Types of data

The data we process can be of three general categories: navigation data, data actively provided by the interested party and data collected from third parties.

Browsing data

When (even via mobile via smartphone or tablet) you access this website or use our services, computer systems and software procedures used to operate the site acquire, during their normal operation, some information about you, which can be classified as "personal data" the transmission of which is implicit in the use of Internet communication protocols.

This includes the hardware model, operating system and version, information about the mobile network and the country from which the access occurs, the time of the request, the method used to submit the request to the server, the access time, the size of the file obtained in response, the numerical code indicating the status of the response given by the server (successful, error, etc.), the details related to the itinerary followed within the web pages with particular reference to the pages visited and other parameters related to the operating system and the user’s IT environment (browser used, version, geographical position, last page visited before accessing the Site’s services) and unique device identifiers (e.g., IP address or names domain of the computers used by users, the address in URI – Uniform Resource Identifier notation, the MAC address – Media Access Control).

This is information that is not collected to be directly associated with identified interested parties, but which by its very nature could, in theory, through processing and association with data held by third parties (in particular, third-party providers of internet connectivity services), allow to identify users.

However, these data are used by us only to obtain statistical information in aggregate and anonymous form on the use of the site, to better understand the user’s browsing behavior in order to offer the user a better browsing experience, to make the technical functionality of the Site, to control and optimize its functioning, to improve the quality of the services offered by the site as well as guarantee the maintenance of the relevant database and the supporting IT infrastructure.

The navigation data can also be used to ascertain responsibility in the event of crimes against the Site or carried out through the Site (malware attempts, spamming, abusive access to IT systems, etc.) and in this case the storage continues. for as long as necessary to protect the rights of Rubber Conversion and/or third parties.

Data actively provided by the user

This means:

  • information sent by users optionally and voluntarily by completing online registration and/or data collection forms or on company blogs published on the website (e.g. e-mail address, subject of the e-mail, name or company name, name and surname, etc.);
  • personal data provided by users to use services accessible on the Site or to participate in initiatives promoted through the Site;
  • personal data provided by users who forward requests for clarification, the sending of news and/or informative material;
  • personal data provided by users who send us application proposals (“curriculum vitae”, etc.).

Through the web forms available on the sites we never ask you for "particular" personal data (i.e., personal data capable of revealing racial and ethnic origin, religious, philosophical or other beliefs, political opinions, adherence to parties, trade unions, associations or organizations of a religious, philosophical, political or trade union nature, as well as personal data suitable for revealing the state of health and sexual orientation) or "related to crimes, criminal convictions and security measures" (data in criminal record matters, or related to the status of accused or suspect, etc.).

Data collected from third parties

The Company does not collect personal data of the interested party from third parties.

Purposes and principles of data processing

We inform you that Rubber Conversion will use your personal data to manage access to the site/portal and the services included therein, manage technical practices, carry out all activities necessary or useful for the constant improvement of the service provided, and for the ascertainment of responsibility in the event of crimes against the Site and/or offenses committed through the Site. Specific further purposes relating to individual processing may be identified in detail, through supplementary information, within the various services included in the portal.

Consultation of the Site may involve the processing of data relating to identified or identifiable persons. The personal data provided by users who consult the Site are processed by the recipient of the communication to follow up on the requests received.

The processing of personal data has the purpose of:

  1. process user requests for support and contact, e.g., relating to the sending of informative material or clarifications (bulletins, newsletters, answers to questions, notices, specifications, price lists, other documentation, etc.),
  2. allow users to register on the site and access services and/or purchase products/services,
  3. perform the service or provide the product requested by the user and organize all management and production activities instrumental to the supply (including relationships with suppliers, and the management of payments by credit card, bank transfer or other instruments),
  4. fulfill the obligations established by law, regulations and/or community legislation;
  5. carry out all legal obligations connected to or deriving from the terminated contractual relationship with the interested party and/or with the organization to which the interested party belongs (collectively the "primary purposes")

The data collected will also be processed for the purposes of:

