Privacy Policy

We wish to inform you, pursuant to European Regulation 2016/679 also known as the "General Data Protection Regulation" (hereinafter "GDPR") and Legislative Decree 196/2003 ss.mm. relating to the protection of natural persons with regard to the processing of personal data, as well as to the free movement of such data, that the information and data provided by you or otherwise acquired as part of the web services provided by MIR GROUP S.r.l. Società Benefit will be processed in compliance with the above-mentioned provisions and the confidentiality obligations that inspire our activity.

The purpose of this policy is to disclose in complete transparency the purposes for which we may use your data, how we will manage it, to whom it may be disclosed, where it may be transferred (within or outside the European Economic Area) and what your rights are.

Who processes your data

Your data will be processed by MIR GROUP S.r.l. Società Benefit in its capacity as Data Controller.

In addition to MIR GROUP S.r.l. Società Benefit, we would like to inform you that there are External Data Processors, who have been appropriately mapped, registered, contracted and appointed by MIR GROUP S.r.l. Società Benefit on the basis of the provisions of Article 28 of the GDPR.

The list of external Data Processors is available at the headquarters of MIR GROUP S.r.l. Società Benefit.

Type of data processed

The data subject to processing are browsing data and data provided voluntarily by the user, as better specified below.

MIR GROUP S.r.l. Società Benefit informs users of the site that the data collected will be used exclusively for the purposes indicated below.

Browsing data

The computer systems and software used for the proper functioning of the site acquire, during their normal operation, some data whose transmission is implicit in the use of internet communication protocols: this information is not collected to be associated with identified data subjects, but which by its very nature could, through processing and association with data held by third parties, allow users to be identified.

This category of data includes IP addresses or domain names of the computers used by users who connect to the site, the URI addresses of the resources requested, the time of the request, the method used to submit the request to the server, the size of the file obtained in response, the numerical code indicating the status of the response given by the server (successful, error, etc.) and other parameters relating to the user's operating system and IT environment.

These data are used for the sole purpose of obtaining anonymous statistical information on the use of the site and to check its correct functioning and are deleted immediately after processing. The data could be used to ascertain responsibility in the event of hypothetical computer crimes against the site.

Data provided voluntarily by the user

The optional, explicit and voluntary sending of e-mails to the addresses indicated on the site or the compilation of specific contact forms, involves the subsequent acquisition of the sender's address, necessary to respond to requests, as well as any other personal data provided. These data will be communicated to third parties only where necessary to comply with the requests of the users themselves.

Purpose of the processing

The processing of data is aimed exclusively at achieving the following purposes:

• consultation of the contents of the site;
• activities strictly connected and instrumental to the management of relations with users and potential collaborators (contact requests).

From the above, it follows that the provision of Personal Data is strictly necessary to follow up on purposes a) and b): any failure to provide data will make it impossible to achieve the purposes indicated above and therefore to follow up on the request. The extent and adequacy of the Data provided will be assessed on a case-by-case basis, in order to determine the consequent decisions and avoid the processing of Data in excess of the purposes pursued.

Processing methods

By processing of personal data, pursuant to the provisions of art. 4 n. 2) of the GDPR, we mean any operation or set of operations, carried out even without the aid of electronic tools, concerning the collection, recording, organization, storage, consultation, processing, modification, selection, extraction, comparison, use, interconnection, blocking, communication, dissemination, cancellation and destruction of data, even if not recorded in a database.

The processing is carried out through automated systems for a period strictly necessary to achieve the purposes for which they were collected and in any case, in accordance with the legislative provisions in force.

How long we will keep your data

Your personal data will be stored for a period not exceeding that necessary to achieve the purposes for which they were collected and subsequently processed. Personal data will be stored for the entire duration of the relationship between the parties and also for a subsequent period according to the following criteria:

• within the terms established by current legislation;
• within the terms established by legislation, including secondary legislation, which require the retention of data (e.g. tax returns);
• within the period necessary to protect the rights of the data subject in the event of any disputes related to the provision of the service.

In any case, the maximum data retention time is estimated at 10 years from the termination of the relationship between the parties.

Communication and dissemination of data

Personal data are processed by employees and/or collaborators of the Data Controller, adequately trained, and will not be disseminated, but may be communicated to third parties (including Partners, consultants and freelancers, banks and credit institutions, insurance companies), to comply with obligations deriving from the law, regulations, EU legislation or for aspects concerning the management and execution of the legal relationship existing or having taken place.

For all the purposes indicated in this policy, your Data may also be communicated abroad, within and outside the European Union, in compliance with the rights and guarantees provided for by current legislation, subject to verification that the country in question guarantees an "adequate" level of protection.

Rights of the data subject

As a data subject, you can request at any time:

• access to personal data;
• their correction in the event of inaccuracy;
• cancellation;
• the limitation of processing;
• the right to object to the processing of data where the conditions are met;
• the right to data portability, i.e. to receive the personal data provided in a structured format of common use and readable by an automatic device.

For anything not expressly provided for by the aforementioned provisions, please refer in full to the legislation in force on Privacy and specifically to art. 15, 16, 17, 18, 20, 21 and 22 of the GDPR.

In the event of a violation, the data subject has the right to lodge a complaint with the competent Supervisory Authority (Art. 13 para. 2 letter d) of the GDPR).

Withdrawal of consent

The consent given regarding the processing of your personal data may be revoked at any time, without prejudice to:

• the lawfulness of the data processing carried out in the period prior to the revocation itself;
• further processing based on legal bases other than consent, such as contractual and legal obligations.

For further clarification about this policy or on any issue relating to the protection of your personal data and the free movement of the same, or in the event that you wish to exercise the rights mentioned above or withdraw your consent, you can write to info@mir-group.it

Data Controller

The Data Controller is MIR GROUP S.r.l. Società Benefit, with operational headquarters in via T. Frizzoni, 22 - 24121 Bergamo.