Privacy disclaimer

1.INTRODUCTION – WHO ARE WE?
Circularity S.r.l. Benefit company with registered office in Milan – Via Giovanni Bensi, n. 12/5, Tax Code / VAT number n. 10388780966 and registration number in the Register of Companies of Milan Monza Brianza Lodi (hereinafter, the “Owner”), owner of the website www.circularity.com (hereinafter, the “Site”), as data controller personal data of users of the Site (hereinafter, the “Users”) provides below the privacy policy pursuant to art. 13 of EU Regulation 2016/679 of 27 April 2016 (hereinafter, the “Regulation”, or the “Applicable Regulations”).

2. HOW TO CONTACT US?

The Data Controller takes the utmost account of the right to privacy and protection of the personal data of its Users.

Users can contact the Data Controller at any time, using the following methods:

By sending a registered letter with return receipt to the registered office of the Data Controller in Milan – Via Giovanni Bensi, n. 12/5;
By sending an e-mail message to the address: circularity@legalmail.it.
The Data Controller has not identified the person in charge of data protection (RPD or DPO), as it is not subject to the designation obligation provided for by art. 37 of the Regulation.

3. WHAT DO WE DO? – PURPOSE OF THE TREATMENT

By browsing the Site, the User can always stay updated on the services and activities developed by the Owner; register and use the service offered through the Site, which allows you to access a network that connects Users (institutions, associations, organizations, producers, suppliers, transporters and recovery plants) in order to facilitate the recovery of raw materials obtained from the efficient use of production waste (hereinafter, “Service”). In relation to the activities that can be carried out through the Site, the Data Controller collects personal data relating to Users.

This Site and any services offered through the Site are reserved for individuals who have reached the age of eighteen. The Data Controller therefore does not collect personal data relating to persons under the age of 18. At the request of the Users, the Data Controller will promptly delete all personal data involuntarily collected and relating to subjects under the age of 18.

Users’ personal data will be lawfully processed by the Data Controller for the following processing purposes:

a) Contractual obligations and provision of the Service: to allow navigation of the Site and to allow the User to register on the Site and use the Service as well as make purchases on the Site, or to execute the Terms and Conditions of the Site, which are accepted by ‘User in the registration and purchase phase; fulfill specific User requests (such as, by way of example, in case of access to the “Contacts” section, “Request information” or the chat made available by the Data Controller, requests relating to a re-contact or in any case to a reply from of the Owner).
The user data collected by the Data Controller for the purposes of any registration and possible purchase on the Site include:

name, surname, e-mail, bank details, as well as any personal information of the User possibly and voluntarily communicated to the Data Controller;
personal data relating to the job position and / or role covered within the production chain and the commercial interests of the User who intends to use the Service offered through the Site. During registration on the Site, the User is subjected to a questionnaire in to express their preferences regarding the materials available through the Site (by way of example and not exhaustive, type of raw materials of interest to your company). The personal data collected are necessary for registration on the Site and to allow the User to use the Service. The User is aware that the information provided through the questionnaire completed during registration on the Site may be transmitted by the Owner and made available, by publication in the section reserved for members of the Site, to other Users who have access to the network, for purposes of the Service offered through the Site. Without prejudice to the provisions of this paragraph, as well as elsewhere in this privacy statement, in no case will the Data Controller make the Users’ personal data accessible to third parties;
personal data whose transmission is implicit in the use of Internet communication protocols, such as: IP addresses used by users who connect to the Site, the URI (Uniform Resource Identifier) ​​addresses of the requested resources, the time of the request, the method used in submitting the request to the server, the size of the file obtained in response, log files and other parameters relating to the operating system and the IT environment of the User.
User data collected by the Titol

