USER PRIVACY POLICY

Pursuant to the pertinent data protection legislation currently in force (Articles 13 and 14 of the EU Regulation 2016/679 – General Data Protection Regulation, hereinafter also referred to as the GDPR), BKT Europe Srl (hereinafter also referred to as the “Owner” or “Company”) hereby provides information about the processing of data of users accessing the website bkt-mytire.com (hereinafter also referred to as the “Website”).

DATA CONTROLLER NAME AND CONTACT DETAILS

The Data Controller is BKT Europe Srl, with its registered office at Viale Bianca Maria 25, 20122 Milan and operational headquarters at Viale della Repubblica 133, 20831 Seregno (MB), VAT no. 05404270968. The Company can be contacted through the email privacy@bkt-tires.com

WHAT DATA ARE PROCESSED

The data processed are browsing data and data voluntarily provided by the user.

Browsing data

The IT systems and software procedures used to operate this website acquire, in the course of their normal operation, some personal data whose transmission is implicit in the use of Internet communication protocols.

This information is not collected to be associated with identified data subjects, but by its very nature could, through processing and association with data held by third parties, allow users to be identified. 

This category of data includes IP addresses or domain names of the computers used by users connecting to the site, the URI (Uniform Resource Identifier) addresses of the requested resources, request time, method used to submit the request to the server, file size obtained in response, numerical code indicating the status of the server’s response (successful, error, etc.) and other parameters related to the user’s operating system and IT environment. 

Cookies and other tracking systems

The website uses technical and analytical cookies. 

Please refer to the cookie policy available via the link on the website for further information on cookies. 

Data provided directly by the user

This category includes all the personal data that the user provides voluntarily (e.g., written requests for information sent to email addresses posted on the website). 

PURPOSES AND LEGAL BASIS OF PROCESSING 

Browsing data

Browsing data are collected for the purpose of website security and to ensure that the website works properly, and they may also be used to ascertain liability in the event of cybercrime directed against the website. 

The legal basis for processing such data is legitimate interest and, in the case of requests from the Authorities, legal obligation.

Cookies and other tracking systems

The website uses technical and analytical cookies. 

The use of analytical cookies is subject to the user’s consent, which can be revoked at any time. Withdrawal of consent does not affect the lawfulness of the processing carried out previously.

Please refer to the cookie policy available via the link on the website for further information on cookies. 

Data provided directly by the user

Any personal data that the user optionally provides by contacting the owner are used only to process any requests made.

The legal basis for processing such data is therefore the execution of pre-contractual and contractual measures.

Security and defense 

Should it become necessary, the aforementioned data may also be used against the legitimate interest of the owner, which consists in verifying the security and proper functioning of the IT systems used and in carrying out defensive activities.

WHO CAN ACCESS THE DATA?

The data will be processed by Controller personnel authorized to process the data. 

External recipients who may access the data being processed are: IT companies that the controller engages for hosting services, support and maintenance services for the systems used and analysis services, legal consultants for litigation management and legal assistance. The data may be communicated to the competent authorities should there be specific requests which the Controller is required to fulfil.

Please note that some of the indicated parties operate as data controllers and that the communication to any who operate as autonomous controllers is made because prescribed by legal obligations or necessary to give effect to the obligations arising from the contractual relationship or the legitimate interest of the controller consisting in maintaining the security of IT systems with maintenance work and the performance of defensive activities through legal advisors. 

The data subject may request a detailed list of data recipients from the Data Controller, to the extent to which they can be identified specifically.

Communication is in any case limited to the sole categories of data the transmission of which is necessary to undertake the activities and purposes pursued.

HOW ARE DATA MANAGED?

The data collected are processed by IT tools and on hard copy methods in compliance with the security requirements stipulated by the pertinent legislation in force for preventing data loss, unlawful or incorrect use and unauthorized access. 

Storage period

Browsing data are not held for longer than seven days (barring any need for the investigation of crimes by judicial authorities).

Data acquired through the analysis service will be stored for 14 months.

Data voluntarily provided by the user through the contact details on the website are kept for the time strictly necessary to process requests and then deleted, subject to defensive needs (which may necessitate further storage).

This is notwithstanding any potential need for defense, for which the data may be retained even beyond the terms indicated. 

Transferring data abroad

The data will be processed within the EU as the Controller and the hosting service provider are based in Italy.

For the e-mail service used by Controller, data will be transferred to non-EU countries in the absence of EU Commission adequacy decisions, but the transfer will be assisted by appropriate safeguards. 