  1. Direct marketing (carrying out market surveys, sending commercial and promotional communications, newsletters, through any automated means of communication, email, telephone with operator, SMS, chat messages, social networks, etc.) or non-automated (ordinary mail); the processing will take place only with the prior consent of the interested party (collected via specific online and/or paper forms); consent is always optional (see below).
  2. Basic profiling*1 (i.e., analysis, including predictive of consistent information:
    1. In case of internal contacts of our companies, customers or possible customers: name and surname of the interested party, name and sector of the organization to which they belong, role, contact details such as headquarters of the organization to which they belong, e-mail and telephone numbers of the same, participation of the interested party in events organized by us and/or our partners);
    2. In case of consumers or individual companies: name and surname of the interested party, contact details such as residence or domicile, work or private email and telephone numbers, economic or product sector of activity, topics of professional or economic interest, participation of the interested party at events organized by us and/or our partners).

Basic profiling processing takes place without the need for prior consent from the interested party (for the reasons better indicated in the following section "Legal basis of processing").

This means that we do not send the same offers to all interested parties and will be able to send you advertising communications as close as possible to your tastes, interests or preferences, or via your preferred contact methods, improving your shopping experience, even to your own advantage.

particular, it does not affect the possibility for the interested party to use our ordinary services (e.g., online pre-registration, purchase of services).

In general, the direct marketing and even basic profiling purposes are called "secondary purposes".

Legal basis of the processing

  • In case of the primary purposes, the processing is necessary, depending on the case, for the execution of pre-contractual measures adopted at the request of the interested party (e.g., requests for clarification, sending of information or commercial offers), for the execution of a contract of which the interested party is a party, or to fulfill a legal obligation to which we are subject (e.g., to allow verification of the correct fulfillment of legal and contractual obligations towards the interested party or third parties by the administrative and tax authorities , the board of statutory auditors or auditors, etc.) and/or based on legitimate interest:
    1. of our company (prevailing over the interests or fundamental rights and freedoms of the interested party) to process the data, to be able to effectively and efficiently manage the relationship with its users, customers and/or suppliers and to organize the related production processes, organizational and management (including relationships with its sub-suppliers and/or with parent, controlled or associated companies pursuant to art. 2359 of the Civil Code or with companies subject to common control) aimed at enabling this objective;
    2. of third parties, to receive from the Data Controller and process personal data i) for the purpose of verifying the correct fulfillment of existing legal and contractual obligations towards the interested party or towards third parties (for example verification by the public authority regarding the fulfillment of tax obligations, or by the board of auditors or auditors regarding the fulfillment of legal obligations, etc.) or ii) to be able to manage the activities related to the Data Controller’s request to receive support to manage the activities towards the interested parties.
  • In case of secondary purposes (direct marketing, profiling) the processing is based: a) in relation to direct marketing towards customers carried out by sending emails/newsletters to promote goods or services similar to those already purchased by you: on our legitimate interest in promoting one’s products and/or services to current customers (so-called soft spam); b) in relation to direct marketing to customers carried out by sending emails/newsletters, to promote our goods or services other than those you may have already purchased: on your prior specific consent to processing for this purpose, not subsequently revoked; c) in relation to direct marketing towards customers operated through automated tools other than the sending of emails/newsletters (e.g., sending of text messages, social messages, instant messaging messages such as Whatsapp etc.): on your prior specific consent to the processing for such purpose, not subsequently revoked; d) in relation to basic profiling, on our legitimate interest in having a minimum set of information to plan direct marketing actions both towards potential customers and towards existing subjects clients;

You must give or deny your consent, separately, respectively for i) the processing carried out by us, and ii) the communication of the data by us to third parties who are independent data controllers for the same purposes.

The logic and forms of organization of processing will be strictly related to the individual purposes indicated above respectively. The processing will take place electronically, and/or on paper. During processing, the data is subjected to protection measures activated by us in order to guarantee the data itself against the risk of authorized access or unauthorized processing, for example, it can only be consulted by having access to the various application software by typing mandatory personal passwords, to be performed only by personnel authorized by us, who must in any case comply with predetermined limits of use on which they have been trained.

Internal subjects who process the data

The data collected is processed by our internal delegates who need to know it in carrying out their activities (e.g., sales office, marketing office, administrative office, call center, technical staff responsible for maintaining the company IT system, etc.).

