Privacy policy

Si&T is committed to protecting the Personal Data entrusted to it. Their management and security are therefore handled with the utmost care, in compliance with the requirements of privacy legislation.

Si&T S.r.l., with registered and administrative office at via Gorizia, 83 – 63100 Chieti Scalo, VAT no. 02337470690 (hereinafter, the “Controller”), as Data Controller pursuant to Legislative Decree 196/2003 (hereinafter, the “Privacy Code”) and EU Regulation no. 2016/679 (hereinafter, the “GDPR”), informs you that the aforementioned regulations protect individuals and other subjects with regard to the processing of personal data, and that such processing will be based on the principles of fairness, lawfulness, transparency and protection of your confidentiality and rights.

Subject of processing

The Controller processes identifying, non-sensitive personal data (in particular first name, surname, tax code, VAT number, email, telephone number, bank and payment details) that you provide when registering on the websites and/or when entering into contracts for the services provided by the Controller.

Purposes of processing

The personal data collected, including any sensitive data that Si&T S.r.l. may obtain on the customer’s initiative in relation to specific operations or particular services requested by the customer (for example, for the provision of particular personnel management services from which the customer’s participation in trade union meetings could be inferred), will be processed for the following purposes:

• compliance with obligations laid down by laws, regulations and EU legislation, as well as by instructions issued by the authorities and supervisory bodies;
• management and execution of the pre-contractual and/or contractual relationship with Customers both in Italy and abroad, by entering the data provided into the IT systems of the Controller and of its subsidiaries/affiliates, as well as for monitoring the quality of the service offered and the risk of fraud connected with the services provided, such as computer fraud;
• communication of commercial information and promotions, including by automated means, via telephone, SMS, MMS and email, relating to the offer of products and services, as well as for market research, surveys and personalised or statistical analyses, including through electronic processing of the information obtained;

Partial or total failure to provide the data will make it partially or totally impossible to achieve the above purposes. Si&T will always process data on the basis of the data subject’s consent.

We will not use personal data for purposes other than and additional to those described in this notice, unless we first inform the data subject and, where necessary, obtain their consent.

Processing methods

Personal data are processed by means of the operations indicated in art. 4 of the Privacy Code and art. 4 no. 2) of the GDPR, namely: collection, recording, organisation, storage, consultation, processing, modification, selection, extraction, comparison, use, interconnection, blocking, communication, erasure and destruction of data. Personal data are processed both on paper and electronically and/or by automated means. Data processing complies with the principles of fairness, lawfulness, transparency and protection of the confidentiality and rights of the data subject. To comply with current legislation, Si&T has also adopted the following measures:

• encryption of data in transit using the https protocol;
• certification of the cloud according to ISO 27001:2013;
• certification of Si&T processes according to ISO 27001:2013;

Access to data

In addition to the Controller, the Data may be accessed by categories of Processors and persons in charge or Third Parties involved in the company organisation (administrative, sales, marketing and legal staff, system administrators) or by external parties (such as third-party technical service providers, postal couriers, hosting providers, IT companies) appointed as Data Processors by the Controller. The updated list of Processors may be requested from the Data Controller at any time.

Disclosure of data

Data will be stored at our premises and will be disclosed exclusively to the parties responsible for providing the services necessary for the proper management of the relationship, guaranteeing protection of the data subject’s rights. Data will be processed only by personnel expressly authorised by the Controller. Without the need for express consent (art. 6 letters b) and c) of the GDPR), the Controller may disclose the data in its possession for the purposes referred to in art. 2.a to Supervisory Bodies (such as IVASS), Judicial Authorities, and to those parties to whom disclosure is mandatory by law for the fulfilment of the aforementioned purposes. Such parties will process the data as independent data controllers.

Transfer of data

Personal data will be managed and stored on servers located within the European Union belonging to the Controller and/or to third-party companies appointed and duly designated as Data Processors. The servers are currently located in Italy and at the Controller’s operational offices. Data will not be transferred outside the European Union. It is understood, however, that the Controller, should it become necessary, may move the servers to Italy and/or the European Union and/or non-EU countries. In that case, the Controller hereby ensures that any transfer of data outside the EU will take place in accordance with applicable law, entering, if necessary, into agreements that guarantee an adequate level of protection and/or adopting the standard contractual clauses provided by the European Commission.

Dissemination

Your personal data will not be disseminated in any way.

Rights of the data subject

As a data subject, you have the rights set out in art. 15 of the GDPR, namely the right to:

• obtain confirmation of whether or not personal data concerning you exist, even if not yet recorded, and their communication in intelligible form;
• obtain information on: a) the origin of the personal data; b) the purposes and methods of processing; c) the logic applied in the case of processing carried out with electronic tools; d) the identity of the controller, the processors and the representative designated pursuant to art. 5, paragraph 2 of the Privacy Code and art. 3, paragraph 1 of the GDPR; e) the parties or categories of parties to whom the personal data may be disclosed or who may become aware of them as designated representative in the territory of the State, processors or persons in charge;
• obtain: a) the updating, rectification or, where you are interested, integration of the data; b) the erasure, anonymisation or blocking of data processed unlawfully, including data whose retention is not necessary for the purposes for which they were collected or subsequently processed; c) certification that the operations referred to in letters a) and b) have been brought to the attention, also as regards their content, of those to whom the data were communicated or disseminated, except where this proves impossible or involves a manifestly disproportionate effort compared to the right protected;
• object, in whole or in part: a) on legitimate grounds, to the processing of personal data concerning you, even if relevant to the purpose of collection; b) to the processing of personal data concerning you for the purpose of sending advertising material or direct sales or for carrying out market research or commercial communication, through the use of automated calling systems without the intervention of an operator, by email and/or through traditional marketing methods by telephone and/or post. Please note that the data subject’s right to object, set out in point b) above, for direct marketing purposes by automated means extends to traditional methods, and that the data subject may in any case exercise the right to object even only in part. The data subject may therefore decide to receive only communications by traditional means, only automated communications, or neither.

Where applicable, you also have the rights set out in arts. 16-21 of the GDPR (right to rectification, right to be forgotten, right to restriction of processing, right to data portability, right to object), as well as the right to lodge a complaint with the Italian Data Protection Authority.

How to exercise your rights

You may exercise your rights at any time by sending:

• a registered letter with return receipt to: Si&T srl, Contrada Frate Nardangelo 65019 PIANELLA (PE) Italy
• an email to: a.pavone@si-t.it

Minors

This Site and the Controller’s Services are not intended for persons under 18 years of age, and the Controller does not knowingly collect personal information relating to minors. Should information on minors be unintentionally recorded, the Controller will promptly delete it at the users’ request.

Changes to this notice

The Data Controller reserves the right to amend this policy at any time, notifying Users on this page. Please therefore consult this page often, referring to the date of last modification indicated at the bottom. If you do not accept the changes made to this privacy policy, you must stop using this Application and may ask the Data Controller to delete your Personal Data. Unless otherwise specified, the previous privacy policy will continue to apply to the Personal Data collected up to that time.

Retention period

For the entire duration of the relationship and up to the period required by laws mandating the retention of accounting records. If the data processed go beyond those required by the aforementioned laws, they are retained for up to 24 months or, at the data subject’s request, until erasure at the initiative of a data subject who demonstrates valid grounds for early erasure.

Information not contained in this policy

Further information regarding the processing of Personal Data may be requested from the Data Controller at any time using the contact details.