Privacy Notice

Information regarding the processing of personal data

1. General Information

In carrying out its activities, the Competence Industry Manufacturing 4.0 S.C.A R.L. competence center (hereinafter “CIM 4.0”) needs to collect and process personal information to perform its daily activities directly and indirectly related to both business and the management of its resources.

Furthermore, CIM 4.0 is required to process certain categories of personal data to comply with legal and/or regulatory requirements, in accordance with Regulation (EU) 2016/679, Italian data protection laws, and any other applicable regulations.

In a framework of maximum transparency and accountability, CIM 4.0 has developed policies and procedures to ensure the application of adequate security measures for data protection (data protection) in every operational area, and thus the rights and freedoms of the individuals to whom the data refer (data subjects).

Below are all relevant information regarding the processing of personal data, starting with general information applicable to all processing unless otherwise specified, subsequently supplemented (pursuant to Articles 12, 13, 14 of the European Regulation 2016/679) by specific information for individual processing activities.

1.1 Data Controller

The Data Controller for the personal data processing activities described below is Competence Industry Manufacturing 4.0 S.C.A R.L. (CIM 4.0 and hereinafter also “the Controller”), with registered office at Via Nizza 230, 10126 Turin, and operational office at Corso Luigi Settembrini 178, 10135 Turin (TO).

CIM 4.0 is a Limited Liability Consortium Company (S.C.A R.L.) that aims to provide goods, services, and job opportunities to the members of the organization under more favorable conditions than those obtainable from the market.

1.2 Regulatory Framework

Without claiming to be exhaustive, the following summarizes the regulatory framework for the implementation of the personal data protection management system in CIM 4.0:

• Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the Protection of Natural Persons with regard to the processing of personal data, as well as the free movement of such data (hereinafter the Regulation or GDPR)
• Legislative Decree 196/2003, containing the “Code regarding the protection of personal data” or, more simply, “Privacy Code,” as amended by Legislative Decree 101/2018
• Legislative Decree 101/2018, Provisions for the adaptation of national legislation to the provisions of the GDPR

1.3 Communication Framework

The Controller of the processing activities described below does not disseminate personal data, i.e., does not make them known to unspecified subjects, in any possible form. However, personal data subject to processing may be legitimately communicated

• to subjects authorized to access them by law, regulations, community norms.
• to persons operating under the authority of the Data Controller
• to external subjects, service providers, and for this purpose, if applicable, appointed as external data processors or independent data controllers

Among the specific information, where appropriate, the categories of subjects to whom the data are made accessible are specified.

1.4 Data Transfer

In no case does CIM 4.0 transfer personal data to third countries or international organizations. However, the Data Controller reserves the right to use cloud services: in such cases, service providers will be selected among those who provide adequate guarantees, as provided by Article 46 of the GDPR.

1.5 Rights of the Data Subject

The data subject has the right to exercise, in compliance with the conditions specified by the GDPR, the following rights regarding the processing of personal data:

• right of access (Article 15 of the GDPR): the data subject has the right to obtain from the Data Controller confirmation as to whether or not personal data concerning them are being processed and, if so, to obtain access to the personal data
• right to rectification (Article 16 of the GDPR): the data subject has the right to obtain from the Data Controller the rectification of inaccurate personal data and, where appropriate, the completion of incomplete data
• right to erasure (Article 17 of the GDPR): the data subject has the right to obtain from the Data Controller the erasure of personal data
• right to restriction of processing (Article 18 of the GDPR): the data subject has the right to obtain from the Data Controller the restriction or blocking of processing
• right to data portability (Article 20 of the GDPR): the data subject has the right to receive in a readable and structured format the personal data concerning them and has the right to obtain the transfer of such information to another Controller
• right to object to automated decision-making (Article 22 of the GDPR): the data subject has the right not to be subjected to a decision based solely on automated processing (e.g., profiling)

Furthermore, the data subject has the right to exercise the

• right to object (Article 21 of the GDPR): the data subject has the right to object at any time to the processing of personal data concerning them.

The data subject can exercise their rights by writing to the email address privacy@cim40.com. To enable the best management of the request, the data subject must specify in the communication the right they intend to exercise and the processing to which they refer, attaching an electronic copy of a valid identity document that the Data Controller will use exclusively to verify the legitimacy of the request.