The mandatory or optional nature of data communication and the consequences of not providing it

Considering the primary purpose, the provision of data is mandatory in case the data is necessary for the fulfillment of legal obligations and failure to provide the data in this case makes it impossible to stipulate the contract with the interested party and/or with the organization to which it belongs; in other cases, you can also not provide the data, but in this case we will not be able to carry out the pre-contractual relationships, the online registration of the interested party on the Website and/or the provision of services or the sale of products/services for the which we require registration and/or provision of data. The unregistered user can browse the Site and view only the contents and materials available without registration.

In relation to those secondary purposes that require your prior consent (direct marketing) as well as, distinctly, for the purposes of our communication of the data to third parties who process them for these same purposes in a capacity other than that of our data controllers:

  • your consent is always optional (free and denyable);
  • failure to provide or consent to the processing will prevent us from processing and/or, respectively, communicating the data to third parties, for these secondary purposes, while it will not interfere with our. existing relationships with you or your organization.
Are there cases of simplified consent or exceptions to the obligation of consent for direct marketing purposes?

As permitted by the General Provision of the Privacy Guarantor of 15.05.2013 – "Consent to the processing of personal data for "direct marketing" purposes through traditional and automated contact tools", the consent requested from you for the secondary purposes of direct marketing is unitary and overall for all possible channels used by us (electronic, paper, postal) as well as for all possible direct marketing sub-purposes (you do not need to provide us with multiple consents for each distinct marketing purpose).

Does the data subject’s consent to processing for direct marketing purposes also apply to the communication of data to third parties?

We communicate some of your data to other companies in our corporate group or to third parties who by contract and in the capacity of "data controllers" are delegated to process the data on our behalf and under our vigilance. In this case the third parties will make use of the same consent (including that for communication to third parties for such purposes) already provided by you.

We can also, but exclusively with your further, separate, additional, express optional consent, communicate or transfer the data to third parties (usually third party partners in the promotion of Events) who treat them in the capacity of joint controllers or independent controllers for direct marketing purposes.

NB: We may process the personal data provided to us by the user, through the use of telephone calls with an operator and the use of ordinary mail, for the aforementioned secondary purposes, without the prior specific consent of the interested party (in this case, without prejudice to the right of the interested party to oppose the processing with simplified methods and also electronically by registering the telephone number of which the interested party is the owner and other personal data relating to subscribers in the paper and electronic lists available to the public, in the Register Public of the Oppositions http://www.registrodelleopposizioni.it/) provided for by the Decree of the President of the Republic no. 178/2010.

Note: When we ask you – for direct marketing purposes – for your telephone number and you give us your consent to its use, we will call you even if the telephone number is registered by you in the Public Opposition Registry, as the number in this case is not obtained from public telephone directories.

Withdrawal of consent

Even after having given your consent to data processing for direct marketing purposes, you can at any time notify the Company of a different wish, via one of the following alternative methods:

As clarified in the General Provision of the Guarantor of 4 July 2013 containing the "Guidelines to combat spam":

  • the communication or transfer of personal data to third parties for marketing purposes in general cannot be based on the acquisition of a single and generic consent from the interested parties for such purposes;
  • the owner must acquire specific consent for the communication (and/or transfer) of personal data to third parties for promotional purposes, as well as distinct from that requested by the same owner to carry out promotional activities himself; if the interested party gives such consent, third parties will be able to carry out promotional activities towards him also with the automated methods referred to in the art. 130, paragraph 1 and 2 of the Privacy Code without having to acquire new consent for promotional purposes.
  • the data controller who intends to collect the personal data of the interested parties also to communicate them (or transfer them) to third parties for their marketing purposes must first issue them with appropriate information which also identifies each of the third parties or, alternatively, indicates the categories (economic or product) to which they belong.
  • by clicking on the "unsubscribe" button, made available to the user at the bottom of the promotional emails sent to the interested party, an email will automatically be sent to the Company and consequently the name of the interested party registered in a specific black-list, preventing further future direct marketing actions by the Company towards the same;
  • by transmitting to the Company by ordinary mail or e-mail your declaration of revocation of consent (which in this case will be manually recorded in the Company’s CRM). This method of communication is always necessary in the event that the interested party wishes to express a more analytical selective will, either with regard to the use of certain individual means and not others (e.g. only paper, only electronic, rejecting that sent via systems automated, etc.) for the receipt, with prior consent, of the Company’s marketing communications, either with regard to individual marketing purposes among those actually possible (for example, choosing to receive only newsletters and not sent to our Events);

