Privacy Policy

1. Data Controller and Data Protection Officer
The Data Controller is Comburex Srl – with registered office at Via F. Ferrucci 57 59100 Prato (PO) Italy. The Data Protection Officer can be contacted at Comburex Srl Via del redolone 45 50134 Serravalle Pistoese (PT), E-mail: amministrazione@comburex.com, PEC: comburex@pec.it
2. Purpose and legal basis of the processing
Comburex processes the personal data of natural persons, legal entities, sole proprietorships and/or freelancers (“Data Subjects”) for the following purposes:
• need to execute a contract of which the interested party is a party or to carry out pre-contractual activities at his request. This necessity represents the legal basis that legitimizes the resulting processing. The provision of the data necessary for these purposes represents, depending on the case, a contractual obligation or a requirement necessary for the conclusion of the contract; in the absence of them, Comburex would be unable to establish the relationship or execute it;
• promotion and sale of products and services of Comburex or third-party companies. The legal basis that legitimizes the resulting processing is the consent of the interested party, which he is free to give or not and which he can, in any case, revoke at any time. The provision of the data necessary for these purposes is not mandatory and the refusal to provide them does not lead to any negative consequences, except for the impossibility of receiving commercial communications;
• promotion and sale of products and services of Comburex or third-party companies, specifically identified through the processing and analysis, also through the use of automated techniques or systems (e.g. big data), of information relating to preferences, habits , consumption choices, aimed at dividing interested parties into homogeneous groups based on specific behaviors or characteristics (customer profiling) also implemented through the enrichment of data with information acquired from third parties (enrichment). The legal basis that legitimizes the resulting processing is the consent of the interested party which he is free to give or not and which he can, in any case, revoke at any time. The provision of the data necessary for these purposes is not mandatory and the refusal to provide them does not lead to any negative consequences, except for the impossibility of receiving dedicated commercial communications.
3. Categories of data processed
Comburex processes personal data collected directly from the interested party, or from third parties, which include, by way of example, personal data (e.g. name, surname, address, date and place of birth), tax code/VAT number, data relating to image (e.g. photo) and other data attributable to the categories indicated above.
Comburex does not request and does not process on its own initiative particular data of its customers (e.g. data revealing racial or ethnic origin, political opinions, and religious or philosophical beliefs, trade union membership, genetic data, biometric data – intended to uniquely identify a natural person, data relating to the person’s health or sexual life or sexual orientation). The data in question will be processed exclusively to execute the customer’s request.
4. Recipients or categories of recipients of the data
The natural and legal persons appointed as Data Controllers and the natural persons authorized to process the data necessary to carry out the tasks assigned to them may become aware of the data of the interested party: workers employed by Comburex or seconded to it, temporary workers, interns and consultants .
Comburex – without the consent of the interested party being necessary – may communicate the personal data in its possession: to those subjects to whom such communication must be carried out in fulfillment of an obligation established by law, by a regulation or by community legislation;
5. Rights of interested parties
Current data protection legislation attributes specific rights to the interested party, who, to exercise them, can contact the data controller directly and at any time.
The rights exercisable by the interested party, described below, are:
• Right of access;
• Right of Rectification;
• Right of cancellation;
• Right of limitation;
• Right to portability;
• Right to object.
Interested parties and legal entities, bodies and associations may at any time modify the optional consents whenever they wish.

Right of access
The right of access provides the possibility for the interested party to know which personal data relating to him or her are processed by Comburex and to receive a free copy (in case of further copies requested, a contribution based on the costs incurred may be charged). The information provided includes the purposes of the processing, the categories of data processed, the expected retention period or, if not possible, the criteria used to define this period, as well as the guarantees applied in the event of data transfer to third countries and the rights exercisable by the interested party.
Right of rectification
The right of rectification allows the interested party to obtain the updating or rectification of inaccurate or incomplete data concerning him.
Right of cancellation (so-called “oblivion”)
The right to cancellation, or to be forgotten, allows the interested party to obtain the cancellation of their personal data in the following particular cases:
• the personal data are no longer necessary for the purposes for which they were collected and processed;
• the interested party revokes the consent on which the processing is based, if there is no other legal basis that could otherwise legitimize it;
• the interested party objects to the processing and there is no further legitimate reason to proceed with the processing carried out by the owner for:
• the pursuit of a legitimate interest of oneself or of third parties and there is no overriding legitimate reason for the owner to proceed with the processing,
• direct marketing purposes, including the profiling connected to it;
• the personal data of the interested party have been processed unlawfully.
This right can be exercised even after the revocation of consent.
Right of limitation
The right of limitation can be exercised by the interested party in case:
• violation of the conditions of lawfulness of the processing, as an alternative to deletion of data;
• request for data rectification (waiting for rectification) or opposition to their processing (waiting for the owner’s decision).
Without prejudice to conservation, any other processing of the data whose limitation is requested is prohibited.
Right to portability
The right to portability allows the interested party to use their data held by Comburex for other purposes. Each interested party may request to receive the personal data relating to him or her or request their transfer to another owner, in a structured, commonly used and readable format (Right to portability).
In particular, the data that can be subject to portability are personal data (e.g. name, surname, address, date and place of birth, residence), as well as a set of data generated by the activity that Comburex has defined for each macro-category of products/services (e.g. statistics, databases, access to third party products). This right does not apply to non-automated processing (e.g. paper archives or registers).
Right of opposition
The right to object allows the interested party to object at any time, for reasons relating exclusively to his situation, to the processing of personal data concerning him.
5.1 Exceptions to the exercise of rights
The data protection legislation recognizes specific exceptions to the rights recognized to the interested party. However, Comburex must continue to process the personal data of the interested party if one or more of the following applicable conditions occur:
• compliance with an applicable legal obligation;
• resolution of pre-disputes and/or disputes (own or third party);
• external investigations/inspections;
• requests from Italian and/or foreign public authorities;
• reasons of significant public interest;
• execution of an existing contract between Comburex and a third party;
• any further blocking conditions/statuses of a technical nature identified by Comburex.

5.2 Exceptions to the exercise of rights
To exercise their rights, each interested party may contact Comburex at the email address amministrazione@comburex.com or submit the request in writing to Comburex Srl via del redolone 45 51034 Serravalle Pistoiese (PT)
The response deadline is one (1) month, extendable by two (2) months in particularly complex cases; in these cases, Comburex provides at least an interim communication within one (1) month.
The exercise of rights is, in principle, free; Comburex, having assessed the complexity of processing the request and, in the case of manifestly unfounded or excessive (even repetitive) requests, reserves the right to ask for a contribution. Comburex has the right to request further information necessary for identifying the applicant.
6. Data retention period
Comburex processes and stores the personal data of the interested party for the entire duration of the contractual relationship, for the execution of the obligations inherent and consequent thereto, for compliance with applicable legal and regulatory obligations, as well as for its own or third party defensive purposes, until the data retention period expires. In particular, the retention period of the interested party’s personal data starts:
• for the products / services included in the contract: from the termination of the relationship; unless their further processing is necessary for one or more of the following purposes:
• resolution of pre-disputes and/or disputes initiated before the expiry of the retention period;
• to follow up on investigations/inspections by external authorities initiated before the expiry of the retention period;
• resolution of pre-disputes and/or disputes initiated before the expiry of the retention period;
8. Cookies
The identification of the consumption habits and propensities of the interested party will also be analyzed through the use of cookies, in compliance with the guarantees and necessary measures prescribed by current legislation.
The complete information on the topic is available on the website comburex.com on the page comburex.com/privacy-policy