INFORMATION ON THE PROCESSING OF PERSONAL DATA

Articles 12 and following of Regulation (EU) 2016/679 (GDPR)

Pursuant to EU Regulation 2016/679 (hereinafter also “GDPR”), this information notice is provided in relation to the processing of personal data provided by the data subject within the scope of the activities, services, and commercial relationships rendered by the companies belonging to the Miller Group network (hereinafter the “Miller Group”).
The information notice is provided pursuant to Article 13 of the GDPR.

1. DATA CONTROLLER AND JOINT DATA CONTROLLERS

The activities are carried out in synergy by a network of independent companies (hereinafter the “Network Companies” or “Companies”). The sharing of the CRM and communication activities does not alter the legal autonomy of the companies nor the professional autonomy of the individual Companies and the STPs (Professional Associations).

Purposes pursued:

• For customer management activities relating to the specific contract or service provided individually, the providing Network company operates as an independent Data Controller;

• For coordinated activities carried out under the Brand banner (such as the management of the single platform/website, the centralized customer database/CRM, and shared marketing initiatives), the Companies operate as Joint Data Controllers pursuant to Article 26 of the GDPR, as they jointly determine the purposes and means of the processing. The joint controllership does not extend to the content and execution of the professional assignments of the individual STPs, nor to information covered by professional secrecy.

The updated list of the Joint Data Controller Companies of the Miller Group Network, with name, registered office, and contact details, is available at the following link: https://millergroup.it/it/contatti/

The data provided by the data subject will be processed in countries located within the European Union. Should the personal data of the data subject be processed in a non-EU state not mentioned in the previous list, the rights attributed to the latter by EU legislation will be guaranteed and prompt communication will be given to the data subject.

SINGLE POINT OF CONTACT AND EXTRACT OF THE JOINT CONTROLLERSHIP AGREEMENT

Pursuant to Art. 26 GDPR, the Companies have signed a Joint Controllership Agreement to clearly and transparently divide their tasks and respective responsibilities. The aforementioned agreement is made available, in its essential content, upon written request to be sent to the address gdpr@millergroup.it

Single Point of Contact: To facilitate the exercise of the rights provided by the GDPR, a Single Point of Contact has been established, reachable at the e-mail address: gdpr@millergroup.it

Allocation of responsibilities: Millertech S.r.l., a party to the joint controllership agreement, manages the technological infrastructure and the security measures of the common database, while responses to requests from data subjects are managed in a coordinated manner through the Single Point of Contact.

For informative, commercial, and marketing communications, the data shared in the CRM are: company name and master data (VAT number and registered office), name and surname of the company contact person, e-mail address of the contact person, and company phone number. Documents and information on the content and execution of individual professional assignments and any information covered by professional secrecy remain excluded from sharing.

PURPOSES OF THE PROCESSING

A) For customer management activities relating to the specific contract or service provided individually, the providing Network company operates as an independent Data Controller processing the following data:

• Master data and contact data, data necessary for the execution of the contractual relationship, with the purpose of carrying out all the activities necessary for the execution of the contract (Art. 6, paragraph 1, letters b and c of the GDPR);

• If the supply covered by the contract requires it, assistance for the purchased services, master data and contact data, as well as personal data depending on the contracted service, will be processed in order to respond to assistance requests (Art. 6, paragraph 1, letter b of the GDPR);

B) For coordinated activities carried out under the Brand banner (such as the management of the single platform/website, the centralized customer database/CRM), the Companies operate as Joint Data Controllers pursuant to Art. 26 of the GDPR, as they jointly determine the purposes and means of the processing. The joint controllership does not extend to the content and execution of the professional assignments of the individual STPs, nor to information covered by professional secrecy, to the sending of promotional material, commercial communications on products or services of the individual Network Companies, clearly identified also through the WhatsApp instant messaging service and the sending of informative and technical Newsletters (Art. 6 letter a GDPR). Communications respect the autonomy of the companies and the ethical rules of the STPs; the name, logo, or image of the STPs and professionals are not used to promote commercial products or services of other companies. E-mail communications may use tracking pixels and link tracking systems that allow detecting message openings and clicks, associating them with the recipient, to measure the effectiveness of the mailings and personalize communications based on the interests detected. The identifiers of the message and the recipient, the selected link, the date and time of the event, and the interests inferred from such interactions are processed. Processing takes place with the prior consent of the data subject pursuant to Art. 122 of Legislative Decree 196/2003 and Art. 6, par. 1, letter a GDPR. Consent to tracking and related personalization can be revoked through the methods indicated in the communications or by writing to gdpr@millergroup.it, continuing to receive communications without tracking.

