Customer Privacy Notice

PRIVACY NOTICE PURSUANT TO ARTICLES 13, 14 AND 26 OF REGULATION (EU) 2016/679 ("GDPR" OR "REGULATION") 

Pursuant to the applicable legislation on the protection of personal data, CRIBIS s.r.l., with its registered office at Via dei Valtorta 48, 20127 Milano, Tax Code and VAT No. 01691720468, and CRIF S.p.A., with its registered office at Via della Beverara 21, 40131 Bologna, Tax Code and VAT No. 02083271201, as joint controllers pursuant to Article 26 of the GDPR (the "Joint Controllers") in respect of the processing of your personal data, are required to provide you with certain information concerning their use. For these purposes, processing means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction. 

1 - Source of personal data 

Personal data concerning you held by the Joint Controllers are collected directly from you or from third parties, including by electronic means, in connection with the performance of the Services provided by the Joint Controllers from time to time and/or the sending of commercial communications, where you have formally given your consent. the Joint Controllers may also collect, through tracking pixels and similar technologies embedded in email communications, information on the opening of messages, the date and time of interaction, the IP address and the technical characteristics of the device or email application used, as well as clicks on links and interactions with the content of the communication, within the limits and for the purposes set out in this Privacy Notice. 

2 - Purposes of the processing of personal data 

2.1 - Necessary Purposes 

The Joint Controllers process personal data in the ordinary course of its business for the following purposes: 

1. a) "operational": purposes strictly connected with the provision of the Services provided by the Joint Controllers from time to time (e.g. obtaining information prior to entering into a contract, obtaining documentation and information for the performance of ongoing activities, preliminary contacts for information on the Service, reminders to send materials and signed contractual documentation, settlement of fees, etc.);
2. b) "mandatory": purposes connected with obligations laid down by laws, regulations and Union legislation, as well as requirements imposed by authorities empowered to do so by law.

The provision of personal data for these purposes is necessary and the relevant processing is based on Article 6(1)(b) and (c) of the GDPR and does not require your consent. Refusal to provide such data makes it impossible to comply with the obligations imposed by law and arising from the Services provided by the Joint Controllers from time to time, with the further consequence that such Services cannot be provided. In communications relating to the relationship, the Joint Controllers may also use tracking pixels and similar technologies, without requesting specific consent pursuant to Article 122 of Legislative Decree No. 196/2003 (Personal Data Protection Code), solely to the extent strictly necessary: (i) for security or authentication purposes, such as confirming logins, activations or changes to credentials; (ii) to verify that recipients have actually taken notice of institutional or service communications which the Joint Controllers are required to send or which are necessary for managing the relationship; (iii) to produce exclusively aggregated and anonymised statistics, without individual tracking. In such cases, the Joint Controllers applies data minimisation measures and, for statistics, techniques designed to prevent identification or the attribution of results to an individual recipient. 

2.2 - Additional Purposes 

The Joint Controllers also process personal data in the ordinary course of its business for the following purposes: 

1. c) purposes supporting the Joint Controllers' business, for which you, in your capacity as a data subject ("Data Subject"), may choose whether or not to give consent.

The following activities fall within this category: 

(i) commercial promotion or initiatives otherwise connected with the business of the Joint Controllers and CRIF Group companies, including by means of automated calling systems (such as, by way of example, SMS, MMS, email, newsletters and fax). With regard to communications sent by email, consent also covers the use of tracking pixels and similar technologies to detect, in relation to each individual recipient, the opening of messages, clicks on links and interactions with their content, including for the purpose of measuring the effectiveness of communications and making them more relevant to the interests expressed. 

The provision of personal data for this purpose is optional and the relevant processing requires the consent of the data subjects; refusal to give consent has no consequences. Failure to give consent prevents the use of individual tracking for marketing purposes, but does not affect the provision of services or the sending of necessary, institutional or service communications. Where consent to promotional communications has been given, the Data Subject may subsequently withdraw it in full or disable individual tracking only, while continuing to receive promotional communications without tracking pixels or tracked links, by using the link or preference centre made available in the communications or by writing to dirprivacy@crif.com or dirprivacy@cribis.com. 

Any further processing for different purposes is excluded. 

3 - Storage periods 

3.1 With reference to the processing referred to in Section 2.1, "Necessary Purposes", your personal data will be stored for a period of 10 years following the termination of the existing contractual relationship, for the purposes described therein. This period is determined by compliance with the applicable tax and accounting legislation. 

3.2 Conversely, with reference to Section 2.2, "Additional Purposes", your personal data will be processed and stored for a maximum of 5 years or until you decide to withdraw the consent given for the purposes described therein. You may withdraw your consent to the processing of personal data for the purposes set out in Section 2.2, "Additional Purposes", at any time by writing to the following email address: dirprivacy@crif.com or dirprivacy@cribis.com. Data collected through tracking pixels and similar technologies for marketing purposes are stored for the same period as that applicable to marketing consent and, in any event, no longer than until such consent is withdrawn or tracking alone is disabled; from that point onwards, individual tracking will no longer be carried out in subsequent communications. 

