1. Introduction
Zehus S.p.A. (“Zehus”), with registered office in Viale Luigi Sturzo 45, Milan (Italy) which can be contacted at the email address privacy@zehus.it, process – in its capacity of data controller – personal data provided by the user (the “User”) of the website www.zehus.it (the “Website”) with regard to the use of the Site and the provision of the requested services available on the Site (the “Services”), in compliance with the terms of this privacy notice (the “Privacy Notice”).
2. Which categories of personal data does Zehus collect?
The Company processes personal data voluntarily provided by the Users, in the context of their interactions with the Website, and in particular:
a) data voluntarily provided by Users, in connection with the forwarding of any requests for information or assistance or the sharing with Zehus of comments on the products and services offered by the Company, by means of the Website (“Identification Data”);
b) browsing data relating to the use of the services offered on the Website, such as IP addresses or domain names of the devices used by Users, URI (Uniform Resource Identifier) addresses of the resources requested, the time of the request, the method used to submit the request to the server and other parameters relating to the Users’ operating system and computer environment. These data are collected by means of cookies, in accordance with the cookie policy, available at the following link https://www.zehus.it/cookie-policy/ (“Browsing Data”);
(collectively referred to as “Personal Data”).
3. What are the purposes of the processing?
The Company processes Personal Data to pursue the following purposes:
To provide the Services offered through the Website, including the possibility of obtaining answers to the requests for information or assistance submitted by the User (hereinafter “Contractual Purposes”);
To comply with the obligations set forth by applicable laws, including possible addressed to the competent authorities and supervisory bodies as well as the response to possible requests submitted by such authorities to Zehus (hereinafter “Law Purposes”);
To develop and improve the Services offered through the Website;
To exercise or protect the rights of Zehus in court proceedings or in an administrative or out-of-court procedures; and
To carry out activities functional to possible mergers, acquisitions, sales of assets, or the transfer of its business, in whole or in part, and execute such operations;
(the purpose listed under numbers from 3) to 5) above are jointly referred to as “Legitimate Business Interest Purposes”).
4. On which legal basis does Zehus procvess the Personal Data?
The processing of Users’ Data for Contractual Purposes is necessary to allow Users to use the Services offered on the Website and Zehus to respond to any requests for information or assistance submitted by Users, as well as to any comments that Users may upload on the Website. In particular:
With regard to Browsing Data, the computer systems and software procedures used to operate this Website acquire, in the course of their normal operation, certain personal data whose transmission is implicit in the use of the Internet communication protocols. This information is not collected to be associated with specific individuals, but given its nature, this information could allow the Users to be identified, by processing and associating it with data held by third parties. Therefore, the collection of Browsing Data is performed automatically, while Users browse on the Website, and their transmission to Zehus is mandatory in order to use the Website;
Identification Data are spontaneously provided to Zehus by the Users who wish to request information or assistance, as well as to share their comments with Zehus. Therefore, the provision of Identification Data is entirely optional, but if the User chooses to provide Identification Data to Zehus, their processing is mandatory, otherwise Zehus would not be able to provide the information or assistance requested by Users nor to take into account the comments voluntarily uploaded by Users.
The processing of Users’ Personal Data for Law Purposes is mandatory, as it is necessary to enable Zehus to comply with applicable laws.
The processing of Users’ Personal Data for Legitimate Business Interest Purpose is carried out pursuant to Article 6(f) of the Regulation (EU) 2016/679 (so called the “GDPR”), in pursuing the Company’s legitimate interest (and, in the case referred to in paragraph 3(e), also the legitimate interest of the Company’s contractual counterparties) to:
Develop and improve the Website and the related Services;
Protect their rights; and
To carry out activities functional to possible mergers, acquisitions, sales of assets, or the transfer of its business, in whole or in part.
