PRIVACY POLICY PERSUANT TO ART. 13 OF EU REGULATION 679/2016 
about potential customers’ and users’ data protection on social media  

Dear Data Subject, 
this information is focused on the treatment of personal data pursuant to article 13 of EU Regulation 679/2016 (described below as GDPR).

1. Joint Controllers of the treatment * 
Technoform Glass Insulation Italia S.r.l.
Viale Europa, n. 30, 20047 Cusago (MI) 
Telephone: 02 9016 561 
E-mail: privacy [dot] oesit [at] technoform [dot] com (privacy[dot]oesit[at]technoform[dot]com)

Technoform Bautec Italia S.p.A.
Via Settembrini n. 80, 20045, Lainate (MI) 
Telephone: 02 937 5721 
E-mail: privacy [dot] oisit [at] technoform [dot] com (privacy[dot]oisit[at]technoform[dot]com)

*The main content of the joint controllership agreement, according to article 26 of GDPR, will be at disposal of the person concerned). 

2. Data categories processed  
The categories of the “personal data” (former art. 4.1 of GDPR) processed by the joint controllers might include, for example: 
- Personal and identifying information (such as, for example, name, surname, etc); 
- Contact details (such as, for example, address, e-mail address, telephone number, etc); 
- Personal data on pre-contractual activities; 
- Special categories of data.

3. Purposes and legal basis of personal data treatment  
3.1 Purposes aiming at implementing a contract or pre-contractual (former article 6 paragraph 1, letter b of GDPR) 
The legal basis of your personal data processing complies with Article 6, paragraph 1, letter b of GDPR.

a. Performance of the pre-contractual activities of each Co-controller;

b. Performance of recruitment activities;

Data will be processed only for the period necessary to fulfil the purposes for which it had been collected.  

3.2 Purposes to comply with legal obligations  
Activities required by legal obligations related to recruitment. 

Data are processed for the time that is strictly necessary to fulfil for which it had been collected, until the end of the period of recruitment, except as indicated in each disclosure that the co-controller interested in the recruitment will release.

3.3 Purposes based on the Data Subject's consent (former Article 6, paragraph 1, letter a of GDPR)
Personal data may be processed to define the objectives that lead the involved Party to give his consent.

a. Answer to requests or questions received and sent to the contacts on the social media listed below, even with chats and comments, to get information on our products, on our companies and also to enable each co-controller to send quotations.

Data will be retained within the strictly necessary time to achieve the purposes for which it has been collected, but in any case, for a period no longer than 24 months. 

Any confirmation of your personal data is optional for the above mentioned purposed. Nevertheless, the handling of your data is unavoidable if you wish to visit our social media pages or if you want to receive an answer from our side.

4. Data processing methods 
As owner of the social media page, we can visit only your public profile and the information available depending on how your user’s profile settings (i.e. your name and your user’s profile image). We will process your data also when you contact us directly on our page. We process your personal data with the aim to reply to your posts. 

Data will be processed by employees and/or cooperators of the joint controllers, exclusively selected as authorized persons to process data ex article 29 GDPR (such as for example:  people in charge of human resources, legal office, administrative department, compliance and risk management and IT services) or external entitled people for data processing as indicated in article 28 of GDPR, whose names will be available at request to the Controller. 

The data processing will be conducted exclusively both on paper and with electronic automated means. Data will be collected thanks to your visit on our social media pages, even if you do not have user profile or you have not logged in.

5. Recipients or categories of recipients of personal data (former Article 13 paragraph 1, letter e of our GDPR) *
Taking into account the above-mentioned purposes, the co-controllers of the agreement, could communicate your data to: 

• Offices and internal roles of the co-controllers;
• Companies and professional operators that supply IT services, including electronic data processing, software management, websites management and IT-consultancy, including mailing companies and hosting providers;
• Companies or professionals in the field of communication and marketing; 
• Professionals or professional bodies of legal, administrative, accounting and fiscal fields; 

• Companies of Technoform group.

  
  * Further information about recipients (previous article 4.9 of GDPR) is available at sites of the personal data processing co-controllers indicated above.

It might occur that some information collected may be processed also outside the European Union. To ensure an adequate level of data protection, the managers of their social media platform base the data processing mainly on adequacy decisions (such as, Meta Platforms Inc. and Microsoft Corporation). In case this adequacy decision might not occur, the co-controllers will endeavour to activate further safeguard mechanisms. 

