POLITYKA PRYWATNOSCI I PLIKOW COOKIE

Industrie Cartarie Tronchetti S.p.A. (also referred to as "we", "us" or "our") pays the utmost attention to the respect and protection of your privacy. Below, we provide the information relating to the processing of personal data of users (hereinafter "Users") who interact with the website www.ictgroup.net ("Site") of Industrie Cartarie Tronchetti S.p.A, and to the processing of cookies collected through browsing.

The information in this Privacy Policy, therefore, relates exclusively to the possible processing of Users' personal data while browsing the Site.

1. Data Controller. The ICT group is made up of different legal entities: Industrie Cartarie Tronchetti S.p.A., ICT Deutschland GmbH, ICT France S.A.S., Industrie Cartarie Tronchetti Ibérica S.L.U., ICT Poland Sp.z.o.o. and Industrie Cartarie Tronchetti UK Limited. The Data Controller of the personal data relating to Users of the Site is Industrie Cartarie Tronchetti S.p.A, with registered office in Piano della Rocca, 55023 Borgo a Mozzano (LU) Italy.

If you have any questions about this Privacy Policy or our privacy practices, please contact us via post at Piano della Rocca, 55023 Borgo a Mozzano (LU) Italy or via email at privacy@ictit.eu

2. Types of data processed.
◦ Recruitment Data: where Users apply for a role within the ICT group on the “Application” page of our Site, the information Users provide to us in their CV and any covering letter or notes, and any other information Users provide via the “Application” page of our Site, which may include their name, address, personal email address, date of birth, languages, education and qualifications.
◦ Download Area Data: where Users wish to access certain financial information about their business via the “Download Area” of our Site, the name of the User’s company, their role within their company, the User’s email address and the User’s password.
◦ Browsing Data: the computer systems and software procedures used to operate this Site acquire, during their normal performance, some personal data whose transmission is implicit in the communication protocols of the Internet. This information is not collected with the intention of associating it with identified data subjects. However, by its nature, it could allow Users to be identified through processing and association with data held by third parties. This category of data includes the IP addresses or domain names of the computers used by the Users who connect to the Site, the URI (Uniform Resource Identifier) addresses of the requested resources, the time of the request, the method used to submit the request to the server, the size of the file obtained in response, the numeric code indicating the status of the response given by the server (e.g. successful, error, etc.), and other parameters relating to the operating system and the IT environment of the User.
◦ Voluntary Data: any personal data which Users (at their option) explicitly and voluntarily send to us via any page of the Site (e.g. User's name, surname and contact details).

We also collect, use and share aggregated data such as statistical or demographic data for any purpose (“Aggregated Data”). Aggregated Data could be derived from User personal data but is not considered personal data in law as this data will not directly or indirectly reveal Users’ identities. For example, we may aggregate Users’ Browsing Data to calculate the percentage of Users accessing a specific Site feature. However, if we combine or connect Aggregated Data with User personal data so that it can directly or indirectly identify Users, we treat the combined data as personal data which will be used in accordance with this Privacy Policy.

If Users do not provide us with their personal data or provide personal data in an incomplete or incorrect way, we may not be able to perform the contract we have or are trying to enter into with a User (for example, to provide a User with goods or services). In this case, we may have to cancel a product or service Users have with us but we will notify Users if this is the case at the time.

It is important that the personal data we hold about you is accurate and current. Please keep us informed if your personal data changes during your relationship with us.

3. How data is collected. We use different methods to collect data from and about Users, including through direct interactions (e.g. where Users fill in forms on our Site), automated technologies or interactions (e.g. as Users interact with our Site) and third parties (e.g. referees of Users who have applied for jobs via our Site).

4. How we use data. We will only use your personal data when the law allows us to. Most commonly, we will use your personal data in the following circumstances:
◦ Where we need to perform the contract we are about to enter into or have entered into with you.
◦ Where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests.
◦ Where we need to comply with a legal obligation.

Generally, your consent is not required to process your data since we rely on one of the above lawful bases for processing instead.

