This privacy notice describes how SAES Getters S.p.A. (the “Company” or "Controller") processes the personal data of users who access the ConfiguraTorr platform on the domain http://saesconfiguratorr.com/ (the "Website" or the “Platform”). This document is drafted in compliance with Regulation (EU) 2016/679 (“GDPR”), Legislative Decree No. 196/2003 as amended by Legislative Decree No. 101/2018, the guidelines of the Italian Data Protection Authority (Garante privacy) and of the European Data Protection Board and the relevant best practices.
The data controller is SAES Getters S.p.A., with registered office at viale Italia 77, 20020 Lainate (MI), Italy, Tax Code and VAT No. 00774910152.
For information on the processing of personal data or to exercise the rights described in paragraph 7 of this notice, you may contact the Company at any time at the contact details set out in paragraph 8, and specifically at the email address: privacy@saes‑group.com or by contacting the DPO appointed by the Company at the email address: dpo@saes‑group.com.
The Platform provides for two categories of users: Basic and Premium. Upon registration, all users are registered as Basic users; the upgrade to the Premium category takes place at a later stage, within the Platform, through the purchase of multiple drawings. Depending on the features used and the purchases made, the following personal data are collected:
| Data category | Description | Main purposes |
|---|---|---|
| Registration data | First and last name, company/institution name (if applicable), country, e‑mail address, password (stored in encrypted form), language preferences. | Creation and management of the account; sending of confirmation e‑mails and communications functional to the registration. |
| Purchase and billing data | In the event of the purchase of one or more drawings within the Platform (including for the purposes of upgrading to the Premium category), in addition to the above data, the following are requested: VAT number/Tax code, full address (street, number, city, postcode, country) and telephone number. | Issuance of the pro‑forma invoice for the purchase of drawings or for the premium plan and verification of payments; allocation of the plan (number of downloadable drawings) |
| Browsing data | IP address, data relating to the device and browser used, access logs, session data (e.g. number of drawings downloaded, pages visited, date and time). | Technical operation of the Website; prevention of unauthorised access; geographical restriction of access (access allowed to users connecting from Europe, including the United Kingdom and Israel). |
| Users’ contact data | Sending of e‑mails to the support service or other communications sent through the Platform. | Handling of support requests, account management, exercise of rights and requests relating to orders. |
Personal data are processed for specific purposes and on the basis of an appropriate legal basis, as set out below:
| Purpose | Legal bases | Description |
|---|---|---|
| Registration and account management | Performance of a contract (Art. 6(1)(b) GDPR) | The data provided upon registration are necessary to create and manage the account, send activation e‑mails and provide access to the configuration services. |
| Issuance of the pro‑forma invoice and payment management | Performance of a contract and compliance with legal obligations (Art. 6(1)(b) and (c) GDPR) | In the event of the purchase of drawings within the Platform, whether by basic users (purchase of a single drawing) or in the event of an upgrade to the premium plan (purchase of multiple drawings), fiscal data are collected (VAT No./Tax code, address and telephone number) in order to issue the invoice, indicate the Controller’s IBAN and record the transaction for tax purposes. |
| Management of configurations and download of drawings | Performance of a contract (Art. 6(1)(b) GDPR) | Data relating to configurations (e.g. selected components and parameters) and to the number of drawings downloaded are processed to provide the requested files, keep track of the number of remaining downloads and allow any renewals of the plan. |
| Service communications and support | Legitimate interest (Art. 6(1)(f) GDPR) | The Company responds to requests for support or information through the contact channels. The legitimate interest consists in providing assistance, improving the service and maintaining the relationship with users, in line with the reasonable expectations of the data subjects. |
| Geographical restriction and security of the Website | Legitimate interest (Art. 6(1)(f) GDPR) | The system records the IP address and verifies the geographical origin in order to allow access only to users located in the European Union, the United Kingdom and Israel; this makes it possible to comply with product export regulations and to protect the security of the Platform, in line with the reasonable expectations of the data subjects. |
| Compliance with legal obligations and defence in legal proceedings | Compliance with legal obligations and legitimate interest (Art. 6(1)(c) and (f) GDPR) | Retention of accounting and contractual documentation for tax purposes and to handle any complaints or disputes for the time necessary to defend against legal claims (up to 10 years). |
The data will be processed by the Controller and by persons specifically instructed by it (for example, persons in charge of the IT systems, the legal function and the administrative function) and may be disclosed to third parties only where necessary in relation to the above purposes or in compliance with legal obligations.
The data may also be disclosed to third parties, acting as independent controllers or data processors, that provide services to the Company (by way of example, providers of cloud storage and IT systems, banks for the management of payments, couriers and forwarders, legal and tax advisors, service providers of the Company, etc.); in particular, the data may also be shared with public authorities upon their request (e.g. the Italian Revenue Agency, judicial authorities) in compliance with legal obligations or at their request, and with subsidiaries and affiliates of the Company (which, unless otherwise indicated, will act as independent data controllers) where necessary for the performance of a sales contract or of pre-contractual measures to be taken at the data subject’s request, as well as for administrative and accounting purposes and, in this context, the data will be stored on servers and/or archives located within the European Union.
In any event, transfers outside the European Union may only take place to countries offering a level of personal data protection equivalent to that guaranteed by EU law or, in any case, subject to the adoption of appropriate safeguards pursuant to Art. 46 GDPR designed to ensure a level of data protection equivalent to that guaranteed within the European Union.
The data marked as mandatory in the registration forms of the Website are necessary for the conclusion of the contract and access to the requested services. Failure to provide them makes it impossible to complete the registration or to provide the requested services (e.g. download of drawings, issuance of the invoice, etc.).
The data collected through the Website will be processed both in paper form and by electronic, IT or automated means, through systems ensuring their protection, security and confidentiality. The Controller has adopted specific and adequate logical, legal, organisational and technical security measures to prevent the loss of data, unlawful or unauthorised uses of the data and unauthorised access. The data are retained for the time necessary to achieve the purposes for which they are collected. In particular:
Personal data may be retained for a longer period where necessary to comply with legal or regulatory obligations and/or to protect the Company. Specifically, personal data collected to safeguard the right of defence will be retained for 10 (ten) years from the last contact between the data subject and the Controller. At the end of the above periods, the data will be deleted or irreversibly anonymised.
Users of the Website have the rights granted by the GDPR pursuant to Articles 12-23 GDPR. In particular, data subjects have the right to request and obtain, at any time: (i) access to their data; (ii) information on the processing carried out, (iii) the rectification and/or updating of the data; (iv) the erasure of the data; (v) the restriction of the processing; (vi) to exercise the right to object to the processing; (vii) data portability (i.e. to receive the data in a structured, commonly used and machine-readable format); (viii) to exercise the right to withdraw their consent to the processing of the data where consent constitutes the legal basis for the specific purpose for which the processing is carried out (this will not, in any case, affect the lawfulness of the processing carried out on the basis of the consent given before its withdrawal); and, finally, (ix) to lodge a complaint with a data protection supervisory authority (in Italy: the Garante per la Protezione dei Dati Personali).
The above rights may be exercised at any time by simple request to the Controller, to be sent:
By e-mail, to the address: privacy@saes-group.com
By post, to the address Viale Italia 77, 20045 Lainate, Milan, Italy (for the attention of the Legal & Compliance Department).
For further information or clarification on the rights mentioned above, you may contact the Controller at the same contact details or the DPO at the address: dpo@saes-group.com
The Website only uses technical cookies necessary for the operation of the Platform and for the management of user authentication (e.g. for authentication, language preferences and session management). No profiling cookies or tracking tools are used for analytics or marketing purposes.