PRIVACY POLICY

Privacy information pursuant to Legislative Decree 196/2003 and art. 13 of the European Regulation 679/2016 (GDPR)

CMM Srl (VAT number 00697130961), in the person of its pro tempore legal representative, with headquarters in Via Curiel, 42 - 20883 Mezzago (MB), as data controller, informs you that, in compliance with Legislative Decree 196 / 2003 and of the European Regulation 679/2016 (so-called GDPR) which governs and regulates the protection of personal data and their free circulation, your personal data will be processed in compliance with the aforementioned legislation, based on the principles of correctness, lawfulness, proporsionality of interests and transparency as well as the protection of your privacy and your rights, for the purposes, in the manner and for the terms better indicated below.

-1- Purpose, methods and legal bases of data processing

This privacy policy applies exclusively to the online activities of this site and is valid for visitors / users of the site. It does not apply to information collected through channels other than this website. The purpose of the privacy policy is to provide maximum transparency regarding the information that the site collects and how it uses it.

Your personal data will be processed exclusively for purposes strictly connected, instrumental and necessary for the fulfillment of the obligations inherent in relations with our Company; in particular:

The processing of personal data is carried out by means of the operations indicated in the Legislative Decree 196/2003 and art. 4 n. 2) GDPR and more precisely: collection, registration, organization, storage, consultation, processing, modification, selection, extraction, comparison, use, interconnection, blocking, communication, cancellation and destruction.

The processing of personal data will be carried out through computer media by the owner, the manager / managers and authorized subjects (in charge) with the observance of all precautionary measures, which guarantee their security and confidentiality.

The data will not be profiled or subject to automated decision-making processes.

The data will be stored with the data owner and with the data processing managers designated by him. In any case, your personal data will be stored and processed within the borders of the European economic area and will be transferred outside that border only with your explicit consent.

In the event that you provide comments and / or personal data for the request for information and / or specific services requested by the user (by way of example and not exhaustive, request for commercial information, subscription to our portal, subscription to our newsletter ), these data are voluntarily provided by the user at the time of the request for the provision of the service. By entering a comment or other information, the user expressly accepts this privacy statement,

This site may process some of the personal data based on the legitimate interests of the data controller as provided for in Legislative Decree 196/2003 and by Art. 6 of the European Regulation 679/206.

The data received will be used exclusively for the provision of the requested service and only for the time necessary for the provision of the service.

The information that users of the site will deem to make public through the services and tools made available to them, are provided by the user knowingly and voluntarily, exempting this site from any responsibility for any violations of the laws. It is up to the user to verify that they have permission to enter personal data of third parties or content protected by national and international regulations.

The data collected by the site during its operation are used exclusively for the purposes indicated above and kept for the time strictly necessary to carry out the specified activities. In any case, the data collected by the site will never be provided to third parties, for any reason, unless it is a legitimate request by the judicial authority and only in the cases provided for by law.

-2- Nature of data collection and consequences of failure to provide it

Like all websites, this site also makes use of log files in which information collected in an automated manner is stored during user visits. The information collected could be the following:

- internet protocol address (IP);

- type of browser and device parameters used to connect to the site;

- name of the internet service provider (ISP);

- date and time of visit;

- web page of origin of the visitor (referral) and exit;

- possibly the number of clicks.

The aforementioned information is processed in an automated form and collected in an exclusively aggregated form in order to verify its correct functioning

of the site, for security reasons and for the legitimate interests of the owner provided for by current legislation.

For security purposes (spam filters, firewalls, virus detection), the automatically recorded data may possibly also include personal data such as the IP address, which could be used, in accordance with applicable laws, in order to block attempts to damage the site itself or to cause damage to other users, or in any case harmful activities or constituting a crime. These data are never used for the identification or profiling of the user, but only for the purpose of protecting the site and its users and the legitimate interests of the Data Controller.

By using or consulting this site, visitors and users explicitly approve this privacy statement and consent to the processing of their personal data in relation to the methods and purposes described below, including any disclosure to third parties if necessary for the provision of a service. The provision of data and therefore the consent to the collection and processing of data is optional, however denying consent may make it impossible to provide some services and the browsing experience on the site could be compromised.

