Privacy policy for the sales network, resellers, installers and technical partners
The companies
URMET S.p.A., Urmet TLC S.p.A., Simon Urmet S.r.l., Urmet ATE
S.r.l., Aprimatic S.r.l., GLT S.r.l.
are part of a group of companies with the same shareholding structure, offering complementary and often integrated products and services.
Within this group of companies, URMET S.p.A. provides various services to the other companies in the areas of HR, ICT, marketing, and sales.
In particular, these companies, addressing the same network of retailers and installers of intercom, video intercom, video recording, alarm systems, home automation, and automation products, as well as the same technical partners promoting, advising, recommending, installing, performing maintenance, repair, and replacement of our products, act as Joint Data Controllers for the processing pursuing the following commercial and technical objectives:
· providing support services to retailers and installers;
· managing the commercial relationship with retailers and installers;
· sending useful information and technical and regulatory updates;
· proposing professional development and support initiatives;
· reminding or notifying deadlines and obligations;
· inviting to seminars, meetings, sessions;
· sending catalogs and other product presentation materials;
· sending technical, informational, and update documentation;
· admission to technical and value-added services;
· information about technical update initiatives and professional training;
· admission to seminars, courses, professional development sessions;
· proposing new products and services;
· preparation of practices for participation in tenders, competitions, etc.;
· conducting aggregate formative surveys.
Therefore, if you are a retailer or installer and come into contact with any of the above-mentioned Joint Data Controllers, it may happen that you are asked for some personal data. For this reason, we provide you with the following information:
Identity of the Joint Data Controllers
The Joint Data Controllers for the processing of personal data of data subjects are:
Urmet S.p.A., represented by its legal representative pro tempore, with registered office in via Bologna 188/C – Turin;
Urmet TLC S.p.A., represented by its legal representative pro tempore, with registered office in via Bologna 188/C – Turin;
Simon Urmet S.r.l., represented by its legal representative pro tempore, with registered office in via Bologna 188/C – Turin;
Urmet ATE S.r.l., represented by its legal representative pro tempore, with registered office in via Bologna 188/C – Turin;
Aprimatic S.r.l., represented by its legal representative pro tempore, with registered office in via Bologna 188/C – Turin;
GLT S.r.l., represented by its legal representative pro tempore, with registered office in via Bologna 188/C – Turin.
Contact details of the DPO – Data Protection Officer
The Data Controller of the processing, Urmet S.p.A., has appointed the Data Protection Officer, who can be reached at the Data Controller's headquarters or contacted via email at the address dpo@urmet.it.
Source of data and type of collected data
a) The Data Controllers collect personal data provided voluntarily by the user at the time of registration on the website of any of the Data Controllers or when performing a transaction through the website, in addition to other personal data associated with order processing. This personal data includes: Title, first and last name, company name, VAT number (if applicable), email address, username and password, shipping and billing address (including postal code, city, and country), phone and fax number, type and quantity of ordered products, order date, order processing status, date and time of delivery, order value, currency, payment information, return requests, or user offers, and the following information provided voluntarily by the user: how they became aware of the website, company data, number of employees, and, for corporate customers, the founding date of the company (collectively "transaction data").
b) The Data Controllers also collect data on user website usage, such as IP address, viewed products; if the user arrives at the website through a referral page or a link in a promotional email or advertisement on another website that redirects to a Data Controller's website. The Data Controllers may also collect information about the referral page and promotional email or targeted advertisement along with the user's IP address to analyze the effectiveness of marketing operations (collectively "usage data").
Purpose of processing
Personal data is processed by the Data Controllers for the following purposes:
1) Transaction data will be used to process orders, manage payments, communicate with the user regarding the order, handle product returns, customer assistance requests, and perform product withdrawals. They will also be used to acquire pre-contractual data and information; exchange information aimed at the execution of the contractual relationship, including pre- and post-contractual activities; make requests or fulfill received requests; manage accounting and tax obligations.
2) Transaction data will also be used to send personalized messages to the data subject or invitations to review products; usage data, in the case of registered customers, will be used together with transaction data (excluding payment information) to display personalized products on the website based on user-expressed interests.
3) If the user requests the sending of marketing communications and newsletters, their transaction data and usage data will be analyzed by the Data Controllers to send personalized commercial communications based on the indicated preferences.
4) Finally, the data will be used to manage and control risks, prevent possible fraud, insolvencies, or non-compliance; prevent and manage potential disputes, and resort to legal action if necessary.