4 - Methods of processing 

Data are processed using manual, IT and electronic communication tools, in accordance with procedures strictly related to the purposes concerned and, in any event, in a manner that ensures the confidentiality and security of the data. Email communications may contain invisible images or other technical markers (tracking pixels) and tracked links which, when a message is opened or an interaction takes place, transmit to the Joint Controllers the information specified in Section 1. Where processing is carried out for aggregated and anonymised statistics, the markers are not differentiated for each individual recipient and any additional technical data are processed using measures designed to prevent their attribution to the data subject. 

5 - Categories of persons or entities to whom personal data may be disclosed or who may become aware of them 

5.1 To pursue the purposes described in Section 2.1, "Necessary Purposes", and Section 2.2, "Additional Purposes", of this Privacy Notice, the Joint Controllers need to disclose personal data in Italy to third parties belonging to the following categories: 

1. a) persons or entities providing data processing services necessary for the performance of assignments received from customers;
2. b) persons or entities carrying out archiving and data entry activities;
3. c) persons or entities providing banking, financial and insurance services;
4. d) persons or entities carrying out accounting, control and audit activities in relation to the activities undertaken by the Joint Controllers;
5. e) CRIF Group companies.

Personal data may be disclosed to other companies within the group to which the Joint Controllers belong, with registered offices outside the European Economic Area, in performance of the contractual obligations undertaken and subject to the conditions set out in Chapter V of the GDPR. In particular, such transfers may take place without specific authorisation where the third country to which the data are transferred is among those which, according to the European Commission, ensure an adequate level of protection. In the absence of such an adequacy decision adopted by the European Commission, transfers to clients or other recipients located in third countries may be carried out by adopting and documenting the appropriate safeguards referred to in Article 46 of the Regulation on the basis of which the personal data are transferred. In the absence of an adequacy decision or appropriate safeguards, transfers of personal data to clients or other recipients located in third countries may be carried out where the conditions and further requirements laid down in the GDPR are met, including the possibility of relying, in specific situations, on the derogations provided for in Article 49 of the GDPR. 

6 - Rights of the Data Subject 

Pursuant to Chapter III of the GDPR, you, as a Data Subject, have the right to: (i) obtain confirmation as to whether or not personal data concerning you are being processed and obtain the information listed in Article 15 of the Regulation; (ii) obtain the rectification of inaccurate personal data concerning you or have incomplete personal data completed; (iii) obtain the erasure of personal data concerning you, pursuant to and subject to the provisions and limitations of Article 17 of the Regulation; (iv) obtain restriction of processing of your personal data in the cases specified in Article 18 of the Regulation; (v) receive personal data concerning you in a structured, commonly used and machine-readable format, in the cases provided for in Article 20 of the Regulation; (vi) object to the processing of your personal data, pursuant to and subject to the provisions and limitations of Article 21 of the Regulation; (vii) withdraw your consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal; (viii) not be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you, pursuant to Article 22 of the Regulation. 

7 - Joint Controllers 

7.1 The Joint Controllers are CRIBIS s.r.l., with its registered office at Via dei Valtorta 48, 20127 Milano, Tax Code and VAT No. 01691720468, and CRIF S.p.A., with its registered office at Via della Beverara 21, 40131 Bologna, Tax Code and VAT No. 02083271201. By means of an arrangement pursuant to Article 26 of the GDPR, the Joint Controllers have determined their respective responsibilities, in particular as regards the exercising of the rights of the Data Subject and their respective duties to provide the information referred to in Articles 13 and 14 of the GDPR. The essence of the arrangement is available on request using the contact details below. The full list of Processors is available at the Joint Controllers' registered offices. Irrespective of the terms of the arrangement, the Data Subject may exercise their rights in respect of and against each of the Joint Controllers. You may exercise your rights under Chapter III of the GDPR through the following channels: 

• For CRIBIS s.r.l.: Email: dirprivacy@cribis.com; Certified email (PEC): cribis@pec.crif.com.
• For CRIF S.p.A.: Email: dirprivacy@crif.com;
• For CRIF S.p.A.: Certified email (PEC): crif@pec.crif.com. 

7.2 You may also lodge a complaint with the Italian Supervisory Authority (Garante per la protezione dei dati personali), following the instructions available at: http://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/4535524. 

8 - Data Protection Officer 

For any questions concerning the processing of your personal data, you may contact the Data Protection Officer using the following contact details: 

• For CRIBIS s.r.l.: Email: dirprivacy@cribis.com; Certified email (PEC): cribis@pec.crif.com.
• For CRIF S.p.A.: Email: dirprivacy@crif.com; Certified email (PEC): crif@pec.crif.com.