Privacy policy

1. Introduction

Under EU regulation no. 679/2016 (hereafter 'GDPR'), this Privacy Policy sets out how Comac spa gathers, uses, transfers and protects the personal information sent by its commercial partners, customers and potential customers and, finally, the users of the services it offers, including through its web pages (www.comac.it.com and blog.comac.it).

Personal data means any information on an identified or identifiable legal person (hereafter 'Subject'), especially identifiers like name, identification number, address, online identifier and physical, facial, physiological, genetic, psychic, economic, cultural and social characteristics.

Processing means any operation or group of operations done, with or without the aid of authorized and applied processes, on personal data or groups of personal data, like gathering, recording, organization, structuring, storage, adaptation, editing, extraction, consultation, use, communication by sending, giving out or any other means, comparison, interconnection, limitation, deletion or destruction.

Controller means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data.

2. Who is the controller for the processing of the data collected pursuant to this policy?

The controller for the personal data gathered is Comac spa, VAT no. 03322910237, fiscal code 03322910237, with its registered offices at Via Maestri del Lavoro 13 – 37059 Santa Maria di Zevio (Verona), Italy, email/PEC: comacspa@postecert.it (herafter 'Comac' or the 'Data Controller').

3. What kinds of data does Comac process?

• Data of customers, prospective customers and suppliers, including their consultants and other representatives, provided voluntarily.
  Any contact with Comac, including through services on its web pages, termination of contractual relationships or optional, explicit and spontaneous sending of emails or letters to Comac's addresses, means the personal data you send will be gathered, purely in order to provide the service you request, respond to your request or agree and manage a contractual relationship. Comac gathers and processes the following personal data: IP addresses, email addresses, telephone numbers, place of residence, date of birth, fiscal code, VAT number, names, qualifications, occupation, bank details, as well as other personal data included in the relevant service and/or communication forms.
• Browsing data.
  IT systems and programs used to run Comac's web sites gather some personal data, spreading of which is implicit when you use internet communication protocols (e.g. IP addresses or computer domain names used by people connecting to the site, information on visits, on the software browser and on other aspects of the user's operating system and IT setting). This data is used purely to get statistical information not linked to any identifying data on how the user uses the site, and to check it is running properly; they are therefore deleted straight after processing.
• Cookies
  Cookies are little text files installed by a web site on a user's browser that record certain information on how the user surfs the internet. For information on the use of cookies on this site, please read the cookie policy.

4. For what ends does Comac use the personal data it gathers?

Personal data will be processed for the purposes indicated below:

• administrative and accounting purposes, including to meet obligations in applicable law or regulations and provisions issued by the responsible authorities and surveillance and control bodies;
• purposes strictly connected to or necessary to fulfilling its contractual obligations and exercising its contractual rights, including after-sales;
• purposes of registering users to the site so they can enjoy Comac's services;
• purposes of meeting any demands made to Comac;
• based on prior consent, purposes of promoting and informing people of Comac's work and its products. Comac may send communication for the above purposes in traditional (e.g. letters, phone calls by workers) and electronic formats like email (e.g. newsletters) and text messages. When it comes to an email address provided to purchase a product or service offered and sold by Comac, the latter may use it to send information and advertising (including the newsletter) about similar products and services (so-called soft spamming) without the need for express prior consent, assuming the Subject does not exercise their right of withdrawal;
• based on prior consent, purposes of processing preferences by identifying type and frequency of purchases, by sending information or advertising of specific interest to the Subject by email and improving commercial offers sent by Comac (so-called profiling).

5. What is the legal basis for the processing of the personal data collected? Can I withdraw my consent?

Legal basis for data processing under the GDPR.
The legal basis for the processing of personal data for the above purposes is as follows:

• for the purposes in point 4, letter (a), meeting an obligation in law;
• for the purposes in point 4, letter (b), meeting Comac's contractual obligations;
• for the purposes in point 4, letter (c), delivering a requested service;
• for the purposes in point 4, letter (d), meeting any other request received by Comac;
• for the purposes in point 4, letters (e) and (f), user consent.

Withdrawing consent
For the purposes in point 4, letters (e) and (f), the Subject may withdraw their consent at any time by emailing com@comac.it.
The right of the Subject to refuse for their personal data to be processed for marketing purposes can be exercised by both electronic (e-mail, text message) and traditional means (post).
When it comes to the newsletter, the Subject may refuse for their data to be processed, including through the link at the bottom of every email with advertising content sent by Comac, where you can automatically unsubscribe from the newsletter.
The Subject withdrawing their consent will have no influence whatsoever on Comac's right to process user data if that processing is needed for Comac to fulfil its contractual obligations, fulfil an obligation in law, defend its rights in a dispute with the Subject or prevent fraud or abuses.