6. Rights of the interested party 
The Interested party, in relation to the personal data object of this present disclosure, have the right to exercise their rights stipulated by the EU Regulation listed hereunder:

• Right of access of the interested party [Article 15 of EU Regulation] (it involves the possibility to be informed about the treatments conducted on its personal data and in case to receive a copy of it);
• Right of correction of its personal data [article 16 of the EU Regulation] (the interested party has the right to rectify incorrect personal data concerning itself); 
• Right of cancellation of its personal data without undue delay (“right to be forgotten”) [article 17 of the EU Regulation] (the interested party, has, and will have, the right to delete its personal data);
• Right to restrict processing of personal data in the cases referred to in article 18 of the EU Regulation, including illicit data processing or contestation of the interested party on the inaccuracy of the personal data [article 18 of EU Regulation];
• Right data portability [article 20 of EU Regulation], (the interested party could ask for its personal data in a structured format in order to send it to the other Owner, as in the cases illustrated in the same article); 
• Right to object to the processing of personal data [article 21 of EU Regulation] (the interested party, has, and will have, the right to oppose to personal data processing in the cases indicated and ruled by article 21 of EU Regulation);
• Right not to be subjected to automated decision-making [Article 22 of EU Regulation] (the interested party has, and will have, the right not to be subjected to a decision based exclusively on automated processing).

You may obtain additional information about the rights of the interested party by asking a complete extract of the articles above mentioned. As per the objectives, for which the consent may be requested, the interested party could withdraw its consent at any time and its effects will be applied starting from the moment of annulment, except for the terms required by law. Generally speaking, the withdrawal of the consent is valid only for the future. 

The rights indicated above, could be put into practice as required by the Regulatory, sending even an email to the following addresses: privacy [dot] oesit [at] technoform [dot] com (privacy[dot]oesit[at]technoform[dot]com) and privacy [dot] oisit [at] technoform [dot] com (privacy[dot]oisit[at]technoform[dot]com).

Following article 19 of the EU Regulatory, the Owner informs all addressees, to whom the personal data has been communicated, the possible changes, cancellations or restrictions of the treatment requested, wherever reasonably possible. 

7. Right to lodge a complaint (previous article 13, paragraph 2 (letter d) of GDPR)
The interested Party, in case it considers that its rights have been threatened, has the right to lodge a complaint to the Antitrust Authority. For any further information about its rights and the exercize of them please refer to http://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/4535524 or send a written communication to the Antitrust Authority to protect its personal data.  

8. Possible consequences in case of lack of data communication and nature of the nature of data (previous article 13 paragraph 2 (letter e) of GDPR)
8.1 In case of fulfilment of law and contractual obligations 
We inform you that in case the objectives of the processing have a legal or contractual obligation (or pre-contractual) as legal basis, the interested party necessarily must provide the requested data. Otherwise, there is an impossibility for the Co-ownercontrolles to proceed with pursue of the specific objectives of the data processing. 

8.2 In case of consent of the interested party 
We inform you that the objectives above mentioned have as legal basis the consent and, in reference to these aims, the interested party could withdraw its consent at any time, and its effects will be valid from the withdrawal and forth, except for the terms provided for by the law. Generally speaking, the withdrawal of consent will affect only in the future. Therefore, the data processing that took place before the revocation will not be concerned and will still be valid.

The lack or partial consent (or its withdrawal) may not ensure the fulfilment of the whole services and activities, concerning only the objectives for which the consent has been refused, and it won’t represent any prejudice or impediment to other purposes (and the activities connected to them) not clearly involved or interested in the negation of consent or not founded on that specific legal basis.

Please note that in case of a request of additional information, even if the consent of the personal data processing is free and optional, it is considered necessary to answer to it. Therefore, sending the request or a similar manifestation of intent will be considered as granting approval, that will always be possible to withdraw following the consequences listed above.

When the data is no longer necessary it is regularly cancelled, if its cancellation will not be possible or in case it involves excessive effort due to a peculiar storage method, the data could not be processed, and it will be saved in non-accessible areas.

9. Existence of automated decision-making processes (including profiling)
It is currently excluded the use of automated decision-making processes as indicated in article 22 of GDPR. If these processes may be instituted in the future for single cases, the interested party will be notified separately if required by law or in case of update of the present disclosure.