Dear User,

as “Data Controller” Crest Optics S.p.A. wishes to inform you, pursuant to art. 13 of Legislative Decree n. 196/2003 (hereinafter the “Privacy Code”), of article 13 of Regulation (EU) 2016/679 (hereinafter “Regulations” or “GDPR 2016/679”), that the personal data you provide will be processed in compliance with the aforementioned law and the confidentiality obligations which are mandatory for Crest Optics S.p.A.

1. Data controller
   Pursuant to articles 4 and 28 of the Privacy Code and articles 4 n. 7) and 23 of the Regulations We inform you that the Data Controller is Crest Optics SpA, share capital Euro 179.489,60, Italian Tax Code and VAT Number 10490851002, with registered office in Rome, 00165, Via di Torre Rossa 66, Tel 0039.06.61660508, Fax 0039.06.61662738, e-mail: info@crestoptics.com, pec: amm@pec.crestopt.com.
2. Data Protection Officer (DPO)
   Crest Optics S.p.A. under the Regulations the Data Protection Officer (DPO) is not required, in any case a resource has been appointed and trained, which can be reached at the following e-mail address: dpo@crestopt.com.
3. Legal basis and purpose of processing
   The personal data requested for the performance of the contractual relationship will be processed by Crest Optics S.p.A. on the basis of the legal ground and according to the purposes indicated below:
   1. a) Purposes connected to obligations established by laws, regulations, community legislation and imposed by Authorities legitimated by the law and by Supervisory and Control Bodies (for example anti-money laundering legislation, etc.);
   2. b) Contractual, connected and instrumental purposes at the conclusion of the contract with Crest Optics S.p.A., its execution, the management of payments and any default by the customer (debt collection and litigation);
4. Nature of the provision of data and consequences of any refusal
   The consent to the data processing for the purposes referred to in letter a) is not required, as the processing is required by law, while for the purpose b) is mandatory and in case of refusal Crest Optics shall not follow up the request, and the activities requested for the execution of the contract shall not be carried out.
5. Methods of processing and conservation
   For the purposes described above, the Data may be processed using manual, computerized and / or otherwise automated means according to the ratio strictly connected to the processing purposes and, in any case, in order to guarantee its security and confidentiality even in case of treatment through innovative tools, distance communication, in compliance with the provisions of article 32 of the GDPR 216/679 and in compliance with the provisions of article 29 of the GDPR 2016/679. We also point out that, in compliance with the principles of lawfulness, fairness and transparency data minimization and accuracy, the Data will be stored under the supervision of the necessary technical and organizational measures to minimize the risks of destruction and accidental loss, unauthorized access or unauthorized processing. The Data is kept for all that is necessary to manage the contract and comply with legal obligations, and periodically updated with information acquired during the course of the relationship.
6. Categories of subjects to whom the Data may be communicated
   The Data may be communicated, for the purposes listed above, to subjects which CrestOptics S.p.A. uses to perform its activities, as well as to execute charges and obligations related to the performance of the contractual relationship, and in particular:
   1. a) professionals also in the form of associates, consultants or counterparties who may intervene in the execution of the assignment;
   2. b) companies, entities, external consortia, banks and lending banks, intermediaries, insurance companies, for the execution of the provisions received or for the provision of services requested;
   3. c) subjects that carry out activities of control, revision and certification of the activities carried out by Crest Optics SpA, possibly also in the interest of the client;
   4. d) subjects that provide services for the management of the information system;
7. Transfer of personal data
   We inform you that the data you provide are processed and stored in the computer systems of Crest Optics S.p.A. and are not stored outside of Europe in full compliance with the Privacy Code and EU Regulation 2016/679.We also inform you that if, in accordance with the aforementioned legislation and for the purposes indicated in this statement, it is necessary to transfer the personal data of the data subject abroad [outside the EU], Crest Optics S.p.A.will proceed on condition that the country of destination has been considered by the European Commission as suitable for the transfer pursuant to art. 45 of Regulation 2016/679 or if one of the conditions referred to in articles 46 and 47 of the same Regulation occurs.
8. Rights of the interested party
   In all cases of data processing you have the right to access, at any time, the data concerning you and to know what they are and how they are used. Specifically, pursuant to art. 7 of Legislative Decree 196/2003 and articles 15 to 22 of EU Regulation no. 2016/679 You can exercise the right to:
   1. request confirmation of the existence or not of personal data;
   2. obtain information on the purposes of the processing, the categories of personal data, recipients or categories of recipients to whom the personal data have been or will be communicated and, where possible, the retention period;
   3. obtain the correction and deletion of data;
   4. obtain the data processing limitation;
   5. obtain data portability, i.e. to receive them from a data controller, in a structured format, commonly used and readable by automatic device, and transmit them to another data controller without hindrance;
   6. oppose the processing at any time and also in the case of treatment for direct marketing purposes;
   7. to oppose an automated decision-making process concerning natural persons, including profiling;
   8. withdraw the consent at any time without prejudice to the lawfulness of the treatment based on the consent given prior to the revocation;
   9. to file a complaint before a supervisory authority.
      Similarly, it may request the updating, correction or integration of inaccurate or incomplete data, or cancellation, transformation into anonymous form or blocking for those processed in violation of the law.

The right to oppose treatment can be exercised for legitimate reasons (to be highlighted in the request).

For any request concerning the exercise of your rights, you can contract CrestOptics S.p.A., to the telephone number Tel. 0039.06.61660508, or with a written request to be sent to fax 0039.06.61662738, e-mail: info@crestoptics.com.

Last update May 15, 2018