INFORMATION ON THE PROCESSING OF PERSONAL DATA PURSUANT TO ART. 13 OF EU REGULATION 679/2016
Addax Biosciences S.r.l., with registered office in Strada Mongreno 247, 10132, Turin, Italy, VAT number and Tax Code 11814250012 (hereinafter: “Addax” or “Data Controller”), acting as Data Controller pursuant to EU Regulation 679/2016 (hereinafter: “Regulation”), considering privacy and data protection as a fundamental objective of its activity, invites you, before communicating any personal data to the Data Controller, to read carefully this Privacy Policy.
This Privacy Policy is related to the website https://addaxbio.com (from now on: “Site”); it is an integral part of the Site and the services offered; it is offered to those who interact with the web services of the Site (hereinafter “Services”), either by a simple consultation or through the use of specific services made available through the Site.
The Data Controller can be contacted at: info@addaxbio.com
This document has been prepared pursuant to Art. 13 of the EU Regulation 2016/679 (hereinafter: “Regulation”) in order to allow you to know our privacy policy, to understand how your personal information is handled when you use our site and, if necessary, to provide informed specific consent to the processing of your personal data. The information and data provided by you or otherwise acquired in the context of the use of our services will be processed in compliance with the provisions of the Regulation and the confidentiality obligations that inspire Addax’s activity. According to the rules of the Regulation, the treatments carried out will be based on the principles of lawfulness, correctness, transparency, purpose limitation and conservation, data minimization, accuracy, integrity and confidentiality.
INDEX
1. Data Controller
2. Personal data subject to processing
a. Navigation data
b. Special categories of personal data
c. Data voluntarily provided by the interested party
3. Purpose of the processing
4. Legal basis and mandatory or optional nature of the processing
5. Recipients of personal data
6. Data retention
7. Location of Data processing
8. Rights of the interested party
9. Changes
10. Cookies
1. Data Controller and Data Protection Officer (“DPO”)
The Data Controller of the treatments carried out through the Site is Addax Biosciences S.r.l., as defined above.
2. Personal data subject to processing
When browsing the Site, Addax will process your personal data, which may consist of a personal identifier – such as your name, an identification number, an online identifier or one or more characteristic elements related to your physical, physiological, genetic, mental, economic, cultural or social identity – which may allow your identification (hereinafter “Personal Data”).
The Personal Data processed through the Site are mainly your contact details, such as name, surname, e-mail and telephone. Particular data may be processed when freely provided by you in the contact form.
a. Web navigation data
The computer systems and the software used to operate the Site acquire, during their normal operations, some personal data, whose transmission is implicit in the use of Internet communication protocols. This information is not collected with the aim of being associated with a person, but – by its own nature – it can allow user identification through association with data held by third parties. This category of data includes the IP addresses or domain names of the computers used, the URI (Uniform Resource Identifier) addresses of the requested resources, the time of the request, the method used to submit the request to the server, the size of the file obtained in response, the numeric code indicating the status of the response given by the server (success, error, etc.) and other parameters relating to the operating system and the user’s IT environment. This data is only used to obtain anonymous statistical information on the use of the Site and to check its correct functioning, or to identify anomalies and / or abuses, and is deleted immediately after processing. The data could be used to ascertain legal responsibility in case of crimes committed against the site or third parties. Except for this contingency, web navigation data is not retained for more than seven days.
b. Special categories of personal data
In the use of the “contact” section of the Website, it may be possible to provide personal data which are included in the special categories of Personal Data pursuant to art. 9 of the Regulation (data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and genetic data, biometric data able to uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation). We invite you to communicate such data only when strictly necessary. Indeed, we would like to remind you that, following the transmission of special categories of Personal Data and in the absence of specific consent to process such data, Addax will not be liable for their treatment, since such data will be considered as made public by the interested party, in compliance with art. 9 (2) (e) of the Regulation. However, we stress the importance of expressing explicit consent to the processing of special categories of Personal Data, if you decide to share such information.
c. Data voluntarily provided by the interested party
In the use of some Services, you may send to us Personal Data related to third parties. In such a case, you will act as an independent data controller, assuming all legal obligations and responsibilities. You, therefore, provide Addax with the widest legal indemnity with respect to any dispute or claim that should involve Addax coming from third parties whose Personal Data have been processed. In any case, should you provide or otherwise process Personal Data of third parties in the use of the Site, this particular processing should be grounded on an appropriate legal basis, pursuant to Art. 6 of the Regulation.
