Professional Area

Privacy Policy pursuant to article 13 of EU Regulation 2016/679 – GDPR – Privacy Policy for the processing of personal data obtained from the data subject and Article 130 of the Privacy Code

What is the purpose of this privacy policy

In compliance with the provisions of Regulation (EU) 2016/679 (General Data Protection Regulation), this Privacy Policy provides information about how we process the personal data that you provide. This Privacy Policy is provided pursuant to article 13 of the GDPR. This privacy policy is not valid for other websites that may be accessed through links present on the website(s) owned by the data controller, who cannot be help responsible in any way for third-parties websites. This privacy policy is also inspired by the provisions of Directive 2009/136/EC, regarding cookies, the Guidelines on cookies and other tracking technologies issued by the Italian Data Protection Authority and the EDPB Guidelines 05/2020 on consent under the GDPR, adopted on May 4, 2020.

Personal data processed:

Personal Data: “personal data”: means any information relating to an identified or identifiable natural person (“data subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person; (C26, C27, C30 GDPR)

Data of the contracting parties/users.

Browsing data
The computer systems and software procedures used to operate this website acquire, during their normal functioning, personal data whose transmission is implied in the use of Internet communication protocols. This data is not collected for the purpose of being associated with identified data subjects, but could, by its very nature, through processing and association with data held by third parties, allow users to be identified. This category of data includes the IP addresses or domain names of the computers used by users to access the website, the addresses in the URI (Uniform Resource Identifier) notation of the resources requested, the time of the request, the method used to submit the request to the server, the size of the file obtained as reply, the code number indicating the status of the reply from the server (successful, error, etc.) and other parameters relating to the user’s operating system and computer system.

Data provided by the data subject
The optional, explicit and voluntary sending of messages to the contact addresses indicated on this website and/or the compilation of data forms implies the subsequent acquisition of the sender's address, necessary to respond to requests, as well as any other personal data entered

Specific privacy policies
Specific privacy policies may be present on the pages of the website for particular services or processing of the data provided.

Cookies. What are cookies? Why are cookies used?

For more information on the cookies used by this website, see the cookie policy in the footer and on the following link.

1. Data controller

pursuant to articles 4 and 24 of EU Regulation 2016/679, is Mitsubishi Electric Europe B.V., with registered office in 1119NS Schiphol – Rijk Capornilaan 34, The Netherlands, branch office in Campus Energy Park, Via Energy Park n. 14, 20871 Vimercate (MB), represented by its legal representative, and may be contacted on the following email address privacy@it.mee.com

2. Data protection officer

(RPD/DPO- Data Protection Officer), pursuant to articles 37 – 39 of EU Regulation 2016/679, who may be contacted on MEU.DMO@mecc.mee.com

3. Purpose and legal basis of processing, retention period, nature of the provision of data

Purpose of processing	Legal basis	Retention period	Nature of the provision of data
Browsing on this website. These data, which are necessary to use the web services, are processed in order to obtain statistical information on the use of services (most visited pages, number of visitors per time slot or day, geographical areas of origin, etc.); check the correct operation of the services offered. The data will be used to ascertain liability in the event of hypothetical computer crimes against the website.	Processing is necessary for the purposes of the legitimate interests pursued by the Data Controller or a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require the protection of personal data, taking into account the reasonable expectations of the data subject and the activities strictly necessary for the operation of the site and browsing. (Article 6, paragraph 1 (f) and C47 of the GDPR)	Browsing data will be retained for the duration of the browsing session and in any case do not persist for more thana few days (unless this is necessary to investigate crimes by the judicial authority).	The provision of data is necessary to browse the website.
Use of cookies and comparable technologies. See the cookie policy in the footer of the website.	For the necessary non-technical comparable cookies and technologies, processing is based on consent to the processing of personal data (article 6 (1) (a) and C42, C43 of the GDPR).	See the cookie policy in the footer of the website.	See the cookie policy in the footer of the website.

In addition to browsing:

Purpose of processing	Legal basis	Retention period	Nature of the provision of data
A) personal data will be processed, according to each data collection area, in order to manage the service requested and for the related activities for:
CONTACTS, sending contact requests, information, for the management of the service, assistance, returns, technical support	processing is necessary to execute a contract to which the data subject is a party or in order to take steps at the request of the data subject prior to entering into a contract; (C44) article 6, paragraph 1(b) of the GDPR	Maximum 12 months	The provision of data is mandatory. Failure to provide the necessary data will make it impossible to receive the service
CUSTOMER AREA, to access the reserved area, download information, documentation, videos, etc.	processing is necessary for the performance of a contract to which the data subject is a party or in order to take steps at the request of the data subject prior to entering into a contract (C44) Article 6(1) (b) of the GDPR	Through to termination of the contract and the time actually required to disable the credentials
MANAGEMENT OF DEDICATED INITIATIVES (e.g., warranty extension) - where applicable -	Processing is necessary for the purposes of the legitimate interests pursued by the Data Controller (Art. 6(1), lett. f) of the GDPR)	Maximum 12 months or until the termination of the contract, and in any case for a period not exceeding the achievement of the purposes for which the personal data are processed
SURVEY (without marketing communication) for the verification of the quality of services provided, including by third parties on behalf of the Data Controller, via e-mail. - where applicable -	processing is necessary for the performance of a contract to which the data subject is a party or in order to take steps at the request of the data subject prior to entering into a contract (C44) Article 6(1) (b) of the GDPR	administrative-accounting activities (10 years)
REGISTRATION FOR PAID TRAINING COURSES/WEBINAIRS - where applicable -	processing is necessary for the performance of a contract to which the data subject is a party or in order to take steps at the request of the data subject prior to entering into a contract (C44) Article 6(1) (b) of the GDPR	Administrative and accounting services (10 years)
REGISTRATION FOR FREE TRAINING COURSES/EVENTS/WEBINAIRS - where applicable -	The processing is necessary for the pursuit of the legitimate interest of the data controller or of a third party, provided that the interests or the fundamental rights and freedoms of the data subject, which require the protection of personal data, do not override, taking into account the reasonable expectations of the data subject (Article 6(1)(f) and Recital 47 of the GDPR)	administrative-accounting activities (10 years)
REGISTRATION WITH THE DEDICATED PROFESSIONAL TEAM PORTAL, with issue of a card customized with the company name. The Professional Team of Mitsubishi Electric is the club for installers and wholesalers of the thermohydraulic and electrical industries. Professional Team offers previews of new products, courses and training programmes, updates on laws and regulations. Professional Team includes promotions and commercial initiatives to ensure greater competitiveness on the market to members. - where applicable -	processing is necessary for the performance of a contract to which the data subject is a party or in order to take steps at the request of the data subject prior to entering into a contract (C44) Article 6(1) (b) of the GDPR	Through to termination of the contract and the time actually required to disable the credentials
RECRUITMENT OF PERSONNEL IN THE WORK WITH US AREA to submit an application for the recruitment of personnel in order to establish an employment relationship, even for positions other than those for which the data subject spontaneously has submitted an application; storage of personal data above all for future recruitment; management of applications in response to job offers published on our website; interviews and any video-interviews (processing of data including images/audio). For other purposes related to recruitment, please refer to the specific information in the dedicated area if this is present on the website - where applicable -	processing is necessary to execute a contract to which the data subject is a party or in order to take steps at the request of the data subject prior to entering into a contract; (C44) article 6, paragraph 1(b) of the GDPR. For other purposes related to recruitment, please refer to the specific information in the dedicated area if this is present on the website	Maximum 24 months. As a general rule, the data collected during the recruitment process will be deleted as soon as it is known that the applicant will not be offered a job or that the offer will not be accepted by the applicant. For other purposes related to recruitment, please refer to the specific information in the dedicated area if this is present on the website	The provision of data is mandatory. Failure to provide the necessary data will make it impossible to submit a job application. For other purposes related to recruitment, please refer to the specific information in the dedicated area if this is present on the website
B) DIRECT MARKETING, to send advertising or direct sales material or carry out market research and analysis, customer satisfaction surveys or send commercial and promotional communications, newsletters, communications about events, invitations or similar sent by email, by automated (email) and traditional methods (telephone and letter mailings). Communications may contain promotional activities and/or logos of third parties and companies belonging to the group. Personal data will not be transferred. For a complete list of group companies and partners, please write to privacy@mee.com. In order to compare and possibly improve the results of automated communications, the Data Controller uses systems with reports. Thanks to the reports, the Data Controller is able to know, for example: the number of readers, openings, unique 'clickers' and 'clicks'; the devices and operating systems used to read the communication; the details of the activities of individual users; details of the emails sent, delivered or not delivered, emails forwarded. The above data are used to compare, and possibly improve, the results of communications.	Processing is based on consent to the processing of personal data (C42, C43) article 6, paragraph 1(A) of the GDPR. Consent is given at the same time for direct marketing by both automated and traditional methods.	Until consent is revoked (or the data subject opts-out). Revocation may also be exercised separately for direct marketing by automated methods only or for direct marketing by traditional methods only.	The provision of data is optional. Failure to provide the necessary data will make it impossible to send direct marketing communications
C) NON-AUTOMATED PROFILING: in order to carry out analyses, evaluations and subdivide the data subjects into similar groups by specific characteristics of activities in order to better manage the services, allow us to analyse the profile, area and sector to which they belong, create clusters, analyse habits, consumptions and behavioural preferences, in order to retain loyalty and improve the commercial offer, the services proposed and allow us to send communications that might be of interest to you and for a more customised service. The processing of personal data may involve customer care activities, by offering customised and courtesy services. These purposes are also pursued by entering the data in the Data Base/company CRMs/platforms and the data will also be processed by the other branch offices.	Processing is based on consent to the processing of personal data (C42, C43) article 6, paragraph 1(A) of the GDPR	Until consent is revoked and in any case no more than 12 months. No more than 3 years for the activities related to dedicated Professional Team portal and generally for training course.	The provision of data is optional. Failure to provide the necessary data will make it impossible to carry out analyses and/or send targeted communications.
D) MANAGEMENT OF REQUESTS TO EXERCISE THE RIGHTS OF DATA SUBJECTS, pursuant to art. 15 et sequitur of the GDPR (rights of the data subject)	Data processing is necessary to fulfil a legal obligation of the Data Controller (C45) Article 6, paragraph 1(c) of the GDPR	5 years of when the request is settled, other than in the case of pending litigation	The provision of personal data is mandatory, given that this is necessary to fulfil legal obligations.

