Privacy Policy

Updated on February 24th 2024

WEBSITE NOTIFICATION IN COMPLIANCE WITH ARTICLES 13 AND 14 OF EUROPEAN REGULATION 2016/679 (GDPR)

Stone Italiana S.p.A, in its status as Controller of the processing of your personal data in compliance with articles 13 and 14 of the European Regulation 2016/679, hereby informs you that the aforementioned legislation makes provisions for the protection of the respective parties with regard to the processing of personal data, and that such processing will be performed in accordance with principles of fairness, legality and transparency, protecting your confidentiality and your rights. The information and personal data provided by you or otherwise acquired during your use of the website will be processed in accordance with the legislative provisions contained in the aforementioned regulations and with the confidentiality obligations provided therein.

INTERESTED PARTIES AND RETENTION TIME

A) utenti (navigatori) del sito web www.stoneitaliana.com e dell’App per iOs e Android

Specific summary information is progressively reported or displayed on the pages of the site prepared for specific services on request that require forms for data collection. We also inform you that, to provide a complete service, our website may contain links to other web sites which are not managed by Stone Italiana S.p.A. Stone Italiana S.p.A. is not responsible for errors, content, cookies, the publication of morally unlawful content, advertising, banners or files that do not comply with current legislation, neither for compliance with Privacy policy for other websites that are not operated by the Data Controller.

Type of data processed

  • Navigation data: the IP addresses or domain names of the computers and other devices utilized by users visiting the website; the addresses in URI (Uniform Resource Identifier) notation of the resources requested and any time indications of said resources; parameters regarding the operating system and the user’s computer system; the pages of origin and arrival; the Navigation index and identification behaviour collected while viewing website pages.
  • Personal data provided voluntarily by the user: the optional, explicit and voluntary despatch of e-mail messages to the addresses shown on this website, and the compilation of forms present on said website, entail the subsequent collection of the sender’s personal data (solely by way of example, name, surname, e-mail address). Specific summary information is shown on pages where web forms are present.

Purposes of processing: your data collected during browsing will be processed for the following purposes.

  1. 1) carrying out operations closely connected to and essential for handling relations with the website’s users or visitors;
  2. 2) collecting, storing and processing your data for statistical analysis, also in anonymous and/or aggregate form; statistical analyses performed to assess the quality of services offered by the website;
  3. 3) sharing the interactions made, and the usage data for the pages on which cookies are installed for the integration of software products or functions, with social network managers
  4. 4) improving the browsing experience in order to present services and advertising messages that correspond to the preferences expressed during navigation

The processing of data for the fulfillment of the purpose specified in point 1 is necessary to perform your request, and in the case of your refusal, this could limit and/or prevent comprehensive use of the functions and services present on the site. The legal basis for the processing of your data for the purposes specified in point 1 is the fulfillment of your request, in accordance with Article 6.1.b.) of the GDPR; if you refuse to provide said data, it would make it impossible for you to visit the website. Providing the data indicated in purposes 2, 3 and 4 is optional in terms of the legal basis of consent, and your refusal to the processing of your data would not compromise the functionality and services present on the website. The legal basis for the processing of your data for the purposes specified in points 2, 3 and 4 is optional, in accordance with Article 6.1.a). Consent is provided by means of the short policy notification by clicking on the words “ACCEPT COOKIES” included in the short policy notification . With regard to the optional consent, further information about the cookies present on the website is provided in the cookie policy document, which can also be accessed from the short policy notification .

Browsing data is stored for the duration specified in the cookie policy that can be consulted on the website.

COOKIES AND OTHER TRACKING SYSTEMS

Your data is also collected by means of tools and services provided by third parties, and it is stored by said parties. For more information and to view the list

Your data is also collected by means of tools and services provided by third parties, and it is stored by said parties. For further information, please refer to the “cookie policy” document Please note that Stone Italiana S.p.a. acts purely as an intermediary for the links included in the cookie policy and it cannot accept any responsibility in the event of changes that may be made.