for the purposes of any contact or request for information include: name, surname, contact details, as well as any personal information of the User possibly and voluntarily communicated to the Owner.
Unless the User gives the Data Controller a specific and optional consent to the processing of their data for the additional purposes set out in the following paragraphs, the User’s personal data will be used by the Data Controller for the exclusive purpose of ascertaining the identity of the User (also by validating the e-mail address), thus avoiding possible scams or abuses, and contacting the User for service reasons only (eg sending notifications relating to the services offered on the Site). Without prejudice to the provisions elsewhere in this privacy statement, in no case will the Data Controller make the Users’ personal data accessible to other Users and / or third parties;
b) administrative-accounting purposes, or to carry out activities of an organizational, administrative, financial and accounting nature, such as internal organizational activities and activities functional to the fulfillment of contractual and pre-contractual obligations;
c) legal obligations, or to fulfill obligations established by law, by an authority, by a regulation or by European legislation.
The provision of personal data for the processing purposes indicated above is optional but necessary, since failure to provide them, within each specific form, will make it impossible for the User respectively to register, make purchases on the Site or make your request to the Data Controller.

The personal data that are necessary for registration purposes are indicated with an asterisk in the application form.

4. FURTHER PROCESSING PURPOSES

4.1 Newsletter

Some personal data of the User (ie name and surname, e-mail address) may be processed by the Data Controller together with other companies belonging to the Innovatec Group, in addition to Circularity s.r.l. (hereinafter, jointly, the “Joint Controllers”), of which the Owner is a part, for the purpose of sending the newsletter. Therefore, the User will receive a periodic newsletter from the Joint Controllers which will contain information and updates, including promotional ones, relating to the services and activities of the companies that are part of the Innovatec Group.

In case of lack of consent, the possibility of registering on the Site will not be affected in any way.

In the event of consent, the User may at any time revoke the same, by making a request to the Data Controller in the manner indicated in paragraph 8 below or, alternatively, by contacting the Innovatec Group holding directly,

• By sending a registered letter with return receipt to the registered office of the holding: Via Giovanni Bensi 12/5 – 20152 Milan

• By sending an e-mail message to the address: info@innovatec.it

The User can also easily oppose further sending of promotional communications also by clicking on the appropriate link for the withdrawal of consent, which is present in each e-mail containing the newsletter, together with the information prepared by the Joint Controllers. Once the consent has been revoked, the User will receive a confirmation message that the consent has been revoked.

5. LEGAL BASIS

Contractual obligations and service provision (as described in paragraph 3, letter a)): the legal basis consists of art. 6, paragraph 1, lett. b) of the Regulations, or the processing is necessary for the execution of a contract of which the User is a party or for the execution of pre-contractual measures adopted at the request of the same.

Administrative-accounting purposes (as described in paragraph 3, letter b)): the legal basis consists of art. 6, paragraph 1, lett. b) of the Regulations, as the processing is necessary for the execution of a contract and / or for the execution of pre-contractual measures adopted at the request of the User.

Legal obligations (as described in the previous paragraph 3, letter c)): the legal basis consists of art. 6, paragraph 1, lett. c) of the Regulation, as the processing is necessary to fulfill a legal obligation to which the Data Controller is subject.

Further processing purposes: for the processing relating to the sending of the newsletter (as described in the previous paragraph 4.1)), the legal basis consists in art. 6, paragraph 1, lett. a) of the Regulations, or the provision by the interested party of consent to the processing of their personal data for one or more specific purposes. For this reason, the Data Controller asks the User to provide specific free and optional consent, to pursue this processing purpose.

6. PROCESSING METHODS AND DATA STORAGE TIMES

The Data Controller will process the Users’ personal data using manual and IT tools, with logic strictly related to the purposes themselves and, in any case, in order to guarantee the

security and confidentiality of the data.

The personal data of the Users of the Site will be kept for the time strictly necessary to carry out the primary purposes illustrated in paragraph 3 above, or in any case as necessary for the civil protection of the interests of both Users and the Data Controller.

In the case referred to in paragraph 4.1 above, the personal data of Users will be kept for the time strictly necessary to carry out the purposes described therein and, in any case, as long as the User does not withdraw his consent.

In any case, any retention terms provided for by law or regulations are reserved.

