INFORMATION ON THE PROCESSING OF PERSONAL DATA
pursuant to art. 13, Regulation (EU) 2016/679 (General Data Protection Regulation – GDPR)
1. GENERAL INFORMATION
In compliance with the provisions of Articles 12 and 13 of Regulation (EU) 2016/679 (General Data Protection Regulation – “ GDPR ”), this page describes the processing of personal data carried out by Costa Eugenio Srl, with registered office in Parma (PR), Via Paradigna, 129 – 43122 , tax code and VAT number IT 00147930341 (hereinafter, “ Company ” or “ Data Controller ”) towards the data subjects involved in the processing listed below (“ data subjects ”).
This website’s privacy policy does not apply to other data processing operations performed following navigation of websites accessed through links that may be present within it.
The Data Controller guarantees that all processing activities relating to personal data will be carried out in accordance with the principles of lawfulness, transparency, and fairness, purpose limitation and data retention, data minimization, accuracy, integrity, and confidentiality.
2. TYPES OF TREATMENT
2.1. DATA FOR CONTACT REQUEST
The management of contact requests using the contact details indicated on this website ( https://www.thermoking.it/contatti/ ) may involve the acquisition of the interested party/user’s personal data.
| Purpose of the processing (art.13, par. 1, letter c), of the GDPR) | The personal data collected is used exclusively to respond to requests submitted and to communicate with the interested party in any subsequent phases. Providing some data may be mandatory and will be indicated by asterisks. |
| Categories of personal data |
|
| Lawfulness of processing (art.13, par. 1, letter c), of the GDPR) | Processing is carried out in order to perform an activity requested by the data subject (Article 6, paragraph 1, letter b), of the GDPR). |
| Scope of communication (art.13, par. 1, letter e) and f), of the GDPR) | The data is processed exclusively by authorized personnel, trained and adequately qualified. It may also be processed by other parties engaged by the Data Controller for purposes related to the processing itself (support for website management; consulting firms): these parties act as data processors and have signed specific agreements with the Data Controller pursuant to Art. 28, paragraph 3, GDPR. In any case, the personal data collected will not be disclosed to third parties, or disseminated or transferred outside the European Union/European Economic Area. |
| Treatment methods (Recital 39, GDPR) | Personal data is processed lawfully, fairly, and transparently, in compliance with the principles set forth in current legislation. Processing is carried out using electronic and paper-based tools. Taking into account the nature and characteristics of the processing, the Data Controller has adopted technical and organizational security measures aimed at limiting or excluding the risks of data loss, possible illicit or incorrect use, or unauthorized access. |
| Data retention period (art.13, par. 2, letter a), of the GDPR) | The data is stored for the time strictly necessary to manage the relationship with the applicant. |
| Nature of the transfer (art.13, par. 2, letter e), of the GDPR) | Data is provided voluntarily by interested parties. However, failure to provide it may affect the processing of the request and the sending of a response. |
2.2. DATA TO REQUEST CREDENTIALS TO ACCESS THE RESERVED AREA
The management of requests for credentials to the references indicated on this website ( https://www.thermoking.it/area-riservata/ ) may involve the acquisition of personal data of the interested party/user.
| Purpose of the processing (art.13, par. 1, letter c), of the GDPR) | The personal data collected is used exclusively to provide the required credentials to access the reserved area. Providing some data may be mandatory and will be indicated by asterisks. |
| Categories of personal data |
|
| Lawfulness of processing (art.13, par. 1, letter c), of the GDPR) | Processing is carried out in order to perform an activity requested by the data subject (Article 6, paragraph 1, letter b), of the GDPR). |
| Scope of communication (art.13, par. 1, letter e) and f), of the GDPR) | The data is processed exclusively by authorized personnel, trained and adequately qualified. It may also be processed by other parties engaged by the Data Controller for purposes related to the processing itself (support for website management; consulting firms): these parties act as data processors and have signed specific agreements with the Data Controller pursuant to Art. 28, paragraph 3, GDPR. In any case, the personal data collected will not be disclosed to third parties, or disseminated or transferred outside the European Union/European Economic Area. |
| Treatment methods (Recital 39, GDPR) | I dati personali sono trattati in modo lecito, corretto e trasparente, nel rispetto dei principi previsti dalla normativa vigente. Il relativo trattamento avviene attraverso strumenti informatici e cartacei. Tenuto conto della natura e delle caratteristiche del trattamento, il Titolare del trattamento ha adottato misure tecniche e organizzative di sicurezza finalizzate a limitare o escludere i rischi di perdita dei dati, di eventuale uso illecito o non corretto, o di accesso non autorizzato. |
| Data retention period (art.13, par. 2, letter a), of the GDPR) | The data is stored for the time strictly necessary to manage the relationship with the applicant. |
| Nature of the transfer (art.13, par. 2, letter e), of the GDPR) | Data is provided voluntarily by interested parties. However, failure to provide it may affect the processing of the request and the sending of a response. |
2.3. DATA RELATING TO APPLICATIONS
Personal data contained in CVs sent to specific addresses indicated on this site ( https://www.thermoking.it/lavora-con-noi ) and entered in the appropriate data collection box are processed for purposes related to personnel search and selection.