1.6 Withdrawal of Consent

With reference to Article 7 of the GDPR, the data subject may withdraw the consent given at any time. In the absence of a different legal basis, the withdrawal of consent entails, within the strictly necessary technical times, the cessation of any further processing activity, including mere storage, without compromising the legitimacy of previously carried out processing. Where processing is not based on consent, its possible withdrawal does not affect its legitimate continuation. The withdrawal of consent can be expressed following the same instructions provided for the exercise of rights.

1.7 Filing a Complaint

The data subject has the right to file a complaint with the supervisory authority of their country of residence.

1.8 Data Retention

The Controller retains and processes personal data for the time necessary to fulfill the indicated purposes. Detailed information includes the times and/or conditions that determine the duration of the retention period.

1.9 Automated Decision-Making Processes

In no case, regarding the processing indicated below, does the Controller carry out processing that consists of automated decision-making processes on the data of natural persons.

2. Specific Information

In the following paragraphs, as an integration and completion of the general information above, detailed information is provided regarding the individual processing activities carried out by the Controller in line with the provisions of Articles 12, 13, 14 of the GDPR.

2.1 Information for website visitors

In addition to the general information, the following information is provided to individuals who access and consult the website of the Controller (https://cim40.com) pursuant to Article 13 of the GDPR. In particular, it is specified that:

• The website you are visiting belongs to CIM 4.0, which guarantees the security, confidentiality, and protection of the data it possesses and those it will possess at any stage of the processing process in compliance with the rules set by the legal framework and in respect of business secrecy.
• The website provides links or references to other third-party websites over which CIM 4.0 has no control. These links are provided for the convenience of users of this site, and the Controller assumes no responsibility in relation to these sites, whose contacts are considered independent data controllers and to whom reference is made for any further information.
• The website uses cookies in compliance with the policy available online (Cookie Policy).

2.1.1 Purpose of Processing

The website uses cookies that allow the Controller to present its content on the web effectively and consistently with the visitor’s expectations. Information related to performance, visited pages, and relevant technical errors are also used with the aim of continuously improving the Group’s online presence.

2.1.2 Legal Basis of Processing

The use of technical cookies and the information used to support site navigation is processing carried out in the legitimate interest of the Controller, who intends to present its proposal online with performance and effectiveness that meet the visitor’s expectations. The use of any other information to evaluate and optimize performance or present advertisements managed by third-party sites is based on the user’s expressed consent.

2.1.3 Data Recipients

In addition to what has already been reported in the general information, the Data Controller communicates the personal data collected during navigation to WordPress (www.wordpress.com) and Google Analytics (https://analytics.google.com) for the preparation of aggregate reports that allow examining the use of the site. Finally, information is forwarded to YouTube (www.youtube.com) and Vimeo (https://vimeo.com) for the presentation of video content on the pages of the COM 4.0 site. For further information, please refer to the respective cookie policies available on the reference sites.

2.1.4 Data Retention

In this case, navigation data is retained for no more than six months.[GA1]

2.1.5 Withdrawal of Consent

Consent to the use of non-technical cookies can be withdrawn at any time using the cookie settings. Withdrawal of consent will not affect the processing of data carried out previously and will result in the cessation of cookie use within the strictly necessary technical times.

2.1.6 Refusal to Provide Data

The data subject may refuse to provide their personal data by disabling the use of cookies as specified in the cookie policy available online. However, it should be noted that this operation may make the service less efficient and inhibit the enjoyment of some of the site’s content.

2.2 Information for those requesting the catalog online

In addition to the general information, the following information is provided pursuant to Article 13 of the GDPR to those who complete the online form to obtain the course catalog promoted by CIM 4.0.

2.2.1 Source of Personal Data

The personal data processed are those provided by the data subject

• By completing the online form prepared to obtain the course catalog promoted by CIM 4.0
• Possible forwarding of communications via email
• Subsequent interactions and insights

2.2.2 Purpose of Processing

The Controller processes personal data to

• follow up on the requests made by the data subject by making the course catalog available to them
• forward promotional information via email

2.2.3 Legal Basis of Processing

The legal basis for processing for both purposes is the expressed consent

• For purpose [a] by completing the catalog request form by entering personal data (mandatory data and optional fields are specified, useful for facilitating communication
• For purpose [b] by checking the available option on the online form page

2.2.4 Data Recipients

The data of the data subject are made available to trained and authorized personnel to access them to perform their duties within the specified purposes and possibly to external providers whose services are essential to meet the expectations of the data subject. In particular, the data strictly necessary for forwarding promotional communications are communicated to MailChimp (https://mailchimp.com).

