Privacy Policy

Information on the processing of personal data of website users

Pursuant to art. 13 of Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and other national and European legislation as applicable

I. Data controller

MAK SpA , with registered office in Carpenedolo (BS), Via Cristoforo Colombo n. 14, Fiscal Code 03086150178 and VAT number 01840560989, represented by its legal representative pro tempore , as data controller (hereinafter “Controller”), informs you that your personal data will be processed for the purposes and in the manner better specified below.

Personal data will be processed in accordance with the law, according to the principles of necessity, fairness, lawfulness, and transparency, protection of your privacy and your rights, limitation of the purpose of processing and retention, data minimization, data accuracy and quality, and data integrity and security.

For any need related to the processing of your personal data, the Data Controller can be reached by writing to the following email address: privacy@makwheels.it.

II. Type and origin of personal data processed

Browsing data. The computer systems and software procedures used to operate the website https://makwheels.it/ (hereinafter the "Site") acquire, during their normal operation, some personal data whose transmission is implicit in the use of Internet communication protocols. This information is not collected to be associated with identified data subjects, but by its very nature could, through processing and association with data held by third parties, allow users to be identified. This category of data includes the IP addresses or domain names of computers used by users connecting to the Site, the URI (Uniform Resource Identifier) addresses of requested resources, the time of the request, the method used to submit the request to the server, the size of the file obtained in response, the numerical code indicating the status of the response from the server (successful, error, etc.), and other parameters relating to the user's operating system and IT environment. This data is used solely to obtain anonymous statistical information on the use of the Site and to verify its proper functioning, and is deleted immediately after processing. The data may be used to ascertain liability in the event of hypothetical computer crimes against the Site. Except for this eventuality, web contact data is currently retained for no longer than seven days and, in any case, no longer than is necessary to process requests.

Data provided by the user to make an online purchase. To make a purchase through the Site, the user is required to provide the following personal data during checkout: name, surname, telephone number, buyer's email address, name, surname, and shipping address, and payment method data. The personal data collected in this way will be processed by the Data Controller for the sole purpose of fulfilling the sales contracts concluded with the user.

Data provided by the user to create a private account. Creating an account on the Site requires completing the relevant form , providing the user's email address and password.

Data provided by the user via the Customer Service contact form. The optional, explicit, and voluntary sending of messages via the contact form on the Site entails the subsequent acquisition of the sender's data (name, surname, email address, address, telephone number, city, country, and message content), which is necessary to follow up on requests. Personal data collected through this method will be processed by the Data Controller solely for the purpose of responding to the request for information received and for any subsequent related communications.

Data provided by the user through the application form. Submitting a job application through the dedicated area of the Site entails the subsequent acquisition of data voluntarily provided by the candidate, which must include name, surname, email address, and the position for which the candidate wishes to apply. Furthermore, following the user's sending of optional messages or their resume , the Data Controller may process the personal data contained therein. The personal data thus collected will be processed by the Data Controller for the sole purpose of recruiting, selecting, and evaluating personnel to be hired or with whom to establish collaboration relationships of any kind.

Data provided by the user through the "Become a Reseller" section. The optional, explicit, and voluntary sending of messages through this section entails the subsequent acquisition of the data provided by the sender (name, surname, email, company name, address, city, country, telephone number, and message content), which is necessary to follow up on requests submitted. The personal data collected in this way will be processed by the Data Controller for the sole purpose of evaluating whether to establish a contractual relationship with the prospective reseller.

Data provided by the user when requesting a COC certificate. The optional, explicit, and voluntary sending of messages via the COC certificate request form on the Site entails the subsequent acquisition of the sender's data (name, surname, email address, telephone number, address, city, zip code, province), which is necessary to process the requests submitted. The personal data collected in this way will be processed by the Data Controller for the sole purpose of responding to the user's COC certificate request.

Data provided by the user via the quote request form. The optional, explicit, and voluntary sending of messages via the quote request form on the Site entails the subsequent acquisition of the data provided by the sender (name, surname, email address, address, telephone number, and message content), which is necessary to follow up on the requests submitted. The personal data collected in this way will be processed by the Data Controller for the sole purpose of responding to the user's quote request.

