Privacy Policy

Data Subject

Data Controller

The Data Controller is Casei Eco-System SRL, a single-member limited liability company.

• Registered office: Corso Italia 45 – 20122 Milan (MI), Italy
• Italian Tax Code / VAT No.: 01971050065
• Administrative and Production Facility: Via Sorelle Carena 4 – 15050 Molino dei Torti (AL)
• Plant: Via dell’Industria 50 – 63076 Monteprandone (AP)
• Telephone: +39 0131 854022
• Email: info@caseiecosystem.com
• PEC: caseiecosystem@pec.it

Requests regarding the protection of personal data and the exercise of rights may be sent to the contact information listed above.

01 / Website Users

Information for Website Users and Contact Information

Navigation data

During normal website operation, the IT systems may collect data whose transmission is implicit in the use of Internet protocols, such as IP addresses or domain names, the addresses of requested resources, the date and time of the request, and technical parameters relating to the device, the operating system, and the IT environment used.

This data is processed to ensure the website’s operation and security, to provide the requested services, to manage any technical issues, and, where necessary, to determine liability in the event of unlawful use.

Data Provided Voluntarily

Sending messages to the email addresses listed on the website or filling out any contact forms results in the collection of the data provided by the user, such as name, email address, phone number, company, and the content of the request.

The data is used to manage communication, provide the requested information or assistance, and, where applicable, take pre-contractual measures requested by the data subject.

Purpose and Legal Basis

• to enable navigation, security, and proper use of the site;
• respond to requests for information, assistance, or business inquiries;
• handle pre-contractual requests;
• to comply with legal obligations;
• to send newsletters or promotional communications when the data subject has provided the required consent;
• Conduct statistical, marketing, or personalization activities using tracking tools when the law requires consent.

The applicable legal bases are, depending on the processing, the implementation of pre-contractual or contractual measures, compliance with legal obligations, the Data Controller’s legitimate interest in cases permitted by law, and the data subject’s consent when required.

Newsletters and Promotional Communications

If a user subscribes to a newsletter or agrees to receive marketing or informational communications, their contact information will be used solely for the authorized purposes.

Consent may be revoked at any time by using the unsubscribe link included in communications, when available, or by contacting the Data Controller.

Data processed for purposes based on consent are retained until consent is withdrawn, subject to any additional legal obligations. Data relating to simple requests for information are retained for as long as necessary to handle the request and address any subsequent developments.

Interactions with Social Media

The website may contain links, buttons, or features that allow interaction with social media platforms. The use of these services may involve the processing of data by the respective providers in accordance with their privacy policies and, when tracking tools subject to consent are used, in accordance with the preferences expressed by the user through the consent management system.

External Websites

This privacy policy applies to the Casei Eco-System website. It does not apply to third-party websites that may be accessible via external links, which remain subject to their respective privacy policies.

03 / Suppliers

Supplier Privacy Policy

Data Processed

In the context of our relationships with suppliers and their representatives, we may process personal, professional, administrative, banking, and contact information necessary for managing the relationship.

When the supplier is a legal entity, data regarding its legal representatives, employees, contractors, or other contacts involved in the business relationship may also be processed.

Special Categories of Data

For the day-to-day management of the supply relationship, Casei Eco-System does not need to receive data falling within the special categories referred to in Article 9 of the GDPR. Suppliers are therefore asked not to disclose such information unless it is necessary.

If the processing of special categories of data proves to be exceptionally necessary, it will take place only if an appropriate legal basis is provided for by law and with any additional information that may be required.

Purpose

• assessment and management of pre-contractual relationships;
• the drafting and execution of supply contracts and related pre- and post-contractual activities;
• administrative, accounting, organizational, and document management;
• management of billing, payments, and, where applicable, credit protection;
• compliance with legal obligations and requests from the relevant authorities;
• judicial or extrajudicial protection of the Data Subject’s rights.

Legal Basis

The legal basis is the performance of a contract or precontractual measures pursuant to Article 6(1)(b) of the GDPR and compliance with legal obligations pursuant to Article 6(1)(c) of the GDPR.

Nature of the Contribution

Providing the data necessary for entering into or fulfilling the supply agreement and for complying with legal obligations is required. Failure to provide such data, in whole or in part, may prevent Casei Eco-System from establishing or properly managing the relationship.

Only the data necessary for the specified purposes is requested.

Storage

Data is retained for as long as necessary to manage the relationship and thereafter in accordance with the retention periods set forth in applicable law.

For personal, administrative, and payment data subject to the standard retention period specified in the company’s privacy notice, the retention period is 10 years from the conclusion of the service or relationship, without prejudice to any additional periods necessary to protect the data subject’s rights.

At the end of the applicable periods, the data is securely deleted or, where appropriate, anonymized, in accordance with technical procedures and backup systems.

The need to retain data is periodically reviewed in light of the purposes for which it was collected.

This privacy notice remains applicable to any subsequent services or similar relationships with the same data subject, unless changes occur that require a new privacy notice.

Data Disclosure

Recipients of Personal Data

The data may be processed by authorized personnel of Casei Eco-System and, when necessary, disclosed to parties whose activities are necessary to achieve the stated purposes, including:

• entities that process data in compliance with specific legal obligations;
• banks and entities that provide payment services;
• software and hardware support companies and IT service providers;
• providers of business management software, CRM, and other organizational tools;
• professional, administrative, tax, and legal consultants;
• companies or professionals responsible for the judicial or extrajudicial protection of the Data Subject’s rights;
• suppliers, customers, or other business partners when such disclosure is necessary to fulfill the business relationship, comply with a legal obligation, or exercise a legitimate right;
• providers of technical, organizational, or logistical services;
• authorities, supervisory bodies, and other public or private entities when disclosure is required or mandated by law.

Entities that process personal data on behalf of Casei Eco-System are designated, where applicable, as data processors pursuant to Article 28 of the GDPR.

Data Dissemination

Personal data will not be disclosed, except when expressly required by law, by an order of the competent authority, or when another applicable legal basis exists.

Information Protection

Data Security

Casei Eco-System implements technical and organizational measures appropriate to the risk to protect personal data from loss, unauthorized access, alteration, disclosure, or unlawful processing.

The company’s currently published privacy notices list, among the measures taken, access control and protection systems, firewalls, encryption techniques, and staff training.

Access to data is limited to those who need it to perform their respective duties, and these measures are reviewed in light of the risks and changes in the systems used.

04 / Rights

Data Subject Rights

In the cases provided for in Articles 15 and following of the GDPR, the data subject may request:

• confirmation of whether or not personal data concerning him or her exists and access to such data;
• information regarding the source of the data, the purposes and methods of processing, and the recipients;
• correction and updating of inaccurate or incomplete data;
• deletion of data in the cases provided for;
• restriction of processing;
• objection to processing in the cases provided for;
• data portability, where applicable;
• information on any logic applied to automated decision-making processes in the cases provided for by law;
• Withdrawal of consent at any time when the processing is based on consent.

The withdrawal of consent does not affect the lawfulness of processing carried out prior to the withdrawal.

Casei Eco-System will respond without undue delay and, in any case, within one month of receiving the request.

When necessary, taking into account the complexity and number of requests, the deadline may be extended by an additional two months. The data subject is notified of the extension and the reasons for it within one month of receipt of the request.

Complaint to the Data Protection Authority

The data subject also has the right to file a complaint with the Data Protection Authority in accordance with the procedures set forth in applicable law.