Privacy notice for external third parties
Privacy notice according to art. 13 D. Lgs. 30 June 2003, n. 196 and following issued regulations.
Data controller and contact details
The data controller for personal data processing activities is CBC (EUROPE) GmbH.
Data processing principles
The Company, identified as the Data Controller in compliance with applicable laws and regulation, wishes to inform you about the scope and the purposes of processing activities performed on your personal data and to remind you about how to exercise your rights to privacy.
The Company will take care of guaranteeing:
- the exact registration of information, in order to guarantee that they correspond to the information you provided;
- the updating of information to any variation you may communicate us;
- the appropriateness and relevance of the data with respect to the purposes for which they will be collected and processed;
- the minimization of the use of personal data within information systems and the use of anonymous data where identification is not necessary.
The Company also ensures that data provided will be processed for its whole life cycle in compliance with applicable laws and regulations and with principles of fairness, lawfulness and transparency.
Data processing purposes and legal ground
Your personal information, and data related to your relatives, will be processed in order to pursue following purposes:
- refine or manage the relationship of collaboration with the Company and fulfill the existing contractual obligations and consequent legal obligations.
Legal ground: performance of a contract; compliance with laws and regulations.
- publication of your personal data in the internal newsletter to share information and values within the Company.
Legal ground: data subject’s consent.
Data processing procedures
Data processing activities will be performed:
- Manually, with physical archiving in paper form;
Electronically, through processing and archiving within IT assets.
Tools and media used – paper, magnetic, computer or telematics – are suitable to guarantee the security and confidentiality of data. Databases and IT systems are managed in protected environments, whose access is under control, and in compliance with the provisions of the law.
Communication of personal data to third parties
According to applicable laws and regulations and in performance of the contract, personal data may be disclosed to a number of subjects, among which:
Cross-border data transfers
In order to effectively perform data processing activities, your personal information may be shared within the Group and transferred to countries in the world where the company operates, including outside of the European Union and Switzerland, with particular reference to Japan.
Regardless of location, the Company handles personal information in compliance with applicable laws and regulations and ensures an adequate level of protection and effective means to exercise data subject’s rights, through the adoption of standard contractual clauses.
Data retention criteria
The Company will hold personal information in its systems and archives for as long as necessary to pursue purposes defined above.
Retention and time limitation requirements are defined for each category of personal data, accordingly to data processing purposes, taking into account legal and contractual requirements. When personal data are no longer necessary for the purposes for which they are processed, data hey are deleted or kept in a form which does not permit the identification of data subjects.
Mandatory or discretional provision of data and consequences of failure to provide personal information
The provision of your personal data is mandatory in terms of legal and contractual obligations. We therefore inform you that any refusal to supply them, in whole or in part, or the failure to authorize data processing and / or communication of data to third parties, may result in the impossibility on the
part of CBC (EUROPE) GmbH to proceed with the same contractual relationships.
The provision of personal data based on consent for the publication of data on the internal company newsletter are optional. Failure to provide these data will result with the impossibility to access benefits associated with the processing activity.
Data subjects rights
Data subjects may exercise their rights as defined by applicable laws and regulations, among these:
Right of access: right to obtain from the Company a confirmation as to whether or not your personal information is being processed, and, if so, to demand to gain access to your personal data.
- Right to rectification: right to obtain from the Company the rectification of your personal data that you may consider inaccurate and to have incomplete information being completed, including by means of providing a supplementary statement.
- Right to erasure: right to obtain from the company the erasure of your personal data without undue delay, where one of the following grounds applies:
- personal data is no longer necessary in relation to the purposes for which they were originally collected or otherwise processed;
- you withdrew the consent to process and/or there is no longer a suitable legal and/or legitimate ground granting the processing;
- your personal data have been unlawfully processed;
- your personal data should be erased in compliance with a legal obligation of a Union or Member State law to which the Company is subject.
- Right to object to data processing: right to object at any time the processing of your personal data based on the legitimate interest of the Company.
- Right to limit the data processing: right to obtain from the Company a limitation on the processing activities when the accuracy and the precision of personal data is disputed, and for the time necessary for the Company to verify the accuracy of personal data.
- Right to data portability: right to receive the personal you provided to the Company in a structured, commonly used and machine-readable format. You also have the right to transmit those data to another data controller without hindrance from the Company, especially following these conditions: the processing is based on consent or on a contract and the processing is carried out by automated means.
- Right to raise a complaint: without prejudice to any other administrative or judicial dispute, if you believe the data processing has been carried out illicitly or not compliant with the applicable laws and regulations, you have the right to raise a complaint with the Supervisory Authority of the Member State, in which you reside or work habitually, or of the State where any breach has occurred.
To exercise your rights or should you have any doubt or complaint regarding this policy and Company’s data processing activities, requests may be addressed to firstname.lastname@example.org.