The Data Controller is Evoca S.p.A., with registered office at Via Roma no. 24, 24030 Valbrembo (BG), Italy, tax code and VAT number 05035600963, telephone number: +39.035.606111, e-mail address: privacy@evocagroup.com (“Company”).

The Data Protection Officer (“DPO”) can be contacted at: dpo@evocagroup.com.

PERSONAL DATA PROCESSED AND SOURCE OF DATA

The “Data” refers to the information provided in the online form completed by you, such as your name and surname, email address, telephone number (optional), company name, city (optional), address (optional), postal code, country, product of interest, and message (optional).

LEGAL BASIS AND PURPOSES OF PROCESSING – DATA RETENTION PERIOD

Your Data may be processed:

• For the performance of a contract to which you are a party or to take steps at your request prior to entering into a contract, in order to respond to your inquiries about the Company and/or its products or services. 
  In this case, the Data will be retained for the time necessary to respond to each specific request for information, and in any event no longer than 30 days. If you have not purchased a product or service, the
  Data may be retained for up to 12 months from collection, based on the Company’s legitimate interest in maintaining evidence of business contacts and managing potential follow-up interactions, unless you object.
• On the basis of the Company’s legitimate interest in protecting its rights, where necessary, to establish, exercise or defend the Company’s legal claims in any venue; in this case, the Data will be retained for the duration of the legal proceedings and until all appeal deadlines have expired.
• On the basis of your consent, for direct marketing purposes, such as sending— by automated (e.g., SMS, e-mail) and traditional (e.g., postal mail) means— promotional and commercial communications relating to services/products offered by the Company, information about company events, as well as the performance of market research and statistical analyses ; in this case, the Data will be retained for up to 24 months.
• On the basis of your consent, and until withdrawn, for the disclosure or transfer of your Data to third parties, including, by way of example and not limitation, other companies of the Evoca Group, distributors, dealers, or other business partners of the Company.
• If you are already a customer of the Company, on the basis of the Company’s legitimate interest in promoting its products or services similar to those you have already purchased; in this case, the Data will be retained until you exercise your right to object pursuant to Article 21 of the GDPR.

After the retention periods indicated above, the Data will be deleted or anonymized, in accordance with the Company’s technical deletion and backup procedures and accountability requirements.

In particular, following your possible withdrawal of consent, the Company will continue processing your Data only to record the fact that you no longer wish to receive marketing information or promotional materials.

PROVISION OF DATA

Providing the Data marked with an asterisk (*) in the data collection form is necessary to supply you with the requested information; failure to provide such Data will prevent the Company from fulfilling your request.

Failure to provide Data not marked with an asterisk (*) has no consequences.

Providing Data for marketing purposes or for disclosure to third parties is optional: such processing will be carried out by the Company only with your explicit and unequivocal consent, without prejudice to your right to withdraw consent at any time.

USE OF CUSTOMER RELATIONSHIP MANAGEMENT (CRM) PLATFORMS (SALESFORCE)

The Data you provide will be entered into the Company’s Customer Relationship Management (CRM) systems (e.g., Salesforce) for the purposes and legal bases set out above.

As part of these activities, the Data may be enriched with information already stored in our CRM databases (e.g., contact history, previous interactions, geographical area, relationship status).

DATA RECIPIENTS

Your Data may be communicated to entities acting as independent Data Controllers (such as supervisory and control authorities and any public or private entity entitled to request the data, or other Evoca Group companies), or processed on behalf of the Company by entities designated as Data Processors pursuant to Article 28 GDPR, acting under appropriate operational instructions (e.g., providers of CRM and marketing automation services, marketing companies, companies managing and/or maintaining the Company’s website, entities providing IT system and telecommunications network services, including e-mail).

AUTHORIZED PERSONNEL

The Data may be processed by employees and/or collaborators of the Company tasked with pursuing the purposes indicated above, who have been specifically authorized to process the Data and have received appropriate operating instructions.

DATA TRANSFER OUTSIDE THE EU

Data may be transferred outside the European Union only to recipients located in countries that are the subject of a European Commission adequacy decision, or, failing that, on the basis of the Standard Contractual Clauses or other appropriate safeguards provided by the GDPR.

DATA SUBJECT RIGHTS

By contacting the Privacy Office at privacy@evocagroup.com, you may request from the Company:

• access to your Data;
• deletion or rectification of inaccurate Data;
• completion of incomplete Data;
• restriction of processing in the cases provided for by Article 18 GDPR; and/or
• objection to processing in cases of legitimate interest of the Data Controller.

Where processing is based on consent or on a contract and carried out by automated means, you also have the right to receive your Data in a structured, commonly used and machine-readable format, and, where technically feasible, to have them transmitted to another controller without hindrance.

You have the right to lodge a complaint with the competent supervisory authority in the Member State of your habitual residence, place of work, or where the alleged infringement occurred.

You also have the right to withdraw your consent at any time for marketing and disclosure to third parties, and to object to the processing of Data for such purposes.

Should you prefer to be contacted only through traditional methods, you may object solely to the receipt of communications via automated means.

Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.