Privacy Policy. Subject adhering to the Privacy Shield. Category of personal data collected under the CCPA: Internet information. This type of processing constitutes a “sale of data” (“sale”) under the CCPA. In addition to the information contained in this clause, the User can refer to the section that describes the rights of California consumers for information related to how to opt-out of the sale.

• Statistics

  The services contained in this section allow the Data Controller to monitor and analyze traffic data and are used to track User behavior.

  Google Analytics

  Google Analytics is a web analytics service provided by Google LLC or Google Ireland Limited, depending on the location where this Application is used (“Google”). Google uses the Personal Data collected to track and analyze the use of this Application, compile reports, and share them with other services developed by Google. Google may use the Personal Data to contextualize and personalize the ads of its advertising network.

  Personal Data collected: Cookies; Usage Data. Location of processing: United States – Privacy Policy – Opt Out; Ireland – Privacy Policy – Opt Out. Subject adhering to the Privacy Shield. Category of personal data collected under the CCPA: Internet information. This type of processing constitutes a “sale of data” (“sale”) under the CCPA. In addition to the information contained in this clause, the User can refer to the section that describes the rights of California consumers for information related to how to opt-out of the sale.

• Displaying content from external platforms

  This type of service allows for the display of content hosted on external platforms directly from the pages of this Application and to interact with it. This type of service may still collect data on web traffic related to the pages where the service is installed, even when users do not use it.

  Google Fonts

  Google Fonts is a font style display service managed by Google LLC or Google Ireland Limited, depending on the location where this Application is used, that allows this Application to integrate such content into its pages.

  Personal Data collected: Usage Data; various types of Data as specified by the service’s privacy policy. Location of processing: United States – Privacy Policy; Ireland – Privacy Policy. Subject adhering to the Privacy Shield. Category of personal data collected under the CCPA: Internet information. This type of processing constitutes a “sale of data” (“sale”) under the CCPA. In addition to the information contained in this clause, the User can refer to the section that describes the rights of California consumers for information related to how to opt-out of the sale.

User Rights

Users can exercise certain rights with respect to the Data processed by the Data Controller. In particular, the User has the right to:

• withdraw consent at any time. The User can withdraw the consent previously given for the processing of their Personal Data.
• object to the processing of their Data. The User can object to the processing of their Data when it occurs on a legal basis other than consent. Further details on the right to object are provided in the section below.
• access their Data. The User has the right to obtain information about the Data processed by the Data Controller, on certain aspects of the processing, and to receive a copy of the processed Data.
• verify and request rectification. The User can verify the accuracy of their Data and request its update or correction.
• obtain the restriction of processing. When certain conditions are met, the User can request the restriction of processing of their Data. In this case, the Data Controller will not process the Data for any purpose other than their storage.
• obtain the deletion or removal of their Personal Data. When certain conditions are met, the User can request the deletion of their Data by the Data Controller.
• receive their Data or have it transferred to another controller. The User has the right to receive their Data in a structured, commonly used, and machine-readable format and, where technically feasible, to obtain its transfer without hindrance to another controller. This provision applies when the Data is processed using automated tools and the processing is based on the User’s consent, a contract to which the User is a party, or on related contractual measures.
• lodge a complaint. The User can lodge a complaint with the competent data protection authority or take legal action.

Details on the right to object

When Personal Data is processed in the public interest, in the exercise of official authority vested in the Data Controller, or to pursue a legitimate interest of the Data Controller, Users have the right to object to the processing for reasons related to their particular situation. Users are informed that, if their Data is processed for direct marketing purposes, they can object to the processing without providing any justification. To find out whether the Data Controller processes data for direct marketing purposes, Users can refer to the relevant sections of this document.

How to exercise the rights

To exercise the User’s rights, Users can send a request to the contact details of the Data Controller provided in this document. Requests are submitted free of charge and are fulfilled by the Data Controller as quickly as possible, in any case within one month.

Further information on processing

Legal defense

The User’s Personal Data may be used by the Data Controller in legal proceedings or in the preparatory phases of such proceedings to defend against abuses in the use of this Application or the related Services by the User. The User acknowledges that the Data Controller may be required to disclose the Data by order of public authorities.

Specific notices

At the User’s request, in addition to the information contained in this privacy policy, this Application may provide the User with additional and contextual notices regarding specific Services, or the collection and processing of Personal Data.

System logs and maintenance

For operational and maintenance purposes, this Application and any third-party services used by it may collect system logs, which are files that record interactions and may also contain Personal Data, such as the User’s IP address.

Information not contained in this policy

Further information regarding the processing of Personal Data may be requested at any time from the Data Controller using the contact details.

Response to “Do Not Track” requests

This Application does not support “Do Not Track” requests. To find out whether any third-party services used support them, the User is encouraged to consult their respective privacy policies.

Changes to this privacy policy

The Data Controller reserves the right to make changes to this privacy policy at any time by notifying Users on this page and, if possible, on this Application, as well as, where technically and legally feasible, sending a notification to Users through one of the contact details in their possession. Therefore, please consult this page frequently, referring to the date of the last modification indicated at the bottom. If the changes involve processing based on consent, the Data Controller will collect the User’s consent again, if necessary.

Information for California consumers

This part of the document supplements and completes the information contained in the rest of the privacy policy and is provided by the company managing this Application and, if applicable, its parent company and its subsidiaries and affiliates (collectively referred to as “we,” “our,” or “us” for the purposes of this section). The provisions contained in this section apply to all Users who are considered consumers residing in the state of California, United States of America, under the “California Consumer Privacy Act of 2018” (such Users are referred to hereinafter simply as “you,” “your,” “yours,” or “yours”), and for them, these provisions prevail over any other provision that may be divergent or in conflict with those contained in this privacy policy. In this part of the document, the term “personal information” is used as defined by the California Consumer Privacy Act (CCPA).