    sending a clear telephone communication of revocation of consent to the Company without formalities. Upon receipt of this opt-out request, the Company will proceed with the removal and deletion of the data from the databases used for processing for direct marketing purposes and, where possible, will inform any third parties to whom the data have been communicated for the same purposes of such deletion. purpose.

    The mere receipt of the cancellation request will automatically constitute confirmation of cancellation.

  • If you instead wish to revoke your consent to any advertising communications that come to you from social channels (e.g., Facebook, Twitter, etc.), you will have to communicate your revocation directly to the individual social platform, according to the methods made available from time to time. time from the same and/or from the browser you use (as our Company is not technically capable of influencing third-party social platforms for this purpose).

The opposition will not produce any consequences on the provision of any ongoing contract activities.

Communication of data to third parties

The Company communicates your personal data to third party recipients only when this is necessary and functional to achieve the data processing purpose pursued in relation to the service or product requested by you, and in any case proceeds with the communication only after having informed you, and where necessary, having obtained your consent to do so. Communication to third parties will always be limited to the data strictly necessary for the respective purposes.

The third party recipients of the data – better identified below – will process the data, as the case may be, a) in the capacity of "external managers" (i.e., on our behalf and on the basis of our written directives aimed at guaranteeing compliance with the privacy legislation during processing and under our supervision), or b) in the capacity of joint controllers (i.e., on the basis of a written agreement regulating the respective activities and responsibilities in relation to personal data), or in the capacity of independent controllers (in such hypothesis will provide the interested party with all the necessary legal information on the respective processing, except in the case in which they are bound to professional secrecy according to current legislation).

Within the scope of the primary purposes and when the interested party stipulates a contract with our company. Company, the data may be communicated to all third parties whose intervention in the processing is useful based on the services requested by the interested party and/or legal obligations or deriving from regulations or other community legislation, for example: controlled companies or affiliates of the Group and/or third-party partner companies that carry out functional or complementary activities to the supply of products or services requested by the interested party (e.g., management of requests for information, quotes, orders, contracts, after-sales), third parties responsible for the execution of activities connected and/or instrumental to the processing (such as commercial agents, banks for the management of collections and payments, commercial information companies, debt collection companies, credit transfer companies, credit insurance companies, companies providing credit services electronic payment, couriers, carriers and freight forwarders, factoring companies, insurance companies, lawyers and law firms, chartered accountants, accountants, auditors and auditing companies, members of supervisory bodies pursuant to Legislative Decree. 231/2001 in relation to organizational models aimed at preventing the commission of certain categories of crimes, auditors, third parties in charge of carrying out web hosting services and/or maintenance of this website and/or the IT systems used by it and/or of the electronic archives connected to the site; carriers and freight forwarders responsible for the transport of goods;; public security authorities and computer forensics companies in the case of requests related to criminal and civil investigations and/or suspected crimes or other abuses or offenses committed to the detriment of Rubber Conversion and/or third parties.

In the case of processing for secondary purposes (direct marketing, profiling), pursuant to the General Provision of the Guarantor of 4 July 2013 containing the "Guidelines to combat spam", we will also communicate the data to: subsidiaries of our corporate group, agencies advertising, marketing analysis companies, communications and/or public relations companies, companies in charge of the design, printing and maintenance of advertising or promotional editorial materials and/or their online management, website production companies, companies web marketing companies, direct e-mailing service companies (e.g. Mail-Up or similar), consultants and/or other entities to which we entrust activities functional to said purposes; maintenance company of the IT systems on which our information resides or through which it is processed. databases; providers of electronic communications and ICT services; third-party commercial partners with whom we activate co-marketing actions (e.g. tire manufacturers, tire collection points, public and private research centers, innovation centers).

The data will not be disclosed.

