This privacy policy describes, pursuant to and for the purposes of art. 13 of EU Regulation 679/2016 (General Data Protection Regulation, hereinafter "GDPR"), the manner in which the Data Controller processes personal data collected or provided by the User while browsing this Website.

Data Controller

The Data Controller, pursuant to and for the purposes of articles 4 and 24 GDPR, is Cree Lighting Europe S.p.A in the person of its legal representative pro-tempore, with registered office in Via Sandro Pertini 122, 50019 Sesto F.no. (FI), Italy

Email: privacyeurope@creelighting-europe.com

Origin and type of data collected

• Navigation data.  IT systems and software procedures used to operate the Website may acquire, during their normal operation, some data whose transmission is implicit in the use of Internet communication protocols. This category of data could include IP addresses or domain names of the devices used, the addresses in URI (Uniform Resource Identifier) notation of the requested resources, the time of the request, the method used to submit the request to the server, the size of the file obtained in response, the numerical code indicating the status of the response given to the server (successful,  error, etc.) and other parameters relating to the operating system and the User's computer environment.
• "Contact" section.  Through the appropriate form are acquired: name, surname, e-mail address, company of belonging, country of origin and any other information that the User shares with us in the message area.
• Newsletter subscription.  To subscribe to the Newsletter we require: name, e-mail address and company affiliation.
• "Customer Service" section.  Through the appropriate form, the following are acquired: identification data (name and surname) and contact details (e-mail, telephone) of the customer and / or company contact person, identification data of the Distributor / Agent, any information or data contained in the files and images that the User decides to share.
• Any personal data and details contained in the CVs that may be sent to the e-mail addresses indicated on the Website or through our LinkedIn page. The Data Controller - in accordance with the provisions and guidelines of the Supervisory Authority - will provide information on the processing of data contained in the CVs at the time of the first useful contact with the candidate. 
• Personal data transmitted in an optional, explicit and voluntary way to the e-mail addresses indicated on the Website. In this case you have the acquisition of the e-mail address, as well as all other personal data included in the message.

Purposes and legal bases of processing

The data are processed for the following purposes:

• to ensure the proper functioning of the Website and the User's navigation.

The legal basis is  the legitimate interest of the Data Controller (Article 6, letter f), GDPR).

• to respond quickly and effectively to Users' questions formulated through the Contact section or other channels made available.

The legal basis is  the execution of contractual and pre-contractual measures adopted at the request of the customer (Article 6, letter b), GDPR) and the legitimate interest of the Data Controller (Article 6, letter f), GDPR) to  be more efficient, to give information on the services offered, as well as to improve and develop new products and services.  

• to give support to the Customer regarding problems on guarantees, technical doubts, faults and technical assistance.

The legal basis is  the execution of contractual and pre-contractual measures adopted at the request  of the customer (Article 6, letter b), GDPR) and the fulfillment of legal obligations of a fiscal, accounting, administrative nature (Article 6, letter c), GDPR).

• to provide information on goods or services similar to those already purchased or used, provided that the User does not object to the processing.

The legal basis is Art. 130, paragraph 4 of Legislative Decree no. 196/2003 (soft spam).

• for marketing purposes, in order to send newsletters and DEM (direct email marketing) to people who have requested subscription to the Newsletter or have checked the appropriate box in our forms.

The legal basis is  the express consent given by the User (Article 6, letter a), GDPR).

• to consider applying for a job.

The legal basis is  the execution of pre-contractual measures adopted at the request of the data subject (Article 6, letter b), GDPR). The processing of any "particular" data is lawful on the basis of the Provision of the Supervisory Authority of 5 June 2019 which integrates and modifies the General Authorization no. 1/2016.

• to comply with legal obligations  to which the Data Controller is subject and to fulfill any requests from the competent Authorities.

The legal basis is the fulfillment of legal obligations (Article 6(c) GDPR).

