With specific reference to personal data as defined by Article 4, paragraph 1, number 1) of EU Regulation No. 679/2016 (hereinafter “Regulation”) that concern you as the “Data Subject,” the undersigned company FUGI S.r.l., owner of the FG PUMPS brand (hereinafter “FUGI”) (Tax Code and VAT Number 12714360158), represented by its legal representative, with registered office in Segrate (MI), via Bruno Buozzi 23/27, 20054, as the “Data Controller” under Article 4, paragraph 1, number 7) of the Regulation, provides you with the following information, which will be valid and effective from January 10, 2022. 

  1. Nature and Type of Your Data Collected and Processed.


1.1. Your data subject to processing fall exclusively within the category referred to as “personal data” under Article 4, paragraph 1, number 1) of the Regulation (“any information concerning an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, particularly by reference to an identifier such as a name, an identification number, location data, an online identifier, or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that person”). 

  1. Information about the “Data Controller.”

2.1. The “Data Controller” of your personal data under Article 4, paragraph 1, number 7) of the Regulation is the company FUGI S.r.l. (hereinafter “FUGI”) (Tax Code and VAT Number 12714360158), represented by its legal representative, with registered office in Segrate (MI), via Bruno Buozzi 23/27, 20054. The legal representative may be contacted at the following email address: admin@fugi.it.

2.2. Please note that any changes or updates regarding the data of the aforementioned subject will be appropriately published in the dedicated “Privacy” section on the website of the undersigned Data Controller.

  1. Purpose of Processing.

3.1. In accordance with Article 5, paragraph 1, letter b) of the Regulation, we inform you that your personal data will be collected and subsequently processed for the following purposes:

    1. Execution of a contract of which you, as the “Data Subject,” are a part, as well as for the fulfillment of any legal or contractual obligations.

3.2. The purpose described above makes the processing in question lawful under Article 6, paragraph 1, letters b) and c) of the Regulation.

 

  1. Recipients of the Collected and Processed Personal Data.


4.1. In accordance with Article 13, paragraph 1, letters e) and f) of the Regulation, we inform you that your personal data may be communicated to third parties, exclusively to fulfill the purposes described in Article 3 above, located in the territory of Italy or within the European Union, or in a so-called third country, with the express exception of those considered “inadequate” by the European Commission under Article 45 of the Regulation. 

  1. Retention Period for Collected and Processed Personal Data.

5.1. In accordance with Article 13, paragraph 2, letter a) of the Regulation, we inform you that the retention period for your personal data will coincide with the duration of the contractual relationship between the data controller and you, which may be extended to comply with any subsequent processing operations after the termination of the contractual relationship, or arising from civil, tax, or fiscal obligations, or from the need to manage any out-of-court or judicial disputes involving the controller.


5.2. Your personal data will be processed using paper, electronic, or telematic means. 

  1. Principles applied to the processing of your data

6.1. In compliance with Article 5 of the Regulation, we inform you that your personal data will be:

  • Processed lawfully, fairly, and transparently with respect to the data subject (the so-called principle of lawfulness, fairness, and transparency);
  • Collected for specified, explicit, and legitimate purposes, and subsequently processed in a way that is not incompatible with those purposes (the so-called principle of purpose limitation);
  • Adequate, relevant, and limited to what is necessary in relation to the purposes for which they are processed (the so-called principle of data minimization);
  • Accurate and, where necessary, kept up to date (the so-called principle of accuracy);
  • Stored in a form that allows the identification of data subjects for no longer than is necessary for the purposes for which the data are processed (the so-called principle of storage limitation);
  • Processed in a manner that ensures appropriate security of personal data, including protection, through appropriate technical and organizational measures, from unauthorized or unlawful processing and from accidental loss, destruction, or damage (the so-called principle of integrity and confidentiality).