Legal basis for processing
The legal basis for processing is as follows:
. Processing is necessary for the performance of a contract to which the data subject is a party or for the execution of pre-contractual measures taken at the request of the data subject, as far as the processing listed in point 1) is concerned;
. The data subject has given consent to the processing of their personal data for one or more specific purposes, as far as the processing listed in point 2) is concerned;
. Execution of pre-contractual measures taken at the request of the data subject and legitimate interest of the data controller (maximizing the effectiveness of communications), as far as the processing listed in point 3) is concerned;
. Processing is necessary for the pursuit of the legitimate interest of the data controller (protection and prevention of fraud and insolvencies), as far as the processing listed in point 4) is concerned.
Data recipients
Personal data processed by the Data Controllers is not disclosed, meaning it is not made known to indeterminate subjects in any possible form, including making it available or simply consulting it. Instead, it may be communicated to employees working for the Data Controllers or to authorized subjects for processing under the authority of the data controller. In this regard, Urmet S.p.A. has entrusted third-party service providers with respect to the operation of the website, such as hosting service providers, marketing and website service providers, IT maintenance service providers, shipping services, and VAT verification services, as well as service providers that allow the integration of other functions into the website that the user can use at their discretion, such as chat tools or the product review function. These service providers, designated as Data Processors, are only provided with the personal data they need to deliver their respective services, and they are not allowed to use or disclose the personal data of the data subjects for other purposes without the prior authorization of the data subject.
If the data subject requests the sending of marketing communications and newsletters from one of the Data Controllers, their name, email address, and other transaction and usage data will be shared to analyze the user's interests and send personalized commercial communications based on the indicated preferences.
The user's transaction data is shared to allow them to manage any product withdrawals and for the Data Controllers to contact the user in this eventuality.
They may also be communicated, to the extent strictly necessary, to subjects who, for the purpose of processing your requests, must provide goods or perform services on behalf of the Data Controllers. Finally, they may be communicated to subjects authorized to access them by virtue of legal provisions, regulations, and community regulations.
In particular, based on the roles and job duties performed, employees have been authorized to process your personal data within the limits of their competencies and in accordance with the instructions given to them by the Data Controllers.
External subjects operating under the authority of the Data Controllers have also been appropriately authorized based on the type of service provided, the processing carried out, and the nature of the data processed.
External subjects to whom the Data Controllers have entrusted the processing of personal data have been designated as Data Processors.
Data Transfer
Under no circumstances do the Data Controllers transfer your personal data to third countries or international organizations.
However, they reserve the possibility of using cloud services; in which case, service providers will be selected from those who provide adequate guarantees, as provided for in Article 46 of GDPR 679/16.
Data Retention
The Data Controllers retain and process your personal data for the time necessary to fulfill the specified purposes. Subsequently, personal data will be stored, and not further processed, for the period established by current provisions in civil and tax law.
Rights of the Data Subject
With reference to Articles 15 - right of access, 16 - right to rectification, 17 - right to erasure, 18 - right to restriction of processing, 20 - right to data portability, 21 - right to object, 22 - right not to be subject to automated decision-making of GDPR 679/16, you can exercise your rights by writing to the Data Controller Urmet S.p.A. at the address above, or by email at dpo@urmet.it, specifying the subject of the request, the right you intend to exercise, and attaching a copy of an identity document that attests to the legitimacy of the request.
The Data Controller particularly reminds that each data subject can exercise the right to object in the forms and manners provided by Article 21 of the GDPR.
Further information on the rights of the data subject is provided at the bottom of this section.
Withdrawal of Consent
With reference to Article 7 of GDPR 679/16, the data subject can withdraw the consent given at any time.
However, some processing covered by this information (points 1) and 4)) is lawful and allowed, even in the absence of consent, as it is necessary for the execution of a contract of which the data subject is a party, or for the fulfillment of his requests, or to pursue the legitimate interests of the data controller.
The withdrawal of consent, where applicable, may limit or compromise the methods of interaction and communication of the customer or user with one or more Data Controllers.
Submission of Complaint
The data subject has the right to submit a complaint to the supervisory authority of the state of residence.
Refusal to Provide Data
Data subjects cannot refuse to provide the Data Controllers with personal data necessary to comply with the legal regulations governing commercial transactions and taxation.
The provision of additional personal data may be necessary to improve the quality and efficiency of the transaction.
Therefore, refusal to provide data required by law will prevent order processing. The additional data indicated in point a) of the "Source of Data and Type of Data Collected" paragraph is provided voluntarily; however, if the data subject decides not to provide the requested data, one or more Data Controllers may not be able to provide services, allow the completion of the transaction through the website, or process the order.
The data indicated in point b) is provided voluntarily by the data subject, and if the data subject decides not to provide the requested data, the provision of products and services will not be compromised.
Automated Decision-Making Processes
In no case do the Data Controllers carry out treatments consisting of automated decision-making processes on your data.