Privacy Policy

This policy is provided pursuant to Regulation (EU) 2016/679 (GDPR) and the applicable national legislation on the protection of personal data. It describes how the Consorzio con attività esterna STILNOVO – Consorzio Pellettieri Toscani (hereinafter also the “Consortium”) processes the personal data of natural persons who interact with the Consortium, including via the institutional website (hereinafter the “Site”), in their capacity as users, members, suppliers, partners or simple contacts.

Data controller

The data controller is:
Consorzio con attività esterna STILNOVO – Consorzio Pellettieri Toscani
Registered office: VIA G. DEI MARIGNOLLI 62/D – 50127 Florence (FI) – Italy
Tax Code and VAT Number: 04379200480
Certified email (PEC): consorziostilnovo@legalmail.it

For any request regarding the protection of personal data, you may contact the Consortium via PEC or in writing at the registered office address.

Types of data processed

Data provided voluntarily by the data subject

The Consortium may process the following personal data, voluntarily provided by the data subject:

identification data (first name, last name, company, if applicable, role);
contact details (email address, telephone number, postal address);
data relating to membership of member companies or potential member companies;
data contained in communications sent to the Consortium (requests for information, applications, cooperation proposals, etc.).

Browsing data

Simple browsing of the Site may involve the processing of browsing data (for example IP addresses, access times, pages visited), which are automatically collected by the IT systems responsible for the operation of the Site. Such data are used exclusively for technical purposes and aggregated statistics and do not allow the direct identification of the user, except possibly through the intervention of the competent authorities.

Cookies and similar technologies

The Site may use technical cookies necessary for the proper functioning of the pages and, where applicable, additional cookies or tracking tools for statistical purposes or to improve services. For more details on the categories of cookies used and the related settings, please refer to the specific cookie policy, if any, published on the Site.

Purposes and legal bases of the processing

Personal data are processed by the Consortium for the following purposes, on the basis of the corresponding legal bases:

Management of consortial and pre-consortial relationships
Management of relationships with member companies or companies potentially interested in joining the Consortium, participation in promotional initiatives, exchange of information relating to the activities of the Consortium.
Legal basis: performance of a contract or pre-contractual measures (Art. 6(1)(b) GDPR).
Responding to requests for information and contact
Responding to requests sent via email, PEC or other contact channels made available by the Consortium.
Legal basis: performance of pre-contractual measures and legitimate interest of the Consortium in managing communications (Art. 6(1)(b) and (f) GDPR).
Promotion and institutional communication activities
Communications relating to initiatives, trade fairs, events and promotional activities connected with the purpose of the Consortium, addressed to member companies or to parties that have had contact with the Consortium.
Legal basis: legitimate interest of the Consortium in promoting its activities and those of the member companies (Art. 6(1)(f) GDPR), without prejudice to the rights of data subjects.
Compliance with legal obligations
Compliance with obligations laid down by national or European legislation, regulations, orders of authorities and administrative, accounting and tax requirements.
Legal basis: legal obligation of the controller (Art. 6(1)(c) GDPR).
Protection of the rights of the Consortium
Management of any disputes, exercise or defence of rights in judicial or out-of-court proceedings.
Legal basis: legitimate interest of the Consortium in protecting its rights (Art. 6(1)(f) GDPR).

Where, for specific purposes, the consent of the data subject is required, such consent will be requested explicitly and recorded. In such cases, the data subject may withdraw consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal.

Nature of the provision of data

The provision of personal data may be:

mandatory where required by law or necessary to fulfil contractual or pre-contractual obligations;
optional in all other cases.

Failure to provide mandatory data may make it impossible for the Consortium to provide the requested service, to initiate or continue the consortial relationship, or to comply with legal obligations. Failure to provide optional data may limit certain functionalities or services, without generally affecting the relationship with the Consortium.

Methods of processing

Personal data are processed by the Consortium using paper and/or electronic tools, in accordance with the principles of fairness, lawfulness, transparency and relevance, in compliance with the GDPR and national legislation. Appropriate technical and organisational measures are adopted to protect data against unauthorised access, loss, alteration, disclosure or misuse.

Data retention

Personal data are kept for the time strictly necessary to achieve the purposes for which they were collected and, thereafter, for the period required by any legal obligations or for the protection of the rights of the Consortium.

data relating to consortial relationships are retained for the entire duration of the relationship and, subsequently, for the period provided for by civil and tax regulations;
data collected for communications and contacts are retained for the time necessary to handle the request and, where there is an ongoing relationship, for the duration of that relationship;
browsing data are processed for the time strictly necessary for technical and statistical purposes and are normally deleted or anonymised in aggregated form.

Recipients of personal data

Personal data may be disclosed:

to employees and collaborators of the Consortium, duly authorised and instructed to process the data;
to consultants and professionals (for example legal, tax, administrative consultants) acting as independent controllers or as processors;
to third parties providing services on behalf of the Consortium (for example IT services, hosting, technical support), appointed as data processors where required;
to public authorities and institutional bodies, within the limits provided for by law or binding measures.

Personal data are not subject to indiscriminate disclosure.

Transfers of data to third countries

In principle, the Consortium does not carry out systematic transfers of personal data to countries outside the European Union or the European Economic Area. Should it be necessary, for specific technical or organisational reasons, to use providers located in third countries, the transfer will take place in compliance with Articles 44 et seq. of the GDPR, adopting the appropriate safeguards provided for by the legislation (for example, adequacy decisions of the European Commission or standard contractual clauses).

Rights of data subjects

Data subjects may exercise the following rights under the GDPR in relation to the Consortium:

right of access: to obtain confirmation as to whether or not personal data concerning them are being processed and receive a copy of such data;
right to rectification: to request the correction or updating of inaccurate or incomplete data;
right to erasure (right to be forgotten): to request the deletion of personal data in the cases provided for by law;
right to restriction of processing: to request that data be marked and processed only for certain purposes;
right to data portability: to receive personal data in a structured, commonly used and machine-readable format, where technically feasible and within the limits set by the GDPR;
right to object: to object, in whole or in part, to the processing of data based on legitimate interest, on grounds relating to their particular situation;
right to withdraw consent, where processing is based on consent, without affecting the lawfulness of processing carried out before withdrawal.

How to exercise your rights

To exercise their rights, data subjects may send a written communication to the Consortium at the registered office address or via PEC to consorziostilnovo@legalmail.it, specifying the request and providing, where necessary, information useful for identification.
Data subjects also have the right to lodge a complaint with the Italian Data Protection Authority (Autorità Garante per la protezione dei dati personali) if they believe that the processing of their data by the Consortium infringes the applicable legislation.

Updates to this policy

This policy may be subject to changes or updates, including as a result of regulatory changes or developments in the services offered by the Consortium. The updated version will be made available through the Consortium’s usual information channels and, where applicable, published on the Site.