WHY THIS NOTICE

Lumed S.r.l., with registered office in Via Staffora n. 18/9 – 20090 Opera (MI), considers the protection of the personal data of its customers and suppliers to be of fundamental importance, ensuring that the processing of personal data, performed in any manner (both automated and manual) should be carried out in full compliance with the safeguards and rights recognised by European Regulation 2016/679 (hereinafter also “GDPR”), on the protection of natural persons with regard to the processing of personal data as well as on the free movement of such data and by the additional applicable rules concerning the protection of personal data.

The term “personal data” refers to the definition contained in art. 4, point 1) of the GDPR, that is, to “any information relating to an identified or identifiable natural person; an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person” (hereinafter also “Personal Data“).

Your Personal Data consist of: Name and surname, postal address, VAT number or tax code, telephone number or mobile number, organisation to which you belong (for example: employer company, etc.), company role, e-mail address.

The GDPR states that, before proceeding to processing Personal Data (meaning, with this definition, pursuant to Article 4, point 2), “any operation or set of operations which are performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise made available, alignment or combination, restriction, erasure or destruction” (hereinafter also “Processing“) it is necessary that the person to whom the Personal Data belong (hereinafter “Data subjects“), should be informed of the reasons for which these are requested and how they will be used.

The purpose of this document is therefore to provide you, in a simple and intuitive manner, with all the useful and necessary information in order that you may transmit your Personal Data in a mindful and informed manner and, where necessary, request and obtain clarifications and/or corrections concerning the latter.

WHO WILL PROCESS YOUR PERSONAL DATA?

The company which will process your personal data for the purposes indicated in the following clauses and that, therefore, will serve as data controller, is Lumed S.r.l., with registered office in Via Staffora no 18/9 – 20090 Opera (MI), Italy – info@lumed.com (hereinafter also “Data Controller“).

FOR WHAT MAIN PURPOSES WILL YOUR PERSONAL DATA BE PROCESSED?

The Data Controller needs to collect some of your Personal Data for the following purposes:

1. to answer requests for information or commercial requests you voluntarily send, including via the contact form on the Internet website http://www.lumed.com (the Website);
2. to fulfil contractual and legal obligations (in particular accounting and tax obligations) should a contract be entered into with the Data subject.

Furthermore, your Personal data will be processed by the Data Controller to carry out consultancy activity and telephone assistance to customers following a request for an estimate or a contact made, including through the Website or the telephone number +39 02 57606751 or the fax number +39 02 57606752. The provision of your data for the aforementioned purposes is necessary to allow the supply of the services spontaneously requested by you or to manage requests for estimates or for requests for information or intervention carried out using the tools for contacting the Data Controller. Your refusal, therefore, will lead to the impossibility of making use of the above-mentioned services.

WHERE WILL YOUR PERSONAL DATA BE PROCESSED?

Your Personal Data will be processed by the Data Controller within the European Union. Should it be necessary to make use of subjects located outside the European Union for technical and/or operational reasons, please note that these subjects will be appointed as Data Processors pursuant to and for the purposes of art. 28 of the GDPR and that the transfer of your Personal Data to these subjects, limited to performing specific processing activities, will be regulated in compliance with the provisions of Section V of the GDPR and, in particular, that all necessary precautions will be taken in order to guarantee full protection of your Personal data, basing this transfer:

1. on decisions concerning the adequacy of the recipient third countries expressed by the European Commission;
2. on adequate guarantees expressed by the third party subject pursuant to art. 46 of the

ADDITIONAL PURPOSES

Subject to your express, free and unambiguous consent pursuant to art. 6, section 1, point a) of the GDPR, the Data Controller may use your Personal Data for the following and additional purposes:

• to verify the level of customer satisfaction in relation to the service provided by the Data Controller;
• to measure the effectiveness and adequacy of the service offered through the Website;
• to send communications (including commercial communications) with the aim of keeping you updated concerning the Data Controller’s news and activities.

Processing your Personal data for the purposes referred to in the above points is optional and cannot disregard obtaining your consent, which must necessarily comply with the conditions of art. 7 of the GDPR, thus determining the lawfulness of the Processing of your Personal data.

The methods of contact aimed at the activities indicated in the previous points, can be either automatic (e-mail) or traditional (telephone calls with operator or via postal mail). In any case, and as better specified below, you can at any time revoke your consent, even partially, for example by consenting to traditional contact methods only.

FOR HOW LONG WILL YOUR PERSONAL DATA BE PROCESSED?

Your Personal Data will be processed by the Data Controller for a period not exceeding the purposes for which they were collected and subsequently processed.

In any case, you may, at any time, notify us, through one of the methods envisaged by this information notice, of your will to revoke your consent for one or all of the purposes for which it was requested. The possible revocation of your consent will in fact force the Data Controller to cease Processing your Personal Data for these purposes.

TO WHOM MAY YOUR PERSONAL DATA BE TRANSMITTED?

Your Personal Data may be disclosed to specific subjects considered recipients of such Personal Data. Please note, in fact, that art. 4, point 9) of the GDPR, defines as the recipient of Personal Data “a natural or legal person, public authority, agency or any other body to which the personal data are disclosed, whether a third party or not” (hereinafter “Recipients“).

In this perspective, in order to correctly carry out all the Processing activities necessary to pursue the purposes referred to in this information notice, the following Recipients may be in a position to process your Personal data:

• individuals, employees and/or collaborators of the Data Controller, who have been entrusted with specific and/or several Processing activities concerning your Personal Data; these individuals have been given specific instructions on safety and the correct use of Personal Data (hereinafter also “Data Processors“);
• where required by law or to prevent or stifle the commission of an offence, your Personal Data may be disclosed to public bodies and/or to the judicial authority.

