Privacy Policy

Privacy Notice pursuant to Art. 13 of Regulation (EU) 2016/679

By means of this document (the “Privacy Notice”) the Data Controller, as identified below, wishes to inform you of the purposes and means of the processing of your personal data and of the rights granted to you by Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (“GDPR”). This Privacy Notice may be supplemented by the Controller where any additional services requested by you entail further processing activities.

Data Controller

GKSD ProCure S.r.l. Tax Code and VAT No. 12587200960 – REA MI-267098, Via Senato, 12 – 20121 Milan (MI), Italy E-mail: procure@gksdholding.com as Controller of the personal data collected through the website https://gksdprocure.com/ (the “Website”), acting through its legal representative pro tempore.

Data Protection Officer
The Controller has appointed a Data Protection Officer (DPO)
E-mail address: dpo@integroup.eu

Types of personal data processed
The processing activities carried out are aimed at collecting the following personal data:

• Identification data (e.g. first name, surname, date of birth, address);
• Contact data (e.g. telephone number, e-mail address);
• Data voluntarily provided by completing the “Contacts” form on the Website (e.g. first name, surname, e-mail address, telephone number where applicable and company/organisation, subject and content of the request);
• Technical and browsing data (e.g. IP addresses, computer domain names);
• Subject to the user’s consent, data collected through Cookies serving purposes other than the strict operation of the website.

Categories of data subjects
The processing activities carried out concern the following categories of data subjects: Website users and visitors, prospective customers, customers

Purposes, Legal Basis and Retention Periods

Processing activities in addition to browsing purposes:

Means of Processing
Personal data are processed by electronic means.

Transfers of data outside the EU
Personal Data are not transferred to third countries outside the European Union and the European Economic Area.
Should such a transfer become necessary and/or unavoidable for the Controller’s organisational requirements, please note that:

• it will take place solely to countries covered by an adequacy decision adopted by the European Commission;
• where a country other than those referred to in the preceding point is involved, the transfer will be governed by the Standard Contractual Clauses, unless the Parties involved agree to adopt one of the other appropriate safeguards provided for by Art. 46 GDPR, or unless one of the derogations set out in Art. 49 GDPR applies.

Recipients of the personal data
Personal data may be shared with service providers closely connected with and instrumental to the Controller’s activities, which typically act as processors pursuant to Art. 28 GDPR. A complete list may be obtained by contacting the Controller at the addresses indicated above.

Rights of the data subject – complaint to the supervisory authority
In relation to the processing described in this Privacy Notice, as a data subject you may, under the conditions laid down by the GDPR, exercise the rights set out in Articles 15 to 22 GDPR and, in particular, the following rights:    

• right of access – Article 15 GDPR: the right to obtain confirmation as to whether or not personal data concerning you are being processed and, where that is the case, to obtain access to your personal data;
• right to rectification – Article 16 GDPR: the right to obtain, without undue delay, the rectification of inaccurate personal data concerning you and/or to have incomplete personal data completed;
• right to erasure (‘right to be forgotten’) – Article 17 GDPR: the right to obtain, without undue delay, the erasure of personal data concerning you. The right to erasure does not apply to the extent that the processing is necessary for compliance with a legal obligation, for the performance of a task carried out in the public interest, or for the establishment, exercise or defence of legal claims.
• right to restriction of processing – Article 18 GDPR: the right to obtain restriction of processing where: a) the data subject contests the accuracy of the personal data; b) the processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of their use instead; c) the personal data are required by the data subject for the establishment, exercise or defence of legal claims; d) the data subject has objected to the processing, pending verification of whether the legitimate grounds of the controller override those of the data subject.
• right to data portability – Article 20 GDPR: the right to receive, in a structured, commonly used and machine-readable format, the personal data concerning you which you have provided to the Controller, and the right to transmit those data to another controller without hindrance, where the processing is based on consent and is carried out by automated means. In addition, the right to have your personal data transmitted directly from this controller to another controller, where technically feasible;
• right to object – Article 21 GDPR: the right to object, at any time, to the processing of personal data concerning you which is based on the lawful ground of legitimate interests, including profiling, unless the Controller demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject, or for the establishment, exercise or defence of legal claims.
• right not to be subject to automated individual decision-making – Article 22 GDPR: the data subject has the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her, unless this is necessary for entering into, or the performance of, a contract, or unless you have given your consent. In any event, no automated decision-making will be applied to your personal data and you may at any time obtain human intervention on the part of the controller, express your point of view and contest the decision.
• right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali): http://www.garanteprivacy.it;
• withdraw consent at any time and as easily as it was given, without affecting the lawfulness of processing based on consent before its withdrawal.

The above rights may be exercised vis-à-vis the Controller by contacting the details indicated above.
The exercise of your rights as a data subject is free of charge pursuant to Article 12 GDPR. However, where requests are manifestly unfounded or excessive, in particular because of their repetitive character, the Controller may charge a reasonable fee taking into account the administrative costs incurred in handling your request, or may refuse to act on the request.
Finally, please note that the Controller may request the provision of additional information necessary to confirm the identity of the data subject.