Privacy Policy

PERSONAL DATA PRIVACY NOTICE

Pursuant to Section 13 of Regulation EU 2016/679 (GDPR) and Italian D.lgs. 196/2003 amended by D.lgs. 101/2018, this notice applies to visitors who interact with IDEA S.R.L. – DIVISIONE BAGNI’s website, which can be accessed from the homepage https://www.ideagroup.it.

This notice describes how you can manage and provide your personal data when accessing our official website but not third-party websites that you may access through links.

You may provide additional personal data through different access channels according to the topics covered. Further privacy notices may also be included in certain sections of the website providing specific services.

Data controllers:

Idea Srl – Divisione Bagni
Via Marigonda, 3/1 – 31040 Gorgo al Monticano (TV), Italy

Disenia Srl
Via A. Carpenè, 21 – 33070 Brugnera (PN), Italy

Contact details: privacy@ideagroup.it

Purpose of processing	Lawful basis for processing	Period for which the data will be kept
Administrative and accounting activities in general and for the fulfilment of applicable legal obligations, regulations and national and supranational legislation.	To comply with legal obligations	Contract duration and for a period of 10 years after termination.
To contact and send you information you requested.	To perform a contract to which you are a party or in order to take steps at your request prior to entering into a contract (art. 6(1)(b) of the GDPR)	For as long as is necessary for us to respond to your queries.
As necessary, to establish, exercise and defend our legal rights and interests in court.	Legitimate interests	In case of litigation, for the entire duration of the same, or until expiration of the term for enforcing appeal actions.
Direct marketing To send – using automated contact methods (such as SMS, MMS and emails) and traditional ones (such as live calls) – promotional and marketing information relating to our services and/or products, or to announce corporate events or participation in webinars, as well as to conduct market surveys or statistical analyses.	Consent (optional, may be withdrawn at any time). Please note that pursuant to the Guidelines Concerning Promotional Activities and Anti-spam Protection issued by the Supervisory Authority on 4 July 2013 the Data Controller only collects one consent for the Marketing purposes described herein. Should you wish to object to the processing of your personal data for Marketing purposes in the ways described herein and withdraw your consent you may do so at any time by contacting the Data Controller at the contact details indicated herein, without affecting the lawfulness of processing based on your consent before its withdrawal.	Until consent is withdrawn.
After the above-mentioned storage period has expired, your data will be destroyed, erased or rendered anonymous in accordance with the technical procedures for data erasure and backup.

What type of personal data do we collect and where do we get it from

Browsing data – log files

You may access our website without being asked to provide any personal data. During normal operation, the IT systems and software dedicated to the functioning of this website receive certain data (whose transmission is an inherent part of using Internet communications protocols) not associated with directly identifiable users. The data collected includes the IP addresses of users who log onto the website, the URI/URL addresses (Uniform Resource Identifier/Locator) of requested resources, the time of the request submitted to the server, the numerical code indicating the status of the response given by the server (successful, error, etc.), and other parameters referring to the user’s operating system and IT environment.

This data does not include any personal information of the user and is not collected to be associated with identified individuals, as it is technical / IT data collected and used in an aggregated and anonymous manner in order to verify the proper functioning and monitoring the security of the Site, improve the quality of service and provide statistics regarding use of the website; ascertain responsibility in the event of hypothetical criminal acts against the website.

Data provided voluntarily by users

The optional, explicit and voluntary sending of messages to our contact addresses, and the filling in and submission of the contact forms on the Controller’s website result in the acquisition of the sender’s contact details and all personal data provided, which are needed to respond to queries and/or deliver the service requested. We confirm to you, however, that in compliance with the GDPR your personal data will be processed according to the principles of correctness, lawfulness and transparency, and that your privacy will be safeguarded. In any case, before proceeding with the activation of a specific service we shall provide you with suitable information and, where necessary, shall acquire your consent to the processing of your personal data. You may withdraw your consent at any time, and thus no longer be able to use the service in question

Failure to give consent or withdrawal of consent will have no consequence, except that you will no longer be able to use the website and/or receive the service requested or obtain more detailed information about our activities.

In any case, your personal data may be processed, if necessary, for the purpose of pursuing legitimate interests of the Data Controller or because of legal obligations. In particular, your consent to the processing of browsing and log data referred to in the previous section is not necessary as this data is processed because of legitimate interests (Section 47 of the GDPR).

Data provision

Apart from what specified for browsing data, provision of your personal data for certain purposes described in the previous paragraph is optional. Failure to provide such data may result in you not being able to use certain services provided by the website.

How we process your data

Your personal data shall be processed by automated means for the time strictly necessary to achieve the purposes for which it is collected, in accordance with the principles of lawfulness, restriction of the purpose of processing and data minimization, pursuant to art. 5 of the GDPR , and within the mandatory times prescribed by law. Specific security measures shall be implemented to prevent any loss of data, unlawful or incorrect use of the data or unauthorised access to the data.

Provision and/or disclosure of the data

In compliance and within the limits of the GDPR, we shall not disclose your personal data, though we may provide it to companies with which we have contract obligations. Your personal data shall be stored on servers located within the European Union. It is nonetheless understood that the Data Controller may move the servers outside the EU if needed. In this case, should your personal data be transferred outside the EU, this will be done in compliance with applicable laws after entering into standard contracts as envisaged by the European Commission, and you shall be informed.

We may communicate your personal data to third parties belonging to the following categories:

providers of services related to the management of the IT system and telecommunication networks used by our company (including any company providing e-mail sending services);
firms or companies that provide assistance and consultancy services;
competent authorities, where this is required to achieve compliance with legal obligations and/or public regulations, on request;
companies that provide marketing platform operation services;
companies that provide IT and website maintenance services.

The entities belonging to the above categories shall carry out the function of Data Processor, or may operate independently as separate Data Controllers. The list of such entities is constantly updated, and can be consulted at our headquarters. Any further communication or disclosure of your personal data shall take place only with your explicit consent.

Existence of an Automated Decision-Making Process

This website does not feature any automated decision-making process, therefore there is no profiling system.

Children

This website and the services provided by the Data Controller are not meant for children under the age of 16. The Data Controller does not intentionally collect the personal data of children. In the event that children’s personal data is accidentally recorded, the Data Controller shall erase such data in a timely manner, at the request of the person concerned.

Rights of the data subject

You have the right to be informed by us about the processing of your personal data. You can do so by sending an e-mail to: privacy@ideagroup.it

Right of access to your personal data: we are fully transparent as to the data we collect and how we use it. You may contact us at any time and access your personal data which we have collected by sending us an e-mail.
Right of rectification: you have the right to obtain rectification of any of your personal data that is inaccurate or incomplete, and to have it updated and/or edited.
Right of erasure: you may send us a request to have all of your personal data erased. Your request will be handled within 30 days.
Right of restriction: you have the right to demand that the Data Controller introduces restrictions to the processing of your personal data.
Right of portability: at your request, we shall export all of your personal data so that it can be transferred to third parties in a structured, commonly used and machine-readable format.
Right to object: you may unsubscribe at any time and thus object to all specific uses that we make of your personal data (newsletters, automatic e-mails, etc.).
Right to lodge a complaint: if you feel that your rights have not been respected, you may lodge a complaint with the competent authorities as indicated on the garanteprivacy.it website or by sending an e-mail to urp@gpdp.it