 

  1. Rights of the Data Subject


7.1. In relation to your personal data processed by the Data Controller, we inform you that you have the right to exercise the following rights, as fully detailed below:

Right of Access by the Data Subject (Article 15 of the Regulation)

1. “The data subject has the right to obtain from the data controller confirmation as to whether or not personal data concerning them is being processed, and, if so, to access the personal data and the following information:

a) the purposes of the processing;
b) the categories of personal data concerned;
c) the recipients or categories of recipients to whom the personal data has been or will be disclosed, in particular if recipients in third countries or international organizations are involved;
d) where possible, the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period;
e) the existence of the right to request from the data controller the rectification or erasure of personal data or the restriction of the processing of personal data concerning the data subject or to object to such processing;
f) the right to lodge a complaint with a supervisory authority;
g) where the personal data is not collected from the data subject, any available information as to its source;
h) the existence of automated decision-making, including profiling referred to in Article 22(1) and (4), and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject.

2. Where personal data is transferred to a third country or to an international organization, the data subject has the right to be informed of the appropriate safeguards pursuant to Article 46 relating to the transfer.

3. The data controller shall provide a copy of the personal data undergoing processing. For any further copies requested by the data subject, the data controller may charge a reasonable fee based on administrative costs. Where the data subject makes the request by electronic means, and unless otherwise requested by the data subject, the information shall be provided in a commonly used electronic format.

4. The right to obtain a copy referred to in paragraph 3 shall not adversely affect the rights and freedoms of others.”

Right to Rectification (Article 16 of the Regulation):

“The data subject has the right to obtain from the data controller the rectification of inaccurate personal data concerning them without undue delay. Taking into account the purposes of the processing, the data subject has the right to have incomplete personal data completed, including by providing a supplementary statement.”.

Right to Erasure (Article 17 of the Regulation):

“1. The data subject has the right to obtain from the data controller the erasure of personal data concerning them without undue delay, and the data controller has the obligation to erase personal data without undue delay where one of the following grounds applies:

a) The personal data is no longer necessary in relation to the purposes for which it was collected or otherwise processed;
b) The data subject withdraws consent on which the processing is based in accordance with Article 6(1)(a) or Article 9(2)(a), and where there is no other legal ground for the processing;
c) The data subject objects to the processing pursuant to Article 21(1), and there are no overriding legitimate grounds for the processing, or the data subject objects to the processing pursuant to Article 21(2);
d) The personal data has been unlawfully processed;
e) The personal data must be erased to comply with a legal obligation under Union or Member State law to which the data controller is subject;
f) The personal data has been collected in relation to the offer of information society services referred to in Article 8(1).

2. Where the data controller has made personal data public and is obliged, pursuant to paragraph 1, to erase it, the data controller, taking account of available technology and the cost of implementation, shall take reasonable steps, including technical measures, to inform other controllers processing the personal data that the data subject has requested the erasure of any links to, or copies or replications of, such personal data.

3. Paragraphs 1 and 2 shall not apply to the extent that processing is necessary:

a) For exercising the right of freedom of expression and information;
b) For compliance with a legal obligation which requires processing by Union or Member State law to which the controller is subject or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
c) For reasons of public interest in the area of public health in accordance with Article 9(2)(h) and (i) and Article 9(3);
d) For archiving purposes in the public interest, scientific or historical research purposes, or statistical purposes in accordance with Article 89(1), in so far as the right referred to in paragraph 1 is likely to render impossible or seriously impair the achievement of the objectives of that processing; or
e) For the establishment, exercise, or defense of legal claims.”

Right to Restriction of Processing (Article 18 of the Regulation)

“1. The data subject has the right to obtain from the data controller the restriction of processing where one of the following applies:

a) The data subject contests the accuracy of the personal data, for a period necessary for the data controller to verify the accuracy of such personal data;
b) The processing is unlawful, and the data subject opposes the erasure of the personal data and requests instead that its use be restricted;
c) Although the data controller no longer needs the personal data for processing purposes, the data is required by the data subject for the establishment, exercise, or defense of legal claims;
d) The data subject has objected to the processing pursuant to Article 21(1), pending verification of whether the legitimate grounds of the data controller override those of the data subject.

2. Where processing is restricted under paragraph 1, such personal data shall, except for storage, only be processed with the data subject’s consent or for the establishment, exercise, or defense of legal claims, or to protect the rights of another natural or legal person, or for reasons of substantial public interest of the Union or a Member State.

3. The data subject who has obtained restriction of processing under paragraph 1 shall be informed by the data controller before the restriction is lifted.”

