Privacy & Cookie Policy
Art. 13 and seq. General Data Protection Regulation no. 2016/679 ("GDPR")
Introduction
Dear User, when you access and navigate on this website (hereinafter 'Website') some of your personal data is acquired, stored, and managed (in technical terms 'processed') through the device you are using, also by analyzing and saving your IP address, browsing data, 'cookies' and other online identifiers such as 'pixels'.
Considering these processing activities, in compliance with the applicable legislation that requires the protection, confidentiality and security obligations on your data, A.L.M.A.G. S.p.A. clarifies below the purposes and means defined in its capacity as Data Controller.

Data Controller
Data processing operations related to the access and interaction with the Website will be performed as Data Controller by A.L.M.A.G. S.p.A., with legal seat in Roncadelle (BS), Via Vittorio Emanuele II, n. 39, VAT n. 03368970988.
A.L.M.A.G. S.p.A. can be contacted at the following addresses:
• by writing an e-mail to privacy@almag.it
• by mail, at the address of the legal seat as provided above.

Categories of data processed
The categories of data processed are:
• information related to the User who navigates the Website, also the online identifiers and the data related to the devices used (*);
• additional information relating to browsing activity on the Website, including online identifiers (cookies, pixels, tracking elements, etc.;
• personal identification and contact data such as name, surname, e-mail address and phone number, where useful for the use of the Website functionalities (*);
• additional data in case of implementation of new functionalities.

Purposes, legal basis and data retention periods
In the table below, the Data Controller lists the specific purposes for which personal data processing takes place, each accompanied by the relevant legal basis and the maximum data retention period, if it is possible to indicate this precisely (otherwise, the retention period criterion based on which the relevant technological tool has been set is indicated).
Purposes
(1) Offering the navigation functionalities of the Website, its pages and contents
Legal basis
6 (1) (b), performance of pre-contractual activities
Data retention period
For the duration the user remains on the Website, and in any case for a maximum of 24 months after it
Purposes
(2) Feedback to requests of contact or information sent by the User
Legal basis
6 (1) (f), exercise of legitimate interest of the Data Controller, aimed at maintaining relations with Users of the Website
Data retention period
For a maximum of 10 years after the interaction with the Data Subject
Purposes
(3) Managing spontaneous contacts from users of the Website, by sending Curriculum Vitae and/or other communications
Legal basis
6 (1) (b), performance of pre-contractual activities
Data retention period
For a maximum of 12 months after the termination of the selection process, unless further storage requirements arise, or consent of the User is provided.
Purposes
(4) Analysis of the usage statistics and improvement of the functionality of the Website through technologies that involve data processing pursuant to Dir. 2002/58/CE
Legal basis
6 (1) (a), based on the consent of the Data Subject
Data retention period
Until the expiry of the online identifier relating to the User which is retained for the longest period, unless the User requests deletion or anonymisation
Purposes
(5) Analysis of the usage statistics and improvement of the functionality of the Website through technologies that, considering their specific functioning, do not fall within the scope of Dir. 2002/58/CE
Legal basis
6 (1) (f), exercise of legitimate interest of the Data Controller, aimed at improving its products and services
Data retention period
Only for the period necessary for the complete anonymisation of the personal data processed


Other information on how we process personal data
If the User wish to receive more information about the balance between the legitimate interests pursued by the Data Controller and the fundamental rights and freedoms of the natural person, he/her can contact the Data Controller at the addresses indicated, having the right to receive adequate feedback as soon as possible and in any case within the time required by law.
In the event of litigation with the User or with third parties, or control of the competent Authorities, the conservation may be extended until the expiry of the last applicable prescription period.
The User's personal data will not be disseminated in any way, except for the acquisition of express and prior consent or within the limits of what is provided for or imposed by law.

Consequences of failure to provide data
The provision of personal data from time to time indicated as mandatory is necessary to pursue the related purposes: not providing such data makes it impossible to proceed with the related processing.
The provision of other personal data is optional: failure to provide such additional data may make it impossible to access all or part of the Website's functions or characteristics. With reference to marketing and profiling purposes, as well as in relation to ‘online identifiers’ that are not merely technical, consent to the processing of personal data is optional: there is no legal or contractual obligation on the User to provide such data for such purposes and/or to consent to the processing of their personal data for such purposes.

Automated decision-making processes
No processing of personal data by means of automated decision-making processes is carried out in accordance with current legislation, and namely with Article 22(1) and (4) of the GDPR.
In any case, any automated processing will not have a legal effect on the Data Subject or significantly affect them, unless specific informed consent is obtained and in any case within the limits of the law.

