Privacy notice
Draft to be validated by legal counsel. The current website's privacy policy is outdated. This text follows the structure required by Art. 13 GDPR; highlighted values must be confirmed. The Italian version will be legally binding.
1. Data controller
The data controller is M&D S.r.l., registered office at Via Monte Santo 25, 00195 Rome (RM), Italy, VAT IT 08516441006. For any request concerning personal data, please write to amministrazione@emmedisrl.it.
Data Protection Officer (DPO): name and contact details, if appointed.
2. Data processed
- Browsing data: IP address, browser type, pages visited, date and time of access, collected automatically by the systems running the website.
- Data you provide through the website forms: name, surname, company, phone, e-mail, message content; for job applications, also your CV and the information it contains.
- Cookies and similar technologies: see our Cookie policy.
3. Purposes and legal bases
| Purpose | Legal basis (GDPR) |
|---|---|
| Answering requests for information, quotes and equipment rental | Pre-contractual measures at your request (Art. 6.1.b) |
| Assessing job applications and recruiting | Pre-contractual measures (Art. 6.1.b); for any special category data in the CV, Art. 9.2.b |
| Complying with legal, accounting and tax obligations | Legal obligation (Art. 6.1.c) |
| Ensuring website security and protecting the controller's rights | Legitimate interest (Art. 6.1.f) |
| Website usage statistics via non-anonymised analytics cookies | Consent (Art. 6.1.a), which may be withdrawn at any time |
4. Whether providing data is mandatory
Fields marked as required in the forms are needed to handle your request; without them we cannot reply. All other data is optional.
5. How data is processed
Data is processed electronically by authorised, trained staff, with appropriate technical and organisational measures to prevent loss, misuse or unauthorised access. No automated decision-making or profiling takes place.
6. Recipients
Data may be shared with suppliers acting as data processors under Art. 28 GDPR (website hosting and maintenance, e-mail services, advisers) and with public authorities where required by law. Data is not disseminated.
7. Transfers outside the EU
Where some suppliers (e.g. Google services) process data outside the European Economic Area, transfers rely on an adequacy decision (EU-US Data Privacy Framework) or on the European Commission's standard contractual clauses.
8. Retention
- Contact, quote and rental requests: as long as needed to handle them and no longer than 24 months, unless a contract is entered into.
- Job applications: 24 months from receipt, unless stated otherwise.
- Browsing data: only as long as strictly necessary for website security.
9. Your rights
You may exercise your rights under Articles 15-22 GDPR at any time (access, rectification, erasure, restriction, portability, objection and withdrawal of consent) by writing to amministrazione@emmedisrl.it. You also have the right to lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it).
10. Whistleblowing reports
Processing of data collected through the reporting platform is described in the dedicated whistleblowing privacy notice.
11. Changes
This notice may be updated. The current version is always published on this page, showing the date of the last update.