Privacy & Cookie Policy

The Data Controller provides below the Privacy Policy pursuant to articles 12, 13 and, if necessary, 14 of the GDPR regarding the processing of personal data provided by the user through the creation of an account in the Reserved Area, the filling out of forms on the Site (profile activation request, machine registration, assistance request, contact form), or simply by browsing this website.

 

1. Data Controller and contact details

The Data Controller is Nuovair S.r.l., with registered office in Via Padania, 9/C – 31020 San Vendemiano (TV), VAT No. 04839590264, registered in the Treviso Business Register under no. REA TV 402560, fully paid-up share capital of Euro 10,000.00, tel. +39 0438 489097, e-mail info@nuovair.com, website https://www.nuovair.com/ (hereinafter the “Site”).

 

2. Principles applicable to processing

In accordance with the provisions of the GDPR, the Data Controller constantly strives to ensure that personal data are:

• processed lawfully, fairly and transparently; collected for specified, explicit and legitimate purposes, and subsequently processed in a way that is not incompatible with those purposes;
• adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed;
• accurate and, where necessary, kept up to date;
• kept for no longer than is necessary for the purposes for which they are processed;
• processed, by means of appropriate technical and organizational measures, in a manner that ensures their security;
• processed, if based on consent, by a freely taken decision by the user, based on a request presented in a manner clearly distinguishable from the rest, in an intelligible and easily accessible form, using clear and plain language.

The Data Controller adopts appropriate technical and organizational measures to ensure the protection of personal data from the design stage and to ensure that, by default, only the data necessary for each specific purpose of processing are processed.

This Privacy Policy may be modified, in line with the evolution of the relevant legislation and the technical and organizational measures gradually adopted by the Data Controller; the user is therefore requested to periodically visit this section of the Site to view updates and the Privacy Policy in its current text.

 

3. Methods of processing personal data

The processing of personal data is carried out using electronic tools, through the Site and the Reserved Area, with logic strictly related to the purposes indicated below and, in any case, in a manner that guarantees the security and confidentiality of the data themselves.

 

4. Purposes of processing personal data

 

(4a) Purposes for which data processing is necessary

The personal data provided by the user are processed mainly to:

• create and manage the account in the Reserved Area (registration, e-mail address confirmation, access, recovery and password reset);
• manage requests for activation of the Professional profile (Installer, Retailer or other professional category) and subsequent profile modification requests;
• manage the registration of Nuovair machines owned by the user, to provide technical assistance, associated confidential documentation (guides, manuals, technical data sheets) and, where applicable, the relative warranty;
• manage requests for direct assistance related to a specific machine;
• respond to requests for information sent via the Site’s contact form;
• execute any commercial relationships related to the purchase of products/services offered by the Data Controller (purchase does not take place directly online on the Site);
• comply with legal obligations to which the Data Controller is subject.

The provision of the data requested in the forms indicated above is necessary for the respective purposes; the failure, partial or incorrect provision of such data makes it impossible to create the account, activate the requested profile, register the machine, or receive a response to the request sent.

 

(4b) Commercial and marketing communications

In addition to the purposes mentioned above, the contact details provided by the user (in particular name and e-mail address) may be processed, subject to the user’s specific and express consent, also for the sending of commercial and promotional communications related to the products/services offered by the Data Controller, via e-mail or other automated contact systems, as well as for market research.

Consent for the processing purposes referred to in this point (4b) is always optional and distinct from consent for the processing of data for the purposes referred to in point (4a): any refusal does not in any way affect the possibility of creating an account in the Reserved Area, requesting the activation of a profile, registering a machine or receiving a response to an assistance or contact request.

The user may at any time revoke the consent given for these purposes, without any formality, using the appropriate unsubscribe link present at the bottom of every commercial communication received, or by writing to the Data Controller at the addresses indicated in point 1.

 

5. Categories of personal data processed

The Data Controller processes, in particular:

• identification and contact data: name, surname, e-mail address, telephone number, address, country;
• data related to the professional profile indicated by the user (e.g. Installer category, Retailer, etc.);
• data related to owned products: serial number of the registered machine, model and year of production (the latter two are entered by the Data Controller during the verification phase);
• access credentials to the Reserved Area (e-mail address and password; the latter is stored in encrypted form and is never readable by the Data Controller);
• free textual content entered by the user in the forms (e.g. message of the contact form, assistance request, note in the profile modification request);
• browsing data and technical cookies, and, only subject to consent via the appropriate banner, statistical data collected by Google Analytics (IP address, type of device and browser, pages visited, time spent) — see point 12 “Cookies and third-party services” below.

The Site does not collect data related to payments or payment instruments (credit cards, bank details): the purchase of products does not take place through the Site.

The processing does not normally involve special categories of personal data (data revealing racial or ethnic origin, political opinions, religious beliefs, health status or sexual orientation, etc.), nor genetic, biometric or judicial data; should the user spontaneously enter such information in the free text fields of the forms (for example in the message of the contact form or in the assistance request), such data would be processed exclusively to respond to the request itself.