Categories of subjects that process data
Within the limits of the obligations, tasks or purposes indicated above, personal data may be made available and/or communicated to:
• employees and/or collaborators of the Data Controller;
• third parties appointed as Data Processors (and namely, products or services providers), as well as their employees or collaborators;
• Judicial, administrative and/or public security authorities, in compliance with the applicable law.
The complete list of Data Processors and other third parties to whom the data are made available and/or communicated can be requested from the Data Controller at any time, at the indicated references.

Transfer of data outside the European Economic Area
Personal data may be transferred to countries outside the European Economic Area for technical purposes to subjects based in countries recognized as "adequate" by the European Commission, among which those adherents to the “EU-US Data Privacy Framework”, or that have stipulated specific Standard Contractual Clauses based on the text approved by the European Commission.

Rights of the Data Subject
The User, as a "Data Subject" according to the GDPR, can at any time exercise the rights attributed to him by the European Regulation n.2016/679. In particular, the User has the right to:
• access his/her personal data;
• obtain the correction or cancellation of the same or the limitation of the processing that concerns him/her;
• oppose the processing;
• obtain his/her data portability, where provided by the law;
• withdraw consent, where provided: the withdrawal of consent does not affect the lawfulness of the processing based on the consent given before the revocation;
• lodge a complaint with the supervisory authority.
For Italy - as the Data Controller’s home state - the supervisory authority is the “Autorità Garante per la protezione dei dati personali” based in Rome (www.gpdp.it).
The exercise of the aforementioned rights can take place by sending a request to the Data Controller's references, as indicated above.
***
What are cookies and other tools used by the Website
Cookies are small text files that are transmitted from the Website to the devices of Users who visit it, and which are then retransmitted to the Website on subsequent visits; they may have different characteristics and be used for different purposes, both by the Website’s Data Controller and by third parties who provide technical services to the Data Controller or directly to the User.
This Website uses different types of cookies, in compliance with the "Guidelines for cookies and other tracking tools" as issued by the Italian Autorità Garante per la protezione dei dati personali with general provision no. 231 of 10 June 2021.
Therefore, Cookies can be divided between "first-party" cookies, if installed directly from the Website, and "third-party" cookies, where they involve access to features and services offered by third parties with respect to the Data Controller.
Some of the cookies used by this Website are "technical" - being installed automatically following the opening of the Website - and therefore do not require the user's consent.
Technical cookies can be "session" cookies, if they are deleted from the device when the browser and/or the navigation tab is closed, or "persistent" cookies, if they remain in the device's memory even after the Website is closed.
The Website might also use cookies, both first and third party, classified as "profiling", with the User's consent, through which the browsing experience and access to the Data Controller’s offerings are personalized and improved.
Additional elements, classified as ‘online identifiers’ by the GDPR, are also implemented, and they enable the analysis and monitoring of the Webite's functionalities and allow the User to access specific services. Some of them do not entail the installation of content on the tool used by the User to connect to the Website, and they allow minimising the processing of personal data carried out, thus meeting the requirements of the “Digital Markets Act” (EU Reg. 2022/1925) and not interfering with the regulations provided for by the “ePrivacy Directive” (Dir. 2002/58/EC).
The complete list is visible in the cookie preference panel.

