UNDER REGULATION (EU) 2016/679 ('GDPR')
1. Who we are
This communication is made available - under Article 13 of European Regulation 2016/679 on the protection of personal data ("Regulation" or "GDPR"), as amended and supplemented by D.lgs. 101/2018, and subsequent amendments and additions - by Midea Italia S.r.l. a socio unico (from now on only Midea Italia s.r.l.) with registered office in Viale Luigi Bodio 29/37, 20158 Milan (MI), as the Data Controller of your personal data.
This Information Notice aims to inform you about how your personal data will be processed.
2. Type of data processed
On the website https://www.mk-masterkitchen.com/mt (the "Website"), it is possible to enter users’ contact details to request information on Master Kitchen branded products and related retailers (the "Products") and assistance services on Products already purchased by users.
When browsing the site, Midea Italia S.r.l. may therefore acquire information on the visitor in the following ways:
a) Navigation data
b) Product Enquiry Data
To request information on the Products and their dealers, also on a geographical basis, the following personal data of the user is required:
- Telephone number*
c) Data for receiving commercial communications
In addition, to carry out - subject to receipt of consent - the processing activities described in point 3.d. below, for marketing and profiling purposes, the first name, surname, email, telephone number, type of contact (e.g., Retailer; Architect; Kitchen manufacturer; Press; Distributor; Furniture maker/retailer; Private individual; Student; Other), the postcode will be requested.
3. Purpose and legal basis of processing
The data provided are processed for the following purposes:
- detect the user experience of our platforms, products, and services and ensure the web pages’ correct functioning and contents. The processing carried out for these purposes is based on a legitimate interest of the Data Controller.
- To occasionally provide the information and/or support services the user requests. The processing operations for these purposes aim to perform a service the user requests.
- Furthermore, subject to your prior consent, which is optional and revocable at any time, the personal data collected may be processed for:
o marketing and, in particular, sending notices of initiatives, commercial offers, questionnaires, and market research of the Controller through digital channels (e.g., by e-mail).
o Profiling: to analyze your preferences, habits, behavior, and interests inferred, for example, from the type of contact and online clicks on sections of the Site, to send you personalized commercial communications or carry out targeted promotional actions.
In any case, your data may also be processed, where necessary, for the following purposes:
- To comply with legal obligations, and in particular, to fulfill obligations under applicable national and supranational regulations and legislation (tax fulfillment, administration, etc.);
- Based on a legitimate interest (judicial protection) to ascertain, exercise, or defend the Controller's rights in and/or out of court.
4. Sharing and transfer of personal data
- The company personnel in charge of carrying out the activities mentioned above and/or related activities;
- service providers (e.g., IT system providers, cloud service providers, database providers, and consultants);
- Public Administrations for purposes of the law;
- any public and/or private entity to which it may be necessary to communicate your data in connection with the abovementioned purposes.
The updated list of Data Processors is available at the Controller's registered office and will be provided upon written request.
Midea Italia s.r.l. may have to transfer your data to countries outside the European Union/European Common Area (EEA) to so-called "third countries.” Such transfers to third countries may include all of the above activities. In particular, international data transfers may take place in the following situations:
a) Group companies: Group companies based outside the European Union have signed data protection agreements using contractual clauses in line with the standards set by the European Commission to protect privacy and legitimize international data transfers.
b) Third countries outside the European Union/EEA: any transfer of personal data to third parties will be made only after informing you and, where required, receiving your consent. Any data transfer to countries other than those for which the European Commission has taken an adequacy decision shall occur based on agreements using standard contractual clauses adopted by the European Commission or other appropriate safeguards by applicable law.
5. Protection of personal data
Midea Italia s.r.l. has implemented technical and organizational measures capable of providing adequate security and confidentiality for personal data.
These measures take into account the following:
- state-of-the-art technology;
- the costs of its implementation;
- the nature of the data;
- the risk of the treatment.
The purpose is to protect them against accidental or unlawful destruction or alteration, accidental loss, unauthorized disclosure or access, and other forms of illegal processing.
