As per the provisions of Regulation (EU) 2016/679 (“GDPR“), Slim Aluminium S.p.A. (the “Company” or the “Controller“) provides below the information regarding the processing of personal data so to allow the users (“User” or “Users“) of the www.slimalu.com website (the “Website“) to be aware of their personal data protection policy and to understand how the Users’ personal information is collected and processed while browsing the Website and while using its services.

IDENTITY AND CONTACT DETAILS OF THE DATA CONTROLLER

The processing Controller is Slim Aluminium S.p.A., with registered office in Cisterna di Latina (LT), Piazzale dell’alluminio SNC

CONTACT DETAILS OF THE DATA PROTECTION OFFICER

The Company has appointed a Data Protection Officer, who can be contacted at the following email address alessandradelvecchio@gmail.com

AIM OF THE PROCESSING AND LEGAL GROUNDS OF THE PROCESSING

a. Legal and required aims for the provision of services – processing required to fulfil a contractual or legal obligation to which the      Data Controller is bound or to execute a specific request by the data subject

The User’s personal data may be processed without the need for his/her consent, whenever fulfilling obligations deriving from              legal provisions, as well as rules, codes or procedures approved by the Authorities and other competent Bodies.

The User’s personal data will also be processed for the purposes related to and/or connected with the provision of services by the        Company in relation to browsing its Website, such as, specifically:

• for the provision of services requested by the User while browsing the Website, including the collection, storage and processing of data for the purpose of establishing and subsequently managing technically and operationally.
• managing relations with third party authorities and public bodies for purposes related to specific requests, the fulfilment of legal obligations or specific procedures.
• Such data – the provision of which is required for the operational execution of the service – will also be processed by electronic means, recorded in special databases, and used strictly and exclusively in the context of browsing the Website
• Since the User’s personal data is required for the aforementioned purposes, it is necessary for the purpose of maintaining and providing all the services related to browsing the Website, and failure to communicate it will make it impossible to provide the specific services in question.

b. Commercial and marketing purposes – consent

Prior to his/her consent, the User’s personal data may also be processed for the following additional purposes related to the                Controller’s activities or those of a third party:

• market research, economic analyses and statistics;
• marketing the Controller’s services and/or those of a third party, sending advertising/informational/promotional material and invitations to participate in initiatives and offers aimed at rewarding the Controller’s customers;
• customer satisfaction surveys concerning the quality of services provided.

These activities may involve the Controller’s products and services, as well as those of companies controlled by Slim Aluminium S.p.A. or their business partners and can also be performed through an automated call system, without the involvement of an operator, even email, and SMSs (Short Message Service).

Consent to the processing of data and communication to the subjects specified below for the aforementioned purposes is optional and can be revoked at any time through the CONTACTS link.

c. Defence of a right in court

In addition, the User’s personal data will be processed whenever required in order to ascertain, exercise or defend a right in court of the Data Controller or of other companies within the control range of Slim Aluminium S.p.A.

d. Controller’s legitimate interest

In the following cases, the Controller may process the personal data collected without the User’s consent:

• in the case of extraordinary merger, transfer or relocation of a business unit, in order to allow the performance of operations required for due diligence purposes and in preparation for the transfer. It is understood that only exclusively required data will be processed for the aforementioned purposes, in the most aggregated/anonymous form as possible.
• anonymous and aggregate analysis of the services used, so as to identify user habits and trends, in order to improve the services provided and to satisfy specific user needs, or to prepare initiatives related to the improvement of services provided.

PERSONAL DATA RECIPIENTS

In pursuit of the purposes specified in point 3, the Data Controller may communicate the User’s personal data to third parties, such as, for example, those belonging to the following subjects or categories of subjects:

• police forces, armed forces and other public administrations, for the fulfilment of obligations required by Law, Community regulations or laws. In such cases, based on the applicable data protection regulations, the obligation to obtain prior consent from the interested party is waived;
• companies, bodies or associations, or parent companies, subsidiaries or associated companies as pursuant to Article 2359 of the Civil Code, or between these companies and companies subject to common control, including consortia, networks of companies and groups and temporary business associations and their members, limited to communications made for administrative and/or accounting purposes.

The Data Controller guarantees the utmost care in ensuring that the communication of the User’s personal data to the aforementioned recipients concerns exclusively data required for achieving the specific purposes for which they are intended.

The User’s personal data is stored in the Data Controller’s database and will be processed exclusively by authorized personnel. The latter will be given specific instructions on the methods and aims of the processing. Said data will also not be disclosed to third parties, except as provided above and, in any case, within the limits described therein.

Finally, it is worth noting that the User’s personal data will not be disclosed, save for the cases described above and/or required by Law.

TRANSFER OF PERSONAL DATA OUTSIDE THE EU

As part of the contractual relationships between Slim Aluminium S.p.A. and its subsidiaries, as well as among subsidiaries, for some of the purposes specified in point 3, the User’s personal data may be transferred outside the EU, including through the inclusion in shared databases managed by third parties, whether part of or outside the control of ​​Slim Aluminium S.p.A. The management of the database and the processing of such data are bound to the purposes for which they were collected and are carried out with utmost respect for the standards of confidentiality and security set forth in the applicable personal data protection laws.

Whenever the User’s personal data are subject to international transfer outside EU territory, the Data Controller will take every appropriate and required contractual measures to ensure an adequate level of personal data protection in accordance with what is described in this policy on the processing of personal data, including, among others, the Standard Contractual Clauses approved by the European Commission.

DATA RETENTION PERIOD

Data will be stored for a period of time not exceeding that required for the purposes for which they were collected or subsequently processed in accordance with the legal provisions.

RIGHTS OF THE INTERESTED PARTIES

As the interested party, the User is granted the following rights concerning the personal data collected and processed by the Controller for the purposes described in point 3: (i) the right to access, in particular by requesting, at any time, confirmation of the existence of the User’s personal data among the Company’s files and the making available of such information in a clear and intelligible way, as well as the right to know the origin, logic and purpose for the processing with express and specific description of the persons in charge and of those responsible for processing, as well as those of third parties to whom the User’s personal data may be communicated; (ii) the right to have their data updated and corrected (save for evaluative data), the right to the deletion of superfluous data or the transformation into anonymous data, as well as the right to block processing and final deletion in the event of unlawful processing; and (iii) if the conditions are met, to the limitation of processing and of the portability of the data. The law also grants interested parties the ability to lodge a complaint with Italian data protection authority, should the User find that his or her rights were infringed upon pursuant to the applicable law on personal data protection.

The User can exercise the rights listed above writing to the person appointed to personal data protection alessandradelvecchio@gmail.com.