| Purpose of the processing (art.13, par. 1, letter c), of the GDPR) | The personal data contained in CVs are processed for purposes related to the search and selection of personnel by the Data Controller. |
| Categories of personal data |
|
| Lawfulness of processing (art.13, par. 1, letter c), of the GDPR) | Personal data are processed for the implementation of pre-contractual measures taken at the request of the data subject (Article 6, paragraph 1, letter b), of the GDPR). |
| Scope of communication (art.13, par. 1, letter e) and f), of the GDPR) | The data is processed exclusively by authorized personnel, trained in data processing, and adequately trained. It may also be processed by other parties engaged by the Data Controller for purposes related to the processing itself (consulting firms, employment agencies, and companies that support the Data Controller in managing the website or information system). In some cases, these parties act as data processors and have signed specific agreements with the Data Controller pursuant to Art. 28, paragraph 3, GDPR. In any case, the personal data collected will not be disclosed to third parties, or disseminated or transferred outside the European Union/European Economic Area. |
| Treatment methods (Recital 39, GDPR) | Personal data is processed lawfully, fairly, and transparently, in compliance with the principles set forth in current legislation. Processing is carried out using electronic and paper-based tools. Taking into account the nature and characteristics of the processing, the Data Controller has adopted technical and organizational security measures aimed at limiting or excluding the risks of data loss, possible illicit or incorrect use, or unauthorized access. |
| Data retention period (art.13, par. 2, letter a), of the GDPR) | Personal data is retained for the time necessary to evaluate applications, and for a maximum of 24 months. |
| Natura del conferimento (art.13, par. 2, lett. e), del GDPR) | Il conferimento dei dati personali è facoltativo; tuttavia, il loro mancato conferimento può comportare l’impossibilità di effettuare una corretta valutazione del candidato ai fini della selezione, e, conseguentemente, di gestire la candidatura. |
2.4. CUSTOMERS AND SUPPLIERS AND THEIR CONTACTS
In carrying out activities related to contractual relationships with customers and suppliers, personal data of such parties (and/or their representatives/contacts) may be processed.
| Purpose of the processing (art.13, par. 1, letter c), of the GDPR) | The data is processed for the purpose of:
|
| Categories of personal data |
|
| Lawfulness of processing (art.13, par. 1, letter c), of the GDPR) | Processing for these purposes is carried out on the basis of various lawfulness conditions: for the fulfillment of contracts or pre-contractual measures (Article 6, paragraph 1, letter b), of the GDPR); for the fulfillment of legal obligations (Article 6, paragraph 1, letter c), of the GDPR); for the pursuit of the legitimate interests of the Data Controller (e.g., the exercise or defense of legal claims in or out of court) (Article 6, paragraph 1, letter f), of the GDPR). |
| Scope of communication (art.13, par. 1, letter e) and f), of the GDPR) | The data is processed exclusively by authorized personnel who have been properly trained and instructed in data processing. It may also be processed by other parties engaged by the Data Controller for purposes related to the processing itself (e.g., tax consultants; law firms; public bodies and competent authorities; etc.). In some cases, these parties act as data processors and have signed specific agreements with the Data Controller pursuant to Art. 28, paragraph 3, GDPR. In specific cases (e.g., investigations and assessments), personal data may be made available to the competent authorities. In any case, personal data will not be disclosed to third parties, or disseminated or transferred outside the European Union/European Economic Area. |
| Treatment methods (Recital 39, GDPR) | Personal data is processed lawfully, fairly, and transparently, in compliance with the principles set forth in current legislation. Processing is carried out using electronic and paper-based tools. Taking into account the nature and characteristics of the processing, the Data Controller has adopted technical and organizational security measures aimed at limiting or excluding the risks of data loss, possible illicit or incorrect use, or unauthorized access. |
| Data retention period (art.13, par. 2, letter a), of the GDPR) | The data is retained for the time strictly necessary to fulfill contractual or regulatory obligations. |
| Nature of the transfer (art.13, par. 2, letter e), of the GDPR) | The provision of data is mandatory for the fulfillment of the purposes described above. |
2.5. WEBSITE NAVIGATION
The computer systems and software procedures used to operate this website acquire, during their normal operation, some personal data whose transmission is implicit in the use of internet communication protocols. This category of data includes the IP addresses or domain names of the computers used by users connecting to the site, the URI (Uniform Resource Identifier) addresses of the requested resources, the time of the request, the method used to submit the request to the server, the size of the file obtained in response, the numerical code indicating the status of the response from the server (successful, error, etc.), and other parameters relating to the user’s operating system and computer environment.