How to manage cookie settings
To withdraw their general consent to the installation and use of cookies, the User can interact with the banner available by the Website on the first access or change the preferences at any time here.
The User can also seek further information on the following websites:
http://www.youronlinechoices.com/uk/your-ad-choices
http://www.allaboutcookies.org/manage-cookies/index.html
The provision of all cookies can always be deactivated by the User by adjusting the browser settings. It should be noted, however, that intervening on these settings could render the Website unusable if the browser blocks cookies that are technically indispensable for the provision of our services.
In any case, each browser has different settings for deactivating cookies. The links to the instructions for the most common browsers are as follows:
Apple Safari,
Google Chrome,
Microsoft Edge,
Mozilla Firefox,
Opera.
***
Last update on: 16th October, 2024
Personal Data Privacy Notice for “Job Candidates”
pursuant to artt. 13 and 14 GDPR
Introduction
Personal Data shall be processed with respect to the applicable law and to the confidentiality and security obligations that inspire the business activity of the Data Controller. This Privacy Notice explains how the personal data of Job Candidates for employment with the Company are acquired, processed, stored and cancelled.
Data Controller
The Data Controller is A.L.M.A.G. S.p.A., with legal seat in Roncadelle (BS), Via Vittorio Emanuele II, n. 39, VAT n. 03368970988, that can be contacted at the following addresses:
• by sending an email to privacy@almag.it;
• by ordinary mail at the registered office’s address.
Categories of data processed
The processed categories of personal data are:
• personal identification data of the Job Candidate *:
• personal data relating to the Job Candidate's skills and professional qualifications *;
• previous professional career of the Job Candidate;
• further personal data qualifying the Job Candidate's skills or job position;
• common or sensitive data shared by the Job Candidate on the basis of consent.
Data marked with an asterisk (*) are mandatory to enable the relevant processing activity.
Purposes, Legal basis and Data retention
Purposes
Legal basis
Data retention
Purposes
(1) Evaluating the possible establishment of an employment or collaboration relationship
Legal basis
Processing is necessary for the performance of precontractual activities carried out by the Data Controller
Data retention
For a maximum of 6 months after the end of the Job selection procedure
Purposes
(2) Accurately assess the position to be proposed to the candidate
Legal basis
Processing is necessary for the performance of precontractual activities carried out by the Data Controller
Data retention
For a maximum of 6 months after the end of the Job selection procedure
Purposes
(3) Acquiring further information about the Job Candidate's personal situation and skills
Legal basis
Processing is based on the consent of the data subject
Data retention
For a maximum of 6 months after the end of the Job selection procedure
Purposes
(4) Retention after the end of the Job selection procedure
Basi giuridiche
Processing is based on the consent of the data subject
Data retention
For a maximum of 1 year after the end of the Job selection procedure
Data processing
The processing of personal data will be based on principles of fairness, lawfulness, and transparency, protecting the confidentiality and rights of the data subject by means suitable to guarantee the security of the personal data processed.
Consequences of not submitting your data
The processing of personal data indicated as mandatory is necessary to fulfill the purposes indicated above: failure to provide such data will result in the impossibility of processing. The provision of other personal data is optional. Failure to provide such further data may result in the impossibility of proceeding with the selection of the Job Candidate or in an error in the employment relationship.
Categories of subjects who can process your personal data, scope of communication or dissemination
Within the limits of the obligations, tasks or purposes indicated above:
• personal data will be processed exclusively by employees and collaborators of the Data Controller, as well as by third parties appointed as Data Processors pursuant to Article 28 GDPR, in compliance with the provisions of the law also with regard to security measures to protect and safeguard the data;
• the data will not be disseminated in any way, except with the consent of the data subject.
The list of Data Processors can be requested to the Data Controller.
The Data Controller may communicate personal data to third parties, qualified as Independent Data Controllers, for the sole purpose of implementing legal obligations, including for example:
• public and private entities, also following inspections or audits (e.g. Tax Authorities, Social Security Agencies);
• subjects who can access the data by virtue of legal provisions (e.g. Tax Police Bodies, Judicial Authorities).
Cross-borders data transfers
Personal data shall be transferred, where foreseen by the technological tools used, to Third countries considered adequate by the EU Commission, or in any case to entities that have entered into Standard Contractual Clauses or other mechanisms of compliance for the extra-EEA transfer of personal data.
For further information you can always contact the Data Controller
Data Subject rights
The Job Candidate may, at any moment, exercise the rights provided by the EU Reg. 2016/679. In particular, the right to:
• to access to their personal data;
• to obtain the rectification or cancellation of the same or the limitation of the processing that concerns them;
• to oppose to the processing activities;
• to the portability of their data;
• to revoke the consent, if allowed: the revocation of the consent does not affect the lawfulness of the processing activities based on the consent given before the revocation;
• to lodge a complaint with the supervisory authority. For Italy, the supervisory authority is the Autorità Garante per la protezione dei dati personali (www.gpdp.it).