Data processed for whistleblowing purposes. Submitting reports of significant events pursuant to Legislative Decree no. 24/2023 through the reporting channel established by the Data Controller, accessible at https://makspa.segnalachi.it/it , may result, if the reporting party includes such types of data in the report, in the processing of personal data such as, for example, the reporting party's name, surname, voice, and job title. Depending on the content of the reports and the attached documents, it may also result in the processing of personal data belonging to special categories pursuant to Art. 9 of Regulation (EU) 2016/679 (including data relating to health conditions, sexual orientation, or trade union membership) or personal data relating to criminal convictions and offenses pursuant to Art. 10 of Regulation (EU) 2016/679.

III. Purpose of the processing

Based on your free, explicit, and informed consent, or in other cases of lawfulness of processing strictly provided for by law, including Article 6 of Regulation (EU) 2016/679, the Data Controller informs you that your personal data will be processed for the following purposes:

a. establishment and execution of the contractual relationship concerning the provision of services and the supply of products offered by the Data Controller through the Site, including through the B2B area, and all related activities;
legal basis: performance of a contract to which the user is a party or of pre-contractual measures adopted at the user's request;

b. management of contact requests received via the form contact details present on the Site;
legal basis: performance of a contract to which the user is a party or of pre-contractual measures adopted at the user's request;

c. recruitment, selection and evaluation of personnel to be hired or with whom to establish collaborative relationships of any kind, on the basis of the applications submitted through the relevant form;
legal basis: execution of pre-contractual measures at the request of the interested party;

d. research and statistical analysis on aggregate or anonymous data, therefore without the possibility of identifying the user, aimed at measuring the functioning of the Site, measuring traffic and evaluating usability and interest;
legal basis: legitimate interest of the Data Controller;

e. receiving and managing reports of potentially relevant events pursuant to Legislative Decree no. 24/2023;
legal basis: fulfillment of a legal obligation to which the Data Controller is subject and pursuit of the Data Controller's legitimate interest in exercising specific rights of the Data Controller, including in matters of employment law;

f. publication of the interested party's image on the Data Controller's website and social media channels;

Legal basis: Given that the publication of the image occurs at the explicit request of the customer, the legal basis for the processing consists in the performance of a contract to which the user is a party or pre-contractual measures adopted at the user's request.

The Data Controller informs you that if you fail to provide the personal data requested for the purposes referred to in letters a), b), c), d), e), and f), you will not be able to use the services offered by the Data Controller through the Website.

IV. Data processing methods and data retention period

The personal data of data subjects are processed primarily using computerized tools by persons authorized to process data pursuant to Art. 29 of Regulation (EU) 2016/679 or by data processors appointed pursuant to Art. 28 of Regulation (EU) 2016/679 for the time necessary to achieve the purposes for which they were collected or for any other related legitimate purpose, and in any case no later than the expiration of the terms established by law for the protection of rights and/or legal obligations, adopting adequate security measures to prevent the destruction or loss of data, any unauthorized use, and unauthorized access, pursuant to Art. 32 of Regulation (EU) 2016/679.

V. Communication and dissemination of data

The personal data collected relating to the user will not be disclosed in any way, except for the Data Controller's right, without the data subject's consent, to communicate such data to certain categories of entities whose activities are necessary and related to the achievement of the purposes set out in this policy, such as, but not limited to, affiliated and related companies, third-party companies providing IT, banking, financial, and insurance services, archiving, assistance, and consulting services, including companies managing social networks, administrative and judicial authorities with the authority to request and obtain information about you, and public authorities or bodies.

The Data Controller informs you that personal data may also be transferred to countries outside the European Union or the European Economic Area (so-called Third Countries) recognized by the European Commission as having an adequate level of personal data protection or, otherwise, only if a level of personal data protection adequate to that of the European Union is contractually guaranteed by the Data Controller's suppliers located in the Third Country (e.g., by signing the standard contractual clauses provided by the European Commission) and that the exercise of data subjects' rights is always ensured.

