Urmet S.p.A, owner of this website, as Data Controller, in compliance with Articles 12 and 13 of the General Data Protection Regulation (GDPR 2016/679), provides users with information relating to the processing of their personal data through the information provided below.
The general information can be consulted at https://privacy.urmet.com
Cookie and website navigation information
This website belongs to Urmet SpA, which processes the data collected through the site in its capacity as Data Controller.
The Data Controller guarantees the security, confidentiality and protection of the data in its possession, or data that will come into its possession, at any stage of the processing, in compliance with the rules established by GDPR 2016/679 and in compliance with business secrecy.
This information is provided, pursuant to Article 13 GDPR 2016/679 – “European Regulation on the protection of personal data”, to users accessing and viewing the website.
This cookie and navigation information therefore describes the ways in which Urmet SpA uses cookies and similar technologies to collect and store information when the user visits the website or receives emails from the Data Controller.
The website may provide links or references to other third-party websites over which the Data Controller has no control. Such links, if present, are provided for the convenience of users of this website and the Data Controller shall have no liability in relation to such websites, and does not provide any indications regarding the accuracy or completeness of the information contained therein.
Data Controller
The data controller is Urmet SpA, with registered office in via Bologna 188/C – 10154 Turin (TO), tel: 0112400000.
Data Protection Officer (“DPO”)
To ask questions about this privacy policy or about how the data are managed, contact the Data Controller's Data Protection Officer (DPO) at dpo@urmet.com
Source and type of data processed
The website acquires information provided directly by the user when browsing the website which falls into the following categories: IP addresses or domain names used by visitors to connect to the website, the URI (Uniform Resource Identifier) addresses of the requested resources, the time of the request, the method used to submit the request to the server, the size of the file obtained in response, the numeric code indicating the status of the response given by the server and other parameters relating to the operating system and the user's IT environment.
Processing methods
During their normal operation, the computer systems and software procedures used to operate this website acquire, some personal data whose transmission is implicit in the use of internet communication protocols.
Through processing and association with data held by third parties, this information, by its very nature, may allow users to be identified.
This information is not collected in order to be associated with identified data subjects but, by its very nature, through processing and association with data held by third parties, may allow users to be identified.
Policy on cookies, pixel tags and JavaScript tags
The website uses various types of cookies, in addition to pixel tags and/or JavaScript tags, to collect and store certain information about the user. A cookie is a small data file that the website sends and saves on the hard disk of the user's computer and/or device (hereinafter both referred to as "computer"); subsequently, when the user accesses the website, the cookies saved on the computer will send information to the entity that sent them.
Purpose of using cookies
- Session cookies store relevant information along with the user's IP address and cookie identifier. These cookies are associated with activities necessary for the use of the website (for example, they are used to navigate the website without having to re-enter login data) and are then deleted from the user's computer once the browser is closed.
- Permanent cookies are stored on first access to a website, in order to recognise the user as a visitor. This cookie is updated with a date and time stamp every time the user returns to the website, and stores information about the pages viewed to potentially show the user personalised information based on previously detected preferences. Permanent cookies remain on the user’s computer after the browser has been closed, but they can be deleted at any time using the browser settings.
- Cookies are also divided into "first-party cookies" and "third-party cookies".
- First-party cookies are set directly on the user's computer, with the sole purpose of recognising the user on subsequent visits.
- Third-party cookies are sent by an independent service provider acting on behalf of the Data Controller and may be used by such third-party service provider to recognise users when they visit the website or third-party websites. Although the Data Controller may allow third-party service providers to access the website to send these cookies to users' computers in accordance with applicable laws, as illustrated in this Cookie Policy, the Data Controller does not have any control over the information collected by the cookies nor does it retain access to such data, which are immediately disclosed to the third parties that collect them.
Social media tools
The website may offer access to social media tools provided by social networking platforms such as Facebook, Google, LinkedIn and Twitter. Users who decide to use such tools by activating the social media tool can share certain personal data with their friends and these social network platforms. Sharing activities are subject to the privacy policies of each social network. Specifically, tools from the Facebook social network are also offered to allow Facebook to share friends’ information and activities with its registered users while browsing our website.
Cookies used, purpose of processing, data retention period
The cookies used in the various sections of the URMET SpA website are listed below:
- technical cookies (first-party) to ensure correct functioning and to improve the user's browsing experience: session cookies fall into this category and such data are not retained).
- performance cookies (first-party): this category includes Analytics cookies used to collect and analyse information for statistical analysis on access and visits to the website; the retention period for this category of cookies is 2 years.
- cookies for targeted advertising (first-party and third-party)
For further details, please see the Cookie policy https://www.urmet.com/it-it/Professionista/Cookies
Legal basis for the processing
Technical cookies are used in the Controller's legitimate interest (art. 6 lett. f): acquisition of the information needed to ensure the functioning of the website, to carry out the transmission of communications via electronic protocols, saving browsing preferences and logins; the remaining cookies are used with the data subject’s consent (art. 6 lett. a) by express acceptance through the appropriate banner and management area.
Data recipients
The acquired data may be disclosed to:
- authorised personnel (employees and associates) of the company
- external parties designated as Data Controllers (companies and professionals who provide website management and maintenance services, information and hosting services)
Finally, the data may be disclosed to the entities entitled to access them under legal provisions, regulations and EU legislation. These entities act as independent Data Controllers.
Personal data are in no case disclosed to unspecified parties.
The complete list of Data Controllers is available upon request.
Data transfer
Under no circumstances will the Data Controller transfer personal data to third countries or to international organisations.
