Privacy Information Notice pursuant to art. 13 of EU Regulation 2016/679 Web Site PERFORMANCE iN LIGHTING S.p.A.

THE REASON FOR THIS INFORMATION NOTICE
In compliance with the provisions of art. 13 of EU Regulation 2016/679 (hereinafter referred to as "EU Regulation" or “GDPR”), concerning the protection of individuals with regard to the processing of personal data, as well as the free movement of such data, this Information Notice is provided to users of the https Site:: https://www.performanceinlighting.com/  (hereinafter, the "Site").
It is understood that PERFORMANCE iN LIGHTING S.p.A. makes available further detailed information notice for specific situations.

IDENTITY OF THE DATA CONTROLLER AND DATA PROTECTION OFFICER
Pursuant to art. 4, n.7 of EU Regulation, PERFORMANCE iN LIGHTING S.p.A.., tax code and VAT number IT08517220011, with registered offices in Via Domenico Bosatelli, 1 - 24069 Cenate Sotto (BG) – Italy, is the Data Controller of data (hereinafter referred to as the “Data Controller”). PERFORMANCE iN LIGHTING S.p.A. has appointed a Data Protection Officer (DPO), that may be contacted at the following email address:  dpo@pec.pil.lighting. 

TYPES OF DATA PROCESSED
For the pursuit of the purposes indicated below, the Data Controller, depending on the cases and if necessary, will process personal data belonging to the following categories:

• Common personal data such as personal and contact data; in addition, the same may concern information collected by the Controller through the forms on the Site ("Request information", "Work with us" and "Newsletter");

• Navigation data (common personal data), data belonging to this category are collected through cookies. For detailed information about the cookies please referred to the Cookie Policy.

PURPOSE OF PROCESSING AND RETENTION PERIOD
The purposes of the processing are as follows:

1 - Purposes for the protection of a legitimate interest of the Data Controller (Art. 6 par. 1, lett. f GDPR):

• a) Ensure the proper functioning of the WebSite;
• b) Prevent or discover fraudulent activities or abuses that are harmful to the Website.
  The data processed for the purposes referred to in points a) and b) will be stored according to the provisions of the  Cookie Policy
• c) Respond to requests for information using the form in the "Request information" section of the Site
  The data processed for the purpose of point c) will be kept for 1 month.

If, in the event of litigation, it is necessary to ascertain, exercise or defend the rights of the Data Controller, the retention period of the Data collected, for the above purposes, may be extended due to the possibility that in that time frame it may be necessary to prepare defensive elements. In that case, the retention of said Data will take place exclusively until the conclusion of the litigation. 

2 - Purposes based on the data subject’s consent (Art. 6 par. 1 lett. a GDPR)

• d) Send communications relating to the services and goods offered by the Data Controller that may be of interest to you (newsletter).
  The data processed for the purpose referred to in point d) will be kept for 24 months.

3 - Purposes based on a contract or pre-contractual measures taken at the request of the data subject (Art. 6 par. 1, lett. b GDPR):

• e) Manage the applications received through the form in the "Work with us" section of the Site.
  The data processed for the above purpose will be stored for a period of 24 months.

LEGAL BASES FOR PROCESSING
The processing of personal data referred to above is based on the following legal bases

• for the purposes referred to in point 1 letter. a), b) and c), the legal basis is the Data Controller’s legitimate interest (Art. 6 para. 1 letter. f of the GDPR);
• for the purpose indicated in point 2 letter d), the legal basis is the consent of the data subject (Art. 6 para. 1 letter. a of the GDPR);
• for the purpose of point 3 letter e), the legal basis are the pre-contractual measures taken at the request of the data subject (Art. 6 par. 1 letter b of the GDPR).

CATEGORIES OF RECIPIENTS
The Data collected by the Controller, within the scope of the purposes mentioned above, may be communicated to one or more of the categories of subjects indicated below, which will process personal data as Data Processors pursuant to art. 28 of the GDPR or as autonomous Data Controllers, such as:

• third parties (for example, external employees and companies that provide specific instrumental services) who carry out activities in outsourcing for the Data Controller;
• hosting service providers;
• entities that perform management activities of the Data Controller’s computer system
• judicial authorities and those subjects to which disclosure is required by law.

The complete and updated list of recipients (ex art. 4 n. 9 of the GDPR), can be requested at the offices of the Data Controller or by writing to the e-mail address: dpo@pec.pil.lighting. 

TRANSFER OF DATA OUTSIDE THE EEA
The processing of personal data will take place within and/or outside the European Economic Area.In particular, the Data Controller will transfer personal data to the following countries outside the European Economic Area:

• United Kingdom. Country for which the European Commission has adopted an adequacy decision pursuant to art. 45 of the GDPR and therefore provides the same level of protection as provided by the GDPR or applicable legislation.