C) Users’ Request for the warranty certificate By compiling the forms accessible in the “Warranty certificate” section, your data (name, surname, e-mail address, city) will be used to respond to your request for information. The provision of data for these purposes enables the fulfilment of your request. The legal basis for processing is article 6.1.b) of the GDPR. Your data, subject to your consent provided by selecting the respective marketing box, will be used for sending commercial and advertising information concerning informative messages and commercial and promotional communications, regarding Stone Italiana S.p.A.’s activities and products by means of traditional methods (e.g. telephone communications, individual e-mail messages, etc.) or automated contact methods (e.g. automated e-mail campaigns, social networks, etc.), software systems managed by third parties, including the insertion of said systems in the Controller’s corporate CRM in complete compliance with the principles of legality and fairness, and with the provisions of law. Providing your data for this purpose is optional and does not compromise the response to your request for information. The legal basis for processing is art. 6.1.a.) of the GDPR. At any time you can object to processing using the link at the bottom of the e-mail or by sending a request to the Data Controller at the addresses indicated in this policy document. Your data will be stored for the time necessary for the provision of the service that you have requested and for marketing purposes, until you decide to cancel your registration or object to processing.

 

 

 

 

 

 

 

 

 

G) Whistleblowing

G.1) Categories of personal data processed and purposes of processing According to the approach of the above-mentioned Policy, personal data may be acquired by the Company insofar as they are contained in whistleblowing reports, or in the acts and documents annexed thereto, received by it through the channels envisaged by the above-mentioned Policy. The receipt and handling of such reports may give rise, depending on their content, to the processing of the following categories of personal data: a) common personal data referred to in Article 4, point 1, of the GDPR, including, for example, personal details (name, surname, date and place of birth), contact details (landline and/or mobile telephone number, postal/email address), job role/occupation; b) ‘particular’ personal data under Article 9 of the GDPR, including, for example, information relating to health conditions, political opinions, religious or philosophical beliefs, sexual orientation or trade union membership; (c) ‘judicial’ personal data referred to in Article 10 of the GDPR, relating to criminal convictions and offences, or related security measures. With regard to the aforementioned categories of personal data, we emphasise the importance that the reports forwarded should be free of information that is manifestly irrelevant for the purposes of the reference discipline, inviting the reporting parties in particular to refrain from using personal data of a ‘particular’ and ‘judicial’ nature unless deemed necessary and unavoidable for the purposes thereof, in compliance with Article 5 of the GDPR. The aforesaid information will be processed by the Company – the Data Controller – in accordance with the provisions prescribed by Legislative Decree no. 24/2023 and, therefore, in general, in order to carry out the necessary preliminary activities aimed at verifying the grounds of the reported facts and the adoption of the consequent measures. In addition, the data may be used by the Data Controller for purposes connected with the need to defend or ascertain its rights in the context of judicial, administrative or extrajudicial proceedings and in the context of civil, administrative or criminal litigation arising in connection with the report made. G.2) Legal basis of the processing of personal data The legal basis for the processing of personal data is mainly constituted by the fulfilment of a legal obligation to which the Data Controller is subject – Art. 6, par. 1, lett. c) of the GDPR – which, in particular, by virtue of the aforementioned legislation, is required to implement and manage information channels dedicated to receiving reports of unlawful conduct detrimental to the integrity of the Company and/or the public interest. In the cases contemplated by the same regulation, a specific and free consent may be requested from the reporting person – pursuant to Article 6(1)(a) of the GDPR – where it is deemed necessary to disclose his/her identity. The processing of ‘special’ personal data, which may be included in the reports, is based on the fulfilment of obligations and the exercise of specific rights of the Data Controller and the Data Subject in matters of labour law, pursuant to Art. 9, par. 2, lett. b) of the GDPR. With regard to the purpose of establishing, exercising or defending a right in court, the relevant legal basis for the processing of personal data is the legitimate interest of the Data Controller in this regard, referred to in Art. 6, par. 1, lett. f) of the GDPR; for the same purpose, processing of personal data of a “particular” nature, if any, is based on Art. 9, par. 2, lett. f) of the GDPR. G.3) Nature of personal data provision The provision of personal data is compulsory since, in accordance with the Company’s Whistleblowing Policy, anonymous reports, i.e. reports from which it is not possible to determine the identity of the reporter, are not taken into account. The personal data provided will be processed to manage the report within the limits and with the confidentiality guarantees imposed by the reference legislation. G.4) Personal data retention period The reports received by the Company, together with the acts and documents enclosed, will be kept for the time necessary for their management and, in any case, as provided for by the legislation, for a period not exceeding five years from the date of communication of the final outcome. After this period, the reports. Consistent with the indications provided in paragraph 1, personal data included in reports that are manifestly irrelevant to the purposes of the alerts will be immediately deleted.

