PRIVACY POLICY STATEMENT

1. DATA CONTROLLER

UMBRAGROUP S.p.A., with registered office at 1 Via V. Baldaccini - Z.I. Loc. Paciana, Foligno (Perugia), in the person of its legal representative pro tempore ANTONELLO MARCUCCI, is the data controller of your personal data  (the "Controller" or "UMBRA").

2. DEFINITION OF PERSONAL DATA AND INFORMATION ON THE PROCESSING ACTIVITIES

Pursuant to the GDPR, the term “personal data” means: "any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person” (the "Data").

For the management of the relationship established between the Controller and the data subject after the latter’s request:
a) to receive company information by filling out the specific form in the “Contacts” section of the UMBRAGROUP website;
b) to download company documentation by filling out the registration form in the “Download” area of the abovesaid website;
the following types of personal data of the data subjects are processed:
- first and last name;
- e-mail address;
- company;
- nationality;
- job title;
- phone number;
- mailing address.

The provision of your personal data is voluntary. It is, however, necessary and essential that you provide at least your first and last name and e-mail address in order to enable UMBRA to provide the services you have requested. If you do not provide this necessary information, UMBRA will not be able to issue you the information and/or documentation you requested. However, there will be no consequences if non-essential data is withheld.

The personal data you transmit to us will be used solely for the specific purposes indicated in Article 3 below.

In any case, UMBRA agrees to ensure that the information collected and used is appropriate for the purposes described, and that its collection does not determine an invasion of your personal privacy.

3. PURPOSES OF THE PROCESSING

The purposes for which your personal data are collected and processed within the framework of the management of the requests received by UMBRAGROUP from data subjects are as follows:
a) Acceptance and management of the requests for the release of company information received via the website’s “Contact us” form filled out by data subjects;
b) Acceptance and management of the requests by data subjects for registration with the website’s “Download” area, in order to obtain access to the company documentation kept there and the possibility to download it;
c) Sending and dissemination of company and Group communications (for example: on projects of national interest in which Umbra participates and/or which it backs; awards received; events organized or in which it participates; institutional company videos; television or radio segments; press review), as well as the sending of promotional, advertising, and soft marketing communications, i.e., merely by way of example: information about and/or invitation to events organized by UMBRA at the sites of the various Group companies or at third-party facilities, information about and/or invitation to trade fairs and events in which UMBRA participates, promotion of advertising and marketing events, offers regarding new products or services offered by UMBRA. The promo-advertising communication is customized on the basis of the data subject’s business sector and the interests and preferences expressed when participating in the Controller’s various initiatives; this is in order to avoid undesired mailings and those which, in any case, would be of little interest to the data subject.

The legal basis for the processing of your data may be found, alternatively, in the following:

• the performance of obligations deriving from a contract for the provision of services requested by the data subject;
• the legitimate interest of the Data Controller;
• the clear, specific, and freely given consent provided by the data subject, with regard solely to the purpose specified under letter c).

4. PROCESSING PROCEDURE AND OBLIGATION OF CONFIDENTIALITY

Your data are processed using IT and/or paper-based systems, by parties authorized by the Controller and committed to guaranteeing the confidentiality of the processing, using methods appropriate for the purposes and in any case capable of guaranteeing the security and confidentiality of the data. There will be no dissemination of your data to unspecified parties.

The processing of your personal data, within the limits of the pursuit of the marketing purposes stated in letter c) of Article 3 above, requires the expression of specific, freely given, and unambiguous consent in accordance with the indications given in the GDPR. If you do not give your consent, this will have no effect on the normal acceptance and management of your requests, but will simply prevent processing of your data for marketing purposes.

5. TRANSFER OF DATA TO EU AND NON-EU PARTIES

UMBRA may transfer some of your data to parties on which it relies for the performance of activities connected with the management of the services provided.

In particular, in order to achieve the purposes described in Article 3 above, as an integral part of the processing activities your data may be transferred to outside providers of IT services, as well as to outside consultants who will process your data in their capacity as Processors.

The list of Processors is kept up to date by the Internal Processing Representative, Administration and Finance Manager, and is available for consultation through that office.

Furthermore, the Controller may transfer your data both to parties to which it is bound by law to transmit them, and to the other Group companies located within the European Union, whether subsidiaries or affiliates.

6. STORAGE PERIOD

Your personal data will be kept by UMBRA:
- for pursuit of the purposes stated in letters a) and b) of Article 3 above, for a period of six months after their communication via the contact form and/or registration with the Download area;
- for pursuit of the marketing purposes, as per letter c) of Article 3 above, until the date of receipt of the communication of withdrawal of the consent previously given.
At the end of these time limits, your data will be erased.
In the case of a dispute in or out of court with the data subject and/or with third parties, the data will continue to be processed for the entire duration of the litigation, and in any case for as long as is necessary for the Data Controller to fully defend its rights.

7. YOUR RIGHTS AS A DATA SUBJECT

During the period in which UMBRA holds or processes your data, you, as the data subject, may exercise the following rights at any time:

• Right to access – You have the right to obtain confirmation of whether or not your data are being processed, as well as the right to receive all information concerning such processing;
• Right to rectification – You have the right to request the rectification of your data in our possession if they are incomplete or incorrect;
• Right to erasure – In certain circumstances, you have the right to request the erasure of your data present in our files;
• Right to restriction of the processing – Under certain conditions, you have the right to request a restriction of the processing of your data;
• Right to portability – You have the right to request the transfer of your data in our possession to a different Controller;
• Right to objection – You have the right to object to the processing of your data;
• Right to lodge a complaint with a supervisory authority – If UMBRA refuses to meet your requests for access, you will be informed of the reasons for said refusal. If you so decide, you have the right to lodge a complaint as described in Article 8 below;
• Right to withdrawal of the consent given.

Such requests may be sent to UMBRA using exclusively the following e-mail address: privacy.ugi@umbragroup.com.

8. COMPLAINTS

If you wish to lodge a complaint with regard to how UMBRA processes your data, or with regard to the management of a complaint you have lodged, you have the right to do so directly to the supervisory authority.

 The Controller

*** GRANTING OF CONSENT ***

With the granting of my consent, I hereby declare that I have carefully read and accept the terms of the above privacy policy statement, and that I specifically agree to the processing of my data for the pursuit of the marketing purposes indicated in Article 3, letter c). I therefore agree to receive e-mails with commercial and informational communications on the products, services, activities, promotions, events, initiatives, and advertising campaigns of UMBRAGROUP S.p.A.