VI. Rights of the interested party

The data subject may at any time exercise the rights set forth in Articles 15 et seq. of Regulation (EU) 2016/679. Specifically, the data subject may request confirmation from the Data Controller as to whether or not personal data concerning him or her exists, access to his or her personal data, rectification or erasure of such data, restriction of processing, or objection to such processing. The data subject also has the right to data portability and the right to lodge a complaint with a supervisory authority. The data subject may obtain information regarding the source of the personal data and, if applicable, whether the data originates from publicly accessible sources. Furthermore, if the processing is based on explicit consent, the data subject has the right to withdraw consent at any time without affecting the lawfulness of processing based on consent before its withdrawal. To ensure that your data is not infringed or misused by third parties, before accepting your request to exercise one of the rights indicated, we will ask you for some information to be certain of your identity.

The interested party may exercise his or her rights by sending a written request to the email address: privacy@makwheels.it.

Information on the processing of customer personal data

pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and other national and European legislation as applicable

I. Data controller

For any need related to the processing of your personal data, the Data Controller can be reached by writing to the following email address: privacy@makwheels.it.

II. Type and origin of personal data processed

The personal data processed by the Data Controller are communicated directly by the customer for the establishment and execution of the contractual relationship with the Data Controller.

The data processed by the Data Controller includes the following categories of data: (i) customer personal data (first and last name or company name, residential or registered office address, VAT number and/or tax code), including login credentials (username and password) for the customer-only area on the company websites (hereinafter "B2B Area"); (ii) contact information (telephone, email, and/or certified email); (iii) customer banking and payment information (currency, payment terms, SDI code for electronic invoices, bank details), including, if the customer is a legal entity, the data of the legal representative, as well as the customer's employees and/or collaborators involved in the activities under the contract. In the latter case, personal data relating to natural persons involved in the performance of the contract entered into with the customer may be processed, relating to the contractual relationship itself, and the source of the personal data is the customer.

Except where specifically required by law, the Data Controller does not collect personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership. It does not process genetic data, biometric data intended to uniquely identify a natural person, or data concerning health or the sex life or sexual orientation of customers. The Data Controller requests that you refrain from providing such data.

III. Purpose of the processing

a. establishment and execution of the contractual relationship concerning the provision of services and the supply of products offered by the Data Controller, including through the B2B Area, and all related activities;
Legal basis: performance of a contract to which the customer is a party or pre-contractual measures taken at the customer's request, with regard to the processing of customer data; legitimate interest of the Data Controller in connection with the performance of the contract to which the customer is a party, with regard to the processing of the data of the customer's employees and/or collaborators;

b. fulfillment of regulatory, tax and fiscal obligations arising from the performance of business activities;
legal basis: fulfillment of legal obligations to which the Data Controller is subject;

c. assert or defend a right in court, as well as in administrative proceedings or in arbitration and conciliation procedures in the cases provided for by law;
legal basis: legitimate interest of the Data Controller.

If, in the execution of the contract, you need to go to the Data Controller's company headquarters:

d. the Data Controller informs the interested party that he or she may be filmed using a video surveillance system installed on the company premises and in the areas pertaining to the premises, including the entrances and external perimeter areas;
Legal basis: legitimate interest of the Data Controller related to the protection of company assets.

The Data Controller informs you that failure to provide the personal data requested for the purposes referred to in letters a), b), c) and d) of this paragraph III will objectively make it impossible to proceed with the establishment of the contractual relationship and/or its execution.
Subject to your free, explicit, and informed consent, the Data Controller may also process your data for the following purposes:

e. direct marketing, through the periodic sending of commercial communications (newsletters) via email concerning the offer of products or services provided by the Data Controller;
Legal basis: consent of the interested party.

Since the processing of personal data for the purposes referred to in letter e) above is not mandatory for the execution of the contractual relationship with the Data Controller, we confirm that the data subject is not required to provide consent for this type of processing.