2.2.5 Data Retention

In this case, the data of the data subjects are retained until the end of the interaction with the data subject.

2.2.6 Withdrawal of Consent

Regarding purpose [2], the data subject can withdraw the expressed consent at any time by using the link contained in the emails periodically forwarded.

2.2.7 Refusal to Provide Data

The form specifies the data to be considered necessary to obtain what is requested: failure to provide such information may prevent the Controller from following up on the data subject’s request. Other data are considered optional and therefore not necessary, although useful to facilitate communication between the parties: their failure to provide does not compromise the satisfaction of the request.

2.3 Information for those subscribing to the newsletter

In addition to the general information, the following information is provided pursuant to Article 13 of the GDPR to those who provide their personal data to receive the CIM 4.0 newsletter.

2.3.1 Source of Personal Data

The personal data processed are those provided by the data subject by completing the online form prepared for newsletter subscription.

2.3.2 Purpose of Processing

The Controller processes personal data to periodically forward information regarding its initiatives and training proposals to the data subject via email.

2.3.3 Legal Basis of Processing

The legal basis for processing is the consent of the data subject expressed by providing their email address in the appropriate section of the site.

2.3.4 Data Recipients

The data of the data subject are made available to trained and authorized personnel to access them to perform their duties within the specified purposes and possibly to external providers whose services are essential to meet the expectations of the data subject.[GA3] In particular, the data are communicated to MailChimp (https://mailchimp.com) for forwarding communications.

2.3.5 Data Retention

In this case, the data of the data subjects are retained until the end of the interaction with the data subject.

2.3.6 Withdrawal of Consent

The data subject can withdraw the expressed consent at any time by using the link contained in the emails periodically forwarded.

2.3.7 Refusal to Provide Data

The requested data (email address) are necessary for the execution of the processing: failure to provide such information would prevent the Controller from following up on the forwarding of periodic communications.

2.4 Information for those completing the course pre-registration form

In addition to the general information, the following information is provided pursuant to Article 13 of the GDPR to those who complete the online form to pre-register for courses promoted by CIM 4.0.

2.4.1 Source of Personal Data

The personal data processed are those provided by the data subject

• By completing the online form prepared for course pre-registration promoted by CIM 4.0
• Possible forwarding of communications via email
• Subsequent interactions and insights

2.4.2 Purpose of Processing

The Controller processes personal data to

• Contact the data subject in light of the course planning of interest to allow for possible formalization of enrollment
• Send the catalog of training courses promoted by CIM 4.0
• forward promotional information via email to those who express interest

2.4.3 Legal basis for processing

The legal basis for processing for the indicated purposes is the consent expressed by the data subject

• For purpose [1] by filling out the pre-registration form with personal data (mandatory data and optional fields are specified, useful for facilitating communication)
• For purposes [2] and [3] by checking the available options on the form page

2.4.4 Data recipients

The data of the data subject are made available to trained and authorized personnel to access them in order to perform their duties within the specified purposes and possibly to external suppliers whose services are essential to meet the expectations of the data subject.[GA4] In particular, the data strictly necessary for forwarding promotional communications are communicated to MailChimp (https://mailchimp.com).

2.4.5 Data retention

In this case, the data of the data subjects are retained until the end of the interaction with the data subject.

2.4.6 Withdrawal of consent

With particular reference to purpose [3], the data subject can withdraw the expressed consent at any time by using the link contained in the emails periodically forwarded.

2.4.7 Refusal to provide data

The form specifies the data considered necessary to obtain what is requested: failure to provide such information may prevent the Controller from fulfilling the data subject’s request. Other data are considered optional and therefore not necessary, although useful to facilitate communication between the parties: their non-provision would not compromise the satisfaction of the request.