The exercise of the aforementioned rights can take place by sending a request by e-mail to the address indicated above.
Availability of this Privacy Notice
This Privacy Notice is made available directly to the candidate, at the first possible contact, or on the Data Controller's website.
Personal Data Privacy Notice for “Suppliers”
pursuant to artt. 13 and 14 GDPR
Introduction
Personal Data shall be processed with respect to the applicable law and to the confidentiality and security obligations that inspire the business activity of the Data Controller.
Data Controller
The Data Controller is A.L.M.A.G. S.p.A., with legal seat in Roncadelle (BS), Via Vittorio Emanuele II, n. 39, VAT n. 03368970988, that can be contacted at the following addresses:
• by sending an email to privacy@almag.it;
• by ordinary mail at the registered office’s address.
Categories of data processed
The processed categories of personal data are:
• personal identification data of the Supplier natural person, or of the employees of the Supplier legal entity,
• personal professional contact data of the Supplier natural person, or of the employees of the Supplier legal entity,
• personal data related to the business ongoing with the Supplier.
Purposes, legal basis and retention periods
Purposes
(1) Execution of the operations necessary to process the preliminary information related to the conclusion of the contract
Legal Basis
Processing is necessary for the performance of precontractual activities
Retention period
10 years from the conclusion of the contract (as set forth by art. 2220 of the Italian Civil Code). Nevertheless, as a guarantee for the Data Controller in the event of litigation or any control by the relevant Authorities, the retention period may be extended until the expiry of the last applicable prescriptive period
Purposes
(2) Management of the relationship with the Supplier and administration, orders and billing
Legal Basis
Processing is necessary for the performance of a contract
Retention period
10 years from the conclusion of the contract (as set forth by art. 2220 of the Italian Civil Code). Nevertheless, as a guarantee for the Data Controller in the event of litigation or any control by the relevant Authorities, the retention period may be extended until the expiry of the last applicable prescriptive period
Purposes
(3) Execution of the operations imposed by applicable law during the subscription process of the contract, among which the storage of the contract
Legal Basis
Processing is necessary to comply with a legal obligation to which the Data Controller is subject
Retention period
10 years from the conclusion of the contract (as set forth by art. 2220 of the Italian Civil Code). Nevertheless, as a guarantee for the Data Controller in the event of litigation or any control by the relevant Authorities, the retention period may be extended until the expiry of the last applicable prescriptive period
Purposes
(4) Carrying out administrative, accounting, contractual and financial analyses and audits
Legal Basis
Processing is necessary to fulfil the legitimate interest of the Data Controller, namely the monitoring of the quality of services performed by the Supplier
Retention period
10 years from the conclusion of the contract (as set forth by art. 2220 of the Italian Civil Code). Nevertheless, as a guarantee for the Data Controller in the event of litigation or any control by the relevant Authorities, the retention period may be extended until the expiry of the last applicable prescriptive period
Consequences of not submitting your data
Processing of the personal data described above is necessary to execute the indicated purposes, therefore not submitting such data implies the impossibility to perform the processing.
Categories of subjects who can process your personal data, scope of communication or dissemination
With respect to the obligations, activities and purposes stated above:
• personal data will be processed exclusively by employees and/or collaborators of the Data Controller, also through third parties appointed as Data Processors, in compliance with the provisions of the law also with regard to security measures to protect and safeguard the data:
• personal data will not be disseminated, except based on the data subject’s consent.
The list of Data Processors can be requested to the Data Controller.
The Data Controller may communicate and disseminate personal data for the sole purpose of executing legal obligations. Personal data may be disclosed in Italy and/or abroad to:
• public and private entities, also following inspections or verifications (for example Financial Administration, Tax Police Bodies, Judicial Authorities, Social Security Entities);
• subjects who can access the data under the provisions of law.
Cross-borders data transfers
Personal data shall be transferred, where foreseen by the technological tools used, to Third countries considered adequate by the EU Commission, or in any case to entities that have entered into Standard Contractual Clauses or other mechanisms of compliance for the extra-EEA transfer of personal data.
For further information you can always contact the Data Controller.
Data Subject rights
The Data Subject may, at any moment, exercise the rights provided by the EU Reg. 2016/679, and namely the rights to:
• access to their personal data;
• to obtain the rectification or cancellation of the same or the limitation of the processing that concerns them;
• to oppose to the processing activities;
• to the portability of their data;
• to revoke the consent, if allowed: the revocation of the consent does not affect the lawfulness of the processing activities based on the consent given before the revocation;
• to lodge a complaint with the supervisory authority. For Italy, the supervisory authority is the “Autorità Garante per la protezione dei dati personali” (www.gpdp.it).
The exercise of the aforementioned rights can take place by sending a request by e-mail to the address indicated above.
Availability of this Privacy Notice
This Privacy Notice is made available to the Supplier, and by it to its staff (if legal entity) by means of publication on the Data Controller's website.