IS IT POSSIBLE TO REVOKE THE CONSENT GIVEN AND HOW?

As provided for by the GDPR, if you have given your consent to the Processing of your Personal Data for one or more purposes for which it was requested, you may, at any time, revoke this fully and/or partially without prejudice to the lawfulness of the Processing based on the consent given before its revocation.

The methods for revoking consent are very simple and intuitive: Simply contact the Data Controller using the contact channels referred to in the “WHAT ARE YOUR RIGHTS?” Section of this statement.

WHAT ARE YOUR RIGHTS?

In accordance with art. 15 of the GDPR, you will be able to access your Personal Data, ask for their correction and updating, if incomplete or incorrect, request their cancellation if the collection occurred in violation of a law or a regulation, as well as oppose the Processing for legitimate and specific reasons.

In particular, all your rights that you may exercise, at any time, towards the Data Controller are shown below.

• Right of access: you will have the right, according to art. 15, section 1 of the GDPR, to obtain confirmation from the Data Controller that your Personal Data are being processed and in that case to obtain access to your Personal Data and to the following information: a) the purposes of the Processing; b) the categories of Personal Data in question; c) the Recipients or categories of Recipients to whom your Personal Data have been or will be disclosed, in particular whether these Recipients are in third countries or in international organisations; d) when possible, the foreseen retention period of the Personal Data or, if this is not possible, the criteria used to determine this period; e) the existence of the right of the Data Subject to ask the Data Controller to rectify or erase the Personal Data or to limit the Processing of Personal Data concerning you or to oppose their Processing; f) the right to lodge a complaint with a supervisory authority; g) should the Personal Data not be collected from the Data Subject, all available information on its origin; h) the existence of an automated decision-making process, including profiling pursuant to art. 22, paragraphs 1 and 4, GDPR and, at least in such cases, significant information on the logic used, as well as on the importance and consequences such Processing may have for the Data Subject. All this information can be found in this Information notice which will always be available to you in the Privacy section of the Website.
• Right of rectification: in accordance with art. 16 of the GDPR, you may ask for rectification of any inaccurate Personal Data. Taking into account the purposes of the Processing, you have the right to have incomplete Personal data completed, including by means of providing a supplementary statement.
• Right to erasure: according to art. 17, section 1, GDPR, you may ask for and obtain the erasure of your Personal Data without unjustified delay and the Controller will be obliged to delete your Personal Data, should even one only of the following reasons exist: a) your Personal Data are no longer necessary for the purposes for which they were collected and processed; b) you have withdrawn the consent on which the Processing of your Personal Data is based and there is no other legal basis for Processing to take place; c) you have objected to the Processing pursuant to Article 21, section 1 or 2 of the GDPR and there is no longer any prevailing legitimate reason to Process your Personal Data; d) your Personal Data have been processed unlawfully; e) it is necessary to delete your Personal Data in order to comply with a legal obligation pursuant to an EU law or a national law. In accordance with art. 17, section 3 of the GDPR, in some cases the Controller is entitled to not cancel your Personal Data should the Processing be necessary, for example, for exercising the right to freedom of expression and information, for fulfilling a legal obligation, for reasons of public interest, for archiving purposes in the public interest of scientific or historical research or for statistical purposes, for ascertaining, exercising or defending a right in court.
• Right to restriction of processing: you may ask for and obtain the restriction of the Processing, in accordance with art. 18 of the GDPR, in the event that one of the following hypotheses occurs: a) you have contested the accuracy of your Personal Data (the restriction will last for the period enabling the Controller to verify the accuracy of your Personal Data); b) the Processing is unlawful but you have objected to the erasure of your Personal Data, asking instead for the restriction of their use; c) the Data Controller no longer needs your Personal Data for Processing purposes but it is required for the establishment, exercise or defence of legal claims; d) you have objected to the Processing pursuant to art. 21, section 1, GDPR and await verification of whether the Data Controller’s legitimate grounds override yours. Where Processing has been restricted, your Personal Data shall, with the exception of storage, only be processed with your consent or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest. We will inform you, in any case, before this restriction is revoked.
• Right to data portability: you can, at any time, ask for and receive, pursuant to art. 20, section 1 of the GDPR, all your Personal Data processed by the Data Controller in a structured, commonly used and readable format or request transmission to another Data Controller without hindrance. In this case, you will provide us with the exact details of the new data controller to whom you intend to transfer your Personal Data, providing us with written authorisation.
• Right to object: pursuant to art. 21, section 2 of the GDPR and as also reiterated by Recital 70, you may at any time object to the Processing of your Personal Data if these are processed for direct marketing purposes, including profiling to the extent that it is related to such direct marketing.
• Right to lodge a complaint with the supervisory authority: without prejudice to your right to appeal to any other administrative or judicial office, if you believe that the Processing of your Personal Data by the Data Controller is in violation of the GDPR and/or of the applicable legislation, you may lodge a complaint to the competent Authority for the Protection of Personal Data.

To exercise all your rights as identified above, simply contact the Data Controller in the following ways:

• by registered letter sent to Lumed Srl, with registered office in Via Staffora no 18/9 – 20090 OPERA (MI);
• by fax to the number +39 02 57606752;
• by sending an e-mail to the e-mail address: info@lumed.com.