Right to Data Portability (Article 20 of the Regulation):

“1. The data subject has the right to receive their personal data, which they have provided to a data controller, in a structured, commonly used, and machine-readable format, and the right to transmit those data to another data controller without hindrance from the original data controller, where:

a) The processing is based on consent pursuant to Article 6(1)(a) or Article 9(2)(a), or on a contract pursuant to Article 6(1)(b); and
b) The processing is carried out by automated means.

2. In exercising their rights with regard to data portability under paragraph 1, the data subject has the right to have their personal data transmitted directly from one data controller to another, where technically feasible.

3. The exercise of the right referred to in paragraph 1 of this Article shall be without prejudice to Article 17. This right does not apply to processing necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the data controller.

4. The right referred to in paragraph 1 shall not adversely affect the rights and freedoms of others.”

Right to Object (Article 21 of the Regulation):

“1. The data subject has the right to object at any time, on grounds relating to their particular situation, to the processing of personal data concerning them based on Article 6(1)(e) or (f), including profiling based on those provisions. The data controller shall cease processing the personal data unless the controller demonstrates compelling legitimate grounds for the processing which override the interests, rights, and freedoms of the data subject or for the establishment, exercise, or defense of legal claims.

2. Where personal data is processed for direct marketing purposes, the data subject has the right to object at any time to the processing of personal data concerning them for such marketing, including profiling to the extent that it is related to such direct marketing.

3. Where the data subject objects to processing for direct marketing purposes, the personal data shall no longer be processed for such purposes.

4. The right referred to in paragraphs 1 and 2 shall be explicitly brought to the attention of the data subject and presented clearly and separately from any other information, at the latest at the time of the first communication with the data subject.

5. In the context of the use of information society services and without prejudice to Directive 2002/58/EC, the data subject may exercise their right to object by automated means using specific technical specifications.

6. Where personal data is processed for scientific or historical research purposes or statistical purposes pursuant to Article 89(1), the data subject, on grounds relating to their particular situation, has the right to object to the processing of personal data concerning them, unless the processing is necessary for the performance of a task carried out for reasons of public interest.”

Right to Lodge a Complaint with a Supervisory Authority (Article 77 of the Regulation):

“1. The data subject shall have the right to lodge a complaint with a supervisory authority, in particular in the Member State of their habitual residence, place of work, or place of the alleged infringement, if the data subject considers that the processing of personal data relating to them infringes this Regulation.

2. The supervisory authority with which the complaint is lodged shall inform the complainant of the progress and the outcome of the complaint, including the possibility of a judicial remedy pursuant to Article 78.”

Diritto a un ricorso giurisdizionale effettivo nei confronti dell’autorità di controllo (Art. 78 del Regolamento)

“1. Without prejudice to any other administrative or non-judicial remedy, every data subject shall have the right to an effective judicial remedy against a legally binding decision of a supervisory authority concerning them.

2. Every data subject shall have the right to an effective judicial remedy if the supervisory authority does not handle a complaint or does not inform the data subject within three months of the progress or outcome of the complaint, as provided in Article 77(2).

3. Proceedings against a supervisory authority shall be brought before the courts of the Member State where the supervisory authority is established.

4. Where proceedings are brought against a supervisory authority, the data subject shall have the right to an effective remedy before the court, including the possibility to obtain a decision from the court if the supervisory authority fails to take action or delays taking action.”

7.2. In compliance with Article 12(1) of the Regulation, FUGI undertakes to provide you with the information required under Articles 15 to 22 of the Regulation in a concise, transparent, intelligible, easily accessible form, using clear and plain language. Such information will be provided in writing or by other means, including electronic ones, or, upon request of the data subject, orally, provided that the identity of the data subject is verified by other means.

7.3. In compliance with Article 12(3) of the Regulation, the Controller informs you that it is committed to providing information regarding any action taken on a request under Articles 15 to 22 without undue delay and, in any case, within one month of receiving the request. This period may be extended by two months if necessary, taking into account the complexity and number of requests.

7.4. To exercise the rights described above in this article, the data subject can use the contact details specified in Article 2 of these “Information”.