Privacy policy

PRIVACY NOTICE

This privacy notice is provided in accordance with and for the purposes of Article 13 of EU Regulation 2016/679 of April 27, 2016 (“GDPR”) and in compliance with local regulations on processing of personal data (hereinafter, jointly, "Privacy Laws”) by Jakala S.p.A. Benefit Company and other companies belonging to the Jakala Group, as better identified in the chart at the bottom of this privacy notice, each as an independent data controller (hereinafter collectively "Jakala" or "Controller" or “Jakala Group).  

Jakala Group intends to provide users (“User(s)”) who contact Jakala to request information through the contact forms available on the website www.jakala.com (the “Website”) with some information about their personal data, voluntarily provided through the contact form, and on the consequent processing of the same by Jakala Group. 

The processing of data by the Jakala Group will be based on the principles of correctness, lawfulness, relevance, transparency and will be carried out while protecting the confidentiality and rights of the Users, in compliance with the Privacy Laws. 

1. Data controller 

The data controller of the personal data provided through the contact form on the Website is the Jakala Group company that operates in the region selected by User when sending their information request. The complete list of data controller companies is shown at the bottom of this privacy notice. 

The User’s request will be received and managed by the data controller company (unless specifically escalated to the parent company Jakala S.p.A. Benefit Company, where necessary). 

2. Types of data processed and categories of data subjects 

The following personal data may be processed for the purposes indicated in the subsequent paragraph: 

- personal identification data (name, surname, company, region); 
- contact details (e-mail address); 
- other information included in the message. 

The personal data belong to the following categories of data subjects: Users who contact Jakala to request information through the contact forms available on the Website. 

3. Purposes of the data processing and related legal basis 

Users’ personal data will be processed by the Controller for the following purposes: 

a) to reply to Users’ requests that may be received by the Controller through the contacts form of the Website. The legal basis of this processing activity is Article 6 paragraph 1, letter (b) of the GDPR, i.e., to execute pre-contractual and/or contractual measures; 

a) to send communications and/or updates on Jakala Group’s activities, invitations to events, initiatives, webinars, promotional communications by e-mail. The legal basis of this processing activity is Article 6 paragraph 1, letter (a) of the GDPR, i.e. the User’s consent. 

The processing of the Users’ personal data will be carried out only to the extent strictly necessary to achieve the above-mentioned purposes and, in any case, in compliance with the Privacy Laws.  

The provision of personal data by User for the purpose specified in point a) is not mandatory, but it is essential and indispensable for the management of the User’s request by Jakala Group; hence, any refusal to provide the data may result in the impossibility for Jakala to respond to the User’s requests and for User to obtain the information requested.  

The provision of personal data by User for the purpose mentioned in point b) is optional. Any refusal to provide the data will not prejudice in any way the possibility for User to obtain the information requested. 

4. Data processing methods  

The processing of personal data is carried out using manual, computerized, and telematic tools, solely for the purposes for which they were collected and, in any case, in a manner that ensures their security and confidentiality. The databases are kept in secure environments, access to which is controlled and in compliance with applicable legal provisions. 

5. Categories of subjects to whom the data may be disclosed 

The personal data provided will be processed by employees and collaborators of Jakala duly authorized, based on the roles and job duties performed by each of them, and/or by third parties duly appointed as data processors. These subjects are authorized to process the personal data within the limits of their competencies and in accordance with the instructions provided to them by the Controller. 

The complete list of data processors is available, upon request, at the Controller's headquarters. 

6. Data Retention 

The Controller will store the personal data for a period not exceeding the fulfilment of the purposes for which they were collected. Specifically: 

a) with reference to purpose a) (i.e. reply to the User’s request), the personal data will be processed only for the time necessary to handle the User’s request; 

b) with reference to purpose b) (i.e. for marketing purpose), the personal data will be processed for 24 months from the User’s consent. 

7. Transfer of data abroad 

Within the purposes described in this privacy notice, the data provided by the User may be processed by companies, bodies or international organizations with headquarters in countries located outside the territory of the European Economic Area (EEA). The processing of such data takes place in maximum compliance with the confidentiality and security standards set out in the applicable personal data protection laws. Whenever the User's personal data is subject to international transfer outside the EEA, Jakala will adopt all suitable and necessary contractual measures to guarantee an adequate level of protection of personal data in accordance with what is indicated in this privacy notice on the processing of personal data. 

8. Rights of data subjects 

Jakala informs Users that, in relation to the aforementioned processing activities, they have the rights provided for in Articles 15 and following of the GDPR. In particular, User has the right to: 

1. access their personal data: in particular, the data subject has the the right to obtain confirmation from the Controller as to whether or not personal data concerning them is being processed and, if so, to access the personal data and obtain further information about their origin, the categories of data processed, the purposes of the processing, the methods of processing, the recipients of data, the data retention period, transfers of data if any, etc.; 

2. obtain the rectification of inaccurate personal data without undue delay, as well as the completion of incomplete personal data by providing a supplementary statement; 

3. obtain the erasure of personal data without undue delay in cases where: 
a)the personal data is no longer necessary for the purposes of the processing; 

b)the consent on which the processing is based has been withdrawn and there is no other legal ground for the processing; 

c)the personal data has been unlawfully processed; 

d)the personal data must be erased to comply with a legal obligation; 

4. obtain the restriction of processing in cases where the accuracy of the personal data is contested (for a period necessary for the data controller to verify the accuracy of such data), the processing is unlawful, and/or the data subject has objected to the processing; 

5. where applicable, object at any time to the processing of personal data based on the legitimate interests pursued by the Controller; 

6. receive the personal data, in a structured, commonly used, and machine-readable format, and transmit these data to another data controller, where the processing is based on consent or a contract and is carried out by automated means (the right to data portability); 

7. where applicable, withdraw consent at any time, if the processing of personal data is based on this legal basis, without affecting the lawfulness of the processing carried out prior to the withdrawal. 

8. lodge a complaint with a supervisory authority: without prejudice to any other administrative or judicial remedy, the data subject who considers that the processing of their personal data violates the Privacy Laws has the right to lodge a complaint with the supervisory authority of the member state where they reside or work, or where the alleged violation occurred. 

If the data subject wishes to obtain further information regarding the processing of their personal data or exercise the aforementioned rights, they can submit a written request to the Controller, with the subject line "Privacy - Exercise of Privacy Rights" to the email address specified in the chart below.