1. What do we need

Our Personal Data Protection Policy governs the use and storage of your data. You can read our Personal Data Protection Policy at the Complete Privacy Information Link. GR Composites, in the person of its legal representative, is the Data Controller of the personal data that you (interested party) provide to us. We collect the following types of personal data:

  • Personal data (such as Name, Surname, email address and telephone number)

2. Why do we need them?

We need your personal data to provide you with the following services:

  • Respond to the requests entered
  • Send information about services and products

3. What we do with them and to whom we can communicate them

Your personal data is processed at the headquarters of GR Composites in Via Beniamino Ubaldi C/D Prato – 06024 Gubbio (PG), Italy. The hosting and data storage take place in Keliweb S.r.l., located in Via B. Diaz, 35 – 87036 Rende (CS).

For each of the purposes that we have described above, we indicate the “legal basis” – that is, for which reasons the processing is permitted – specifying which processing is necessary and which depends on your choice.

The treatments described are necessary to form and execute the contracts and to fulfill the connected legal obligations, and in any case for the pursuit of the legitimate interest of our Company in the correct formation and execution of the relationship, and for the fulfillment of the obligations that arise from it. , in any case, to the protection of its contractual reasons. The acquisition of data for the purposes indicated is therefore necessary and constitutes an essential requirement for the conclusion and execution of the contract, without which it would not be possible to supply products and/or perform services.

As regards the purposes in point 2, we will be able to proceed with the sending only after you have given your consent by clicking in the appropriate space under the form. In any case, for your maximum guarantee, you can inform and/or oppose the processing for this specific purpose at any time, with the methods that are indicated at the bottom of this information.

No third party has access to your data, unless specifically required by law or necessarily provided as an integral part of our contractual obligations towards you, without which the possibility of providing you with products and/or services would cease.

4. How long we keep them and how they are treated

Pursuant to Italian law, we are required to keep the documents that are part of the treatments bound by law for a mandatory period of time defined by the laws themselves, based on our Data Retention Policy. After this period, your personal data will be irreversibly destroyed or pseudo-anonymised or rendered anonymous, based on the effort deemed best with respect to the type of personal data provided. All personal data held by us for notifications of updates to our products and services, or for commercial and marketing activities, or for processing for activities not bound by the law, will be kept for a maximum of 5 years. For more information on our personal data retention programme, see our Data Retention Policy. Your data will be processed on paper and/or electronically. For us, the security and correct storage of your data are fundamental, also to prevent unauthorized or unlawful processing and the accidental destruction or loss of data.

This is why the treatments are carried out in compliance with adequate security measures, both directly and by any external data processors and by subjects placed under their authority and adequately trained. In the case of joint proposals with other subjects, these other companies could operate independently as “owners” of the treatments they carry out, on which they will provide you with separate information.

5. What are your rights and who can you contact?

Rights of the interested parties

In relation to the treatments described in this Information, as an interested party you may, under the conditions set out in the GDPR, exercise the rights set out in articles 15 to 21 of the GDPR and, in particular, the following rights:

• Right of access – article 15 GDPR: right to obtain confirmation as to whether or not personal data concerning you are being processed and, in this case, obtain access to your personal data – including a copy of the same – and communication, among others of the following information:

  • a) purpose of the treatment
  • b) categories of personal data processed
  • c) recipients to whom these have been or will be communicated
  • d) data retention period or the criteria used
  • e) rights of the interested party (rectification, cancellation of personal data, limitation of treatment and right to object to treatment
  • f) right to lodge a complaint
  • g) right to receive information on the origin of my personal data if they have not been collected from the interested party
  • h) the existence of an automated decision-making process, including profiling;

• Right to rectification – article 16 GDPR: right to obtain, without unjustified delay, the rectification of inaccurate personal data concerning you and/or the integration of incomplete personal data;

• Right to cancellation (right to be forgotten) – article 17 GDPR: right to obtain, without unjustified delay, the cancellation of personal data concerning you, when:

  • a) the data are no longer necessary with respect to the purposes for which they were collected or otherwise processed;
  • b) You have withdrawn your consent and there is no other legal basis for the processing;
  • c) You have successfully objected to the processing of your personal data;
  • d) the data has been processed unlawfully
  • e) the data must be deleted to fulfill a legal obligation;
  • f) the personal data have been collected in relation to the offer of information society services referred to in Article 8, paragraph 1, GDPR. The right to erasure does not apply to the extent that the processing is necessary for compliance with a legal obligation or for the performance of a task performed in the public interest or for the establishment, exercise or defense of legal claims in court.

• Right to restriction of processing – article 18 GDPR: right to obtain the limitation of the treatment, when:

  • a) the data subject contests the accuracy of the personal data;
  • b) the processing is unlawful and the interested party opposes the cancellation of personal data and instead requests that their use be limited
  • c)although the data controller no longer needs it for processing purposes, personal data are necessary for the data subject to ascertain, exercise or defend a right in court;
  • d) the interested party has opposed the processing, as indicated below, pending verification of the possible prevalence of the legitimate reasons of the data controller with respect to those of the interested party;

• Right to data portability – article 20 GDPR: right to receive, in a structured format, in common use and readable by an automatic device, the personal data concerning you provided to the Data Controller and the right to transmit them to another data controller without impediments, if the treatment is based on the consent and is carried out by automated means. Furthermore, the right to obtain that your personal data be transmitted directly by the Data Controller to another data controller if this is technically feasible;

• Right to object – article 21 GDPR: right to object, at any time, to the processing of personal data concerning you based on the condition of legitimacy of the legitimate interest, including profiling, unless there are legitimate reasons for the Data Controller to continue the processing which prevail over the interests, on the rights and freedoms of the interested party or for the assessment, exercise or defense of a right in court.

• Propose a complaint to the Guarantor Authority for the protection of personal data, Piazza di Montecitorio n. 121, 00186, Rome (RM).

The above rights may be exercised, against the Data Controller, by contacting the references in the “Data Controller and Managers” paragraph. The Data Controller will take charge of your request and provide you, without unjustified delay and, in any case, at the latest within one month of receipt of the same, with information relating to the action taken regarding your request.

The exercise of your rights as an interested party is free in accordance with article 12 of the GDPR. However, in the case of manifestly unfounded or excessive requests, also due to their repetitiveness, the Data Controller could charge you a reasonable fee, in light of the administrative costs incurred to manage your request, or deny the satisfaction of your request.

Finally, we inform you that the Data Controller may request further information necessary to confirm the identity of the interested party.

If you would like information on how we have managed your personal data, please contact GR Composites, data controller, at info@grcomposites.it or in writing to Via Beniamino Ubaldi C/D Prato – 06024 Gubbio (PG), Italy. GR Composites, the data controller will examine your request and will do its best to provide you with all the necessary information.

If you believe that your personal data has not been handled appropriately according to the law, you can also contact GR Composites, data controller at the addresses indicated above, or send a report to the Data Protection Authority, reachable at the link www.garanteprivacy.it.