The data subject must provide the Companies with the data necessary for the performance of the contractual relationship, as well as the data necessary to fulfill obligations provided for by laws, regulations, community legislation, or by provisions of Authorities legitimated by law and by supervisory and control bodies. Data not essential for the performance of the contractual relationship are qualified and considered supplementary and their provision by the data subject, if requested, is optional and bound to consent.

DATA RETENTION:

Your data will be stored for the time strictly necessary to manage the indicated purposes, according to principles of correctness, lawfulness, and transparency.

In particular, personal data processed for the purpose referred to in point (A 1) are kept for the entire duration of the contract and for the time provided by law. Personal data processed for the purposes referred to in point (A 2) are kept for five years from the moment they are provided as part of the assistance activity. Finally, data processed for the purposes referred to in point (B) are kept until consent is revoked. Individual data relating to openings, clicks, and inferred interests are kept for the time necessary to verify the effectiveness of the mailings and to personalize communications, with periodic verification of their relevance and necessity; they are deleted or anonymized when no longer necessary and, in case of revocation of consent to tracking and related personalization, except for the retention of only the evidence necessary to document consents and revocations.

PROCESSING METHODS:

Your personal data will be processed, recorded, and stored in paper format and/or through electronic tools. The data will be processed in compliance with the appropriate technical and organizational measures referred to in Art. 32 of the GDPR. The processing of the personal data of the data subject may consist of any operation or set of operations among those indicated in Art. 4, paragraph 1, point 2 of the GDPR. The processing of personal data will take place using suitable tools and procedures to guarantee security and confidentiality and may be carried out, directly and/or through delegated third parties, both manually using paper supports and with the aid of IT or electronic tools. For the purposes of correct management of the relationship and fulfillment of legal obligations, the data may be included in the internal documentation of the companies and, if necessary, also in the accounting records and registers required by law. The personal data of the data subject may be processed by employees of the company functions of the Companies appointed to pursue the aforementioned purposes. These employees have been expressly authorized to process the data and have received adequate operating instructions pursuant to and for the purposes of Art. 29 GDPR.

POTENTIAL RECIPIENTS OF PERSONAL DATA

The processed data may be sent and shared with suppliers and data managers who provide us with certain services (e.g., accounting services, e-mail management services, companies providing IT assistance services), our consultants (e.g., accountants, etc.) and/or Data Processors and their employees as authorized subjects.

Furthermore, the personal data of the data subject may be communicated and processed by external subjects operating as independent data controllers pursuant to Articles 4 and 24 GDPR such as, by way of example, supervisory and control authorities and bodies.

RIGHTS OF THE DATA SUBJECTS:

The data subject may exercise the rights of access, rectification, erasure, restriction, portability and/or objection pursuant to and for the purposes of Articles 15 and following of the GDPR, to ask the Data Controller for access to their personal data and the rectification or erasure thereof or the restriction of the processing concerning them or to object to their processing.

Before fulfilling requests – the Data Controller may carry out an identity check on the data subject to assess the legitimacy of the request received.

To exercise these rights, the data subject may contact the Joint Data Controller Companies or independent Data Controllers in relation to the areas defined above at the address gdpr@millergroup.it.

You have the right to request a copy of your personal data in a structured, commonly used, and machine-readable format.

The Companies will respond within 30 days of receiving the formal request sent by the data subject.

In the event of a breach of the personal data of the data subject, the latter may lodge a complaint with the competent authority: “Garante per la protezione dei dati personali” (Data Protection Authority).

For the Joint Data Controllers