7. SCOPE OF COMMUNICATION AND DISCLOSURE OF DATA

The User’s personal data may be transferred outside the European Union and, in this case, the Data Controller will ensure that the transfer takes place in accordance with the Applicable Regulations and, in particular, in accordance with Articles 45 (Transfer on the basis of an adequacy decision) and 46 (Transfer subject to adequate guarantees) of the Regulation.

The employees and / or collaborators of the Data Controller in charge of managing the Site and the Users ‘requests may become aware of the Users’ personal data. These subjects, who have been instructed to do so by the Data Controller pursuant to art. 29 of the Regulations, will process the User’s data exclusively for the purposes indicated in this statement and in compliance with the provisions of the Applicable Law.

Third parties who may process personal data on behalf of the Data Controller as Data Processors may also become aware of the Users’ personal data, such as, by way of example, suppliers of IT and logistical services functional to the operation of the Site, suppliers of outsourced or cloud computing services, professionals and consultants.

Users have the right to obtain a list of any data processors appointed by the Data Controller, making a request to the Data Controller in the manner indicated in paragraph 8 below.

Furthermore, the personal data of the Users may be communicated by the Data Controller, to the extent that this is necessary to execute contractual obligations and / or to fulfill legal obligations, to other Users registered on the Site and / or to independent third parties data controllers. , such as consultants, as well as other subjects to whom the data must necessarily be communicated to allow the User to use the services offered through the Site.

8. RIGHTS OF THE INTERESTED PARTIES

Users can exercise the rights guaranteed to them by the Applicable Law, by contacting the Owner in the following ways:

By sending a registered letter with return receipt to the registered office of the Data Controller (Via Giovanni Bensi, 12/5 Milan);
By sending an e-mail message to circularity@legalmail.it or info@circularity.com
The Data Controller has not identified the person in charge of data protection (RPD or DPO), as it is not subject to the designation obligation provided for by art. 37 of the Regulation.

Pursuant to the Applicable Law, the Data Controller informs that Users have the right to obtain indication (i) of the origin of personal data; (ii) the purposes and methods of the processing; (iii) the logic applied in case of processing carried out with the aid of electronic tools; (iv) the identity of the owner and managers; (v) the subjects or categories of subjects to whom the personal data may be communicated or who can learn about them as managers or agents.

Furthermore, Users have the right to obtain:
a) access, updating, rectification or, when interested, integration of data;
b) the cancellation, transformation into anonymous form or limitation of data processed in violation of the law, including those that do not need to be kept for the purposes for which the data were collected or subsequently processed;
c) the attestation that the operations referred to in letters a) and b) have been brought to the attention, also as regards their content, of those to whom the data have been communicated or disseminated, except in the case in which this fulfillment is proves impossible or involves the use of means that are manifestly disproportionate to the protected right.

Furthermore, Users have:
a) the right to withdraw consent at any time, if the processing is based on their consent;
b) the right (where applicable) to data portability (right to receive all personal data concerning them in a structured format, commonly used and readable by an automatic device);
c) the right to object:
i) in whole or in part, for legitimate reasons, to the processing of personal data concerning them, even if pertinent to the purpose of the collection.
ii) in

in whole or in part, to the processing of personal data concerning them for the purpose of sending advertising or direct sales material or for carrying out market research or commercial communication;
iii) if personal data are processed for direct marketing purposes, at any time, to the processing of their data carried out for this purpose, including profiling to the extent that it is connected to such direct marketing.
d) if they believe that the processing that concerns them violates the Regulation, the right to lodge a complaint with a Supervisory Authority (in the Member State in which they usually reside, in the one in which they work or in the one in which the alleged violation has occurred ). The Italian Supervisory Authority is the Guarantor for the protection of personal data, based in Piazza Venezia n. 11, 00187 – Rome (http://www.garanteprivacy.it/).

The Owner is not responsible for updating all the links that can be viewed in this Notice, therefore whenever a link is not functional and / or updated, Users acknowledge and accept that they must always refer to the document and / or section of the websites. recalled by this link.