However, it reserves the right to use cloud services; in which case, the service providers will be selected from those residing in countries for which an adequacy decision is foreseen (Art. 45 GDPR) or which provide adequate guarantees, as required by Art. 46 GDPR.
You can obtain more information on the transfer and/or a copy of the guarantees applied by contacting the Controller.
Withdrawal of consent
With reference to Article 7 of GDPR 2016/679, the data subject may withdraw consent at any time through the specific preference management area at the bottom of the page showing the status of previously given consents.
The system will track changes and updates to any consents given. Withdrawing consent will block the use of analytical and advertising cookies without affecting browsing.
The data subject can disable cookies at any time by following the instructions provided by the browser used.
Refusal to provide data
Technical cookies must be accepted in order to browse the website. Accepting the remaining cookies is optional and takes place with the user’s express consent. If they are not accepted, there may be some restrictions in the use of some features of the website or it may prevent the use of benefits connected to the services or products offered by the Data Controller.
Rights of the data subject
The data subject may exercise the rights provided for by GDPR 2016/679 (Article 15 – 22) at any time.
The following may be requested, in particular:
- whether their personal data are being processed and - if confirmed - to obtain a copy of such data (“right of access”);
- the rectification of inaccurate data and the completion of incomplete data (“right to rectification”);
- the erasure of data or the right to be “forgotten”, unless there are obligations to retain the data or the Data Controller’s legitimate interests (the “right to erasure”);
- that the processing of their data be restricted (the “right to restriction”);
- that the data provided to the Data Controller be transferred to another Data Controller (“right to portability”), only if the processing is based on consent or on a contract;
- objection to the processing of personal data for reasons related to the data subject’s particular situation, to be specified in the request.
The data subject may exercise the aforementioned rights by writing to the Data Controller at the email address above, specifying the subject of the request and the right that is to be exercised, providing any suitable identification details proving the legitimacy of the request.
The data subject is also entitled to lodge a complaint with the Data Protection Authority if they believe that the processing of their data does not comply with the principles of the GDPR (Art. 77 GDPR ).
Automated decision-making processes
The Data Controller will not, under any circumstances, carry out processing operations consisting of automated decision-making processes on personal data.
Information for those who register in the reserved area
This information is provided, pursuant to Article 13 GDPR 2016/679 – “European Regulation on the Protection of Personal Data”, to the customers (installers and wholesalers) who register for an account and access the reserved area to purchase products.
Data Controller
The data controller is Urmet S.p.A, with registered office in via Bologna 188/C – 10154 Turin (TO), tel.: 0112400000.
Data Protection Officer (“DPO”)
To ask questions about this privacy policy or about how the data are managed, contact the Data Controller's Data Protection Officer (DPO) at dpo@urmet.com
Source and type of data
Personal data are those provided spontaneously by the user by filling in the registration form on the website.
Purpose of the processing
Personal data are processed to create an account, manage access to the area and allow the user to make purchases and manage orders. If the user provides consent during registration, their email address will be used to send promotional communications on the company's products and services.
Legal basis for the processing
Processing is carried out for the performance of a service at the data subject’s request (Article 6(b) GDPR), for management of the account, express consent (Article 6(b) GDPR) and to send commercial communications.
Data retention
The data will be kept until the user makes a request to cancel the account.
Data recipients
The personal data processed by the Data Controller will not be disclosed, that is, they will not be made known to unspecified parties, in any possible form, including making them available or simply consulting them.
The data may be disclosed to:
- the Controller's employees, on the basis of the roles and work tasks performed, who are authorised and trained to carry out processing operations;
- expressly authorised internal and external consultants operating under the authority of the Data Controller;
- external parties (service providers) designated as Data Processors: e.g. suppliers of IT services for assistance and maintenance of the website, hosting providers.
Finally, the data may be disclosed to the entities entitled to access them under legal provisions, regulations and EU legislation. These entities act as independent Data Controllers.
The full, updated list of recipients is available upon request at the Data Controller's headquarters.
Nature of data provision
The provision of data is optional. However, the communication of data marked with (*) is essential to create an account. Therefore, any refusal to provide such data will make registration impossible. The user can refuse to provide further data (e.g. telephone number) [that] are processed for better management of the commercial and contractual relationship.
Data transfer
Under no circumstances will the Data Controller transfer personal data to third countries or to international organisations. However, the Data Controller reserves the right to use cloud services; in this case, the service providers will be selected from among those reside in countries for which an adequacy decision is required (Article 45 GDPR) or that provide adequate guarantees, as required by Article 46 GDPR 2016/679.
Rights of the data subject
The data subject may exercise the rights provided for by GDPR 2016/679 at any time, including:
- access to their personal data and all other information referred to in Article 15;
- rectification of inaccurate data and/or completion of incomplete data (Article 16);
- erasure of data (data cannot be erased if it is obligatory for the information to be kept or if the Data Controller’s legitimate interest to continue the processing prevails over that of the data subject) (Article 17);
- restriction of processing in the cases indicated in Article 18;
- the right to receive personal data in a structured, machine-readable format and to transfer it to another Data Controller (Article 20);
- the right to object to the processing of data under the conditions set out in Article 21.
The data subject may exercise the aforementioned rights by contacting the Controller using the contact details indicated above or by going to the address indicated, providing any information useful for identification, which certifies the legitimacy of the request.
The data subject is also entitled to lodge a complaint with the Data Protection Authority if they believe that the processing of their data does not comply with the principles of the GDPR (Art. 77 GDPR ).