Mme/ Dear Sir,
We would like to inform you that the European Data Protection Regulation No. 2016/679 (“GDPR”) states that the entity that processes personal data is obliged to inform the data subject (i.e., the person to whom the data refers) regarding some qualifying elements of the processing, which has to be performed with correctness, lawfulness and transparency, protecting the confidentiality and rights of the data subjects themselves. In compliance with Art. 13 of aforesaid Regulation, we are relaying the following information.

1. Data Controller and Data Protection Officer
The Data Controller is CLIVET S.p.A., based in Villapaiera – Feltre (BL), Via Camp Lonc 25, TAX and VAT CODE 00708410253. For the purpose of the exercise of the rights provided by the Regulation and for any other request regarding your personal data, you may address the Data Controller, by sending a communication to the electronic mail address privacy@clivet.it or a registered letter (to the attention of the privacy contact) to Via Camp Lonc, n. 25 - 32032 Z.I. Villapaiera, Feltre (Belluno), Italy.
The Data Protection Officer appointed by the Data Controller can be contacted by e-mail at dpo@clivet.it.

2. Purposes and lawful basis of the processing
The data is gathered and processed: 
a) for the first operations of the CLIVET machines and for any aftersales repairs and assistance. The lawful basis is, as the case may be, that referred to in Art. 6 par. 1 letter b) (“the processing is necessary for the performance of a contract in which the data subject is a party or in order to take steps at the request of the data subject prior to entering into a contract”) or that referred to in letter c) of the same article  (“the processing is necessary for compliance with a legal obligation to which the controller is subject”) of the GDPR.
b) to carry out surveys of the interested party and/or administer questionnaires to detect the degree of customer satisfaction, in relation to the services and products of the Data Controller. The legal basis resides in the legitimate interest of the Data Controller referred to in Article 6(1)(f) of the GDPR, represented by the Data Controller's need to improve the level of service to the data subject and, in general, to its customers, as well as the need to improve the quality of the Data Controller's products.

3. Categories of data gathered and processing methods
The data gathered for the aforesaid purposes are common personal data such as: name, surname, address, telephone number, e-mail. These are processed, exclusively by processors authorised by CLIVET SPA, with automated and non-automated tools, and with methods that ensure the safety and confidentiality of the data. The personal data referred to in this circular letter is not processed through automated decision-making processes.

4. Nature of the provision of data and consequences of refusal
The provision of the data referred to in this information notice is necessary for the achievement of the purposes described above. The refusal to provide part or all of your personal data, will imply the impossibility on our part to perform the activities indicated under “purposes.”

5. Recipients of the data gathered
For the abovementioned purposes, the data may be disclosed or made accessible to:
a) Employees or collaborators of the Data Controller, the Authorised entity in charge of processing;
b) Companies that are part of the Midea Group, of which the Data Controller is part;
c) Third-party companies engaged in outsourcing activities on behalf of the Data Controller, or who process data on behalf of the Data Controller, in their capacity as Data Processors, also when this reveals to be necessary to fulfil an obligation provided by law, a regulation or Union norm.

6. Retention period
The personal data you furnish will be retained for the time necessary to fulfil the purposes referred to in point 2.
In particular, in compliance with the prescription terms provided in Italy, the data collected for the purpose referred to in letter a) of point 2 will be kept for a period of 10 years from the sale of the machine by Clivet or for from the date of the repair/service, except for interruptive events of the prescription itself.
The data collected for the purpose referred to in letter b) of point 2 will be kept for a period of 12 months. 
A longer data retention period may be determined by requests formulated by the Public Administration or another legal, governmental or regulatory Body or by the involvement of this company in law proceedings that entail the processing of the personal data you furnish.

7. Possible transfer of data to Third Countries
The data shall be prevalently processed in Italy or however within the European Union; however some processing activities could be performed in countries outside the EU/SEE Space. In such case, CLIVET S.p.A. ensures that the transfer of the data will be to Countries which the European Commission has retained to guarantee an adequate level of protection or after the stipulation of standard contract clauses approved by the Commission itself, in conformity with the provisions of Article 44 and subsequent amendments, of the GDPR.
Possible transfers from the parent company, Midea, to other companies of the group established outside the EU/SEE Space shall be performed adopting the same procedures and providing the guarantees provided by the GDPR. Any exceptions to the above may be performed only in compliance with Art. 49 of the GDPR.

8. Data subject’s rights and complaint to the Supervisory Authority
The data subject has the right to obtain from the Data Controller, access to the personal data. In particular, the data subject has the right to obtain: a) information on the origin of the personal data, the purposes and methods of the processing, the logic applied in case of processing performed with the use of electronic tools; b) the update or rectification; c) the erasure or restriction of the processing of his or her own data (transformation in anonymous form, blocking of data processed in breach of law, including those for which retention is not necessary in relation to the purposes for which the data was gathered or subsequently processed); d) the portability of the data processed in a structured manner. You also have the right to object to the processing of your personal data, which means that you can ask us to stop processing your personal data. This right is only recognised in special circumstances (Article 21 GDPR) and, in particular, where the legal basis for processing is the legitimate interest of the Data Controller. The data subject is entitled to lodge a complaint to the Data Protection Authority, represented in Italy by the Italian Personal Data Protection Authority, based in Rome, Piazza Monte Citorio, 121.

9. Changes and updates to this Policy
This Policy was last amended on 5 May 2021 and replaces previous versions. We may change this Policy from time to time and we will notify you of any changes by posting this revised document on our websites, informing you by email or through our applications before these changes become effective.