3. Purpose of the processing
The treatment we intend to carry out, following your specific consent where necessary, has the following purposes:
a. To allow the Services requested by you, such as:
– sharing of website content;
– general request for information;
– registration for events and initiatives organized by Addax;
b. to respond to requests for information;
c. to send commercial information and offers;
d. to stipulate “e-commerce” sales contracts and fulfill the related obligations;
e. to fulfil any legal and tax obligations.
4. Legal basis, and mandatory or optional nature of the processing
The legal basis for the processing of Personal Data for the purposes referred to in section 3 (a-d) is art. 6 (1) (a) and (b) of the Regulations, as the processing takes place after consent is given, or is necessary for the provision of the Services, or for responding to requests coming from the interested party. The provision of Personal Data for these purposes is optional, but in certain cases failure to provide such data would make it impossible to activate the Services provided by the Site. The purpose related to section 3.e represents a legitimate processing of Personal Data pursuant to art. 6 (1) (c) of the Regulation. Once Personal Data has been provided, the processing is indeed necessary to fulfil a legal obligation to which Addax is subject.
For treatments carried out for the purpose of sending direct advertising material or direct sales or for carrying out market research or commercial communications relating to Addax products or services similar to those requested by you, Addax may use, without your consent, e-mail and ordinary mail addresses pursuant to and within the limits permitted (see, for instance, the decision of the Italian Data Protection Authority, 19 June 2008); the legal basis for processing your data for this purpose is Art. 6.1.f of the Regulation.
In any case, pursuant to Art. 21 of the Regulation, you can object to this processing at any time, initially or during subsequent communications, free of charge, by writing to the Data Controller or DPO at the addresses indicated above. You will obtain an immediate confirmation of the interruption of this treatment (Article 15 of the Regulation).
5. Recipients of personal data
Your Personal Data may be shared, for the purposes referred to in section 3, with:
a. subjects that typically act as data processors pursuant to Art. 28 of the Regulation that is: i) persons, companies or professional offices that provide assistance and consultancy services to Addax in accounting, administrative, legal, tax, financial and credit recovery matters, in relation to the provision of the Services; ii) subjects with whom it is necessary to interact in order to provide the Services (for example hosting providers) iii) subjects delegated to carry out technical maintenance activities (including maintenance of network equipment and electronic communication networks) – (collectively “Recipients”);
b. subjects, bodies or authorities, and autonomous data controllers to whom it is mandatory to communicate your Personal Data by law or following orders coming from public authorities;
c. persons authorized by Addax to process Personal Data pursuant to Art. 29 of the Regulation, where necessary to carry out activities strictly related to the provision of the Services, when these persons are formally bound to confidentiality (e.g. Addax employees).
The list of data processors who process data may be requested to the Data Controller.
6. Data retention
The Personal Data processed for the purposes referred to in section 3 (a-d) will be kept for the time strictly necessary to achieve them, in compliance with the principle of storage limitation pursuant to Art. 5.1.e of the Regulation. In any case, the Data Controller will process the Personal Data for the time necessary to fulfil contractual and legal obligations. More information about the data retention period and the criteria used to determine this period can be requested to the Data Controller to the above-mentioned addresses.
7. Location of Data processing
Your Data will be processed within the European Union and within the scope of EU legislation on privacy and personal data protection.
Any transfer of your Data outside the European Union can only take place in one of the following cases:
a) following your explicit, specific or informed consent;
b) when the transfer is necessary for executing a contract between you and the controller executing pre-contractual measures requested by you;
c) when the transfer is necessary for the conclusion or execution of a contract made in your interest between the controller and another natural or legal person.
8. Rights of interested parties
Pursuant to Articles 15 and followings of the Regulation, you have the right to request, at any time, access to your Personal Data, their rectification or erasure, the limitation of processing in cases provided for by Art. 18 of the Regulation and – in the cases listed by Art. 20 of the Regulation – to obtain in a structured format, commonly used and machine-readable, the data concerning your person. At any time, pursuant to Art. 7 of the Regulation, you can revoke the consent given, and file a complaint to the competent supervisory authority pursuant to Article 77 of the Regulation, if you believe the processing of your data is contrary to the legislation in force.
You can file a request for opposition to the processing of your data pursuant to Article 21 of the Regulation, in which you have to give evidence of the reasons justifying the opposition. The Data Controller reserves the right to evaluate the request, which would not be accepted in case legitimate and binding reasons to proceed with the treatment, prevailing over your interests, rights and freedoms, exist. Requests should be sent to the Data Controller to the above-mentioned addresses.