6. What methods does Comac use to treat the personal data it gathers? Who may Comac share that data with?

Method of processing
Personal data is mainly processed with electronic tools according to methods and means that ensure its safety and exclusivity, in line with legislation on personal data protection. In particular Comac resorts to technical, IT, organizational, logistical and procedural safety measures to ensure the utmost protection of data as required by law, granting access only to entrusted people.

Remit of sharing data
The Subject's personal data may be shared with the following:

• Comac's employees and collaborators, so administration, accounting, after-sales, IT support and logistics can be done;
• people giving assistance to customers and providing centralized services, including for Comac's benefit, including marketing and after-sales services;
• companies or consultants entrusted with installing, maintaining and running Comac hardware and software (including Comac web pages);
• external companies or consultants providing banking, financial, insurance, legal, personnel recruitment and selection services;
• companies in the group controlled by Comac spa and to which Comac belongs;
• supervisory and control authorities and bodies and, in general, public or private persons acting as public officials or persons in charge of a public service;
• parties that perform activities involving the filing of documentation and data entry.

With reference to personal data communicated to them, the parties that belong to the above-mentioned categories can operate, depending on the case, as processors or persons in charge of processing, or as separate data controllers.
Personal data shall not be in any way disseminated or communicated to other external entities, except where disclosure is required by law or necessary.

7. How long will Comac store the personal data it gathers?

Personal data shall be kept for the time necessary from an operational and/or legal point of view as follows:

• for the purposes referred to in point 4, letters (a), (b) and (c) and (d) above for a period not exceeding 10 years, without prejudice to any specific legal obligations regarding the keeping of accounting records and, in any case, according to statutory limitation periods;
• for the purposes in point 4, letter (e), above, until consent is withdrawn;
• for the purposes in point 4, letter (f), above, for a maximum period of 12 months.

In any case Comac may store the personal data it gathers for longer than stated above in the event of potential or actual legal disputes or to prevent fraud or abuses.

In any case, at the end of the period for which the personal data are stored, the data shall be deleted or aggregated or anonymized.

8. Will the personal data gathered by Comac be transferred abroad?

It may happen that Comac shares the personal data with certain parties, who may in turn process it in countries in and outside the EU and EEA. If it is transferred to countries whose laws do not offer the same level of data protection given by the GDPR, Comac will resort to other legal mechanisms, including contractual clauses standard to the EU, to ensure the rights and protections bestowed by Comac still apply to the shared data.
Further information regarding international transfer of data may be sent to the contacts available at the end of this policy.

9. What rights does the Subject have?

This section lists the Subject's rights, which they may exercise at any time by writing to com@comac.it.
The Subject will have the right to:

• find out from Comac whether their personal data is being processed and if so, get hold of the information in article 15 of the GDPR;
• have their personal data corrected or, based on the purposes of processing, added to where it is incomplete;
• have their personal data deleted for one of the reasons given in article 17 of the GDPR;
• limit the processing of their personal data in the cases provided for by applicable law;
• object to the processing of their personal data for reasons connected with your particular position;
• receive, in a structured, commonly used and legible electronic format, any personal data relating to them and transmit this data to another Data Controller without impediment by the Data Controller, if technically possible, within the remit of article 20 of the GDPR.

Depending on the amount or complexity of the requested information, an appropriate fee may be charged.
The Subject will also have the right to make a complaint to a monitoring body (in Italy, the Personal Data Protection Supervisor), if they consider that the processing of their personal data has been carried out in violation of the GDPR.
In any case, the Subject is welcome to contact Comac, which commits to deal with the issue with the utmost courtesy, seriousness and discretion.

10. Minors

Our products and services are primarily intended for an adult audience. Comac does not intentionally ask for or gather personal data from or relating to children aged 16 and under without the consent of their parent or carer. Should Comac find out that it has been sent personal data about such children without the consent of their parent or carer, it will make every reasonable effort to:

• delete such personal data from your files as soon as possible; and
• ensure that these personal data are not further used for any purpose and are not further disclosed to third parties.

11. Amendments and updates to this Policy

Comac reserves the right to edit, update and change this Privacy Policy, which will take effect from the moment it is published on this site.

12. Information

For any information on this Privacy Policy or our products, you can write to the email address com@comac.it.

Last updated on 20 January 2020.