The data controller is SAES Getters S.p.A., with registered office in 20045 – Lainate (MI), at Viale Italia 77, tax code and VAT no. 00774910152 (the “Company” or the “Data Controller”).
If you have any doubts about how the Company processes personal data, you can always contact it at the addresses listed in Section 8 of this policy or by contacting the DPO, LCA Servizi S.r.l., at the e-mail address: firstname.lastname@example.org
Description of Sections of the Site
The Site consists of several sections pertaining to the different business divisions or departments of the Data Controller, described in more detail below:
- SAES Corporate: this section illustrates the Company’s history, mission and core values, and management;
- Lab Research: this section illustrates the long-term scientific projects and research carried out by the Company;
- Design House: this section illustrates the design projects developed by the Design House and also aimed at the Business to Consumers market;
- Red Zone: this section illustrates the start-up incubator project “Red Zone By SAES”;
- Industrial, High Vacuum, Chemicals and Packaging: these sections describe the products manufactured and marketed by the Company;
- Contacts: this section is intended to provide contacts and ways through which to submit inquiries to the Company;
- Investors Relations: this section illustrates the Group’s main financial results and sharing key news with investors; the area also includes a section on Corporate Governance.
- Careers: this section is intended for the submission of applications for employment positions within the Company;
jointly, (the “Sections“).
Data collected, purposes and legal basis
The personal data processed depend on the purposes for which the data subject decides to contact the Data Controller and the specific section of the Site through which the data subject contacts the Data Controller. The personal data processed are only those relevant to and not exceeding the purposes of the processing summarized in the following subsections.
In addition, we invite data subjects not to provide personal data of third parties and additional personal data unless absolutely essential for the achievement of the purposes described by this paragraph.
a) Request for information from Lab Research and Red Zone teams
Through filling out the “Do you want to ask us something?” form at the bottom of the presentation sections of the Lab Research and Red Zone teams respectively, the data subject may contact and request information directly from the aforementioned research teams.
In particular, the Company will collect the following personal data:
– first and last name (the “Personal Data“);
– e-mail address (the “Contact Data“); as well as
– any other personal data contained in requests forwarded to the Data Controller.
Such personal data will be processed to respond to requests sent by data subjects through the relevant section of the Site.
The legal basis for the processing of personal data is the legitimate interest of the Data Controller in responding to requests for information forwarded by data subjects, in order to provide them with assistance and advice about the Company’s products and activities. Legitimate interest that does not affect the rights and freedoms of the data subjects as it is reasonable to assume that – considering the manner in which (and the reasons for which) the data were acquired – the data subject has a corresponding interest in being contacted to receive the requested
b) Participation in Red Zone initiatives and joining the start-up incubator
With reference to Red Zone’s initiatives, the Company will collect the Personal Data, company name and corporate references, job role of the representatives of the start-ups that intend to participate in the Red Zone project, Contact Data, the country where the company is based, as well as any additional personal data that are present within the presentations that may be attached during the completion of the form on the Site (e.g. personal data of any partners), to describe the activity carried out by the start-up.
Personal Data will be processed to enable a start-up’s personal representative to participate in the initiatives published on the Site, to present their start-up, and to join the Red Zone start-up incubator.
The legal basis for the processing of Personal Data is legitimate interest of the Data Controller in identifying start-ups to join the Red Zone incubator. Legitimate interest that does not affect the rights and freedoms of the data subjects as it is reasonable to assume that – considering the manner in which they were acquired – the data subject also has a corresponding interest in being contacted to participate in Red Zone initiatives.
c) Requests for information about products and activities submitted through the Contacts section
The data subject may submit requests regarding the products and activities offered by the Company via the “Contacts” form.
In this case, the Data Controller will collect the Personal Data, Contact Data, company name and corporate references, the country where the company is based, as well as any other data communicated through the submitted request.
The data subject must also select the relevant Section for the request he or she intends to submit; in the event that the data subject selects the wrong Section, the Company will forward the request to the function dealing with the correct Section.
Personal data will be processed to respond to requests sent by data subjects through the relevant Section of the Site.
The legal basis for the processing of personal data is the legitimate interest of the Data Controller in responding to requests for information forwarded by data subject, in order to provide them with assistance and advice about the Company’s products and activities. Legitimate interest that does not affect the rights and freedoms of the data subjects as it is reasonable to assume that – considering the manner in which (and the reasons for which) the data were acquired – the data subject has a corresponding interest in being contacted to receive the requested information.
d) Investors Newsletter Subscription
Personal Data, Contact Data, job role, company name and country where the company is based, will also be processed to enable the data subject to subscribe to and benefit from the Investors Newsletter service. In case of a request to subscribe to the newsletter service, the data subject’s personal data will be processed in order to respond to his or her request and enable the sending, by e-mail, of messages containing informative and promotional material referring to the Company’s products and services.
