Privacy Policy

Date updated October 2022

This statement, made pursuant to Articles 13 and 14 GDPR provides information about how the data of users, customers, applicants and suppliers – including when interacting with the website www.baglionispa.com (the “Site”, owned by Baglioni S.p.A) are processed by Baglioni S.p.A.

Data Controller:

BAGLIONI S.p.A. with registered office in Via Biandrate, 24 – 28100 Novara, CF/P.IVA 01169330030 (hereinafter referred to as “Baglioni”) which can be contacted at the following addresses: telephone:+39 0321 485211 – FAX:+39 0321 53571 – email address: privacy@baglionispa.com.

Types of data processed, purposes and legal bases for processing

The Controller will process the personal data collected in the manner and for the purposes described below:

	Purpose	Types of data	Stakeholder categories	Legal Basis
A	Satisfy Site users’ requests entered through the contact form	First name, last name, e-mail address, telephone, other data given in the message or subject	Site Users	Free and specific consent given via the box at the bottom of the contact form. Refusal to provide consent will result in the inability of the Data Controller to respond to the data subject’s requests
B	Ensure the proper operation, management, maintenance and improvement of the Site Ensure that data subjects’ browsing is safe and ascertain liability in the event of cyber-security breaches. To obtain statistical analysis of the use of the Site with the possibility of analyzing the data also in aggregate form. Plug-ins and interaction with social The Site allows interaction with third-party sites and social networks (Youtube, LinkedIn) through social plug-ins	Navigation data: -technical information, including IP address, information about devices used by visitors to the Site, browser and operating systems, etc. -information about browsing the Site, including URLs of pages visited and activities that are performed on the page, dates and times of browsing, time spent on the Site.	Site Users	Cookie Consent Users of the Site are always free to decide whether to provide their browsing data, for example, by choosing to disable cookies through their browser settings. However, refusal to provide information necessary for the purpose of browsing may make it impossible to carry out activities closely related to the browsing itself and, therefore, also to consult and interact with the Site.
G	Personnel search and selection- evaluation of spontaneous applications	personal data provided voluntarily by candidates through the submission of a curriculum vitae for the purpose of establishing a working relationship or collaboration with the companies of the Baglioni Group	Candidates for job positions	Execution of a spontaneous application request by the candidate

Method of treatment

The processing of personal data of data subjects will be mainly carried out with the help of electronic or computerized means, in the manner and with the tools suitable to ensure the security and confidentiality of the data in accordance with the GDPR. In particular, all the necessary technical, IT, organizational, logistical and procedural security measures will be adopted so that the minimum level of data protection required by law is guaranteed, allowing access only to persons authorized to process the data by Baglioni or by the other Companies that are part of the Baglioni Group or by the data processors appointed by them.

The information acquired and the manner of processing will be relevant and not excessive in relation to the type of services rendered. Data will also be managed and protected in environments whose access is under constant control. In particular:

• Browsing data is collected through the use of cookies. To learn more about how cookies work, how to enable and disable them, please see our cookie policy.
• Plug-ins and interaction with social media: by accessing any of the areas of the Site equipped with these kinds of tools, the Internet browser will connect data subjects directly to the servers of the third-party sites in question, thereby transferring their personal data to the operators of those sites.

Depending on the specific agreements therein with the operators of such third party sites, Baglioni may act as an autonomous data controller or joint data controller with respect to such data transfers.Regarding the privacy protection methods and processing of personal data collected by the operators of third-party sites with which the described interactions take place, please refer to the relevant sites

Data retention

• Data provided in spontaneous applications: Retention period: for the period strictly necessary for the selection of candidates.
• Browsing data: This data is kept only as long as it is strictly necessary for the purposes for which it is collected.

Communication and dissemination of data

The personal data collected will be processed by the personnel authorized by Baglioni who need to have knowledge of it in function of their activities and/or by external parties who carry out services on behalf of Baglioni such as, for example, the management activity of the computer system, competent authorities and/or public bodies and supervisory and control bodies for the possible fulfillment of legal obligations, agencies and communication companies, other parties who in any capacity collaborate – for the achievement of institutional purposes – with the Data Controller and who may act as data processors or autonomous data controllers.

In addition, the data may be disclosed to other companies that are part of the Baglioni Group.

Data on data subjects will not be disseminated except in execution of legal obligations.

Transfer of data outside the EEA

Baglioni S.P.A. is the parent company of the Baglioni Group, which also has some offices in the U.S.A. and China, so personal data may be transferred, again as part of intercompany relations, to countries outside the European Economic Area (“EEA”), which includes in addition to the member states of the European Union, Norway, Lichtenstein and Iceland.

In the event that the transfer of personal data to countries outside the European Economic Area proves necessary to pursue the purposes of the processing operations described in this Notice, Baglioni guarantees that all data transfers outside the EEA, if any, will take place in such a way as to ensure the full protection of the rights and freedoms of the data subjects.

Rights of the data subject

Pursuant to Art. 13 of the GDPR, the data subject has the right to:

• request from Baglioni access to personal data concerning him/her, rectification, erasure, restriction of processing or to object to their processing
• Revoke consent at any time without affecting the lawfulness of processing based on consent given before revocation

• file a complaint with the Data Protection Authority at the following PEC address: protocollo@pec.gpdp.it.

These rights may be exercised by sending written notice to the Data Controller at the following email address: privacy@baglionispa.com.

Changes

Baglioni reserves the right to make changes to this policy at any time by giving appropriate notice via the Site or by email.