H) Video surveillance

Video surveillance equipment is installed at the Zimella premises.

Purpose: protection of persons and safety and protection of Company and third party assets.

The legal basis of the processing is the legitimate interest: -Protection of persons and property against possible aggression, theft, robbery, damage, vandalism. -Aiding the possible exercise, in civil or criminal proceedings, of the right of defence on the basis of useful images in the event of unlawful acts.

Retention period: data are retained for 24 hours and then destroyed.

The provision of data is compulsory if you are travelling through areas subject to video surveillance, duly indicated by appropriate signs.

METHODS OF PROCESSING PERSONAL DATA Your personal data will be processed using manual, electronic and/or telematic means, through the use of cookies (as described in the cookie policy available on the website) with electronic calculation equipment comprising third party software, and automated means of contact (e.g. automated campaigns for despatching e-mail messages, SMS, automated telephone contacts, instant messaging, social networks, etc.), in compliance with the procedures specified in articles 6, 32 of the GDPR and with the adoption of the appropriate security measures. In order to assess and if necessary to improve the results attained by communications, the Controller utilizes systems for sending newsletters and promotional communications with reports. The Report gives the Controller information such as: the number of readers, the number of communications opened, the unique “clickers” and clicks; the devices (iPhone, Blackberry, Nokia…) and operating systems (Windows, Apple, Linux, Android…) used to read the communication; details of the activities of individual users; detail of e-mails sent per date/hour/minute; details of e-mails that are delivered and those undelivered; the list of recipients who have unsubscribed from the newsletter; those who have opened an e-mail or clicked on a single link; users encountering problems in viewing the message; link tracking (i.e. the number of clicks made on the links in the message); click tracking (which links were clicked and by whom). All this data is used for the purpose of assessing, and possibly improving, the results attained by the communications.

METHODS OF PERSONAL DATA PROCESSING – Whistleblowing processing

The processing of personal data included in the reports forwarded in accordance with the “Whistleblowing Policy” shall be carried out by the Company’s “appointees” and shall be based on the principles of fairness, lawfulness and transparency, pursuant to Article 5 of the GDPR.

Personal data may be processed by analogue and/or computerised/telematic means, functional to storing, managing and transmitting them, in any case in application of appropriate physical, technical and organisational measures to guarantee their security and confidentiality at every stage of the procedure, including the filing of the report and related documents – without prejudice to the provisions of Article 12 of Legislative Decree no. 24/2023 – with particular reference to the identity of the whistleblower, the persons involved and/or in any case mentioned in the reports, the content of the reports and related documentation.

USE OF SOCIAL PLATFORMS Stone Italiana S.p.A. may also provide connections (links) to other social media platforms leading to servers installed by individuals or organizations over which it has no control. Stone Italiana S.p.A does not provide any indication of, nor can it accept any responsibility for, the accuracy, or any other aspects, of the information available on these websites. The link to a third-party website can in no way be considered as a validation, neither by Stone Italiana S.p.A. nor by any such third party, of the products and services provided by other websites or third parties. Stone Italiana S.p.A. does not issue declarations or guarantees regarding the use or storage of user data on third-party websites. Users are advised to perform a detailed examination of the privacy policy that governs third-party websites linked to our website in order to have a complete view of the ways in which your personal data may be used.

RECIPIENTS OF PERSONAL DATA AND DISCLOSURE OF DATA Your data will be processed by appropriately-appointed personnel and will be communicated externally, to companies acting as independent Data Controllers or Data Processors:

The complete list can be requested by writing to the Data Controller’s contact details.

RECIPIENTS OF PERSONAL DATA AND DATA DISCLOSURE – Whistleblowing processing

In addition to the aforementioned internal figures specifically authorised by the Data Controller, the personal data collected may also be processed, within the scope of the “Whistleblowing Policy” and in pursuance of the purposes indicated, by the following third parties, formally designated as Data Processors if the conditions provided for by Article 28 of the GDPR are met:

  • providers of consulting services and assistance in the implementation of the “Whistleblowing Policy”;
  • IT Companies and professionals with regard to the application of adequate technical-informatics and/or organisational security measures on the information processed by the corporate system;

If necessary, personal data may be transmitted to the Judicial Authorities and/or Police Bodies who request it in the context of judicial investigations.

Personal data will be processed within the European Economic Area (EEA) and stored on servers located there.

