Notice on the processing of Customer data

pursuant to Articles 12, 13, and 14 of Regulation 2016/679/EU

The company TECNOBODY S.P.A. (hereinafter "Data Controller"), Tax Code and VAT Number 02323900163, represented by its legal representative, Mr. Alessandro Carminati, with registered and operational office in Dalmine (BG), Via Lodi No. 10, in its capacity as the "Data Controller," informs you that your personal data will be collected for the establishment and management of the contractual relationship between our company and the Customer, concerning the design, production, sale, installation, and assistance of medical devices and products in the field of motor rehabilitation, as requested by you and more specifically outlined in its Statute. These data will be processed in compliance with Articles 12, 13, and 14 of Regulation 2016/679/EU, in order to ensure the rights, fundamental freedoms, and dignity of individuals, particularly with regard to privacy and personal identity. The personal data may refer directly to the customer, an individual person, or a sole proprietorship, or may consist of information referring to individuals who represent, belong to, or are otherwise linked to the customer in any way, whether the customer is an individual or legal entity, or another public or private entity.
We inform you that if the services provided to you involve the processing of personal data of third parties under your control, it will be your responsibility to ensure that you have fulfilled the requirements of the regulations concerning the data subjects, in order to make their processing by us legitimate.

Let me know if you need further adjustments!


Origin, Purpose, Legal Basis, and Nature of the Data Processed

The processing of personal data provided by the Customer is carried out by the company TECNOBODY S.P.A. to fulfill obligations arising from legal provisions, regulations, EU legislation, as well as for the establishment, management, execution, and generally for the fulfillment of the contractual or pre-contractual relationship with the Customer (also referred to as the Company) that you represent, and is aimed at:

a) Personal data, banking details, tax and accounting information, navigation data, photographs, PEC address, CNS, and SDI code, yours, your Company’s, the personal data of individuals (Data Subjects) who work for you and your Company, and third parties, communicated to us by you or on behalf of the Customer, processed in order to fulfill legal obligations related to invoicing and administration in accordance with current regulations, regulations, EU legislation, and provisions issued by authorities authorized by law;
b) Personal data, banking details, tax data, navigation data, photographs, and PEC address, yours, your Company’s, the personal data of individuals (Data Subjects) who work for you and your Company, and third parties, communicated to us by you or on behalf of the Customer, processed in order to fulfill the contract to which the Customer is a party and all related pre-contractual and contractual activities, commercial, organizational, accounting, and tax purposes, strictly related and instrumental to the execution of the contract or anything else you may request;
c) Data related to communication forms, including interactive ones, that can be used for exchanging information with the company TECNOBODY S.P.A., such as email addresses, fixed and mobile phone numbers, accounts for communication tools via PC, tablet, smartphone using a data or internet connection, to enable communication between our company and the Customer;
d) Personal data and data related to communication forms, including interactive ones, used for marketing and/or promotional activities through traditional and automated contact methods, aimed at promoting the products and services marketed by the Company.

Additionally, your personal data and that of individuals working for the Customer, collected from third parties, may be processed for the purposes outlined above and in compliance with applicable laws, as well as within the limits of legal obligations and as directed by the competent judicial authority, or as expressly required by specific regulatory obligations of TECNOBODY S.P.A.


Communication of Data to Third Parties

The communication of the collected personal data is provided for by legal obligations, to fulfill the requirements requested by the Customer, or inherent to the pre-contractual and/or contractual relationship, as well as to follow up on any delegations granted by the Customer and to comply with specific requests from the Customer.

In relation to these purposes, your personal data will be communicated, if necessary, to:

- External parties acting as Data Controllers, such as authorities and supervisory and control bodies, law enforcement or judiciary, and generally entities, both public and private, authorized to request the data or that may access it by virtue of legal provisions, regulations, or EU legislation, within the limits set by such rules.
- Employees and collaborators of the Data Controller tasked with processing the data for the purposes indicated in this notice.
- External parties designated as "Data Processors" who carry out specific activities on behalf of the Data Controller. For example: activities carried out by external consultants and/or professionals, including in association, for the fulfillment of tax and accounting, insurance, regulatory obligations, collections and payments, IT system and software maintenance and assistance, transport services, freight forwarders and companies operating in the transport sector, audit and control companies, and, more generally, companies performing outsourcing activities on behalf of the Data Controller. The updated list of data processors is kept at the operational headquarters of the Data Controller.
- External parties or offices for the fulfillment of required obligations such as, for example, the Revenue Agency, Social Security Institutes, Labor Inspectorates, Public or Private Offices.
- Subsidiaries, affiliates, or companies connected to the Data Controller in order to fulfill the pre-contractual and contractual relationship.

