INFORMATION ON PERSONAL DATA PROCESSING

ESAin s.r.l.  with head office in Via Francesco Dassori 49 / 4-5 16131 Genova, VAT number 03470480108  (hereafter, “the Owner”), as the Processing owner, informs you  in compliance with the art. 13 of the Legislative Decree 30.6.2003 n. 196 (hereafter, “Privacy Code”) and the art. 13 of the EU Rule n. 2016/679 (hereafter, “GDPR”) that the collected data will be processed with the modes and for the purposes specified below:

1. Object of the processing
The Owner is processing the personal, identification and non-sensitive data (like first name, family name, company name, tax code, VAT number, e-mail address, telephone number – hereafter the “personal data” or “data”) you provided us when you requested our services, and/or when you signed the agreed service contract.

2. Processing purpose
Your personal data are processed:
A) for the following Purposes associated with the subscriptions and purchase of products:
– to fulfil the pre-contractual, contractual and fiscal obligations resulting from the current relationships with you;
– to fulfil the obligations provided for by the law, regulations, EC rules or Authority order ;
– to exercise the Owner rights, for instance the right of defence in trial.

In case you already are our customer, we inform you we could send you commercial information covering Owner’s services and products similar to those you already have benefited from, unless you express your disagreement.
B) to send via email newsletter, commercial information and/or advertising materials about products and services offered by the Owner.

3. Modes of processing

Your personal data could be processed by means of the operations specified in the art. 4 of the Privacy Code and art. 4 n. 2) of GDPR, and in particular: collection, recording, organizing, keeping, referring, processing, modification, selection, extraction, comparison, use, interconnection, block, communication, deletion, and destruction of the data. Your personal data are subjected to paper, electronic and/or computerized processing.
The Owner will process the personal data for the time needed to fulfil the above purposes and in any case not longer than 10 years since the relationship termination for the Purposes specified at the point 2.A and until your explicit revocation in the case of the Purposes specified at the point 2.B.

4. Access to data
Your data could be made accessible for the Purposes specified at the points 2.A) and 2.B):
– to Owner’s employees and collaborators, in their roles as internal responsible for, and/or persons in charge of, the processing and/or system administrators;
– to companies or professionals or third parties (for instance, external collaborators, suppliers, credit institutions, professional offices, etc.) performing outsourced activities on behalf of the Owner, as external persons in charge of the processing.

5. Data communication

Without your explicit consent (see art. 24 lett. a), b), d) of the Privacy Code and art. 6 lett. B) and c) GDPR), the Owner could communicate your data for the purposes specified at the point 2.A) to Supervisory bodies, Judicial authorities, as well as all other entities entitled by law to compulsorily receive such a communication to execute the above Purposes. Your data will be not released.

6. Data transfer
The personal data will be managed and kept on servers based within the European Union, owned by the Owner and/or by third parties in charge, and duly designed as Responsible, of the processing. The servers are currently based in Italy. The data will be not transferred outside the European Union.

7. Type of data provision and consequences of the refusal to answer
The data provision for the purposes specified at the point 2.A) is mandatory. Without these data, we could not ensure we could be able to provide the Services and products specified at the point 2.A).
You freely provided us with your data for the purposes specified at the point 2.B) to receive the Owner communications. So you can choose to deny later the possibility to process the already provided data: doing so, you no more will receive newsletter, commercial information and advertising materials related to the Services offered by the Owner.

8. Rights of the concerned person
You as the interested person, have the rights specified at the art. 7 of the Privacy Code and art. 15 of the GDPR, and in particular the rights to:
i. obtain the confirmation about the existence of personal data concerning you, even when not still recorded, and their communication in an intelligible format;
ii. Obtain the information of: a) the personal data origin; b) the purposes and types of processing; c) the applied logic in the case of a processing by means of electronic instruments; d) the information required to identify the Owner, the persons in charge and the appointed representative according to the art. 5, paragraph 2 of the Privacy Code and art. 3, paragraph 1, of the GDPR; e) the persons and categories of persons entitled to receive your personal data, or able to learn them in their role of appointed representative within the State territory, responsible persons, or persons in charge;
iii. obtain: a) the update, amendment or, if interested, the integration of data; b) the write-off, transformation in an anonymous form, or the block of the data processed by breaking the law, including the data not requiring to be kept, for the purposes for which the data have been collected and then processed; c) the declaration confirming that the operation specified at the above letters a) and b) have been reported, also concerning their contents, to all those who received that data, unless such a performance will result impossible or involving the use of resources clearly disproportionate in comparison with the protected;
iv. To raise a total or partial objection: a) for rightful reasons to the processing of personal data concerning you, even if they are relevant to the collection purpose; b) to the processing of personal data concerning you, with the aim to send you advertising materials, or direct selling, or to carry out market researches, or marketing communication, by means of automated call systems without any operator, via e-mail and/or with traditional marketing systems by telephone calls and/or post mail. We point out that the objection right of the concerned person described at the above point b), for the purposes of direct marketing by means of automated systems extends to the traditional systems, and in any case the concerned person ever can exercise his/her objection right, even partially. So, the concerned person can choose to only receive communications by traditional means, or automated communications, or neither of the two.
If applicable, he/she has the rights specified at the art. 16-21 GDPR (amendment right, oblivion right, processing limitation right, data portability right, objection right), as well as the right to file a complaint to the Supervisory Authority.

9. How to exercise the rights
You could in any time exercise your rights by sending:
– a registered letter with return receipt addressed to ESAin s.r.l. – Via Francesco Dassori 49 / 4 e 5 16131 Genova;
– an e-mail to staff@esain.com

10. Minors
The Owner deliberately does not collect personal data concerning minors. In case of unintentional recording of information concerning minors, the Owner will delete them immediately, on users’ demand.

11. Owner, responsible persons and persons in charge
The Owner of the processing is ESAin s.r.l. – Via Francesco Dassori 49 / 4-5 16131 Genova – VAT number 03470480108 – Tel. +39 010311544 – staff@esain.com.
The updated list of the persons responsible and in charge of the processing is kept at the head office of the Owner of processing.

12. Amendments to this information
This information is subjected to changes. Therefore it is advisable to regularly refer to this information in its latest version.