INFORMATION ON THE PROCESSING OF PERSONAL DATA
pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data

HCCables (hereinafter also referred to as the “Controller” or the “Licensor”), with registered office at Via Mure Sud, 3 – 35044 Montagnana (PD), VAT no.  05642810286, in its capacity as data controller, hereby informs you, pursuant to Articles 13 and 14 of European Regulation 679/2016 on the protection of personal data (“GDPR”), of the following.

1. TYPES OF DATA PROCESSED
The Licensor is the data controller of the personal data provided at the time of signing the Contract and any additional data subsequently supplied during the performance of the Contract.
The personal data collected by the Licensor in relation to the management of the contractual relationship—and during any pre-contractual phases—may be provided directly by the Data Subject (as defined below) or by the Client, in cases where such data concerns the Client’s internal representatives involved in managing the Contract.
The personal data processed by the Licensor may include, by way of example but not limited to, names, job titles, telephone numbers, tax identification numbers, payment and banking details, and, where applicable, company names and email addresses of individuals and legal representatives of companies who are contractual parties to the Contract, as well as internal contacts responsible for contract management (hereinafter, the “Data Subjects” and the “Data”).
Certain information—such as data relating to legal representatives or proxies, financial statements, or customer creditworthiness—may also be obtained from public sources (such as Chambers of Commerce or commercial information services).

2. PURPOSES OF DATA PROCESSING
The processing of Data is carried out by the Licensor in the course of its business and commercial activities for purposes related to the establishment, management, and execution of commercial relationships, including the management of pre-contractual relations. In particular, the Data provided by the Data Subjects will be processed, mainly through electronic means, for the following purposes:
a) the performance of obligations strictly related to the management of the Contract, including administrative and accounting management, payment and invoicing processes, the provision of services, and customer support services. The provision of data for these purposes is essential for the proper management of the Contract and does not require the Data Subject’s consent (Art. 6(1)(b) of the GDPR);
b) the performance of activities instrumental to the management of the Contract, including activity planning, legal protection, management of any disputes, and debt recovery. In such cases, the provision of data, where required, is optional, and the processing is based on the legitimate interest of the Licensor;
c) compliance with obligations arising from laws, regulations, or EU legislation (e.g., tax and accounting obligations), for which the provision of data is mandatory and the processing does not require the Data Subject’s consent (Art. 6(1)(c) of the GDPR);

3. METHODS OF PROCESSING
The Data will be processed by the Company using both electronic and manual systems, in accordance with the principles of fairness, lawfulness, and transparency as set out in the applicable data protection regulations. The confidentiality of the Data Subject will be safeguarded through technical and organizational security measures designed to ensure an adequate level of protection.

4. DATA RETENTION
The Data required for the management of the Contract and the fulfillment of the obligations outlined in points (a) and (b) of section 2 of this notice will be retained by the Controller in its records for 10 years following the registration of the related operations, in compliance with civil and tax obligations imposed by current legislation. Similarly, the Data referred to in point (c) of section 2, necessary for protection in the event of claims or disputes, will be retained for 10 years after the termination of the Contract.

5. DATA DISCLOSURE, DISSEMINATION, AND TRANSFER
The Data will be processed, within the limits of necessity, by authorized personnel of the Controller who have been properly trained and instructed, as well as by personnel of third parties who provide services to the Controller and process Data on its behalf and under its instructions, acting as data processors.
These may include providers of IT services (e.g., hosting providers), call center services, debt collection activities, customer support services (e.g., ticketing systems), marketing support services (e.g., direct email marketing), and third-party companies, including companies that… HCCables, which provide complementary services. The complete and updated list of entities that process Data as data processors is available upon request from the Data Protection Officer.
In cases where the contractual relationship involves the participation of our commercial partners, the Controller may share certain Data with distributors, resellers, and partners who are part of the distribution chain for products and services.  HCCables.
In the course of its regular business activities, Data may be disclosed to parties carrying out control, audit, and certification tasks related to the activities undertaken by the Controller, as well as to consultants and independent professionals providing tax, legal, or judicial assistance services, or in the context of corporate transactions where it is necessary to evaluate the company’s assets. Data may also be disclosed to other companies HCCables, where necessary for group coordination and control purposes, as well as to public entities and administrations, including tax authorities where required, and to parties legally entitled to receive such information, including Italian and foreign judicial authorities and other public bodies. This is done for purposes related to compliance with legal obligations or the fulfillment of contractual obligations arising from the business relationship, including the need for legal defense.