IV. Data processing methods and data retention period

The personal data of data subjects are processed using paper and/or electronic means by persons authorized to process data pursuant to Art. 29 of Regulation (EU) 2016/679 or by data processors appointed pursuant to Art. 28 of Regulation (EU) 2016/679 for the time necessary to achieve the purposes for which they were collected or for any other related legitimate purpose, and in any case—after the expiration of the contractual relationship—no later than the expiration of the legally required terms for the protection of rights and/or legal obligations, adopting adequate security measures to prevent the destruction or loss of data, any unauthorized use, and unauthorized access, pursuant to Art. 32 of Regulation (EU) 2016/679.

The Data Controller informs you that the collection and storage of your data may also occur through the use of the Google Forms application, owned by Google Ireland Limited, with headquarters at Gordon House, Barrow Street, Dublin 4, Ireland. For any further information regarding the processing of your data through this application, please refer to the provider's Privacy Policy published at the following link: https://policies.google.com/privacy.

V. Communication and dissemination of data

The personal data collected relating to the customer, as well as, in the cases referred to in paragraph 1 of this policy, to the customer's employees and/or collaborators, will not be disclosed in any way. The Data Controller reserves the right, without the data subject's consent, to communicate such data to certain categories of entities whose activities are necessary and related to the achievement of the purposes set out in this policy. These entities include, but are not limited to, third parties providing or distributing technical and IT services, marketing and communications services, banking, financial, and insurance services, archiving services, including databases, legal assistance and professional consultancy, administrative and judicial authorities competent to request and obtain information about you, and public authorities or bodies.

VI. Rights of the interested party

The interested party may exercise his or her rights by sending a written request to the email address: privacy@makwheels.it.

Information on the processing of suppliers' personal data

I. Data controller

For any need related to the processing of your personal data, the Data Controller can be reached by writing to the following email address: privacy@makwheels.it.

II. Type and origin of personal data processed

The personal data processed by the Data Controller are communicated directly by the supplier for the establishment and execution of the contractual relationship with the Data Controller.

The personal data processed includes the following categories of data: personal details, contact details, and bank details of the supplier, including those of the legal representative, as well as those of the supplier's employees and/or collaborators involved in the activities under the contract. Therefore, personal data relating to natural persons involved in the performance of the contract and related to the contractual relationship itself may be processed. In the latter case, the source of the personal data is the supplier.

Except where specifically required by law, the Data Controller does not collect personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership. It does not process genetic data, biometric data intended to uniquely identify a natural person, data concerning health, or data concerning the sex life or sexual orientation of suppliers. The Data Controller requests that you refrain from providing such data.

III. Purpose of the processing

a. establishment and execution of the contractual relationship with the Data Controller;
Legal basis: performance of a contract to which the supplier is a party or pre-contractual measures taken at the request of the supplier, with regard to the processing of the supplier's data; legitimate interest of the Data Controller related to the performance of the contract to which the supplier is a party, with regard to the processing of the data of the supplier's employees and/or collaborators;

b. fulfillment of regulatory, tax and fiscal obligations arising from the performance of business activities;
legal basis: fulfillment of legal obligations to which the Data Controller is subject;

The Data Controller informs you that failure to provide the personal data requested for the purposes referred to in letters a), b), and c) of this paragraph III will objectively make it impossible to proceed with the establishment of the contractual relationship and/or its execution.

If, in the execution of the contract, you need to go to the Data Controller's company headquarters:

IV. Data processing methods and data retention period

V. Communication and dissemination of data

The personal data collected relating to the supplier, as well as, in the cases referred to in paragraph 1 of this policy, to the supplier's employees and/or collaborators, will not be disclosed in any way. The Data Controller reserves the right, without the data subject's consent, to disclose such data to certain categories of entities whose activities are necessary and related to the achievement of the purposes set out in this policy. These entities include, but are not limited to, third-party companies providing technical and IT services, banking, financial, and insurance services, archiving, assistance, and consulting services, administrative and judicial authorities competent to request and obtain information about you, and public authorities or bodies.

