Information on the Processing of Personal Data pursuant to Article 13 of Regulation (EU) 2016/679
Pursuant to Article 13 of Regulation (EU) 2016/679 ("GDPR"), IRCA S.p.A. and Irca Distribuzione inform you that the personal data collected will be subject to shared processing for the purposes indicated below and in compliance with the above mentioned regulations; in relation to the above mentioned processing IRCA S.p.A. and Irca Distribuzione provide the following information: 

Joint controllers (Article 26 of the GDPR)
IRCA S.p.A. headquarters at Via degli Orsini 5, 21013 Gallarate (VA), VAT number 09684290969, email: [email protected] or [email protected] (hereinafter: Controller or Joint Controller)

Irca Distribuzione headquarters at Via Irlanda 6, 21013 Gallarate (VA), VAT number 02737290128, email: [email protected] o [email protected] (hereinafter: Controller or Joint Controller)

Personal Data Collected
The personal data subject to the processing is exclusively related to identification data (as an example: name, surname, e-mail, telephone number and work).

Purposes of the processing, legal basis and data retention
The personal data provided by the user are processed and used exclusively for the following specified purposes. The purposes of the processing of personal data are as follows:

1. Registration to the reserved area of the website www.irca.eu, in order to use the services offered to registered users.
   The legal basis that legitimizes the processing of personal data is the perform of a contract to which the data subject is a party (Article 6.1, letter b) of the GDPR).
   Personal data will be stored for the entire duration of the service requested and/or until you decide to unsubscribe from the reserved area, as well as for the following 10 years. 
2. Profiling purposes
   In case of your clear consent, your personal data (collected for the purposes referred to in point A above) will be processed for profiling purposes for the creation of your profile through the analysis of your choices, interests and tastes in order to send you personalized commercial communications more in line with your needs.
   The legal basis for this processing of personal data is, as mentioned above, the specific consent.
   With regard to profiling purposes, please note that your personal data will be processed using exclusively half-automated tools and will not be subject to exclusively automated decision-making processes. 
   The personal data will be processed until revocation of the consent, which can be manifested at any time. On the other hand, personal data relating to profiling activities will be kept for up to 12 months from the moment of their collection.
3. Business and/or marketing purposes
   If you give your consent, your personal data will be processed for marketing purposes, sending promotional communications, sending newsletters of a business nature, advertising material and/or offers of products and services, as well as carrying out statistical and/or market research and sending satisfaction questionnaires, both with automated (e-mail, whatsapp, facebook, instagram, linkedin) and traditional (by post and direct call with operator intervention) contact methods of the Joint Controller. 
   If you give your consent, your personal data will be processed for marketing purposes, sending promotional communications, sending newsletters of a business nature, advertising material and/or offers of products and services as well as carrying out statistical and/or market research and sending satisfaction questionnaires, both with automated (e-mail, whatsapp, facebook, instagram, linkedin) and traditional (by post and direct call with operator intervention) contact methods of the Irca Group's commercial partners and/or companies, to whom the personal data collected in this specific context will be communicated. 
   The personal data will be processed until consent is withdrawn, which can be expressed at any time. On the other hand, detailed personal data referring to marketing activities will be stored up to 24 months from the moment of their collection.
   The legal basis for such processing of personal data is, as mentioned above, your consent (specific to each processing operation).

Obligatory data provision 
The personal data required to register for the reserved area of the website are marked with an asterisk (*). 
Any refusal to provide the above-mentioned data does not, therefore, allow the registration to the reserved area of the website.

Data recipients
The data will be processed by the employees of the Joint Controllers duly appointed and authorized to pursue the above purposes and who have received adequate training and operating instructions.

The data may be processed, on behalf of the Joint Controller, by external subjects duly appointed as Data Processors, to whom operational instructions are given. Such subjects could be included, as an example, in the following categories:
a.    companies offering e-mail services; 
b.    companies offering website maintenance services; 
c.    companies offering support in carrying out market studies.
We may also be required to disclose personal data to external parties who operate as independent Data Controllers, such as competent judicial authorities or supervisory and control bodies.

Transfer of Personal Data to countries outside the European Union
Personal data will not be transferred to third countries and/or international organisations.

Rights of the data subject
By contacting Irca by e-mail at [email protected], the data subjects may ask the Joint Controller for access to the data concerning them, their erasure, rectification of inaccurate personal data, integration of incomplete data, restriction of processing in the cases provided for in Article 18 GDPR, as well as object to processing, on grounds related to their own particular situation, in the event of a legitimate interest of the Joint Controller.
Furthermore, where the processing is based on consent or contract and is carried out by automated means, the data subjects have the right to receive the data in a structured, commonly used and machine-readable format and, if technically feasible, to transmit them to another joint controller without hindrance.
The data subjects have the right to withdraw the consent given at any time for marketing purposes and to object to the processing of the data. The possibility for the the data subject who prefers to be contacted for the above mentioned purpose exclusively through traditional methods, to express his object only to the receipt of communications through automated means, remains unchanged. 
Data subjects have the right to lodge a complaint with the competent supervisory authority in the Member State where they habitually reside or work or in the State where the alleged infringement has occurred.