The analytics service employed by the website involves a transfer of data outside the EU and, specifically, to the United States. The guarantee adopted for this transfer is the EU Commission’s Data Privacy Framework adequacy decision.

WHAT HAPPENS IF THE DATA ARE NOT PROVIDED?

With the exception of the browsing data necessary to run IT and Internet protocols, users may provide their data via the contact details available on the website freely and voluntarily. 

However, not providing this data will render any of the user’s submitted or intended requests ineffective. 

WHAT ARE THE DATA SUBJECT’S RIGHTS?

Articles 15 to 22 of the GDPR recognize the data subject’s right to request from the controller access to and rectification or erasure of personal data, restriction or objection of processing, and also data portability.

Please note, in particular, the possibility to object to data processing carried out for marketing purposes.

Regarding data collected automatically by the website, the controller may not be able to identify you based on the information stored. Therefore, according to Article 11 (2) of the GDPR, with respect to such data, Articles 15 to 22 of the GDPR do not apply, unless the user provides additional identifying information in order to exercise the rights under these articles.

Data subjects may assert their rights at any time, without formalities, by simply contacting the controller.

The data protection legislation currently in force recognizes the following rights.

• The right of access, i.e., the right to obtain from the controller confirmation as to whether or not personal data concerning him or her are being processed, and, where that is the case, access to the personal data and the following information: a) the purposes of the processing; b) the categories of personal data concerned; c) the recipients or categories of recipient to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organizations; d) where possible, the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period; e) the existence of the right to request from the controller rectification or erasure of personal data or restriction of processing of personal data concerning the data subject or to object to such processing; f) the right to lodge a complaint with a supervisory authority; g) where the personal data are not collected from the data subject, any available information as to their source; h) the existence of automated decision-making, including profiling, and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject. Where personal data are transferred to a third country or to an international organization, the data subject shall have the right to be informed of the appropriate safeguards relating to the transfer. 
• The right to rectification, i.e., the right to obtain from the controller without undue delay the rectification of inaccurate personal data concerning him or her. Taking into account the purposes of the processing, the data subject shall have the right to have incomplete personal data completed, including by means of providing a supplementary statement. 
• The right to erasure (right to be forgotten), i.e., the right to obtain from the controller the erasure of personal data concerning him or her without undue delay where: a) the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed; b) the data subject withdraws consent on which the processing is based and where there is no other legal ground for the processing; c) the data subject objects to the processing and there are no overriding legitimate grounds for the processing, or the data subject objects to the processing; d) the personal data have been unlawfully processed; e) the personal data have to be erased for compliance with a legal obligation in Union or Member State law to which the controller is subject; f) the personal data have been collected in relation to the offer of information society services to minors. The request for erasure cannot, however, be accepted if the processing is necessary: a) for exercising the right of freedom of expression and information; b) for compliance with a legal obligation which requires processing by Union or Member State law to which the controller is subject or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller; c) for reasons of public interest in the area of public health; d) for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes insofar as the right is likely to render impossible or seriously impair the achievement of the objectives of that processing; or e) for the establishment, exercise or defense of legal claims. 
• The right to restriction of processing, i.e., the right to obtain from the controller restriction of processing where one of the following applies: a) the accuracy of the personal data is contested by the data subject, for a period enabling the controller to verify the accuracy of the personal data; b) the processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of their use instead; c) the controller no longer needs the personal data for the purposes of the processing, but they are required by the data subject for the establishment, exercise or defense of legal claims; d) the data subject has objected to processing pending the verification whether the legitimate grounds of the controller override those of the data subject.
• The right to data portability, i.e., the right to receive the personal data concerning him or her, which he or she has provided to a controller, in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller without hindrance from the controller to which the personal data have been provided, where the processing is based on consent or a contract, and the processing is carried out by automated means. This right leaves the right to erasure (right to be forgotten) unaffected.

• RIGHT TO OBJECT:

The law also grants data subjects the right to object, i.e., the right to object at any time, on grounds relating to their particular situation, to the processing of personal data concerning them carried out because it is necessary for the performance of a task carried out in the public interest or in connection with the exercise of official authority vested in the controller or for the furtherance of the legitimate interests of the controller or a third party. Where personal data are processed for direct marketing purposes, the data subject shall have the right to object at any time to processing of personal data concerning him or her for such marketing, which includes profiling to the extent that it is related to such direct marketing. 

Data subjects are also informed that if they believe that their personal data are being processed in violation of the GDPR, they may lodge a complaint with the competent Supervisory Authority in their country as provided for in Art. 77 of the GDPR or seek legal redress as per Art. 79 thereof.

This privacy policy was drafted on February 15, 2024