These entities, appointed or responsible, act as Recipients of the processing or are themselves Data Controllers of the personal data transmitted to them. TECNOBODY S.P.A. provides them, where required, with appropriate operational instructions, particularly regarding the adoption and compliance with security measures, in order to ensure the confidentiality and security of the data.
In the event that your personal data, or personal data of third parties under your control, need to be communicated to external companies, selected from time to time, TECNOBODY S.P.A., as Data Controller, will explicitly inform you in writing about the recipients of the processing, to whom only the necessary data for their requested activities will be transmitted.
In reference to personal data protection aspects, the Customer is invited, in accordance with Article 33 of the European Regulation 2016/679, to report to TECNOBODY S.P.A., as Data Controller, any circumstances or events that could lead to a potential "personal data breach" in order to allow immediate assessment and the adoption of any actions aimed at counteracting such an event.
Such a report can be made by sending a communication to TECNOBODY S.P.A. at the email address: privacy@tecnobody.it
The obligation of TECNOBODY S.P.A., as Data Controller, to communicate data to Public Authorities upon specific request remains unchanged.


Transfer of Data Abroad

Personal data may be transferred to countries and international organizations within the European Union (EU) and the European Economic Area (EEA), and, as a rule, will not be transferred to countries or international organizations outside the EU or the EEA (third countries). However, if necessary for the purposes outlined in this notice, data may be transferred to third countries. In such cases, to ensure an adequate level of protection of personal data, the transfer will take place in accordance with Articles 44 et seq. of EU Regulation 2016/679 (GDPR), or to third countries for which the European Commission has issued adequacy decisions, based on Standard Contractual Clauses approved by the European Commission, or in accordance with specific exceptions provided for by the GDPR. For the processing of information and data that will be communicated to these entities, equivalent protection levels adopted for the processing of personal data of their employees will be required. In any case, only the data necessary for achieving the intended purposes will be communicated, and the regulatory instruments provided by Chapter V of the GDPR will be applied. You may request further information regarding the data transfers by sending an email to the Data Controller.


Methods, Logic of Processing, and Retention Periods

Your data is collected and recorded lawfully and fairly for the purposes outlined above, in compliance with the principles of Article 5, paragraph 1 of the GDPR.
The processing of personal data occurs using both paper-based and electronic methods, through manual, computer-based, and telematic tools, with logic strictly related to the purposes themselves and, in any case, in a manner that ensures the security and confidentiality of the data, through operations such as collection, recording, organization, storage, consultation, processing, modification, selection, extraction, comparison, use, interconnection, blocking, communication, deletion, and destruction of the data.

Personal data will be processed by TECNOBODY S.P.A., as Data Controller, for the entire duration of the pre-contractual and/or contractual relationship and also afterward, in order to enforce or protect its rights, for administrative purposes, or to comply with obligations arising from the regulatory and legal framework in force, and in compliance with specific legal obligations for data retention. These data may be stored for the time necessary to provide the service, to achieve the purposes for which they were collected, and to manage similar future requests, in accordance with the principles of lawfulness, fairness, non-excessiveness, and operability established by current privacy regulations.


Nature of the Provision of Data

In relation to the purposes outlined in points a), b), and c) of this notice, the provision of personal data is essential for the execution of the contractual and pre-contractual relationship between the Customer and TECNOBODY S.P.A., as well as for enabling the latter to comply with the requirements set by applicable regulations: without such personal data, it is impossible to establish and maintain the pre-contractual and contractual relationship between the Customer and TECNOBODY S.P.A.
For this reason, consent to the processing of data is not required under Article 6 of the European Regulation 2016/679, as the processing of personal data occurs based on the provisions of Article 6, paragraph 1, b) and c) of the European Regulation 2016/679.
In relation to the purpose indicated in point d) of this notice, providing your data is optional. Consent is, in fact, required under Article 6 of the EU Regulation 2016/679 for the processing of personal data related to marketing activities.


Rights of the Data Subject

In accordance with and within the limits and conditions established by the regulations regarding the protection of personal data concerning the exercise of the rights of Data Subjects (Chapter III of the European Regulation 2016/679) with respect to the processing activities described in this Notice, each Data Subject has the right to:

  • Request confirmation as to whether or not their personal data is being processed;
  • Access personal data concerning them and the information related to such data;
  • In relation to the personal data concerning them, request rectification, completion of incomplete data, and, where possible, deletion, as well as notification of the rectifications and deletions to those to whom the data has been transmitted;
  • Request restriction of processing in the cases provided by the law;
  • Obtain the portability of their personal data, i.e., receive them from the Data Controller in a structured, commonly used, and machine-readable format, also for the purpose of transmitting them to another data controller, in cases where the legal basis of the processing is the contract or consent, and the processing is carried out by automated means;
  • Object at any time to the processing of their data and, specifically, object to decisions that concern them if based solely on automated processing of their data, including profiling;
  • Lodge a complaint with the supervisory authority (in Italy, the Garante Privacy) under Article 77 of the GDPR, if they believe that the processing concerning them violates the provisions of the Regulation.

The Data Subject may exercise their rights concerning privacy and the protection of personal data by requesting the appropriate form from TECNOBODY S.P.A., completing it, and sending it by email to privacy@tecnobody.it, or by registered mail to the address of the Data Controller.

Best regards,
TECNOBODY S.P.A.