The processing of Users Personal Data for Legitimate Business Interest Purposes is not mandatory and Users may object to such processing in the manner set out in paragraph 9 below, unless the Company or its contractual counterparties (in the case referred to in paragraph 3, letter e)) have an interest which prevails over that of the Users, in performing the processing of the Personal Data or where the Company processes Personal Data in order to protect its rights.
5. Who can have access to Personal Data?
For the purposes referred to in paragraph 3 above, the Personal Data provided by Users may be disclosed or communicated to the following categories of entities, which are located within the European Union:
employees and/or workers of the Company, in the performance of their duties or contractual obligations, inherent to the relationship with the Users;
third party suppliers, providing assistance or consultancy services to Zehus, including but not limited to to technological, accounting, administrative, legal and insurance services;
companies of the group to which Zehus belongs;
entities (including Public Authorities) that may access to Personal Data under applicable laws; and
with specific reference of the Legitimate Business Interest Purposes set out in paragraph 3(e) above, to potential purchasers of the Company and entities resulting from the mergers or any other transformation affecting the Company.
6. Are the Personal Data transferred abroad?
The Personal Data will not be transferred to countries outside the European Economic Area.
7. How does Zehus process the Personal Data?
Personal Data will be processed by means of electronical and telematic tools as well as hard copies, in such a way as to guarantee the security, protection and confidentiality of Personal Data. Personal Data will be processed in such a way as to minimize the risks of destruction, loss, unauthorized access to Personal Data or their unlawful processing as well as the processing of Personal Data for purposes other than the ones indicated above.
8. Which is the retention period applicabile to the Personal Data?
Users’ Personal Data will be retained only for the time necessary to pursue the specific purposes for which they were collected, as indicated within this Privacy Notice. In particular,
Identification Data collected for Contractual Purposes and Legitimate Business Interest Purposes will be retained for a period equal to the time necessary to provide the relevant Service (including any renewals) and for 10 years after its termination, except in cases where the retention for a longer period is required for any litigation, requests from competent authorities or pursuant to applicable legislation; while
Identification Data collected for Law Purposes will be retained as long as required under applicable laws.
Lastly, Browsing Data will be retained for the term set forth in the cookie policy.
9. Rights of the Users
Users can exercise the following rights, at any given time and for free, by sending an email to privacy@zehus.it:
Obtain from Zehus the confirmation of the existence of Personal Data and to be informed of its content and source, verify its accuracy and request its integration, update or rectification;
Request the erasure, anonymization or restriction of the processing of Personal Data processed in breach of applicable laws;
Request Zehus to limit the processing of the Personal Data where: (1) The User contests the accuracy of the Personal Data, until Zehus have taken sufficient steps to correct or verify its accuracy; (2) The processing of Personal Data is unlawful but the User does not want Personal Data to be erased by Zehus; (3) Although Zehus no longer needs the Personal Data for the purposes of the processing, Personal Data are needed by the Users to establish, exercise or protect rights; or (4) The User has objected to processing of Personal Data based on legitimate interests, as long as the assessment to verify whether Zehus has compelling legitimate grounds to keep on processing is pending;
Object to the processing of Personal Data for Legitimate Business Interest Purposes, unless Zehus demonstrates the existence of prevailing legitimate reasons or the processing is necessary to exercise or defend Zehus’ rights, pursuant to Section 21 of the GDPR;
Request the erasure of Personal Data, without undue delay;
Obtain Personal Data portability; and
Lodge a complaint with the Italian Data Protection Supervisory Authority (https://www.garanteprivacy.it/).
10. Personal Data of Users under 18
The Website is not addressed to users under age of 18 and, in any case, Zehus does not collect and otherwise intentionally process Personal Data referred to users under age of 18. In case Zehus is aware of the collection and processing of such Personal Data, Zehus will delete it immediately.
11. Updates
This Privacy Notice might be subsequently updated or integrated, also as consequence of possible amendments to applicable laws. However, the updated version of this Privacy Notice will always be available on this Website, to be consulted by Users.