Customer privacy notice

Data controller

The Data Controller is I.P.S. SYSTEMS S.R.L., with registered offices in Genoa at Via Nizza 7/4, staircase D (operational office), 16145, and Via Lanfranconi 1/5a (registered office), 16121, VAT No. 01986330999; email: info@ipssystems.it - privacy@ipssystems.it; telephone: +39 010 8970066. The pro tempore legal representative is Dr Maria Chiara Salvatico, email: gdpr@ipssystems.it. Website: www.ipssystems.it.

In accordance with the principle of transparency, the following information explains the characteristics and methods used to process your personal data.

Categories of data processed

I.P.S. SYSTEMS S.R.L. acts as Data Controller in the engineering sector, designing data-centre, networking and security infrastructure; part of its business also concerns automation, systems and training. It guarantees the utmost confidentiality, accuracy and updating of your personal data in accordance with applicable data-protection legislation.

Subject matter of the processing

The Controller processes personal data such as first name, surname, physical address, province and municipality of residence, landline and/or mobile number, fax, tax code, VAT number, company name, personal email and banking or payment details, including IBAN, supplied when contracts are concluded for the services and products offered and/or for marketing purposes. The Controller may also store cookies as described in the Cookie Policy.

Purposes and legal basis of processing

I.P.S. SYSTEMS S.R.L. uses the data to process registrations, manage customer contact requests, provide assistance and comply with legal and regulatory obligations. Personal data is never used for undeclared purposes.

a) Registration, contact requests and information material

Processing is carried out for activities preliminary and subsequent to registration for our services, including online services; to manage requests for information and contact or the delivery of information material; and to fulfil related obligations. The legal basis is performance of the services requested by the data subject and compliance with legal obligations.

b) Management of the contractual relationship

Processing covers activities preliminary and subsequent to the purchase of a service or product, order management, service delivery, invoicing and payment management, together with contractual, legal, regulatory and European obligations or orders from an Authority, including anti-money-laundering requirements, and the exercise of the Controller’s rights, including legal defence. The legal basis is performance of the contract and compliance with legal obligations.

c) Promotional activities

I.P.S. SYSTEMS S.R.L. may use contact details supplied by the Data Subject/Customer for direct marketing concerning its services and products, even without explicit consent, unless the Data Subject/Customer objects. The legal basis is the Controller’s legitimate interest. Before further processing for a purpose other than that for which the data was collected, the company will provide information on that purpose and all relevant additional information.

Nature of providing data and consequences of refusal

Collection and processing for registration, requests and management of the contractual relationship are necessary to provide the requested services. Refusal to provide expressly required data prevents I.P.S. SYSTEMS S.R.L. from managing the service and/or contract and related obligations. Providing data for promotional purposes is optional; the Data Subject may object to its use and request deletion at any time without affecting contractual services.

Processing methods

Processing complies with the principles of lawfulness, fairness and transparency. Data is adequate, relevant and limited to what is necessary for the purposes, in accordance with the data-minimisation principle.

Data is processed electronically and on paper using tools designed to ensure security and confidentiality. Automated tools may also be used to store, manage or transmit data. Processing includes the operations listed in Article 4(2) GDPR: collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure, dissemination or other availability, alignment or combination, restriction, erasure or destruction.

I.P.S. SYSTEMS S.R.L. applies appropriate security measures to preserve confidentiality, integrity and availability and requires equivalent measures from suppliers and Processors. Data is stored in paper, electronic and telematic archives located in countries where the GDPR applies.

Data retention

Unless deletion is expressly requested, personal data is retained for the period required by applicable law and no longer than necessary for the stated purposes. Contract-performance and invoicing data is retained for ten years and is then securely destroyed.

Marketing and commercial-promotion data is retained until the Data Subject unsubscribes, unless it is genuinely anonymised. Following an objection, data is deleted within 30 days. Unrequested or unnecessary personal data is deleted as soon as possible.

Rights of the data subject

Requests may be addressed to I.P.S. SYSTEMS S.R.L., Via Nizza 7/4, 16145 Genoa, Italy, or to privacy@ipssystems.it, telephone +39 010 8970066. You have the right to:

1. obtain confirmation as to whether personal data is being processed and access the data and related information (Art. 15);
2. rectify and erase data (Arts. 16 and 17);
3. restrict processing (Art. 18);
4. have rectification, erasure or restriction communicated to recipients unless impossible or disproportionate (Art. 19);
5. data portability (Art. 20);
6. object to processing (Art. 21);
7. object to automated decision-making, including profiling (Art. 22);
8. withdraw consent at any time (Art. 7);
9. lodge a complaint with the competent supervisory authority, which in Italy is the Italian Data Protection Authority.

I.P.S. SYSTEMS S.R.L. responds within one month, except in particularly complex cases where the period may be extended to three months; the reason for the delay will be explained within one month. The outcome is provided in writing or electronically. Withdrawal of consent does not affect the lawfulness of earlier processing.

Data subjects should keep their data up to date by writing to privacy@ipssystems.it. Marketing or newsletter consent may be withdrawn through the link in each communication. Please consult the Cookie Policy to reject cookies or tracking technologies. After withdrawal or restriction, data is no longer used and may be archived to respond to legal or authority requests. The company may retain an anonymised version.

Disclosure of data

Personal data is not disseminated and may be accessed, only as necessary, by authorised employees and collaborators. It may also be disclosed to third parties acting as independent or joint Controllers or as external Processors appointed under Article 28 GDPR, including:

• external public or private bodies carrying out inspections;
• previously appointed external consultants;
• suppliers and consultants processing data on behalf of I.P.S. SYSTEMS S.R.L.

Data may be transmitted to public-security authorities upon request and to judicial authorities where necessary. A complete list of recipients is available upon request through the contact details at the start of this notice. Data is not transferred to third countries or international organisations; any future transfer outside the European Union will comply with European Commission requirements and applicable law. Data is disclosed where required by legal or contractual obligations.

Transfers outside the EU

Your data will not be disclosed for processing in third countries.

Automated decision-making

The Controller does not use automated decision-making, including profiling. Any assessment of personal, professional, economic or health aspects, preferences, interests, reliability, behaviour, location or movements is performed through human rather than automated decision-making.