Transfer of data abroad

The Data Controller transfers personal data to the following third country:

  • USA: to the third party supplier Microsoft Corporation with headquarters 1 Microsoft Way, Redmond, WA 98052, USA. as a provider of the individual productivity cloud application service (called “Microsoft 365”), of video conferencing services (“Microsoft Teams”) and cloud computing services (“Microsoft Azure”), for the execution of the contractual service towards the customer (e.g. for managing email or drafting documents) and/or for the fulfillment of related legal obligations.

As expressly indicated in Attachment 1 to the Terms of Use of Online Services, with reference to the 365 Service, Microsoft undertakes to archive inactive Company data processed by Rubber Conversion as follows: "if the Company provisions its tenant ( …) in the European Union, Microsoft will store the following Inactive Company Data only within that Geographic Area: (1) the contents of your Exchange Online mailbox (email message body, calendar entries, and attachment contents email), (2) the content of the SharePoint Online site and files stored on that site, and (3) files uploaded to OneDrive for Business.” For such data, therefore, no transfer takes place to the USA or it is purely occasional in nature.

See Microsoft’s policy at: https://docs.microsoft.com/it-it/microsoft-365/enterprise/o365-data-locations?view=o365-worldwide. You can view Microsoft’s privacy policy at the following address: https://privacy.microsoft.com/it-it/privacystatement.

However, it is possible that other inactive data, other than those indicated above, are transferred from the EU to the USA for the service in question and that their transfer is more than occasional. With reference to this hypothesis, Rubber Conversion applies adequate guarantees consisting in the stipulation – automatic upon activation of the service – of the Standard Contractual Clauses (CCS), because of which the supplier, in relation to the processing within its competence, undertakes to comply with obligations privacy substantially equivalent to those provided by the GDPR for Rubber Conversion. These CCS were previously submitted by Microsoft to the Article 29 Working Group of the European Union and obtained the relevant approval.

Although, therefore, in abstract terms the risk cannot be excluded with absolute certainty that in certain occasional situations the American public authority may access personal data transferred from the EU to the USA on the basis of the US legislation referred to by the EU Court of Justice in Schrems ruling of 07.16.2020 (i.e., art. 702 of FISA and Executive Order EO 12333 which legitimizes the American public authority to such access for national security purposes), however, on the basis of common experience, considered: ) the core business of Rubber Conversion ii) the type of personal data processed by Rubber Conversion and iii) the limited categories of interested parties to which the data refers (candidates, employees, suppliers, customers/prospects and leads), the possibility that in concrete there is a public interest in making such sporadic access to the data (of which the supplier by law may not give notice to the Company) appears objectively unlikely. The adoption of any additional measures will be communicated by Rubber Conversion to the interested parties.

Duration of treatment

In the case of processing for primary purposes, personal data are usually processed for the entire duration of the pre-contractual and/or contractual relationships established with the interested party, in particular:

  1. in the pre-contractual phase, for the time necessary to manage the interested party’s requests received by the Company (e.g. requests for documentation, brochures, information, etc.) and to track the successful completion of the Company’s responses; and thereafter until you communicate your opposition to the processing for the aforementioned purposes;
  2. in relation to the contract stipulated with the interested party, for the entire duration of the contractual relationships established with the interested party;

as well as

  1. after the termination of the contractual relationship established with the interested party, for the time necessary to carry out all the legal obligations connected to the terminated contractual relationship (in particular proving the fulfillment of fiscal and civil obligations to the supervisory authorities) and in any case until the expiry of the civil term of the action for compensation of damage due to the interested party pursuant to art. 2946 of the Civil Code, for: 10 years from the termination of the contract).

Personal data is processed for IT security purposes (e.g., log recordings) and are kept for the time necessary to complete the relevant security checks and evaluate the results (1 year from the time of collection).

In the event of an out-of-court or judicial dispute arising with the interested party and/or third parties, the data will be processed for as long as is strictly necessary and sufficient to exercise full protection of the Data Controller’s rights.

The processing of data for secondary purposes (marketing) as described above will continue:

  1. in the event that you are not already one of our customers until you revoke the consent previously given for the respective aforementioned purpose;
  2. if you are already our customer, until you communicate your opposition to the processing for the aforementioned purposes.