App TrackAdvice - Privacy Policy

This Privacy Policy is intended to describe the purposes and methods through which Italtractor ITM S.p.A., with registered office at via Confortino 30, 40056 Valsamoggia, Bologna, Italy, as Data Controller ("Company" or "Data Controller"), collects and processes personal data relating to the user ("User") who interacts with the TrackAdvice App ("App") and with the various services and functions offered by the same. In particular, the App allows Users, after downloading and authenticating with their TrackAdvice account, to use the TrackAdvice services in order to collect data and measurements of the undercarriage such as wear and temperature (such activity including the phases of analysis, reporting, interpretation of data and issuance of recommendations) with the aim to efficiently and cost-effectively manage the maintenance of the undercarriage parts and their replacement, within the limits and modalities described in the TrackAdvice End User License Agreement (“EULA”) [https://trackadvice.group-itm.com/policy/]

The information contained in this Privacy Policy is provided pursuant to art. 13 of EU Regulation of 27 April 2016 n. 679 the ("GDPR"), Legislative Decree n. 196/2003 (the “Privacy Code”) as well as the provisions issued by the Italian Data protection Authority and the Guidelines of the European authorities.

Information about data processing is provided only for the App and for the processing carried out by the Company and does not extend to processing carried out by third parties through other sites and/or contents that may be consulted by the User via links. With respect to these further processing, the Company assumes no responsibility, the User having to refer to the individual privacy policies of the sites and/or third-party contents.

1. Data Controller and location of processing

The Data Controller is Italtractor ITM S.p.A., with registered office at via Confortino 30, 40056 Valsamoggia, Bologna, Italy.

The data is mainly processed at the headquarters of the Data Controller, by technical personnel of the Company, authorized to process the data, within the territory of the European Union.

2. Modalities of processing

The Company processes the User's data by adopting all the appropriate security measures aimed at preventing unauthorized access, as well as the unauthorized disclosure, modification or destruction of data. The processing is carried out with both manual and IT and/or telematic tools, with organizational methods and with logics strictly correlated and limited to the purposes indicated.

As regards the methods of accessing and using the App, as well as for identifying the data processed for this purpose, please refer to the TrackAdvice End User License Agreement (“EULA”) [https://trackadvice.group-itm.com/policy/]

3. Purposes and legal basis for the processing

The Company, through the App, will process User’s personal data for the following purposes:

a. Registration of the account: for the purpose of registering and using the App, after downloading, the User will be asked to enter his/her credentials to the TrackAdvice service (i.e. email address and password). Once the account has been inserted, the User will access the App and will be able to use the TrackAdvice service and the services provided by the App. The legal basis for the processing of personal data is represented by the execution of the service expressly requested by the User, and any refusal to provide the data will make it impossible for the Company to register the User's account and allow the use of the TrackAdvice services through the App;

b. Activation and sending of TrackAdvice notifications: once the account has been inserted by the User, as explained above, in addition to the services offered by the App the User can also activate the notification service through the App, in order to receive alerts regarding possible anomalous behavior of the undercarriage and/or of its components (alarms) or reminders of inspection deadlines. Also in this case, the legal basis for the processing of personal data for the purpose of sending said category of notification through the App is represented by the execution of the service requested by the User;

c. Pursuit of the legitimate interests of the Company and/or third parties: User's data may also be used for the exercise of the rights and legitimate interests of the Company and/or third parties, for example the management of complaints and disputes, credit recovery, fraud and/or illegal activities prevention and detection. In these cases, even if the provision of the User's data is not mandatory, it is still necessary as such data are strictly connected and instrumental to the pursuit of such legitimate interests, which do not prevail over the User's fundamental rights and freedoms, and any refusal to provide them could make it impossible to provide the services offered by the App;

d. Fulfill legal obligations and/or applicable obligations: the Company may also use the data provided by the User or otherwise acquired during the User's interaction with the App for purposes related to the execution of legal obligations, regulations, national and EU regulations as well as deriving from provisions issued by authorities legitimized by the law, which represent the legal basis of the processing, without the need to obtain the prior consent of the User;

e. Carry out aggregate statistical analysis on an anonymous basis in order to improve the performance and services offered by the Company through the App: in this case, no consent from the User will be required, as the indicated processing will be carried out only on anonymous data.

4. Categories of data processed

The Company receives and collects, through the App, information relating to the User who visits and uses the functions of the App. In particular, the Company collects and processes the following information.

4.1 Data voluntarily provided by the User

The Company limits the collection of information provided voluntarily by the User to the data necessary for the pursuit of the purposes described in paragraph 3 above and for the services expressly requested. Furthermore, the Company may collect and process further personal data, where they are provided voluntarily by the User as part of the services offered by the App, for example in the event that the User contacts the Company to report disservices or malfunctions, exercise his/her rights on the processing of personal data, etc. These data will be processed by the Company solely for the purposes strictly related to the User's request. Failure to provide data may make it impossible to obtain the requested service/assistance.

4.2 Device location information

When the User uses the App through a Mobiledevice, the use of Bluetooth technology for the scan of the data collected by the TrackAdvice service requires necessarily, due to Mobileset-ups, the enabling of device location permission. This does not depend from the Company’s choices and is only because Bluetooth, for functioning as a common pairing technology, is used to scan and “locate” the device. So, the set-up for use of Bluetooth LE technology on MobileAPI requires location permissions to be granted in order to use the App and to enable scanning of BLE devices. As said, this collection does not depend from the Company’s choices and is performed only by the User’s operating systems, and the Company does not collect, nor processes, any location and GPS data for its own purposes as Data Controller.