5. Purposes of data processing. We have set out below a description of all the ways we plan to use your personal data, and which of the lawful bases we rely on to do so. We have also identified what our legitimate interests are where appropriate. Please note that we may process your personal data for more than one lawful ground depending on the specific purpose for which we are using your data.

Type of Data	Lawful Bases	Purpose Activity
Recruitment Data	Our legitimate interests (i.e. to select and recruit new employees and to decide whether to appoint you to work for us (which may include shortlisting you for a role, calling you to interview and/or deciding to offer you a role within our business)); Our need to decide whether to enter into a contract of employment with you; If you are successful in your application, our need to take steps to enter into a contract of employment with you.	For a full list of the uses we make of your Recruitment Data, please see our Privacy Notice in the application area.
Download Area Data	Performance of a contract with you.	To provide you with access to certain financial information about your company.
Browsing Data	Necessary for our legitimate interests (to define types of customers for our products and services, to keep our Site updated and relevant, to develop our business and to inform our marketing strategy); Necessary for our legitimate interests (to study how customers use our products/services, to develop them, to grow our business and to inform our marketing strategy); Necessary for our legitimate interests (for running our business, provision of administration and IT services, network security, to prevent fraud and in the context of a business re-organisation or group restructuring exercise); Necessary to comply with a legal obligation.	To use data analytics to improve our Site, products/services, marketing, customer relationships and experiences; To deliver relevant Site content to you and measure or understand the effectiveness of the content we provide to you; To administer and protect our business and our Site (including troubleshooting, data analysis, testing, system maintenance, support, reporting and hosting of data) To obtain anonymous statistical information on the use of the Site; To check the correct functioning of the Site and to improve the browsing experience of Users; To ascertain responsibility in case of hypothetical computer crimes against the Site.
Voluntary Data	Performance of a contract with you; Necessary for our legitimate interests (for running our business).	To respond to any requests from Users.

We will only use User personal data for the purposes for which we collected it. However, we may process User personal data without your knowledge or consent, in compliance with the above rules, where this is required or permitted by law.

6. Data storage period. We will only retain your personal data for the time reasonably necessary to achieve the purposes for which the data were collected and, in any case, in compliance with the relevant regulations in force.

To determine the appropriate retention period for personal data, we consider the amount, nature and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal, regulatory, tax, accounting or other requirements. Details of retention periods for different aspects of your personal data are available upon request.

In some circumstances we will anonymize your personal data (so that it can no longer be associated with you) for research or statistical purposes, in which case we may use this information indefinitely without further notice to you.

7. Data security. Industrie Cartarie Tronchetti S.p.A. observes specific security measures to protect the confidentiality, integrity and availability of personal data and prevent its loss and unauthorised use. In addition, we limit access to your personal data to those of our employees, agents, contractors and other third parties on a “need-to-know” basis. They will only process your personal data on our instructions and they are subject to a duty of confidentiality. We have put in place procedures to deal with any suspected data security breaches and will notify you and any applicable regulator of a suspected breach where we are legally required to do so.

8. Data Disclosures & International Transfers. The personal data we process under this Privacy Policy may be shared with data processors pursuant to Art. 28 of Regulation, by employees on a need-to-know basis and entities or authorities, to whom it is compulsory to communicate such personal data pursuant to the provisions of law.

We will share your personal data with third parties where required by law, where it is necessary to administer the working relationship with you or where we have another legitimate interest in doing so.

Your personal data may be shared with other members of the ICT group, as listed in Section 1 of this Privacy Policy. Your personal data may also be shared with external companies, which will collaborate with us in order to fulfil those purposes set out in Section 5 of this Privacy Policy. Such external companies may include:
◦ companies that provide IT, system administration and/or information management services to us;
◦ companies that provide professional advice to us, such as lawyers, accountants or business immigration experts;
◦ companies that provide services for the management of our website;
◦ companies that provide recruiting and selection services to us.

For more details on the data processors we use, please contact us using the details set out above.