| Purpose of the processing (art.13, par. 1, letter c), of the GDPR) | This data is used solely to obtain statistical information on the use of the site and to monitor its proper functioning. The data may also be used to determine liability in the event of hypothetical cybercrimes against the site (legitimate interests of the owner). |
| Lawfulness of processing (art.13, par. 1, letter c), of the GDPR) | Processing is necessary for the pursuit of the Data Controller’s legitimate interests in the security of its information system and in evaluating the use and functioning of the website (Article 6, paragraph 1, letter f), of the GDPR). |
| Scope of communication (art.13, par. 1, letter e) and f), of the GDPR) | The data is processed exclusively by authorized personnel who have been properly trained and instructed in data processing. It may also be processed by other parties engaged by the Data Controller for purposes related to the processing itself (e.g., support for the management of information systems; this website). In some cases, these parties act as data processors and have signed specific agreements with the Data Controller pursuant to Art. 28, paragraph 3, GDPR. The data may be disclosed to the competent authorities in specific cases. In any case, personal data will not be disclosed to third parties, or disseminated or transferred outside the European Union/European Economic Area. |
| Treatment methods (Recital 39, GDPR) | Personal data is processed lawfully, fairly, and transparently, in compliance with the principles set forth in current legislation. Processing is carried out using computerized and automated tools. Taking into account the nature and characteristics of the processing, the Data Controller has adopted technical and organizational security measures aimed at limiting or excluding the risks of data loss, possible illicit or incorrect use, or unauthorized access. |
| Data retention period (art.13, par. 2, letter a), of the GDPR) | Data is generally retained for the purposes indicated above, for short periods of time, except for any extensions related to investigative activities. |
| Nature of the transfer (art.13, par. 2, letter e), of the GDPR) | The provision of data is implicit in accessing and browsing the website. |
2.6. COOKIES
For more general information on cookies and how to enable and disable them, please visit: https://www.thermoking.it/cookie-policy/
3. RIGHTS OF THE INTERESTED PARTY
Under the conditions set forth by current legislation, the interested party may exercise the following rights by contacting privacy@thermoking.it :
- access to personal data (Article 15 of the GDPR), which allows you to obtain confirmation as to whether or not personal data concerning you is being processed and, where that is the case, to obtain access to that data;
- the rectification of personal data (Article 16 of the GDPR), which allows you to obtain the rectification and/or integration of personal data that are inaccurate or incomplete;
- the erasure of personal data (Article 17 of the GDPR), which allows, where the legal requirements exist, to obtain the erasure of personal data;
- restriction of processing (Article 18 of the GDPR), which allows, in specific cases, the restriction of the processing of personal data;
- data portability ( Article 20 of the GDPR), which allows, in certain cases and with respect only to the data provided by the data subject, the recipient to receive personal data in a structured, commonly used, and machine-readable format;
- Objection (Article 21 of the GDPR), which allows the data subject to object at any time, for reasons related to his or her particular situation, to the processing of personal data carried out by the Data Controllers for the pursuit of their legitimate interests.
If you believe that the processing of your personal data violates the GDPR, you have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali) in accordance with the procedures established by that authority, or to take appropriate legal action.
This policy is updated as of May 21, 2026.
Privacy Policy of this website
Information on the processing of personal data (Article 13 of the GDPR 2016/679)
WHY THIS NOTICE
This page describes how the personal data of users of the website are processed.