2.5 Information for those filling out the course registration form

In addition to the general information, the following information is provided pursuant to Article 13 of the GDPR to those who fill out the online form to register for the courses scheduled by CIM 4.0.

2.5.1 Source of personal data

The personal data processed are those provided by the data subject

• By filling out the online form prepared for registration for the courses scheduled by CIM 4.0
• Possible forwarding of communications via email
• Subsequent interactions and insights

2.5.2 Purpose of processing

The Controller processes personal data to

• Deliver the course requested by the data subject
• Send the catalog of training courses promoted by CIM 4.0
• forward promotional information via email

2.5.3 Legal basis for processing

The legal basis for processing for purpose [1] is the request of the data subject, understood as a pre-contractual measure functional to the organization and delivery of the course. For purposes [2] and [3], the legal basis is constituted by the consent expressed by checking the available options on the form page.

2.5.4 Data recipients

The data of the data subject are made available to trained and authorized personnel to access them in order to perform their duties within the specified purposes and possibly to external suppliers and professionals whose services are essential to meet the expectations of the data subject.[GA5] In particular, the data strictly necessary for forwarding promotional communications are communicated to MailChimp (https://mailchimp.com).

2.5.5 Data retention

In this case, the data of the data subjects are retained

• Regarding the data processed for purpose [1], until the end of the course delivery unless legal obligations apply to the Controller
• Regarding purposes [2] and [3], until the end of the delivery of the requested service

2.5.6 Withdrawal of consent

With particular reference to purpose [3], the data subject can withdraw the expressed consent at any time by using the link contained in the emails periodically forwarded.

2.5.7 Refusal to provide data

The form specifies the data considered necessary to obtain what is requested: failure to provide them would prevent the fulfillment of the data subject’s request. Other data are considered optional and therefore not necessary, although useful to facilitate communication between the parties: their non-provision would not compromise the delivery of the requested service.

2.6 Information for those submitting their Curriculum Vitae

In addition to the general information, the following information is provided pursuant to Articles 13 and 14 of the GDPR to subjects from whom the Controller directly or indirectly acquires the curriculum vitae and/or general curricular information and/or with whom a job interview is conducted.

2.6.1 Purpose of processing

The personal data of those who, spontaneously or following a personnel search or through another channel (e.g., specialized portals and social networks, recruitment companies), submit their curriculum to the attention of the Controller and/or decide to attend an introductory interview at the Controller, are processed to

• Identify the most suitable candidates for potential collaboration,
• formulate job offers and possibly initiate a collaboration relationship

2.6.2 Source of data

The personal data processed are provided by the data subject on the occasion of:

• sending the curriculum to the Controller, spontaneously (via email or by filling out the online form specifically prepared) or in response to an advertisement
• introductory interviews, specific interviews, and selections
• referral by third parties, including recruitment companies
• searches conducted on public databases, possibly made available by specialized sites (e.g., LinkedIn)

2.6.3 Categories of data

The personal data processed belong to the following categories:

• identification data: name, surname, contact details, educational and professional background
• special data: health-related data possibly provided by the data subject to ensure adequate identification of the role

2.6.4 Legal basis for processing

CIM 4.0 processes the data of the data subjects based on the freely expressed consent with the sending or delivery of their Curriculum Vitae or the publication of their data on sites and portals aimed at seeking new job opportunities. Similarly, any special data provided to the Controller are processed based on the consent of the data subject, explicitly expressed upon sending the curricular data or at the time of the first introductory interview.

2.6.5 Scope of communication and dissemination

The personal data of the data subjects may be communicated within the indicated purposes to workers operating under the Controller’s employment (e.g., to schedule the introductory interview or any further in-depth meetings) and for this purpose appropriately trained and authorized.

2.6.6 Data retention

In this case, if a collaboration relationship is not promptly initiated between the parties, the personal data are retained for a period of 36 months, after which the data will be deleted unless the consent for retention is renewed for an additional equivalent period. In case of initiation of a collaboration relationship, the Controller will retain and update the curricular data based on the indications of the data subject until the end of the relationship between the parties.

2.6.7 Refusal to provide data

Curricular data are considered necessary to enable the pursuit of the purposes indicated by the Controller. Failure to provide them may result in CIM 4.0 being unable to proceed with any processing activities and thus perform the activities enabling the potential employment relationship with the data subject.