We share your personal data within our group - this involves transferring your data to the UK and the EU.

Some of the external third parties with whom we share your personal data are based in the UK and/or in the EU, so their processing of your personal data may involve a transfer of data from: (a) the EU to the UK and/or (b) from the UK to the EU.

We will only transfer your personal data to countries that have been deemed to provide an adequate level of protection for personal data (i.e. the UK and countries within the EU).

9. Cookies - definition. Cookies are small text strings that a website (such as our Site), when visited by a User, sends to the browser of the User's terminal, where they are stored to then be re-transmitted to the same websites the next time the User visits them. While browsing a website, the User can also receive cookies on his/her terminal that are sent from different sites or web servers (so-called "third parties"), on which some elements may reside (such as, for example, images, maps, sounds, specific links to pages of other domains) present on the site that the User is visiting.

10. The cookies installed on our Site:
◦ Strictly necessary cookies: which guarantee normal browsing and use of the Site, allowing, for example, to authenticate access restricted areas;
◦ Technical cookies: which can be divided into browsing or session cookies and which allow Users to be remembered during his/her browsing of the Site;
◦ Analytics cookies: similar to technical cookies, which are used directly by the Site manager to collect information, in aggregate form, on the number of Users and how they visit the Site;
◦ Functionality cookies: which allow the User to browse according to a series of selected criteria (for example, the language) in order to improve the service provided.

You can provide your consent to the use of all cookies other than strictly necessary cookies by accepting the use of such cookies via the information banner on cookies. You can find more information about the individual cookies we use and what they are for in the table below:

Type of Cookie	Provider	Technical name	Purpose	Expiration time
Third-party analytics, technical	Google LLC	_ga	Registers a unique ID for a website visitor it tracks how the visitor uses the website. The data is used for statistics	2 years
Third-party analytics, technical	Google LLC	_gid	Registers a unique ID for a website visitor it tracks how the visitor uses the website. The data is used for statistics	A day
Third-party analytics, technical	Google LLC	_gat	Set by Google Analytics to control the request rate	A minute
Functionality cookie	Pimcore	PHPSESSID	To provide functions across pages	Session

11. Social network plug-in cookie links. Industrie Cartarie Tronchetti S.p.A. informs you that social network cookies are not present on the Site and are not sent by the Site to the User's terminal. These cookies, which are not essential for browsing purposes, are activated only when the relative web page is accessed, by clicking on the related icons, or by entering the respective social websites. For more details and to disable their being stored on the User's terminal, please refer to the following: LinkedIn, YouTube

12. Your rights. Pursuant to the GDPR, you have the right at any time to:
◦ request access to your personal data. This is commonly known as a “data subject access request” and enables you to receive a copy of the personal information we hold about you and to check that we are lawfully processing it;
◦ request the rectification of any errors in the personal data that we hold about you. This enables you to have any incomplete or inaccurate information we hold about you corrected;
◦ request the erasure of your personal data. This enables you to ask us to delete or remove personal data where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal data where you have exercised your right to object to processing (see below);
◦ request the restriction of processing of your personal data. This enables you to ask us to suspend the processing of personal data about you, for example if you want us to establish its accuracy or the reason for processing it;
◦ to object to processing of your personal data where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground. You also have the right to object where we are processing your personal data for direct marketing purposes; and
◦ request the transfer of your personal information to another party. This is commonly known as the right to data portability.

We may need to request specific information from you to help us confirm your identity and ensure your right to access the information (or to exercise any of your other rights listed above).

In the limited circumstances where you may have provided your consent to the processing of your personal data for a specific purpose, you have the right to withdraw your consent at any time by contacting us using the contact details set out in Section 1 of this Privacy Notice.

You can also lodge a complaint with the Italian Data Protection Authority (however, we would appreciate the chance to deal with your concerns before you approach the Italian Data Protection Authority so please contact us in the first instance by e-mail at the following address: privacy@ictit.eu).

This Privacy Policy was last updated on 15th December 2021