Furthermore, when handling your data, Midea Italia s.r.l.:
- collects and processes personal data that are adequate, relevant, and not excessive, as required to fulfill the above purposes, and ensures that such personal data remain up-to-date and accurate.
6. Data retention periods
The personal data covered by this notice will be stored for the following periods:
- For the entire duration of the contract and, after termination, for the ordinary limitation period of 10 years, for processing operations having as their legal basis the performance of pre-contractual measures and/or a contract to which the data subject is a party;
- Until the exercise of its right to opt-out of the activity of e-mail promotion of sales-like services based on the legitimate interest of the Controller (soft spam);
- For a respective duration of 24 from the date of collection of the data subject's consent for optional marketing processing;
- For the duration foreseen by law (10 years for administrative accounting tasks) for processing to fulfill legal obligations;
- In the event of litigation, for the entire duration of the litigation, until the time limit for bringing legal actions has been exhausted, for the Holder's judicial protection treatment based on his legitimate interest.
Once the retention above periods has elapsed, the personal data in question will be destroyed, deleted, or rendered anonymous, consistent with the technical procedures for deletion and backup and with the accountability requirements of the Data Controller.
7. Your legal rights
The rights associated with the personal data that Midea Italia s.r.l. Processes are, under Articles 15 et seq. of Regulation (EU) 679/2016:
- Right to rectification. You have the right to obtain the rectification of personal data that concerns you or that you have communicated to us. Midea Italia s.r.l. makes reasonable efforts to ensure that the personal data in its possession is accurate, complete, up-to-date, and relevant, based on the most recent information available;
- Right to limitation. You have the right to obtain a restriction on the processing of your personal data if:
o you contest the accuracy of your personal data during the period in which Midea Italia s.r.l. must verify its accuracy; - the processing is
unlawful, and you request a restriction of the processing or the deletion of your personal data;
o Midea Italia s.r.l. no longer needs to keep your personal data, but you need it to ascertain, exercise or defend your rights in court; or - you object to the processing while Midea Italia s.r.l. has your personal data, there is no longer a need for Midea Italia s.r.l. to retain your personal data, but you need it to ascertain, exercise or defend your rights in a court of law; or
o you object to the processing while Midea Italia s.r.l. verifies whether its legitimate reasons prevail over yours.
- Right of access. You may request from Midea Italia s.r.l., information about the personal data stored about you, including information about which categories of personal data Midea Italia s.r.l. Owns or controls, for what purpose they are used, where they were collected (if not directly from you), and to whom they were possibly disclosed;
- Right to portability. Following your request, Midea Italia s.r.l. if technically possible, transfer your personal data to another Data Controller, provided that the processing is based on your consent or is necessary for the performance of a contract.
- Right to cancellation. You may obtain it from Midea Italia s.r.l. the deletion of your personal data if:
o your personal data are no longer necessary about the purposes for which they were collected or otherwise processed;
o you have the right to object to the further processing of your personal data and exercise this right;
o your personal data have been processed unlawfully.
Unless the processing is necessary because of legal or statutory obligations or to establish, exercise or defend a right in court.
- Right to object. You may object to processing your personal data at any time, provided that the processing is not based on your consent but on the legitimate interests of Midea Italia s.r.l. or of third parties. In such cases, Midea Italia s.r.l. shall no longer process your personal data unless we can demonstrate compelling legitimate grounds, overriding interest in the processing or the establishment, or the exercise or defense of a legal claim. If you object to the processing, please state whether you wish to delete your personal data or restrict its processing.
- Right to complain. In the event of an alleged violation of applicable privacy law, you may file a complaint with the competent authorities in your country or where the infringement occurred.
Data subjects may exercise the rights listed and described above:
- by contacting the Company's Privacy Office by mail at: Viale Luigi Bodio 29/37, 20158 Milan
In addition, where the processing is based on consent or contract and is carried out by automated means, data subjects have the right to receive the data in a structured, commonly used, and machine-readable format and, if technically feasible, to transmit them to another data controller without hindrance.
Data subjects have the right to complain to the competent supervisory authority in the Member State where they habitually reside or work or in the State where the alleged infringement occurred.