The consent to the use of your data for marketing and / or advertising purposes (sending e-mails and / or communications with advertising offers), is optional and requires on your part, in addition to the provision of your personal data, also an explicit request through opt-in function on this website.

-3- Timing and terms

The Data Controller, the managers and the subjects authorized to process (in charge) will process the personal data for the time necessary to fulfill the aforementioned purposes and, in any case, for no more than 10 years from the termination of the relationship where provided or made necessary by the regulations in force. .

With regard to the provision of data by you for the receipt of commercial information, newsletters and periodic information, the data will be processed until your unsubscribe request.

-4- Communication and dissemination of data

Your personal data, for the purposes of the execution of the contract or from the services requested by you and for the purposes indicated above, may be communicated:

• to all natural and legal persons (by way of example but not limited to legal, administrative, tax consultancy firms, auditing companies, couriers and shippers, data processing centers, IT consultants, suppliers, etc.) in cases where the communication is necessary for the purposes described above;

• to banks for the management of collections and payments;

• to factoring or credit recovery companies; to our collaborators and employees specifically appointed and within the scope of their duties.

• to SMTP providers for sending newsletters

The DPO, if appointed by the Data Controller on a mandatory or voluntary basis, as well as the name and number of managers may be subject to change, therefore it is advisable to consult our website - where you can find all the updated information - on the page dedicated to the following link: www.cmmelevators.com or by contacting the following addresses: +39 039623548,

privacy@cmmelevators.com.

-5- Rights of the interested party

By calling +39 039623548 or writing to privacy@cmmelevators.com at any time you can exercise your rights towards the data controller pursuant to European Regulation 679/2016, which we reproduce for your convenience.

The interested party has the right to obtain confirmation of the existence and / or the fact that the processing of personal data concerning him is in progress, even if not yet registered, as well as their communication in an intelligible form.

The interested party has the right to obtain the indication:

• of the origin of the personal data (with particular regard to the case in which the same are not collected from the interested party and, in the case of data transfer to a third country, of the existence of adequate guarantees pursuant to art. 46 of the Regulation);

• of the purposes and methods of the processing;

• of the logic applied in case of treatment carried out with the aid of electronic instruments;

• the identity of the owner, manager and the designated representative;

• the subjects or categories of subjects to whom the personal data may be communicated or who can learn about them as appointed representative in the State, managers or authorized subjects;

• the categories of personal data being processed;

• the data retention period or the criteria used to determine this period;

• the existence of automated decision-making processes, with particular regard to profiling, and the logic applied by them;

• the right to obtain a copy of the personal data being processed;

Furthermore, the interested party has the right to obtain:

• updating, rectification or, when interested, integration of data;

• the cancellation, transformation into anonymous form or blocking of data processed in violation of the law, including data which need not be kept for the purposes for which the data were collected or subsequently processed;

• the attestation that the operations referred to in letters a) and b) have been brought to the attention, also as regards their content, of those to whom the data have been communicated or disseminated, except in the case in which this fulfillment is revealed impossible or involves the use of means that are manifestly disproportionate to the protected right;

• the portability of data to other subjects for which an explicit request must be made at the following addresses +39 039623548, privacy@cmmelevators.com

• the deletion of data in our archives pursuant to article 17 pt. 1 letter from a) to f) of the Regulations (so-called right to be forgotten), by communicating to +39 039623548, privacy@cmmelevators.com

• to limit the processing of data pursuant to art. 18 pt. 1, lett. from a) to d) of the Regulations

The interested party has the right to object, in whole or in part, to the processing of data:

• for legitimate reasons connected to your particular situation, even if the processing is relevant to the purpose of the collection;

• to the processing of personal data concerning him for the purpose of sending advertising or direct sales material or for carrying out market research or commercial communication;

• to the processing of data pursuant to art. 6, point 1 letters e) and f) including profiling on the basis of these provisions.

If the data processing is based on the consent of the interested party, the latter has the right to withdraw this consent at any time by making an explicit request to the following addresses:

+39 039623548, privacy@cmmelevators.com.

Furthermore, the interested party has the right to lodge a complaint with the Supervisory Authority.

The exercise of the aforementioned rights can be exercised with a request addressed to the owner or manager sent by telephone, by email to the addresses indicated above or even by registered letter with return receipt.