 

6. Source of personal data

The personal data processed by the Data Controller are collected directly from the user, at the moment of filling out the forms described above or during browsing on the Site.

 

7. Legitimate interests

The legitimate interests of the Data Controller may constitute a valid legal basis for processing, provided that the interests or fundamental rights and freedoms of the data subject do not prevail. It constitutes, in particular, a legitimate interest of the Data Controller: to ensure the security of the Site and the Reserved Area (for example through anti-spam systems and limitation of access attempts already present in the forms); to prevent fraudulent or abusive use of the services offered; to carry out, subject to consent via cookie banner, aggregate statistical analyses on the use of the Site.

 

8. Circulation of personal data

 

(8a) Communication of personal data – categories of recipients

Personal data may be processed, in addition to by the Data Controller’s personnel authorized to process them, also by third parties that provide services functional to the Site and the Reserved Area, in their capacity as data processors, including, but not limited to:

• the hosting service provider on which the Site is hosted;
• Google LLC/Google Ireland Ltd, for storage on Google Drive of technical documents and confidential materials made available in the Reserved Area;
• Google LLC/Google Ireland Ltd, for the Google Analytics service (Site usage statistics, only subject to consent) and for the Google Maps service (map incorporated in the Site);
• any technical service and Site maintenance providers;
• any commercial communication service providers (e.g. email marketing platforms), limited to the data of users who have given specific consent as referred to in point (4b).

The updated list of data processors with whom the Data Controller maintains relationships is available upon written request to the addresses indicated in point 1.

Personal data may also be communicated to the competent authorities, in fulfillment of obligations deriving from legal provisions.

 

(8b) Transfer of personal data to third countries

Some of the providers indicated in point (8a), in particular Google LLC, are based in the United States of America: data processed via Google Drive, Google Analytics and Google Maps may therefore be transferred outside the European Union. Such transfers take place on the basis of the adequate guarantees provided for by the GDPR (in particular the standard contractual clauses approved by the European Commission, adopted by Google for its services). The user may request further information on such guarantees by writing to the addresses indicated in point 1.

 

9. Criteria for determining the retention period of personal data

The data of the account in the Reserved Area are kept for the entire duration of the relationship with the user (active account) and, after its possible cancellation, for the time necessary to fulfill legal obligations. The data related to registered machines are kept for the duration of the product’s useful life/warranty. The data entered in the contact form are kept for the time necessary to manage the request and, subsequently, for a short period for commercial correspondence archiving purposes. The data processed for the marketing purposes referred to in point (4b) are kept until the user revokes consent.

 

10. User/Data subject rights

The Data Controller recognizes – and facilitates the exercise, by the user, of – all the rights provided for by the GDPR, in particular the right to request access to their personal data and to extract a copy (art. 15 GDPR), to rectification (art. 16 GDPR) and to deletion thereof (art. 17 GDPR), to the limitation of processing concerning them (art. 18 GDPR), to data portability (art. 20 GDPR, where the prerequisites exist) and to object to processing concerning them (art. 21 and 22 GDPR, for the hypotheses mentioned therein).

Where the processing is based on consent (for example statistical cookies, see point 12), the user has the right to revoke said consent at any time, without prejudice to the lawfulness of the processing based on the consent given before the revocation, using the cookie preference management panel present on the Site or by contacting the Data Controller at the addresses indicated in point 1.

The user also has the right to lodge a complaint with the Data Protection Authority, as the competent supervisory authority in Italy, and to file a judicial appeal, both against a decision of the Data Protection Authority, and against the Data Controller and/or a data processor.

 

11. System and personal data security

The Data Controller adopts appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including: the storage of user passwords in encrypted form; systems for limiting access attempts and for automatic detection of suspicious requests (honeypot) on the Site’s forms; restricted access to authorized administrators only for administrative areas and for more sensitive data (e.g. credentials of third-party services); encrypted e-mail communication (HTTPS) between the user’s browser and the Site.

The user acknowledges and accepts that no security system guarantees, in terms of certainty, absolute protection; therefore, the Data Controller is not liable for acts or facts of third parties who abusively, despite the adequate precautions adopted, access the systems without the necessary authorizations.

 

12. Cookies and third-party services

The Site uses technical cookies, necessary for the operation of the Site and the Reserved Area (e.g. session management, storage of cookie preferences), always active and for which consent is not required.

Subject to the express consent of the user via the appropriate banner shown at the first visit, the Site may also use statistical cookies from Google Analytics, to collect aggregated and anonymized information on the use of the Site (pages visited, time spent, traffic origin). The user may at any time review or revoke their consent via the cookie preference management panel present on the Site.

The Site also incorporates a map provided by Google Maps, which is also loaded only subject to the user’s consent via the same cookie banner.

For more information on cookies and the processing of data by Google, please refer to the policies published directly by Google (Google Privacy Policy and Google Analytics).

 

13. Automated decision-making processes

The Data Controller does not perform entirely automated decision-making processes, including profiling, which produce legal effects on the user or which similarly significantly affect them.