4. To whom will your data be communicated? Data recipients

Your personal data will be disclosed to persons who will process your data as independent Data Controllers or Data Processors (Article 28 of the GDPR) and will be processed by natural persons (Article 29 GDPR) acting under the authority of the Data Controller and Data Processors based on specific instructions given on the purposes and methods of processing. Your data may be disclosed to recipients belonging to the following categories:

Entities based in Italy and in EEA countries that provide services for the website and communication networks, including email, hosting, website management, platforms, and CLOUD, management systems;
Mitsubishi Electric Group companies, for the sales/distribution and assistance network in the territory;
Firms or companies in the field of assistance and consultancy, including trainers for training purposes;
Commercial information companies for assessing solvency and payment habits and/or to entities for debt recovery purposes in case of administrative-accounting purposes;
Entities based in Italy, with whom the Data Controller has entered into agreements and prior consent, where required;
For direct marketing, with prior consent, to entities for managing direct marketing activities;
For the \"work with us\" section, to entities for managing recruitment activities;
Competent authorities for compliance with legal obligations and/or public body provisions, upon request.

In order to receive the list of Data Processors pursuant to Article 28 please write to privacy@it.mee.com or the other addresses above.

5. Are data transferred to non-eea countries?

Personal data will be transferred to countries outside the EEA in order to fulfill the purposes outlined above. The data will be transferred in accordance with Articles 44 et seq. of EU Regulation 2016/679, to third countries with an adequacy decision or to entities with whom Standard Contractual Clauses (SCC) established by the European Commission have been signed. The data subject may obtain information about the safeguards for data transfer by sending an email to privacy@it.mee.com

6. Will automated decision-making processes be used?

Your personal data will be processed using traditional, electronic and automated processing methods. No fully automated decision-making process is in use.
With reference to profiling activities, which may be carried out with the explicit consent of the data subject as indicated in the purposes, it will be conducted through the intervention of the operator who will process the data subject's profile and analyze their habits and consumption choices, in order to improve the commercial offer and services of the data controller (non-automated profiling).

7. What are your rights? How can you exercise your rights?

You may exercise your rights as set out by article 15 et sequitur of Regulation (EU) 2016/679, by contacting the Data Controller, sending an e-mail to privacy@it.mee.com or writing to the above contact addresses. You have the right, at any time, to request any of the following rights: right of access (article 15), right to rectification (article 16), right to erasure (article 17), right to restriction of processing (article 18). The controller shall communicate (article 19) any rectification or erasure of personal data or restriction of processing to each recipient to whom the personal data have been disclosed. The controller shall inform the data subject about those recipients if the data subject requests this. In addition, in the cases envisaged you have the right to data portability (article 20) and in this case you will receive your personal data in a structured, commonly used, machine-readable and interoperable format. You have the right to object (article 21), at any time, to the processing of your data based on legitimate interest, and withdraw any consent given without prejudice to the lawfulness of the processing based on your consent prior to the withdrawal of such consent.
To stop receiving automated direct marketing communications (email), it will be sufficient to send an email at any time to privacy@it.mee.com with the subject “unsubscribe from automated” or use our automatic unsubscription system for emails only.
To stop receiving traditional direct marketing communications (calls with an operator and postal mail), it will be sufficient to send an email at any time to privacy@it.mee.com with the subject “unsubscribe from traditional.”
To stop receiving any marketing communications, it will be sufficient to send an email at any time to privacy@it.mee.com with the subject “unsubscribe marketing.”
You can withdraw your consent to profiling (non-automated) by sending an email at any time to privacy@it.mee.com with the subject “no profiling.”
If you believe that the processing of your personal data by the Data Controller is in violation of Regulation (EU) 2016/679, you have the right to lodge a complaint with the supervisory authority, particularly in the member state where you reside or work, or where the alleged violation of the regulation occurred, or to take appropriate legal action. There is no existence of fully automated decision-making processes.

8. Changes to the privacy policy

The Data Controller reserves the right to modify, update, add or remove parts of this privacy policy. In order to facilitate verification and modification of the text, the date of update will be shown in the privacy policy.
Date of update: 26 March 2025