Disclosure on the processing of personal data - Esprinet Group

With this disclosure, drawn up pursuant to Article 13 of EU Regulation no. 2016/679 (hereinafter, "GDPR"), the Data Controller wishes to inform you of the processing methods that, in compliance with the applicable legislation on personal data protection, will be used to process your personal data.

The Data Controller is the Esprinet Group Company with which you are interacting and is reported in the "Table of Data Controllers" provided below.

The table also shows the e-mail address that can be contacted for more information regarding personal data processing activities for each company mentioned.

The Group Data Protection Officer can be contacted at the e-mail address dpo@esprinet.com

1. Objective of the processing

The Data Controller processes personal, contact and/or professional data (by way of non-limiting example, name, last name, company name of the reference company, address, telephone, e-mail, IP address and the domain names of the computers and terminals used by users) of site users - hereinafter, “personal data” or even just “data”.
The aforementioned data may be communicated to the Data Controller by you, by your company or collected by the Data Controller independently while you browse on the domains indicated in the Table.

2. Purpose of the processing

The data collected are processed by the Data Controller taking the utmost care to apply the appropriate applicable security measures and always in compliance with current regulations.
Your personal data will be processed for the following purposes:

1. To provide, on request, information on the Controller's services and products, renegotiate, enter into and manage contracts between the Controller and the company you represent, as part of the services offered by the Controller;
2. To allow the download of content relating to products distributed by the Data Controller for which a request is made either through e-mail correspondence or in person;
3. To carry out direct marketing activities, for example by subscribing to newsletters;
4. For webinar and events organisation, the personal data provided to register will be processed in order to organise and manage the same and to carry out the related administrative activities, including measurements of customer satisfaction and to send materials related to the topic addressed. With further information, you will be informed of the possible communication of your data to the event co-organiser;
5. Site operation and security.

Through the sites and domains listed in the Table, you can also register in Personal Areas to purchase the products offered by the Data Controller. In this case, specific disclosures will be provided and, where necessary, specific consent will be requested to send promotional material.

During your relationship with the Data Controller, your personal data may also be processed for other different purposes. In this case, the Data Controller will provide the details of the processing through specific disclosures on the processing of personal data that will supplement this policy.

2.1 Lawfulness of processing

The processing carried out for the purposes listed in the previous paragraph is based on the following legal bases pursuant to Article 6 of the GDPR:

• regarding the purposes referred to in letters a), b) and d), the processing is required, as the case may be, for the correct performance of a contract or for pre-contractual measures requested by the data subject (Article 6, paragraph 1) letter b) GDPR) or
• regarding the purposes referred to in point e), the data are processed to ensure that the Data Controller can pursue its legitimate interests related to the correct operation of the site (Article 6, paragraph 1 letter e) GDPR).
• regarding the purpose referred to in letter c), the processing hinges on consent provided in a free, specific, informed and unequivocal manner (Article 6, paragraph 1 letter a), GDPR).

For the purpose based on consent, you may at any time revoke this consent to the processing of data, without prejudice to the processing for which consent had been given prior to the revocation. The revocation may be expressed in the manner set out in point 9 of this disclosure.

3. Processing methods

The processing of your personal data is carried out by the operations indicated in Article 4 no. 2) GDPR and specifically through: collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction of data.

Your data will be processed using both manual and IT tools.
Processing will take place in compliance with the regulations in force and the principles established by Article 5 GDPR:

• lawfulness, fairness and transparency;
• Limitation of the purpose
• Data minimisation;
• Accuracy;
• Limitation of storage;
• Completeness and confidentiality;
• Accountability.

The data processing will always take place in compliance with the organisational, physical and logical measures and in compliance with the provisions of Article 32 of the GDPR and the legislation applicable at any one time on the protection of personal data. The measures adopted to this end by the Data Controller will be implemented and expanded in each case, also by taking into account technological developments.

4. Storage time

The Data Controller will process personal data for the time required to fulfil the purposes referred to in paragraph 2:

• for the purposes referred to in points a) and b): no later than two years from collection;
• for the purposes referred to under point c): until the consent provided in order to receive the newsletter is revoked
• for the purposes referred under in point d): the data will be stored for 1 year after the webinar has taken place
• for the purposes referred to under point e): please refer to the Cookie Policy.