9. Changes
This privacy policy is effective from May 25, 2018 (although it has been subjected to modifications over time). Addax reserves the right to modify or update its content, in part or completely, also due to changes in the applicable legislation. Addax will inform you of these modifications, as soon as they are introduced, by publishing them in this section of the Site. Modifications to the policy will be binding as soon as they are published on the Site. Addax invites you to regularly visit this section to gain knowledge of the most recent and updated version of the privacy policy, so as to be always updated on the principles informing data collection and processing by Addax.
10. Cookies
The cookie policy refers exclusively to this Site and must be understood as an integral part of its Privacy Policy.
a. Definitions, characteristics, and legislative application.
Cookies are small text files that the sites visited by the user send and record on their computer or mobile device, and that are re-transmitted to the same sites during a subsequent visit. Thanks to cookies, a site remembers the user’s actions and preferences (such as, for example, login data, the chosen language, font sizes, display settings, etc.) so that they do not have to be indicated again every time the user returns to the website, or browse from one page to another. Cookies are therefore used to perform computer authentication, session monitoring and storage of information regarding the activities of users accessing a site. They may also contain a unique identification code that allows to keep track of the user’s navigation within the site for statistical or advertising purposes. During the navigation on a site, the user can also receive on his computer or mobile device cookies of sites or web servers other than the one she/he is visiting (so called “third-party cookies”). Some operations could not be carried out without the use of cookies, which in certain cases are therefore technically necessary for the site to function.
There are various types of cookies, depending on their characteristics and functions, and these can remain on the user’s computer or mobile device for different periods of time: the “session cookies” are automatically erased when the browser is closed; the “persistent cookies” remain on the user’s device until a set deadline.
According to Italian and EU legislation (in particular Directive 2009/136/EC), the use of cookies does not always require an express consent of the user. In particular, “technical cookies”, i.e. those used for the sole purpose of transmitting a communication over an electronic communication network, or strictly necessary to provide a service explicitly requested by the user, do not require consent. These cookies are indispensable for the functioning of the site or necessary to perform activities requested by the user.
Among the technical cookies, which do not require an express consent for their use, the Italian Data Protection Authority, following EU law, (see “Individuazione delle modalità semplificate per l’informativa e l’acquisizione del consenso per l’uso dei cookies”, May 8, 2014) also includes:
– analytical cookies, when used directly by the site manager to collect information, in aggregate form, on the number of users and on how they visit the site;
– browsing or session cookies that guarantee normal browsing and use of the website (allowing, for example, to make a purchase or authenticate access to restricted areas);
– functionality cookies, which allow the user to browse according to a series of selected criteria (for example, the language, the products selected for purchase) in order to improve the service offered:
– profiling cookies – i.e. those aimed at creating user profiles and used in order to send advertising messages in line with the preferences shown by the user in the context of web browsing – do require a prior consent.
b. Types of cookies used by the Site
The Site uses the following types of cookies, and offers the possibility of de-selecting them, (except for third-party cookies for which the user must refer directly to the relevant section of the respective party, indicated by means of links):
– Technical cookies (navigation or session) strictly necessary for the operation of the Site or to allow the user to use the contents and services requested.
– Analytics cookies, which allow the site manager to understand how it is used by users. These cookies do not collect information on the user’s identity, or any personal data. The information is treated in aggregate and anonymous form.
– Functionality cookies, used to activate specific features of the Site and a set of selected criteria (for example, the language, the products selected for purchase) in order to improve the service provided.
– Profiling cookies, aimed at creating profiles related to the user and used in order to send advertising messages in line with the preferences shown by the user.
ATTENTION: when technical and / or functionality cookies are disabled, the Site may not be accessible, or some services or certain functions of the site may not be available or not work properly, and the user may be requested to change or manually enter some information or preferences whenever visiting the Site.
Addax uses third-party cookies which are used for their own purposes, including analytical and profiling aims. It should be noted that these third parties act as autonomous controllers of the data collected through the cookies sent by them, therefore the user must refer to their policies.
c. How to view and modify cookies through your browser
The user can select which cookie authorize through the appropriate procedure set in the section related to cookies, as well as authorizing, blocking or erasing (in whole or in part) cookies through the specific function of your browser. However, in the hypothesis that all or some of the cookies are disabled, some services or certain functions of the Site may not be available or work properly, and / or the user could be forced to change or manually enter some information or preferences. For more information on how to set preferences on the use of cookies through your browser, you can consult the instructions to be found on the browser’s website.
For more detail about Cookies click here.