Categories of personal information collected, disclosed, or sold

This section summarizes the categories of personal information we have collected, disclosed, or “sold” under the CCPA and the related purposes of processing. You can find detailed information about these activities in the section titled “Detailed Information on the Processing of Personal Data” in this document.

Information we collect: the categories of personal information we collect

We have collected the following categories of personal information about you: Internet information. We will not collect additional categories of personal information without first providing you with a new notice.

How we collect information: what are the sources of the personal information we collect?

We collect the above categories of personal information, directly or indirectly, from you when you use this Application. For example, you provide us with your personal information directly when you submit requests through any form on this Application. Additionally, you indirectly provide us with personal information when you browse this Application, as the personal information pertaining to you is automatically observed and collected. Finally, we may collect your personal information from third parties that work with us in relation to the provision of the Service or the operation of this Application and its features.

How we use the information collected: sharing and communicating your personal information with third parties for operational purposes.

We may disclose your personal information to third parties for operational and service purposes. In this case, we enter into a written contract with the third party that obligates the recipient of your personal information to keep that information confidential and not to use it for purposes other than those necessary for the performance of the contract. We may also disclose your personal information to third parties when you request it or authorize us to do so in order to provide you with our Service. For further information on the purposes of processing, we invite you to consult the relevant section of this document.

Sale of your personal information

For the purposes of this document, the term “sale” means “selling, renting, releasing, publicly disclosing, disseminating, making available, transferring, or otherwise communicating, orally, in writing, or by electronic means, a consumer’s personal information by a business to another business or third parties, for consideration or for other types of profit.” This means that, for example, a sale can occur whenever an application publishes advertisements, conducts statistical analyses of its traffic or views, or simply uses tools such as social network plug-ins and similar tools.

Your right to opt-out of the sale of your personal information

You have the right to opt-out of the sale of your personal information. This means that whenever you ask us not to sell your data, we will comply with your request. Such requests can be made freely, at any time, and without any verification requirements, simply by following the instructions provided below.

Instructions for opting out of the sale of personal information

If you would like more information or to exercise your right to opt-out of all sales made by this Application, both online and offline, you can contact us using the contact details provided in this document.

What are the purposes for which we use your personal information?

We may use your personal information to enable the proper functioning of this Application and its features (“operational purposes”). In such cases, your personal information will be processed in a manner that is adequate and proportionate to the purposes for which it was originally collected and strictly within the limits of compatible purposes. We may also use your personal information for other reasons, such as for commercial purposes (as indicated in the section “Detailed Information on the Processing of Personal Data” within this document), as well as to comply with the law and defend our rights before the competent authorities when our rights or interests are threatened or when we suffer harm. We will not use your personal information for unrelated, non-correlated, or incompatible purposes without first providing you with a new notice.

Your privacy rights in California and how to exercise them.

Right to know and to portability

You have the right to know the following:

• the categories of personal information we collect about you and the sources of that information, the purposes for which we use your personal information, and with whom we share it;
• in the event of the sale or disclosure of personal information to third parties for operational purposes, we will provide you with two separate lists in which we will inform you:
  • for the sale, the categories of personal information disclosed to each category of recipients; and
  • for disclosure to third parties for operational purposes, the categories of personal information obtained from each category of recipients;

The above information will be limited to personal information collected or used in the last 12 months. If our response is provided electronically, the information contained therein will be “portable,” meaning it will be delivered in a compatible format to allow you to transmit the information to other entities without hindrance—provided that this is technically feasible.

Right to request the deletion of one’s personal information

You have the right to request the deletion of any of your personal information, subject to legal exceptions (such as, for example but not limited to, when the information is used to identify and repair errors on this Application, to detect security incidents, for the purpose of protection against fraudulent or illegal activities, to exercise certain rights, etc.). If no legal exceptions apply, following the exercise of your right, we will delete your personal information and request our service providers to do the same.

How to exercise your rights

To exercise the rights described above, you must submit a verifiable request by contacting us using the contact details provided in this document. In order for us to respond to your request, we must be able to verify your identity. Therefore, you can only exercise the above rights by submitting a verifiable request that must:

• provide sufficient information that allows us to reasonably verify that you are the person to whom the personal information we have collected pertains or an authorized representative;
• describe your request with enough detail to allow us to understand, evaluate, and respond appropriately to what you are asking.

We will not respond to any request if we are unable to verify your identity and therefore confirm that the information in our possession actually pertains to you. If you cannot submit a verifiable request in person, you may authorize a person registered with the California Secretary of State to do so on your behalf. If you are an adult, you may submit a verifiable request on behalf of someone under your parental control. You may submit a maximum of 2 requests within a 12-month period.

How and within how much time we will handle your request

Within 10 days, we will confirm that we have received your request and provide you with information on how we will process it. We will respond to the request within 45 days of receiving it. If we need more time, we will explain the reason and inform you how much additional time we need. In this regard, please note that we may take up to 90 days to fulfill your request. Our communications will cover the 12-month period prior. If we deny your request, we will explain the reason for the denial. We will not charge any fees to process or respond to your verifiable request unless it is manifestly unfounded or excessive. In such cases, we may apply a reasonable fee or deny the request. In either case, we will communicate our decisions and explain the reasons.