The legal basis of the processing is constituted by the explicit, free and informed consent of the data subject, which can be given by checking the relevant box within the “Subscribe to our newsletter” form.
At any time, data subjects may request to be unsubscribed from the newsletter service. To unsubscribe, the Interested Party must send a specific communication to the Company at the contact details indicated in paragraph 8, expressing the desire to be excluded from the service or following the procedure indicated at the bottom of the messages received, by pressing the “Unsubscribe” button.
In any case, any opposition will not affect the lawfulness of the processing activities carried out up to that point by the Company.
The processing of personal data for this purpose although optional is necessary to subscribe the newsletter service: any refusal to communicate the data will result in the impossibility for the Company to send the newsletter to the data subject, but will not preclude the possibility to browse the Site and request information.
e) Submission of an application through the Careers section
The data communicated by the data subjects and present in the curricula, sent through the “Careers” section will be processed to evaluate the candidate’s professional profile for the purpose of a possible collaboration and/or hiring by the Company.
Such processing finds its legal basis in the need to execute pre-contractual measures taken at the candidate’s request.
For further information, please refer to the extended and specific information on the processing of personal data that will be provided to the candidate, via e-mail, following the Company’s receipt of the resume or, at the latest, at the time of the first contact and, in any case, in writing at the opening of the first interview.
f) Data automatically collected by the Site
In addition to the personal data processed with reference to each Section, the computer systems and software procedures used to operate the Site acquire, in the course of their normal operation, some personal data whose transmission is implicit in the use of Internet communication protocols.
This is information that is not collected to be associated with identified data subjects, but which by its very nature could, through processing and association, allow the identification of the data subjects.
This category of data includes the IP addresses or domain names of the computers used by the data subjects who connect to the Site, the addresses in URI (Uniform Resource Identifier) notation of the resources requested, the time of the request, the method used in submitting the request to the server, the size of the file obtained in response, the numerical code indicating the status of the response given by the server (successful, error, etc.) and other parameters relating to the operating system and the computer environment of the data subject (the “Browsing Data“).
This data is used for the sole purpose of obtaining anonymous statistical information on the use of the Site and to check its correct functioning. The data could be used to ascertain responsibility in case of hypothetical computer crimes against the Site.
g) Online purchases (shop.saesgetters.com)
The data disclosed at shop.saesgetters.com (including delivery and payment data) will be processed to allow the user to complete the purchase of the products desired and provide customer assistance, where necessary. Processing involves the sending of service communications on order status and the fulfilment of legal requirements.
For this same purpose, data will be disclosed to third parties supplying accessory services to online sales, such as shippers and carriers (for the dispatch and delivery of the products purchased) and banks (to handle payments and reimbursements). These subjects will process data, as applicable, as autonomous controllers or data processors; in the latter case, this will be done by virtue of a specific written appointment made upon them by the Data Controller. The communication of these data is compulsory: any refusal will make it impossible for the Company to receive and accept the purchase order placed by the user.
This processing is carried out on the legal basis that it is necessary in order to execute a contract to which the data subject is party and in order to fulfil the related legal obligations.
The data may also be processed to carry out customer satisfaction surveys by e-mail, aimed at verifying user satisfaction and improving the Company products and services.
This processing is carried out on the legal basis that it is in the legitimate interests of the Company to improve its products and services, and is compatible with the position of the data subjects insofar as: (i) market research is anonymous and the outcome is not shared with any subjects other than the Company; and (ii) as it is reasonable to assume that the customer has an interest in finding and purchasing high-quality products and to be able to ask for assistance from qualified customer service.
You can object to the processing of data for the purposes of customer satisfaction surveys at any time by following the procedure described at the foot of communications whereby you are asked to take part in the survey, or by writing to email@example.com or to SAES Getters S.p.A., Viale Italia 77, 20045 Lainate, Milan (FAO Legal Office). Any objection to this will in no way prejudice the processing of data required to process the purchase orders.
h) Judicial protection of the Data Controller
All data collected for the purposes described in subsections (a), (b), (c), (d), (e), (f) and (g) may, in addition, be processed to enable the Data Controller to exercise its right of defense should a dispute arise with the data subjects or to respond to any requests from judicial and administrative authorities.
The legal basis for the processing is the legitimate interest of the Data Controller in judicial protection. Legitimate interest that does not affect the rights and freedoms of the data subjects as an expression of a constitutionally guaranteed right of the Data Controller.
Data communication and data recipients
The data will be processed by the Data Controller and by the subjects specifically instructed by the same (e.g., subjects in charge of the management of information systems, the function of the legal function, the administrative function) and may be communicated to third parties only where necessary in relation to the above purposes or in execution of legal obligations, first and foremost transparency and publicity obligations arising from the legislation dedicated to listed companies, including Consob circulars and regulations.