This is an information that is provided pursuant to art. 13 of EU Regulation 2016/679 to those who interact with web services though the link:
https://www.thermoking.it/ The information is provided only for Costa Eugenio S.r.l. website, and no other websites that may be consulted by the user via link.
HOLDER OF THE TREATMENT
Following consultation of this website, data relating to identified or identifiable persons may be processed. The Data Controller is Costa Eugenio S.r.l. with registered office in Via via Paradigna, 129 – Fraction: Cortile S. Martino 43122 (PR), in the person of the Legal Representative.
DATA PROTECTION MANAGER:
The person in charge of data protection (DPO) has not been identified as the writer does not process data of natural persons falling within the definition of art. 37 European Regulation GDPR 2016/679.
PURPOSE OF DATA PROCESSING
The treatments connected to the web services of this are only handled by technical personnel, or by any authorized persons for occasional maintenance operations.
The personal data provided by users who submit requests to join the services offered are used only to perform the service or provision requested, and are disclosed to third parties only if this is necessary for this purpose.
METHOD OF TREATMENT
Personal data are processed with automated tools for the time strictly necessary to achieve the purposes for which they were collected.
Specific security measures are observed to prevent data loss, illicit or incorrect use and unauthorized access.
PROVISION AND OPTIONAL PROVISION OF DATA
Apart from what is specified for navigation data, the user is free to provide personal data contained in the IT forms (form) requesting the Data Controller to access the services offered.
Failure to provide them may make it impossible to obtain what is requested.
COMMUNICATION OF DATA
DISCLOSURE OF DATA
The personal data processed, in any way, will be brought to the attention of indeterminate subjects.
TRANSFER ABROAD
The personal data processed will not be transferred abroad.
TYPES OF DATA PROCESSED
NAVIGATION DATA
The computer systems and software procedures used to operate this website acquire, during their normal operation, some personal data whose transmission is implicit in the use of Internet communication protocols. This is information that is not collected to be associated with identified interested parties, but which by their very nature could, through processing and association with data held by third parties, allow users to be identified. This category of data includes IP addresses or domain names of the computers used by users who connect to the site, the URI (Uniform Resource Identifier) addresses of the requested resources, the time of the request, the method used to submit the request to the server, the size of the file obtained in response, the numerical code indicating the status of the response given by the server (successful, error, etc.) and other parameters relating to the operating system and the user’s IT environment. These data are used for the sole purpose of obtaining anonymous statistical information on the use of the site and to check its correct functioning and are deleted immediately after processing. The data could be used to ascertain responsibility in the event of hypothetical computer crimes against the site.
DATA PROVIDED VOLUNTARILY BY THE USER
The optional, explicit and voluntary sending of e-mails or other data through the forms on this site, or through any addresses indicated on this site entails the subsequent acquisition of the sender’s address, necessary to respond to requests, as well as any other personal data included in the message.
Specific summary information will be progressively reported or displayed on the pages of the site set up for particular services on request.
COOKIES
The description of the type of cookies used, their management of use and purpose, is referred to the paragraph “Cookie Policy” in the document published on this website.
DATA RETENTION PERIOD
Personal data are processed with automated tools for the time strictly necessary to achieve the purposes for which they were collected.
RIGHTS OF THE INTERESTED PARTY (GDPR articles 15-22)
At any time, the interested party may exercise the right to:
- ask for confirmation of the existence or otherwise of their personal data.
- obtain information about the purposes of the processing, the categories of personal data, the recipients or categories of recipients to whom the personal data have been or will be communicated and, when possible, the retention period.
- obtain the correction and deletion of data.
- obtain the limitation of the treatmen.
- obtain data portability, i.e. receive them from a data controller, in a structured format, commonly used and readable by an automatic device, and transmit them to another data controller without impediments.
- oppose the processing at any time and also in the case of processing for direct marketing purposes.
- oppose an automated decision-making process relating to natural persons, including profiling.
- propose a complaint to the Italian Data Protection Authority.
Requests should be addressed to the Data Controller by writing to costa@thermoking.it
Every effort will be made to make the functions of this site as interoperable as possible with the automatic privacy control mechanisms available in some products used by users.
Considering that the state of improvement of the automatic control mechanisms does not currently make them free from errors and malfunctions, it is specified that this document, published at the address
https://www.thermoking.it/privacy-policy
https://www.thermoking.it/privacy-policy constitutes the “Privacy Policy” of this site which will be subject to updates (the various versions remain available at the same address).