The provision of personal data

The mandatory or optional nature of the provision is specified from time to time – with reference to the individual information requested – by affixing a special symbol (*) to the mandatory information. Any refusal to communicate the data marked as mandatory makes it impossible for the Data Controller to execute the contract or provide the available services. The provision of additional data is, however, optional.

Processing methods

The processing of personal data is carried out by the Data Controller using paper, electronic or telematic methods, using internal personnel specifically authorized to process personal data. Appropriate security measures are adopted in order to minimize the risks of destruction or loss - even accidental - of data, unauthorized access or processing that is not permitted or does not comply with the purposes of collection.

Retention period

The data are processed for the time necessary to perform the service requested by the User or in general until the purposes for which they were collected are achieved. Some data will be kept for longer periods of time, by virtue of obligations relating to fiscal-administrative-accounting obligations (eg 10 years pursuant to art. 2220 c.c.) With regard to marketing purposes, the retention period of purchase data is 10 years. The data relating to applications for our job positions are kept for a maximum of 24 months.

When the intended processing purposes are exhausted, the personal data will be deleted or permanently anonymized.

Communication of personal data

The User's personal data will not be disclosed to indeterminate subjects, however the data may be communicated to third parties, legal and / or natural persons, which provide the Data Controller with outsourced services of a technical and organizational nature, such as IT services, communication services, e-mail marketing services, logistics services, etc. The same will operate as data controllers, joint controllers or duly appointed data processors, in full compliance with the current legislation indicated above. They shall be provided only with the information necessary for the performance of their duties. The complete and updated list of data processors is available upon request.

Please note that the data may be made available to subjects who have the right to access them by virtue of legal provisions, within the limits and for the purposes set out in these rules, as well as to banks, credit institutions, credit recovery companies and insurance agencies.

Transfer of personal data

Any transfer of personal data to non-EU countries that may be necessary to follow up the contract in place with the User or to guarantee the services offered (think of the case of suppliers based in third countries) is performed in accordance with Articles. 44 et seq. of the GDPR, providing appropriate tools that guarantee adequate data protection guarantees.

Links to other Websites, platforms and social networks

This information is provided only for the creelighting-europe.com Website and not for other websites and social platforms accessible by the User through links and social buttons, particular buttons on the Website that depict the icons of social networks. For more information on the processing of data by these external parties, please refer to their respective privacy policies. In any case, it is recommended to disconnect from the respective services to ensure that the data processed on this Website is not linked to your social profile.

Rights of the data subject

At any time, pursuant to Articles. 15 et seq. of EU Regulation 679/2016, the User may exercise the following rights:

a)     obtain confirmation as to whether or not processing is underway and access personal data;

b)     obtain information about the origin of the data, the purposes of the processing, the categories of personal data, the recipients or categories of recipients to whom the personal data have been or will be communicated and the expected retention period or the criteria used to determine it;

c)     request the correction, limitation of processing or cancellation of data, provided that the cancellation is compatible with the legal obligations of tax and accounting conservation to which the Data Controller is bound;

d)     oppose the processing;

e)     request data portability, where possible;

f)      withdraw consent, without prejudice to the lawfulness of the processing based on the consent given before the revocation;

g)     lodge a complaint with the Supervisory Authority for the protection of personal data.

The exercise of rights, with the exception of letter g), may take place by sending a request to the e-mail address privacyeurope@creelighting-europe.com

Please note that for revocation of consent to marketing and unsubscription from the contact lists, the User can alternatively click on the appropriate cancellation link in each communication received.      

Updates and changes

In the future, the Data Controller may modify or simply update, in whole or in part, the Privacy Policy of the Website, also in consideration of the modification of laws or regulations governing this matter and protecting the rights of the data subject. Changes and updates to the Privacy Policy will be binding as soon as they are published on the Website. We therefore invite the User to regularly access this section to check the publication of the most recent and updated Privacy Policy.

This document was updated on 09/06/2023.