INFORMATION on the PROCESSING OF PERSONAL DATA
Pursuant to art. 13 European Regulation for the Protection of Personal Data 679/2016 hereinafter GDPR
1. This information
1.1 EDRA S.p.A. takes into utmost consideration the importance of guaranteeing the privacy and protection of personal data in compliance with applicable Italian and European legislation, and describes herein below the methods of processing the personal data of those (“User”, “Users”) who register in the community Oncommunity, directly from this site, or even through a link from another site or through other registration methods.
1.2 This Web Site contains links to other Web sites: this information does not concern such other Web sites that may be consulted by the User through specific links. They may contain “information on the processing of personal data” differing, in whole or in part, from this Information. EDRA S.p.A. therefore invites the User to examine the privacy policy of each site to which he connects, before entering any personal information.
1.3 This information applies to the personal data of Oncommunity Users collected through this Web Site or through the other available registration methods, as well as to any connected treatments.
1.4 This is the current privacy policy updated on the date that appears at the bottom: EDRA S.p.A. reserves the right, at any time, to modify and update it.
1.5 The declarations of EDRA S.p.A., all set out below, integrate the Legal Notes (Terms and Conditions of Use) of the Web Site but are not of a contractual nature and therefore do not generate contractual obligations towards the User and corresponding rights of the User.
2. Data Controller
2.1 The Data Controller of personal data is: EDRA S.p.A., a company incorporated under Italian law with registered office in Milan, registered with Company Register of Milan under number 08056040960.
3. Place of processing of personal data
3.1 The processing of personal data takes place at the registered office of EDRA S.p.A. indicated above. The data shall be stored in a Data Center located in the registered office of EDRA S.p.A. in Milan and in the Data Center of Elmec Informatica located in via Pret n. 1 Brunello (VA) Italy, appointed External Data Processor pursuant to art. 28 GDPR.
4. Type of data processed
Traffic data and data of Users browsing this Web Site
4.1 The computer systems and software procedures used to operate this Web Site acquire, during their normal operation, some personal data whose transmission is implicit in the use of Internet communication protocols. This category of data includes the IP addresses or domain names of the computers used by Users who connect to the site, the addresses in URI (Uniform Resource Identifier) notation of the requested resources, the time of the request, the method used to submit the request to the server, the size of the file obtained in response, the numerical code indicating the status of the response given by the server (successful, error, etc.) and other parameters relating to the operating system and the User’s IT environment.
4.2 The Web Site also acquires and stores the data-sequence URL (Uniform Resource Locator) identifying the resources visited or searched by the User on the Internet (e.g. Web pages, documents, images, etc.), including the date and time of access and their content.
4.3 The Web Site also acquires data and information from the User’s computer through the use of cookies: permanent and/or “session”:
– permanent cookies: the Website’s computer system, during its normal operation, sends some data from the EDRA S.p.A. server to the User’s browser which are stored on the User’s computer hard disk to allow navigation in some specific areas reserved for the site.
– session cookies: the Website’s computer system sends some data consisting of random numbers generated by the server, the so-called session cookies, which are not stored permanently on the User’s computer and which therefore disappear when the computer shuts down . The sending of such data is used to allow the transmission of session identifiers, necessary for the safe and efficient exploration of the Web site and to collect information on the use of the site by the User.
Any profiling cookies are processed for the sole purpose of allowing the use of personalized banners. No targeted advertising will be sent instead thanks to the use of such cookies. The consent to the use of the same must be expressed by accepting the use of the Web site as per the Privacy Guarantor Act of 4 June 2014.
4.4 Most of the Users’ browsers are set up to automatically accept cookies, but the Users can set their browser to deactivate, once and for all or from time to time, the receipt and saving of new cookies; or the User can set its computer to receive a warning when it is about to store a cookie. If cookies are deactivated, the User, while being able to access the Web Site, may not be able to navigate in specific and/or restricted areas.
4.5 In general, the Web Site acquires and stores – and sometimes communicates to third parties – all the navigation data described above exclusively in anonymous and aggregated form. The processing of such data allows the Data Controller to manage and control the proper functioning of the Site and to carry out statistics and sampling for promotional or scientific purposes.
Data voluntarily disclosed by the User.
4.6 The Web Site may sometimes ask the User to provide some personal information such as, for example, name and surname, etc. for registration in the community, the provision of data such as personal data, data of enrollment in professional registers, telephone number, e-mail address, are mandatory, while the provision of data such as professional and personal addresses are optional and depend only on the User’s will.
