Privacy Policy on the Processing of Personal Data

Pursuant to Article 13 of EU Regulation 2016/679

1 – Identity and Contact Details of the Data Controller

The Data Controller pursuant to Article 24 of the GDPR, namely the party determining the purposes and means of the processing, is CRPI Compagnie Riunite Partecipazioni Industriali Srl whose contact details are:

Legal office: Via Abruzzi, 72 20131 Milan (MI)
e-mail address: privacy@crpi.it

2 – Contact details of the Data Protection Officer

The Data Controller has appointed a Data Protection Officer, available at the following contact details:

Telephone: +39 02 49 5431 50
E-mail: privacy@crpi.it
PEC: crpi@pec.it

3 – The purposes and legal bases

Your personal identification and contact data, subject to processing, are used for the following purposes:

Purpose	Legal Basis	Data retention
A) respond to Your specific requests	Performance of a contract to which You are a party	10 years from termination of the contract
B) fulfill pre-contractual, contractual and tax obligations relating to the conclusion and/or execution of contracts to which You are a party	Performance of a contract to which You are a party	10 years from termination of the contract
C) fulfillment of legal and/or regulatory obligations of a fiscal, administrative and accounting nature	Necessity to comply with legal obligations	10 years from termination of the contract

4 – Categories of recipients

It should be noted that, in relation to the purposes indicated above, personal data may be disclosed to recipients collaborating with the Data Controller or for the fulfillment of legal obligations. Such recipients are bound to the utmost confidentiality regarding any information they may become aware of and, by way of example, the categories are listed below.

Authorities, public administrations and supervisory and control bodies for their institutional purposes.
Parties collaborating with the Data Controller for the achievement of the purposes indicated above.
Parties providing services for the management of the Data Controller’s IT system.
Qualified professionals for the study and resolution of any legal and contractual issues.
Consultants, consulting companies and professional firms, (business organization experts, payroll processing companies, accountants, etc…).

5 – Transfer of data outside the EU

The Data Controller does not transfer data to third countries; however, it reserves the right to use cloud services and, in such case, the service providers will be selected among those providing adequate guarantees as provided for by Article 46 of GDPR 679/16.

6 – The data retention period or the criteria used to determine it

The Data Controller will process personal data for the time necessary to fulfill the above purposes, the personal data will be processed and stored both in paper and digital form by duly informed and authorized personnel and by specifically appointed processors, and in any case for no longer than 10 years from termination of the relationship.

7 – Rights of the data subject

Please be informed that, in relation to the processing of the personal data concerned, in order to ensure fair and transparent processing, the following rights may be exercised:

Right to information and access pursuant to Article 15 GDPR: in order to obtain from the Data Controller information on whether or not personal data concerning you are being processed as well as access to your personal data and information on the purposes of the processing, the recipients or categories of recipients to whom the data are disclosed.
Right to rectification (pursuant to Article 16 GDPR), erasure (pursuant to Article 17 GDPR) and restriction (pursuant to Article 18 GDPR) in order to request from the Data Controller the rectification and erasure of your personal data and the restriction of processing.
Right to portability (pursuant to Article 20 GDPR) in order to receive in a structured, commonly used and machine-readable format the personal data concerning you provided to the Data Controller and you have the right to transmit such data to another controller, provided that such operation is technically feasible.
Right to object (pursuant to Article 21) in order to object to the processing of your data.
You may at any time exercise your rights by writing:
- by mail to CRPI Compagnie Riunite Partecipazioni Industriali Srl, Via Abruzzi, 72 20131 Milan (MI) – Italy, to the attention of the Data Protection Officer
- by e-mail, to the Data Protection Officer: privacy@crpi.it

8 – The right to withdraw consent

With reference to Article 6 of GDPR 679/16, the data subject may withdraw the consent given at any time. Following withdrawal, neither the exact fulfillment of the services covered by the contract nor the continuation of the contractual relationship in which the processing of personal data depends exclusively on the expression of consent can be guaranteed.

9 – The right to lodge a complaint with the Supervisory Authority

The data subject has the right to lodge a complaint with the Supervisory Authority of the State of residence.

10 – Mandatory or optional nature of data provision and consequences in case of failure to provide data

The provision of data and consent to their processing for the purposes a), b), c) is necessary for the performance of a contract to which You are a party or for the implementation of pre-contractual measures adopted at your request and any failure to provide them prevents the supply of the requested products/services.

11 – The existence of automated decision-making or profiling processes and the logic used

No profiling processes are carried out.

Update: October 2025