In relation to the provisions of the EU Regulation 2016/679 (European Regulation for the protection of personal data), we hereby supply the necessary information regarding the processing of personal data provided by the data subject. This information notice is furnished pursuant to Articles 13 and 14 of the EU Regulation 2016/679 (European Regulation for the protection of personal data) and Article 13 of Legislative Decree 30.6.2003 no. 196 (Privacy Code).

1. DATA CONTROLLER

Pursuant to Articles 4 and 24 of the EU Regulation 2016/679, the Data Controller is the company MAKLAUS s.r.l.

2. CATEGORIES OF PERSONAL DATA PROCESSED

The Data Controller processes the following personal data categories:

  • Identifying data (e.g., name, surname, business name, address).
  • Contact data (e.g., phone, email, address).
  • Fiscal data (e.g., tax code, VAT number).
  • Banking and payment details (e.g., bank and payment references).

3. PURPOSE AND LEGAL BASIS OF PROCESSING

3.1 The personal data provided will be processed in relation to the legal conditions under Article 6(b) of the EU Regulation 2016/679, namely for a contract execution to which the data subject is a part or the execution of pre-contractual measures, specifically:

  • to establish contacts and conclude purchase and assistance contracts;
  • to fulfill pre-contractual, contractual, and fiscal obligations arising from relationships with the data subject;
  • to navigate the company’s website;
  • to answer emails, contacts and general requests for information regarding the services and products offered by MAKLAUS s.r.l.;
  • to transmit data to partners, professionals, companies or firms collaborating with MAKLAUS s.r.l., for activities related to the provision of services or products of the Data Controller;
  • to complete data collection forms to send information requests to the Data Controller;
  • to process anonymous data for reporting, for studying and implementing of the services offered by the Data Controller;
  • for administrative-accounting purposes (organizational, administrative, financial, and accounting nature regardless of the nature of the processed data);
  • to comply with legal obligations, regulations, community legislation, or orders from authorities (e.g., anti-money laundering, fiscal obligations);
  • to exercise the Data Controller’s rights, such as the right to defense in court.

3.2 Only with the specific and distinct consent of the data subject under Article 7, for the following Marketing purposes:

  • to send via email, mail, and/or SMS and/or telephone contacts, newsletters, commercial communications, and/or advertising material about products or services offered by the Data Controller and to measure satisfaction with the quality of services.
  • to send via email, mail, and/or SMS and/or telephone contacts commercial and/or promotional communications from third parties (e.g., business partners, resellers, service providers).

4. RECIPIENTS AND CATEGORIES OF DATA RECIPIENTS

The personal data provided may be communicated to recipients appointed under Article 28 of the EU Regulation 2016/679 that will process the data as Data Processors and/or as natural persons acting under the authority of the Data Controller and the Data Processor, in order to fulfill contracts or related purposes. Specifically, data may be communicated to recipients belonging to the following categories:

  • entities providing services for the management of the information system and communication networks of MAKLAUS s.r.l. (including email);
  • firms or companies within the framework of assistance and consultancy relationships;
  • competent authorities for compliance with legal obligations and/or provisions of public bodies upon request;
  • commercial information companies for the assessment of solvency and payment habits and/or entities for credit recovery purposes.

The subjects belonging to the above categories perform the function of Data Processor or operate in total autonomy as distinct Data Controllers.

5. TRANSFER OF DATA TO A THIRD COUNTRY AND/OR INTERNATIONAL ORGANIZATION

The personal data provided by the data subject will not be transferred outside the European Union, except
for reasons related to the provision of the service, ensuring all technical measures to ensure their security, confidentiality, and integrity.

6. DATA PROCESSING METHODS

The processing of personal data is carried out through the operations indicated in Article 4, number 2 of the EU Regulation 2016/679, namely: collection, registration, organization, storage, consultation, processing, modification, selection, extraction, comparison, use, interconnection, blocking, communication, deletion, and destruction of data. Personal data is processed both in paper and electronic
and/or automated formats.

7. DATA RETENTION PERIOD

The processing will be carried out in an automated and/or manual form, with methods and tools aimed at ensuring maximum security and confidentiality by specifically appointed persons. In compliance with the provisions of Article 5, paragraph 1, letter e) of the EU Regulation 2016/679, personal data collected will be stored in a form that allows the identification of data subjects for a period not exceeding the achievement of the purposes for which personal data is processed.

8. NATURE OF DATA PROVISION AND REFUSAL

The provision of personal data for the purposes mentioned at point 3.1 of this document is necessary and not subject to specific consent to follow up on the execution of the contract and enjoy the services offered by the Data Controller. The non-provision of personal data may result in the inability to obtain the requested services offered by the Data Controller.

The provision of data referred at point 3.2 is optional and subject to specific consent. Refusal of consent will be limited at marketing activities and will inhibit the possibility of sending you news and future offers about promotions and/or updates on our products.

9. DATA SUBJECT’S RIGHTS

The data subject can exercise their rights as expressed in Articles 15, 16, 17, 18, 19, 20, 21, and 22 of the EU Regulation 2016/679 by contacting the Data Controller at privacy@maklaus.com. The data subject has the right, at any time, to:

  • Obtain confirmation of the existence or otherwise of personal data concerning them, even if not yet recorded, and their communication in an intelligible form;
  • Obtain the indication of: a) the origin of personal data; b) the purposes and methods of processing; c) the logic applied in case of processing carried out with the aid of electronic instruments; d) the identifying details of the data controller, the processors, and the representative designated pursuant to Article 5, paragraph 2, of the Privacy Code and Article 3, paragraph 1, of the GDPR; e) the subjects or categories of subjects to whom personal data may be communicated or who can learn about them as designated representative in the State’s territory, data processors, or persons in charge.
  • Obtain: a) the updating, rectification, or, when interested, integration of data; b) the deletion, transformation into anonymous form, or blocking of data processed unlawfully, including data whose retention is unnecessary for the purposes for which the data were collected or subsequently processed; c) the attestation that the operations referred to in letters a) and b) have been brought to the attention, also as regards their content, of those to whom the data have been communicated or disseminated, except where such fulfillment proves impossible or involves a manifestly disproportionate effort compared to the right protected.
  • Object, in whole or in part: a) for legitimate reasons to the processing of personal data concerning them, even if pertinent to the purpose of collection; b) to the processing of personal data concerning them for the purpose of sending advertising materials or direct sales or for carrying out market research or commercial communication through the use of automated call systems without the intervention of an operator via email and/or traditional marketing methods by telephone and/or mail.

Where applicable, the data subject also has the rights referred to in Articles 16-21 of the GDPR (Right of rectification, right to erasure, right to restriction of processing, right to data portability, right to object). Without prejudice to any other administrative and judicial remedy, if the data subject considers that the processing of personal data concerning them infringes the EU Regulation 2016/679, pursuant to Article 15, letter f) of the Regulation, they have the right to lodge a complaint with the Data Protection Authority. With reference to Article 6, paragraph 1, letter a) and Article 9, paragraph 2, letter a), they have the right to withdraw consent at any time.

In the case of a request for data portability by the data subject, the Data Controller will provide in a commonly used and readable format the personal data concerning them, subject to paragraphs 3 and 4 of Article 20 of the EU Regulation 2016/679.


For contacts and further information:
MAKLAUS s.r.l. Località Piani della Rugginosa 236/237 – 50066 Reggello (FI)
privacy@maklaus