5. Communication of data to third parties

The data provided by the User as well as those collected by the App as part of the related services will not be disclosed and may be communicated, also outside the EU and for the purposes and with the methods illustrated in this Privacy Policy, to the following categories of subjects:

• companies of the group to which the Company belongs, for organisational, internal control purposes, for the pursuit of the legitimate interests of the Company and/or third parties, and for the purpose of executing the services/requests expressly made by the User;

• companies, collaborators, consultants or entities that the Company uses to carry out tasks of a technical or organizational nature (such as, for example, IT and web service providers), or with which the Company collaborates (including other companies in the group, where necessary), for the purpose of providing its services;

• persons, companies or professional firms that provide assistance and consultancy services to the Company, with particular but not exclusive reference to accounting, administrative, legal, tax and financial matters;

• subjects whose right to access the data is recognized by provisions of the law or by orders from the authorities.

The subjects belonging to the categories indicated above will use the data as autonomous data controllers in accordance with the law or as data processors duly appointed by the Company.

For the purposes indicated in this Privacy Policy, the personal data will also be transferred abroad to not-EU countries, included to the companies which belongs to the Company’s group: in particular, for the cases in which such data will be transferred outside EU, the Company adopts the specific measures provided by for the GDPR for ensuring an adequate protection of the data, such as specific agreements which include the Standard Contractual Clauses provided by the EU Commission.

The list of subjects to whom the data is or may be communicated, as well as the measures implemented to protect the personal data for extra-EU transfers, can be requested to the Company by contacting the addresses indicated in the "User’s Rights and Contacts" section.

6. Storage of the data

The data are processed for the time necessary to carry out the activities indicated in paragraph 3 above, and are deleted when the purposes for which they were collected and processed cease to exist.

In particular, the Company will delete User's personal data for the time necessary to provide the TrackAdvice service and the services offered through the App, and in any case for no more than 10 years from the termination of the use of the TrackAdvice services/last activity performed by the User on the App. For the other pursuit of the other purposes connected to the use of the services (e.g. legal obligations, legitimate interests) the data will be retained for the time necessary to pursue said purposes and, in any case, according to applicable periods of limitation envisaged by applicable provisions, as well as for enforcing and defending rights and/or legitimate interests pursued by the Company and/or third parties, in case of litigation and at its preliminary or subsequent phase.

7. User’s Rights and Contacts

The User can exercise, in the cases expressly provided for by the law and where applicable, the rights granted by the GDPR. In particular, the User has the right to:

· obtain confirmation that the personal data is being processed and, in this case, to ask the data controller for access to information relating to the processing itself (e.g. purposes, categories of data processed, recipients or categories of recipients of the data, the retention period, etc.);

· request the rectification of inaccurate or incomplete data;

· ask the data controller to delete the data (e.g. if the personal data are no longer necessary with respect to the purposes for which they were collected, in the event of revocation of the consent on which the processing is based, etc.);

· request the limitation of the processing (e.g. in the event of a dispute by the User on the accuracy of the data; if the processing is unlawful and the User opposes the deletion of the personal data; if the data are necessary for the exercise or the defense of a User's right in court, even if the data controller no longer needs it; in the event of exercising the right to object, for the time necessary to verify the existence of legitimate reasons);

· receive the personal data in a commonly used and readable format from an automatic device and transmit them to another data controller or obtain direct transmission from one data controller to another, if technically feasible (so-called data portability).

The User also has the right to object in whole or in part, for legitimate reasons, to the processing of personal data concerning him/her.

These rights can be exercised directly by sending a communication to the following email address: trackadvice@group-itm.com

Finally, if the User considers that the processing of the data provided violates the legislation on the protection of personal data, he has the right to lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it).

8. Data collection using cookies and similar technologies

A cookie is a small text string sent to the browser and saved on the User's device when they visit a website or use an app. Cookies and similar technologies are used by the Company to make the App work or to improve its performance, but also to provide information on the App or on Users' activities.

With reference to the App, the latter only uses technical cookies and similar technologies, that are essential to allow the User to move within the App and to use its functions, to remember the User's choices (e.g. registration, authentication, etc.), to distribute requests across multiple servers,. These cookies do not require the User's consent. The technical cookies used in the App and their characteristics, in particular, are illustrated in the table below.

Who places the cookie/technology?	Name of the cookie/technology	Purposes	Storage period
ITM/TrackAdvice mobile app	User name and password	Authentication	Until user log-out or unstallation of the mobile app
ITM/TrackAdvice mobile app	Database of undercarriage/machines components	Functionality	Until user log-out or unstallation of the mobile app

8.1 Disable cookies and similar technologies

Please be aware that by disabling the technical cookies certain functions of the App may not be available.

9. Extra-EU transfers of personal data

The data is mainly processed at the headquarters of the Data Controller, by technical personnel of the Company, authorized to process the data, within the territory of the European Union. For the purposes indicated in this Privacy Policy, the personal data may also be transferred abroad to not-EU countries, included to the companies which belongs to the Company’s group: in particular, for the cases in which such data will be transferred outside EU, the Company adopts the specific measures provided by for the GDPR for ensuring an adequate protection of the data, such as specific agreements which include the Standard Contractual Clauses provided by the EU Commission.

10. Amendment to this Privacy Policy

The Company reserves the right to make changes to this Privacy Policy at any time, giving notice by publication on the App. We invite the User to check these updates on the App.

If the changes are particularly significant and/or have a significant impact on the User's rights, the Company may also communicate them to the User through a different method (for example by sending an email).

Privacy Policy updated on 16/12/2022