• United States of America. Country for which, on 10 July 2023, the European Commission adopted an adequacy decision pursuant to art. 45 of the GDPR (hereinafter, the "Data Privacy Framework"), to which US companies importing personal data of European data subjects can adhere by self-certification. In this context, the transfer of personal data to US recipients who have adhered to the Data Privacy Framework takes place on the basis of such an adequacy decision (art. 45 of the GDPR). If, on the other hand, the US recipient has not adhered to the Data Privacy Framework, the Controller ensures that this entity assumes specific contractual obligations in accordance with the applicable laws regarding the protection of personal data (including the signing of standard contractual clauses approved by the European Commission, pursuant to art. 46 of the GDPR).

  In any case, the data subject may always request more information, including the countries receiving the personal data, by writing to the e-mail address privacy.it@pil.lighting.
  For details of transfers through cookie you can consult the  Cookie Policy.

METHODS OF PROCESSING
Personal data will be processed both on paper and electronically and/or automated. Collection, registration, organisation, storage, consultation, processing, modification, extraction, comparison, use, interconnection, communication, cancellation and destruction and any other appropriate operation may be carried out, including automated data, in compliance with the legal provisions necessary to ensure, inter alia, the confidentiality and security of the data and the accuracy, updating and relevance of the data to the declared purposes.

RIGHTS OF THE DATA SUBJECT
The data subject, in relation to the personal data provided, has the right to exercise at any time and according to the provisions of the EU Regulation the rights established by the latter and the following:

• Right to withdraw consent (art. 7, par. 3, of the EU Regulation): right to revoke the consent given. The withdrawal of consent does not affect the lawfulness of the processing based on consent before the revocation;
• Right of access of the interested party (art. 15 of the EU Regulation): right to obtain confirmation of the existence or not of personal data relating to him and their copy in an intelligible form;
• Right of rectification (Art. 16 of the EU Regulation): right to rectification of inaccurate personal data concerning him;
• Right to erasure "right to be forgotten" (art. 17 of the EU Regulation): right to erasure of your data;
• Right to restriction of processing (Art. 18 of the EU Regulation): right to obtain the restriction of processing, for example, in case of dispute of the accuracy of the data or in case of unlawful processing;
• Right to data portability (Art. 20 of the EU Regulation): right to receive in a structured format, of common use and readable by automatic device the personal data concerning him provided to the Data Controller and the right to transmit such data to another Data Controller without hindrance if the processing is carried out on the basis of a consent or a is contracted and carried out by automated means;
• Right to object (Art. 21 of the EU Regulation): right to object to the processing of your personal data;
• Right not to be subjected to automated decision-making processes (Art. 22 of the EU Regulation): right not to be subject to a decision based solely on automated processing.

Requests should be sent to the following e-mail address: privacy.it@pil.lighting.
Please note that the Data Controller undertakes to respond to your requests within one month, except in the case of requests of particular complexity, for which a maximum of 3 months may be required. In any case, the Data Controller will explain the reason for the wait within one month of your request.
The outcome of the request will be provided in writing (at the request of the interested party) or in electronic format (and, in this case, free of charge).
The Data Controller specifies that the data subject may be asked for any contribution if his requests are manifestly unfounded, excessive or repetitive: in this regard the Data Controller will keep track of the requests. Data Controller, in compliance with art. 19 of the EU Regulation, undertakes to report to the recipients to whom the personal data of the data subject have been disclosed any corrections, cancellations or restrictions of processing requested by the data subject, where this is possible.

RIGHT TO LODGE A COMPLAINT (ART. 77 OF THE EU REGULATION)
If the data subject considers that his or her rights have been compromised or damaged, or that the processing of his or her data is contrary to current legislation, has the right to lodge a complaint with the Data Protection Authority in the manner indicated by the same link

NATURE OF DATA PROVISION
The provision of data for the purposes referred to in point 1 letter a) and b), is necessary; failure to provide will make it impossible to navigate the website and ensure the security of the same.
Regarding the provision of data for the purpose referred to in point 1 letter c), is necessary; the failure to provide will not allow a proper management of requests received by the data subject.
Regarding the provision of data for the purpose referred to in point 3 lett. e), is necessary; the failure to provide will not allow a proper management of the application made by the interested party for a job position with the Data Controller.
For the purpose of point 2 letter d), the provision of data by the interested party is optional; failure to provide data by the interested party will make it impossible to receive communications about services offered by the Controller that may be of interest to them.

AMENDMENTS AND UPDATES
The Data Controller may make changes and/or additions to this information also as a consequence of any subsequent amendments and/or regulatory additions. In such cases, the new version of this information will be communicated as soon as possible in a way that reaches the parties concerned as quickly as possible.