Contact details may, on rare occasions, also be shared with the Controller’s clients and/or suppliers—for instance, if collaboration with such parties is required in order to provide services.

Under no circumstances will the Data be disclosed or broadly transferred outside the European Union. However, for specific needs related to the location of third parties with whom the Data may be shared (as described above), some Data may be transferred outside the European Economic Area to countries that provide an adequate level of protection.

In cases where the third country does not offer an adequate level of protection, the Controller undertakes to ensure appropriate safeguards, including contractual protections such as the use of Standard Contractual Clauses. A copy of the commitments undertaken by third parties in the context of such clauses can be requested by contacting the Data Protection Officer.

6. MARKETING AND PROFILING
Subject to the Data Subject’s consent, the Data may also be processed by the Controller for the following purposes:

a) sending, via email, automated messages, or telephone calls, commercial offers and initiatives related to products or services of the Controller’s companies HCCables,  as well as conducting market research or other customer satisfaction initiatives promoted by the Controller. Should the provision of any data for this purpose be required—which is a highly exceptional case—such provision shall be optional. It is understood that the processing of data for this purpose will only be possible with the Data Subject’s consent (Art. 6 (1)(a) GDPR). Consent may be withdrawn at any time, freely and in the manner indicated in section 7 below or via the unsubscribe link provided in each electronic communication. Failure to provide or the withdrawal of consent will in no way affect the execution of the Contract;
b) the analysis of habits related to the use of the Controller’s products and services HCCables  by the Data Subject, based on what may be considered of interest, both to improve HCCables’ products and services by adding features that are more relevant to its clients, and to offer the Data Subject products that may better meet their specific needs. Should the provision of any data for this purpose be required—which is a highly exceptional case—such provision shall be optional. It is understood that data processing for this purpose will be possible only with the consent of the Data Subject (Art. 6(1)(a) of the GDPR). Any use of information relating to the use of products or services attributable to the Client as a legal entity may be carried out by the Controller even without specific consent, unless otherwise provided by applicable law. Consent may be withdrawn at any time, freely and in the manner indicated in section 7 below; failure to provide or the withdrawal of consent shall in no way affect the execution of the Contract.
Subject to the Data Subject’s consent, and for the purpose of receiving promotions and commercial offers, the Licensor may also share the Data with companies HCCables  that are involved in software development and training, as well as with partners and suppliers of HCCables 
for the purpose of sending promotions and commercial offers by those parties.
Without prejudice to the right to request the erasure of Data, and the rights of objection and restriction of processing as outlined in section 7 of this notice, the Data processed for the purposes set out in this section will be stored and processed in compliance with applicable data protection regulations for the time strictly necessary to fulfill the purposes described above, for a maximum of 24 months or for any longer period permitted by law for profiling activities as referred to in letter a) of this section; otherwise, for the purposes referred to in letter b) of this section, the processing will continue until the Data Subject withdraws their consent.

7. WHAT ARE THE DATA SUBJECT’S RIGHTS
In relation to the data processing described herein, the Data Subject may exercise the rights provided under the GDPR (Articles 15–21), including:
•  to receive confirmation of the existence of the Data and access their content (right of access);

•  to update, modify, and/or correct the Data (right to rectification);

•  to request the erasure or restriction of processing of Data processed unlawfully, including Data whose retention is unnecessary in relation to  the purposes for which they were collected or otherwise processed (right to be forgotten and right to restriction);

•  to object to the processing (right to object);

•  to withdraw consent, where given, without affecting the lawfulness of processing based on consent before its withdrawal;

•  to lodge a complaint with the supervisory authority (Garante per la protezione dei dati personali  – www.garanteprivacy.it) in the event of a breach of personal data protection regulations;

•  to receive a copy in electronic format of the Data concerning them as a Data Subject, when such Data have been provided in the context of the contract, and to request that such Data be transmitted to another data controller (right to data portability).

To exercise these rights, the Data Subject may contact the Data Protection Officer by sending a request to the email address info@hccables.it or by sending a written communication to:
HCCables
Via Mure Sud, 3 – 35044 Montagnana (PD), Italy.