4.7 The User, in order to have access to certain contents of the Web Site in specific restricted areas and to be able to take advantage of the full functionality of the web Site, has the duty to:
– get a unique key pair (Username and Password) through a registration procedure;
– subsequently, for each new session, enter his Username and Password for recognition by the authentication system.
4.8 The personal data collected from the form filled in by the User upon his voluntary registration (Registration data) consist of information relating to the User’s contacts and so, for example: name and surname or name of the company, association or legal entity , professional title, postal address, e-mail address, telephone number, fax number. The Web Site’s computer system automatically associates these data with the Username and Password chosen by the User and connects them to an account. In subsequent accesses to the first, it will be possible to access the personal registration data only by typing in the Username and Password; the User is therefore fully responsible for the adequate custody of his Username and Password.
Data provided by third parties
4.9 The IT system of the Site sometimes also processes personal data and contacts of Users published in public categorical directories (e.g. single database of telephone subscribers, databases of professional associations, databases of social security institutions in the medical-health categories, etc.). As such, these data may be processed by EDRA S.p.A. as independent data controller, in compliance with the provisions of the GDPR and in particular with those provisions regarding unwanted communications (e-mail, SMS, MMS, electronic faxes).
5. Purpose of processing
User’s personal data provided shall be lawfully processed for the following purposes:
5.1 Activities strictly connected and functional to the operation of the services offered to Oncommunity users: for example, allowing the User to access the services offered and view the contents of the Web Site; allow the User to receive the requested products or services, executing the orders received; respond to the User’s questions and requests, receive the various services offered by EDRA S.p.A.
5.2 Technical management of the Web Site and its information system, for example, acquisition, feedback and management of account information; securing and checking the correct functioning of the Site; monitoring the activity of the Web Site;
5.3 Enrichment or personalization of the contents, services, or design of the Web Site during a single visit, or repeated accesses;
5.4 Profiling in aggregate form (i.e. anonymous, without any prejudice to the privacy and confidentiality of the data of each registered owner), of Users and their access to reserved specialist pages, for the purpose of scientific and/or market research, analysis, and for the elaboration of reports, carried out directly by EDRA S.p.A. or also through specialized third-party companies;
5.5 Communication with the User regarding changes or updates to the Web Site and its services;
5.6 Advertising communications, communications of special offers and promotions concerning the products/services of EDRA S.p.A.;
5.7 Requests for market surveys or participation in Scientific Information activities, also on behalf of third parties, to which the User can freely choose whether to join or not.
5.8 Communicate the data provided by the user to third parties who use them as independent Data Controllers, for informational or promotional purposes, with the sole consent of the interested party;
6. Processing methods.
6.1 The processing of personal data takes place using computerised, telematic, manual tools, both as EDRA S.p.A. and as Oncommunity or with other names and commercial signs of the group of which Edra is the controlling company.
6.2 Data processing takes place in compliance with the GDPR and the provisions defined within the EDRA S.p.A. organization described in the Processing Registers and in the Programmatic Security Document, which the Company shall keep updated.
7. Categories of subjects who process the data.
7.1 The processing is carried out by the Data Controller and his appointees: employees, agents, representatives, third party suppliers (e.g. companies that provide data processing services, invoice printing, enveloping and labeling of products purchased online, shipping, etc.).
7.2 The processing is also carried out by the other companies of the group of which EDRA S.p.A. is the controlling company and by third parties (companies, associations, legal entity, etc.) for which the Data Controller acts as an agent, licensee, publisher and/or as a counterparty of a specific contract, and only with the consent of the interested party and in relation to the purposes listed above.
In the cases envisaged by art. 28 of the GDPR (i.e. when the company carries out processing on behalf of other independent Data Controllers) EDRA S.p.A. is appointed Data Processor.
7.3 The processing of data by EDRA S.p.A. and its employees and or collaborators may take place regardless of the User’s consent in the following cases:
7.3.1 at the request of the Judicial Authority, or to defend or protect one’s rights in administrative, judicial or arbitration proceedings;
7.3.2 for contractual and pre-contractual purposes;
7.3.3 in the event that the processing of data is necessary to allow investigations aimed at countering illegal activities, acts in fraud of the law, or to guarantee the safety of people or things; in all cases, in general, in which the transmission of data is required by law;
7.3.4 in the event that EDRA S.p.A. is acquired by, transferred or merged with another company, or in the event that this Site or some of its contents are transferred to third parties.