The Supplier undertakes to make this notice available to all natural persons involved in the processing carried out by the Data Controller.
Personal Data Privacy Notice for “Clients”
pursuant to artt. 13 and 14 GDPR
Introduction
Personal Data shall be processed with respect to the applicable law and to the confidentiality and security obligations that inspire the business activity of the Data Controller.
Data Controller
The Data Controller is A.L.M.A.G. S.p.A., with legal seat in Roncadelle (BS), Via Vittorio Emanuele II, n. 39, VAT n. 03368970988, that can be contacted at the following addresses:
• by sending an email to privacy@almag.it;
• by ordinary mail at the registered office’s address.
Categories of data processed
The processed categories of personal data are:
• personal identification data of the Client natural person, or of the employees of the Client legal entity,
• personal professional contact data of the Client natural person, or of the employees of the Client legal entity,
• personal data related to the business ongoing with the Client.
Purposes, legal basis and retention periods
Purposes
(1) Execution of the operations necessary to process the preliminary information related to the conclusion of the contract
Legal Basis
Il trattamento è necessario per dare corso ad attività precontrattuali
Retention period
10 years from the conclusion of the contract (as set forth by art. 2220 of the Italian Civil Code). Nevertheless, as a guarantee for the Data Controller in the event of litigation or any control by the relevant Authorities, the retention period may be extended until the expiry of the last applicable prescriptive period.
Purposes
(2) Management of the relationship with Client and administration, orders and billing
Legal Basis
Il trattamento è necessario per adempiere gli obblighi derivanti dal contratto
Retention period
10 years from the conclusion of the contract (as set forth by art. 2220 of the Italian Civil Code). Nevertheless, as a guarantee for the Data Controller in the event of litigation or any control by the relevant Authorities, the retention period may be extended until the expiry of the last applicable prescriptive period.
Purposes
(3) Execution of the operations imposed by applicable law during the subscription process of the contract, among which the storage of the contract
Legal Basis
Il trattamento è necessario per l'adempimento di un obbligo legale al quale il Titolare è soggetto
Retention period
10 years from the conclusion of the contract (as set forth by art. 2220 of the Italian Civil Code). Nevertheless, as a guarantee for the Data Controller in the event of litigation or any control by the relevant Authorities, the retention period may be extended until the expiry of the last applicable prescriptive period.
Purposes
(4) Carrying out administrative, accounting, contractual and financial analyses and audits
Legal Basis
Il trattamento è necessario per il perseguimento del legittimo interesse del Titolare, consistente nel monitoraggio della qualità delle prestazioni erogate
Retention period
10 years from the conclusion of the contract (as set forth by art. 2220 of the Italian Civil Code). Nevertheless, as a guarantee for the Data Controller in the event of litigation or any control by the relevant Authorities, the retention period may be extended until the expiry of the last applicable prescriptive period.
Consequences of not submitting your data
Processing of the personal data described above is necessary to execute the indicated purposes, therefore not submitting such data implies the impossibility to perform the processing.
Categories of subjects who can process your personal data, scope of communication or dissemination
With respect to the obligations, activities and purposes stated above:
• personal data will be processed exclusively by employees and/or collaborators of the Data Controller, also through third parties appointed as Data Processors, in compliance with the provisions of the law also with regard to security measures to protect and safeguard the data:
• personal data will not be disseminated, except based on the data subject’s consent.
The list of Data Processors can be requested to the Data Controller.
The Data Controller may communicate and disseminate personal data for the sole purpose of executing legal obligations. Personal data may be disclosed in Italy and/or abroad to:
• public and private entities, also following inspections or verifications (for example Financial Administration, Tax Police Bodies, Judicial Authorities, Social Security Entities);
• subjects who can access the data under the provisions of law.
Cross-borders data transfers
Personal data shall be transferred, where foreseen by the technological tools used, to Third countries considered adequate by the EU Commission, or in any case to entities that have entered into Standard Contractual Clauses or other mechanisms of compliance for the extra-EEA transfer of personal data.
For further information you can always contact the Data Controller.
Data Subject rights
The Data Subject may, at any moment, exercise the rights provided by the EU Reg. 2016/679, and namely the rights to:
• access to their personal data;
• to obtain the rectification or cancellation of the same or the limitation of the processing that concerns them;
• to oppose to the processing activities;
• to the portability of their data;
• to revoke the consent, if allowed: the revocation of the consent does not affect the lawfulness of the processing activities based on the consent given before the revocation;
• to lodge a complaint with the supervisory authority. For Italy, the supervisory authority is the “Autorità Garante per la protezione dei dati personali” (www.gpdp.it).
The exercise of the aforementioned rights can take place by sending a request by e-mail to the address indicated above.
Availability of this Privacy Notice
This Privacy Notice is made available to the Client, and by it to its staff (if legal entity) by means of publication on the Data Controller's website.
The Client undertakes to make this notice available to all natural persons involved in the processing carried out by the Data Controller.