The data may also be communicated to third parties, autonomous data controllers or data processors, who provide services in favor of the Company (by way of example, cloud storage providers, legal and tax consultants, service providers of the Company, etc. ), in particular they may also be shared with subsidiaries and affiliates of the Company (which, unless otherwise indicated, will act as autonomous data controllers) if necessary for the execution of a sales contract or pre-contractual measures to be taken at the request of the data subject, as well as for administrative-accounting purposes and, in this context, may be transferred outside the European Union.
Place of data processing
The data will be processed at the Company’s premises and the data will be stored at servers and/or archives located within or outside the European Union.
Transfer outside the European Union may take place only and exclusively to countries that offer a level of protection of personal data similar to that guaranteed by EU law or, in any case, subject to the adoption of adequate safeguards referred to in Article 46 of the GDPR aimed at ensuring a level of data protection similar to that guaranteed within the European Union.
Processing Method and data retention period
Data will be processed both in paper form and by electronic, computer or automated means, through systems that ensure their protection, security and confidentiality. Specifically, according to the Section selected at the time of the submission of the request by the data subject, the data will be segregated on the relevant section of CRM – Customer Relationship Management and consultable only by the relevant function.
In addition, the Data Controller has adopted specific and adequate logical, legal organizational and technical security measures to prevent data loss, illicit or unauthorized use of data and unauthorized access.
Data are processed only for the time strictly necessary to achieve the purposes for which they were collected. In particular:
- Purposes (a) and (b): personal data processed for participation in Red Zone and start-up incubator initiatives will be retained for as long as necessary to assess whether the start-up can become part of the Red Zone incubator and, in any case, for no longer than three (3) years from the time of acquisition of the same. This data may be kept for a longer period in the event that the start-up becomes part of the Red Zone incubator: in this case, the data will be processed for as long as the start-up is part of the Red Zone incubator and, following its exit, for the time stipulated by the regulations on ordinary prescription (10 years);
- Purpose c): the personal data processed for any request for information will be kept for as long as necessary to analyze and respond to the requests received, and in any case, for no longer than 18 (eighteen) months starting from the time of their acquisition, extendable – on the basis of a legitimate interest of the Company and the reasonable expectation of the Data Subject himself – by subsequent periods of 18 (eighteen) months where the data subject, as a result of the contacts made with the Company and the continued interest shown in its products and services, does not object to the processing, in the manner indicated in this notice or at the foot of each communication sent;
- Purpose d): the personal data processed with reference to the subscription to the investor newsletter service will be retained for up to 18 (eighteen) months from the subscription to the newsletter service and the granting of the relevant consent, which may be extended – on the basis of the legitimate interest of the Company and the reasonable expectation of the Interested Party itself – by subsequent periods of 18 months where the Interested Party, following the contacts made with the Company and the continued interest shown in its products and services, does not object to the processing, in the manner indicated in this notice or at the foot of each communication sent;
- Purpose e): the Personal Data processed with reference to the sending of applications will be kept for 12 (twelve) months after receipt;
- Purpose f): the Navigation Data will be kept for 12 months;
- Purpose g): personal data processed in order to enable the user to complete the purchase of the desired products on shop.saesgetters.com will be kept for the period necessary to fulfill tax, accounting and regulatory obligations related to the sale of the Company’s products; with regard to the purpose of carrying out surveys and market research, the data will be processed for up to 18 months after the delivery of the purchased products.
- Purpose (h): personal data collected to ensure the right to defense will be retained for 10 (ten) years from the last contact occurred between the Data Subject and the Data Controller.
It should be noted that personal data may be retained for a longer period if necessary to fulfill legal or regulatory obligations and/or for protection.
Rights of the Data Subject
Data subjects are entitled to the rights conferred by the GDPR under Articles 12-23 of the GDPR. In particular, data subjects have the right to request and obtain, at any time: (i) access to their data; (ii) information about the processing carried out; (iii) rectification and/or updating of data; (iv) deletion of data; (v) restriction of processing; (vi) to exercise the right to object to processing; (vii) data portability (i.e., to receive data in a commonly used, machine-readable, structured format); (viii) to exercise the right to revoke one’s consent to the processing of data where this rises to the legal basis for the specific purpose for which the processing is carried out (this, in any case, will not affect the lawfulness of the processing carried out on the basis of the consent given before revocation); and, finally, (ix) to lodge a complaint with a data protection authority (in Italy: Garante per la Protezione dei Dati Personali).
The above rights may be exercised at any time by simple request to the Company, to be transmitted:
- by e-mail, to the address: firstname.lastname@example.org
- by regular mail, to the address of Viale Italia 77, 20045 Lainate, Milan (for the attention of the Legal Department).
For other information or clarifications on the mentioned rights, you can contact the Data Controller at the same contact details or the DPO at: email@example.com