5. Cookies

The methods used to process the information collected while users are on the Data Controller's websites are described in detail in the Cookie Policy available on all the domains listed in the Table.

6. Access to data and their communication

Your data may be made accessible, for the purposes referred to under paragraph 2, exclusively to persons duly instructed by the Data Controller, as well as to external data processors who have reached a specific agreement with the Data Controller pursuant to Article 28 of the GDPR. The updated list of data processors is on file at the registered office of the Data Controller in question.
Specifically, your data may be processed by:

• employees and associates of the Data Controller in their capacity as data processors and/or system administrators;
• third-party companies or other parties (by way of example, website suppliers, credit institutions, professional firms, consultants, etc.) who carry out outsourced activities on behalf of the Data Controller, in their capacity as external data processors or independent data controllers.

Without the need for express consent, and therefore pursuant to Article 6 letters b) and c) GDPR), the Data Controller may communicate your data to Supervisory Bodies, Judicial Authorities, and those parties to whom the communication is mandatory by law. These parties will process the data in their capacity as independent data controllers. Your data will not be disseminated.

7. Information Notice on the Processing of Personal Data pursuant to Article 14 of EU Regulation 2016/679

As part of lead generation activities, companies within the Esprinet Group may contact phone numbers not registered in the Public Opt-Out Register in order to present products and services distributed by the Esprinet Group companies.

If the contacted individual is willing to schedule a meeting with a sales representative to analyze the current state of their company and identify the most suitable strategy for their situation, the company will also process their first name, last name, and email address. In this case, personal data is processed based on pre-contractual measures requested by the data subject, in accordance with Article 6.1(b) of the GDPR.

Furthermore, if during the initial phone contact the data subject has given consent to be recontacted for marketing purposes, commercial information, and promotional activities—including the sending of newsletters and advertising materials—they will receive a specific information notice, and the company may proceed to send automated communications or contact them through traditional methods with an operator.

The processing of data for the aforementioned marketing purposes is not mandatory and is based on freely given and explicit consent. It is noted that the data subject may withdraw their consent at any time by contacting the company (without affecting the lawfulness of the processing carried out prior to the withdrawal).

Personal data may be disclosed, within the scope of their specific responsibilities, to entities used by the company to carry out promotional, advertising, marketing, and communication activities, to authorized internal personnel of the company, and to public authorities for legal compliance.

Personal data will not be disclosed or processed in non-EU countries under any circumstances.

Data will be retained only for the time necessary to fulfill the above-mentioned purposes, and in any case no longer than two years from the date of receipt, unless a commercial relationship is established that entails further processing purposes and therefore different retention periods.

8. Data transfer

Personal data is stored on servers located within the European Union. In any case, it is understood that the Data Controller, if necessary, will also have the right to use servers outside the EU, or to transfer data to non-EU countries for the transmission of the same to third parties commercial partners of the Data Controller, by adopting appropriate protection tools in compliance with the provisions of Articles 44 et seq. of the GDPR.

9. Rights of the data subject

In your capacity as a data subject, you have the rights detailed in Chapter III of the GDPR and more specifically the right to request the Data Controller for access to your personal data, including their rectification or erasure (where applicable), objection to the processing or limitation of it. The data subject also has the right to revoke his/her authorisation to process the data for which he/she has given consent, the right to request data portability, as well as the right to lodge a complaint with the Data Protection Supervisory Authority pursuant to Article 77 GDPR.

10. How to exercise these rights

To exercise the aforementioned rights, you may send a specific request to the contacts listed in the Table. All the rights summarised in paragraph 8 can be exercised by writing to the e-mail address in the Table under “E-mail address that can be contacted for more information”. We will respond without delay.

Pursuant to Article 77 of the GDPR, you are also entitled to lodge a complaint with a supervisory authority (Supervisory Authority for the protection of personal data).

11. Disclosure update

This disclosure is published on the websites of the Esprinet Group Companies. Any updates to the document will be published in the same section that we suggest you consult on a regular basis.

Updated on 2 July 2025