8. Rights of data subjects
8.1 The Oncommunity User is solely responsible for the truthfulness of the personal information entered therein. Pursuant to articles 15 to 21 of the GDPR, the User has the right:
1. obtain confirmation of the existence or not of personal data concerning him, even if not yet registered and their communication in an intelligible form.
2. obtain the following information:
a) the origin of the personal data;
b) the purposes and methods of processing;
c) the logic applied in the event of processing carried out with the aid of electronic means;
d) the identification details of the Data Controller, of the Data Processors
e) the persons or categories of persons to whom their personal data may be disclosed or who may become aware of them in their capacity as Data Processors or persons in charge of processing.
3. obtain:
a) access, update, amendment or, where interested, integration of the data;
b) the deletion, transformation into anonymous form or restriction of the data processed in breach of the law, including data whose storage is not necessary in relation to the purposes for which the data were collected or subsequently processed;
c) proof that the operations referred to in letters a) and b) were communicated, also with regards to the content thereof, to the subjects to which the data was communicated or disseminated, except where this would result impossible or implies a clearly excessive effort as compared to the protected right.
The User can exercise these rights guaranteed by applicable law by contacting at any time EDRA S.p.A. at the Contacts indicated in point 11 below.
8.2 Starting from 25 May 2018, the User may also, pursuant to articles 15-21 of the GDPR, exercise the following specific rights:
- right of access
- right of amendment
- right to erasure (right to be forgotten), with the exception of the case in which the treatment is necessary for the Data Controller, for the exercise of the rights to freedom of expression and information, for the fulfillment of a legal obligation or for the execution of a task carried out in the public interest, for storage purposes in the public interest, for scientific or historical research or for statistical purposes, for the establishment, exercise or defense of a right in court.
- right to restriction of processing
- right to object
- right to withdraw his consent at any time, if the processing is based on his consent;
- right to lodge a complaint with the Guarantor Authority for the protection of personal data
Therefore, if the User wishes to exercise this right, he can express his will by contacting EDRA S.p.A. at one of the addresses indicated in point 11, infra.
8.3 EDRA S.p.A. reserves the right to communicate changes or updates to the Site to the User whenever necessary.
9. Retention of personal data
9.1 EDRA S.p.A. shall keep User’s personal data for as long as such information is deemed relevant for commercial purposes, and in any case up to a maximum of ten years from the last interaction or until the User requests the deletion of his own data by contacting EDRA S.p.A. at one of the addresses indicated in point 11, infra.
10. Information Security
10.1 EDRA S.p.A. takes the right of its Users to privacy and protection of their personal data into the utmost consideration and therefore shall strive to protect the privacy of Oncommunity Users.
10.2 Personal and demographic data including access credentials (username / login and password) of each User are sent and stored on servers equipped with firewalls and physically located in protected data centers.
10.3 Login and password transit on the Internet in encrypted form on SSL protocol. Other personal data transit between data centers over MPLS private lines in encrypted form.
10.4 The implementation of lockout management systems (which provide for blocking access in the event of repeated incorrect accesses) also make it possible to protect accounts from intrusion or hacking attempts by unauthorized third party Users.
10.5 Furthermore, EDRA S.p.A. adopts internal security procedures described in the Programmatic Security Document (DPS) including, for example, the filtering of access and use of data by its appointees.
10.6 EDRA S.p.A. cannot in any case be responsible for any unauthorized access, for loss of data (e.g. password), illicit/incorrect use, or for alterations of personal data that occur beyond its control, nor can it ensure the correct and safe use of the User’s personal data by third parties.
11. Contacts
11.1 The User can exercise the rights recognized by the art. 7 of Legislative Decree 196/2003 and submit any request, question, comment, or dispute regarding this information, or the way in which your personal data is processed on the Site to:
EDRA S.p.A.
via Enrico Forlanini no. 21, 20134 Milan, Italy
tel +39 02 88184.1;
fax +39 02 88184.301;
email privacy@lswr.it
12. DPO
The Owner pursuant to art. 37, co. 1, letter b) of the GDPR has appointed the Data Protection Officer (the “DPO”) who can be contacted at the following addresses:
dpo@lswr.it
tel. +39 02.88.184.1
Revision dated 10 February 2026