VI. Rights of the interested party

The data subject may at any time exercise the rights set forth in Articles 15 et seq. of Regulation (EU) 2016/679. Specifically, the data subject may request confirmation from the Data Controller as to whether or not personal data concerning him or her exists, access to his or her personal data, rectification or erasure of the data, restriction of processing, or objection to processing. The data subject also has the right to data portability and the right to lodge a complaint with a supervisory authority. The data subject may obtain information regarding the source of the personal data and, if applicable, whether the data originates from publicly accessible sources. Furthermore, if the processing is based on explicit consent, the data subject has the right to withdraw consent at any time without affecting the lawfulness of processing based on consent before its withdrawal. To ensure that your data is not infringed or misused by third parties, before accepting your request to exercise one of the rights indicated, we will ask you for some information to be certain of your identity.

The interested party may exercise his or her rights by sending a written request to the email address: privacy@makwheels.it.

Information on the processing of candidates' personal data

I. Data controller

For any need related to the processing of your personal data, the Data Controller can be reached by writing to the following email address: privacy@makwheels.it.

II. Type and origin of personal data processed

The personal data processed by the Data Controller are communicated directly by the interested party as part of the selection process functional to the possible establishment of an employment and/or collaboration relationship with the Data Controller.

The personal data processed includes the following categories of data: personal details, contact information, family composition, information relating to educational background and previous and current professional experience, as well as any other information useful for evaluating your CV and verifying your possession of the requirements requested by the Data Controller to establish an employment relationship.

Except where specifically required by law, the Data Controller does not collect personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership. It does not process genetic data, biometric data intended to uniquely identify a natural person, data concerning health, or data concerning the sex life or sexual orientation of candidates. The Data Controller requests that you refrain from providing such data.

III. Purpose of the processing

a. recruitment, selection and evaluation of personnel to be hired or with whom to establish collaborative relationships of any kind;
legal basis: execution of pre-contractual measures at the request of the interested party;

b. compliance with regulations regarding training, hygiene, workplace safety, social security, assistance, prevention of accidents and occupational diseases (Legislative Decree no. 81/2008);
Legal basis: fulfillment of legal obligations.

If during the selection process you need to go to the Data Controller's company headquarters:

c. the Data Controller informs the interested party that he or she may be filmed using a video surveillance system installed on the company premises and in the areas pertaining to the premises, including the entrances and external perimeter areas;
Legal basis: legitimate interest of the Data Controller related to the protection of company assets.

The Data Controller informs you that failure to provide the personal data requested for the purposes set out in this paragraph III will objectively make it impossible to evaluate your application.

IV. Data processing methods and data retention period

The personal data of data subjects are processed using paper and/or electronic means by persons authorized to process them pursuant to Art. 29 of Regulation (EU) 2016/679 or by data processors appointed pursuant to Art. 28 of Regulation (EU) 2016/679 for the time necessary to achieve the purposes for which they were collected or for any other related legitimate purpose, and in any case—after the conclusion of the selection process—no later than the expiration of the legally required terms for the protection of rights and/or legal obligations, adopting adequate security measures to prevent the destruction or loss of data, any unauthorized use, and unauthorized access, pursuant to Art. 32 of Regulation (EU) 2016/679.

V. Communication and dissemination of data

The personal data collected relating to the candidate will not be disclosed in any way, except for the Data Controller's right, without the data subject's consent, to communicate such data to certain categories of entities whose activities are necessary and related to the achievement of the purposes set out in this policy, such as, by way of example and not limited to, third-party companies providing technical and IT services, archiving, assistance, and consulting activities, administrative and judicial authorities competent to request and obtain information about you, public authorities, or public bodies.

VI. Rights of the interested party

The interested party may exercise his or her rights by sending a written request to the email address: privacy@makwheels.it.

Privacy Policy

Information on the processing of personal data of website users

Information on the processing of customer personal data

Information on the processing of suppliers' personal data

Information on the processing of candidates' personal data

GERMANY / AUSTRIA