Under no circumstances will personal data be disseminated.

There are no transfers of data outside the European Economic Area.

MINORS The website is not intended for use by minors and no data regarding minors is collected by the Data Controller. In the event that the Data Controller should become aware of the collection of said data (e.g. through the contact form), it will delete it immediately. The company will reply to requests for information in compliance with the respective laws. Please note that in the case of a request for information, the person holding parental responsibility is required to provide us with consent for the collection of the minor’s personal data.

DATA CONTROLLER The Data Controller is Stone Italiana S.p.A., with registered office in Via Lavagno 213, 37040 Zimella – (Verona) – 0442 715715 stone@stoneitaliana.com in the person of its pro-tempore legal representative. You have the right to obtain, from the Controller, the erasure (right to be forgotten), restriction, updating, correction, portability, and opposition to the processing, of the personal data that regards you, and more in general you can exercise all the rights provided by articles 15 and following of the European Regulation 2016/679 by writing to stone@stoneitaliana. The data subject has the right to lodge a complaint with the Supervisory Authority

APPLICATION OF THIS POLICY If you have any doubts about this Policy, please contact Stone Italiana S.p.A. by sending an e-mail to stone@stoneitaliana or by contacting the Data Controller at the company contact details provided in this document.

CHANGES TO THIS POLICY Stone Italiana S.p.A. reserves the right to update this information in accordance with any changes in legislation that may arise, and in due consideration of suggestions made by employees, customers, collaborators and users. In case of changes made by Stone Italiana S.p.A., the Privacy Policy on the main privacy page and on the Homepage of the website https://stoneitaliana.com/ will be promptly updated

RIGHTS OF DATA SUBJECTS

Each data subject has the right to exercise the rights referred to in Articles 15 et seq. of the GDPR, in order to obtain from the Data Controller, for example, access to their personal data, rectification or erasure of such data or restriction of the processing that concerns them, without prejudice to the possibility, in the absence of a satisfactory response, to lodge a complaint with the Data Protection Authority.

EU Regulation 2016/679: Articles 15, 16, 17, 18, 19, 20, 21, 22 – Rights of the data subject

  1. 1. Data subjects have the right to obtain confirmation of the existence or not of personal data concerning them, even if not yet recorded, and their communication in an intelligible form, and the possibility of lodging a complaint with the Supervisory Authority.
  • b) the purposes and methods of processing;
  • c) the logic applied in the case of processing perfomed using electronic instruments;
  • d) the identification details of the Data Controller, the Data Processors and the designated representative in compliance with Article 5, Paragraph 2;
  • e) the subjects or categories of subjects to whom personal data may be communicated or who may acquire knowledge of it in their status as a designated representative in the territory of the State, as managers or as personnel authorized to process personal data.
  • a) updating, rectification or, when they deem it necessary, the completion of data;
  • b) the erasure, transformation into anonymous format or the blocking of data processed in violation of the law, including data whose retention is not necessary with regard to the purposes for which the data was collected or subsequently processed;
  • (c) notification that the operations specified in points a) and b) have been communicated, along with the respective content, to those to whom the data was notified or disclosed, unless this fulfillment proves impossible or involves a manifestly disproportionate use of resources when compared to the right upheld;
  • d) data portability.
  1. 4. Data subjects have the right to object, in whole or in part:
  • a) to the processing of personal data concerning them, even if relevant to the purpose of collection, for legitimate reasons;
  • b) to the processing of personal data concerning them for the purpose of sending advertising or direct sales material or for performing market research or commercial communications

In order to exercise these rights, it is necessary to submit a specific request in free form to the following address of the Data Controller: stone@stoneitaliana.com, or to send to the same address the form available on the website of the Data Protection Authority.  

With regard to the Whistleblowing processing, please note that the aforementioned rights of data subjects may be restricted pursuant to and for the purposes of Article 2-undecies of Legislative Decree no. 196 of 30 June 2003 (“Privacy Code”, as amended by Legislative Decree no. 101/2018), for the time and within the limits in which this constitutes a necessary and proportionate measure, if their exercise may result in concrete and effective prejudice to the confidentiality of the identity of the reporting subjects.

In such cases, the persons concerned will in any case have the right to refer the matter to the Guarantor Authority so that the latter may assess whether the conditions for taking action under Article 160 of Legislative Decree no. 196/2003 are met.