Nice

Privacy Notice – Website and Related Services

ARTICLES 13 AND 14 OF REGULATION (EU) 2016/679 (GDPR)

 

1. WHO WE ARE

Nice S.p.A. (“Nice” or the “Company”), with registered office in Italy, is the parent company of numerous entities operating internationally. For the purposes set out in this Personal Data Protection Notice (the “Policy”), Nice acts as data controller or, where applicable, as joint data controller together with other companies of the group, in accordance with Regulation (EU) 2016/679 (“GDPR”), determining the purposes and means of the processing of personal data carried out through Nice’s websites.

Nice carries out its activities with the utmost attention to the protection, security, integrity and confidentiality of personal data, in compliance with the applicable data protection legislation and the principles set out in Article 5 of the GDPR, including lawfulness, fairness, transparency, purpose limitation and data minimisation.

Through its websites, Nice provides information and services of an institutional, technical, commercial and support nature to:

  • end users (“Retail Users”); and
  • professionals operating in the home automation and building automation sector (“Professional Users”),

adapting the content and functionalities of the websites to the characteristics and needs of each category of users.

This notice describes the manner in which Nice processes the personal data of Retail Users and Professional Users solely in relation to the use of the websites operated by Nice, including online forms, contact channels and digital functionalities made available through such websites.

For the sake of clarity, this Notice  does not apply to the processing of personal data carried out through mobile applications, connected devices, cloud platforms or other digital services offered by Nice, which are governed by separate and specific privacy notices, already updated in compliance with applicable legislation, including Regulation (EU) 2016/679, Directive (EU) 2022/2555 (“NIS 2”) and Regulation (EU) 2023/2854 (“Data Act”).

 

2. METHODS OF COLLECTING PERSONAL DATA

This Notice  applies to the processing of personal data carried out by Nice in connection with the use of the websites operated by the Company, in particular in the following circumstances:

  • when you contact Nice by sending requests or enquiries through the contact forms made available on the websites;
  • when you contact Nice by telephone using the customer service or technical support contact details published on the websites;
  • when you complete and submit purchase orders, repair requests or other forms available on the websites;
  • when you provide your contact details (e.g., by handing over a business card) at trade fairs, exhibitions, events or in the course of direct interactions with Nice’s sales or commercial staff, where such data is subsequently processed for purposes connected with the websites or the activities described therein.

In addition, Nice may collect personal data through the websites in other specific contexts, such as:

  • when you submit an application through the “Work with us”, “Careers” or similar sections of the websites;
  • when you register for or take part in events, training sessions or initiatives organised or promoted by Nice through its websites.

Where the purposes and methods of processing differ from those described in this Notice , or where the processing concerns activities governed by separate privacy notices, Nice shall provide a specific and dedicated privacy notice, pursuant to Articles 13 and 14 of the GDPR, taking into account the source and nature of the personal data collected.

Where you provide personal data relating to third parties, you represent and warrant that you are duly authorised to do so and that the data subjects concerned have been duly informed of the processing of their personal data in accordance with the applicable data protection legislation.

Nice invites you to promptly notify the Company of any changes or updates to your personal data, in order to ensure that the data processed remains accurate and up to date.

 

3. ACCURACY OF DATA PROVIDED ON BEHALF OF THIRD PARTIES

Where you provide, through the websites, personal data relating to third parties, you confirm that you are duly authorised to do so and that the relevant data subjects have been informed of the processing of their personal data in accordance with this Notice  and the applicable data protection legislation.

You further undertake to ensure that such personal data is accurate, complete and up to date, and to promptly inform Nice of any changes or updates, in order to enable the Company to process the personal data in compliance with the principles of accuracy and data minimisation set out in Article 5 of the GDPR.

 

4. CATEGORIES OF PERSONAL DATA THAT MAY BE COLLECTED

Depending on the nature of the interaction with Nice and the services or information requested through the websites, the Company may collect and process the following categories of personal data (collectively, the “personal data”):

4.1 Contact data

Such as first name, surname, postal address, telephone number and e-mail address.

4.2 Sales and transaction data

Where applicable, such as VAT number, tax code, IBAN, billing address and delivery address, to the extent strictly necessary for the management of orders, requests or related administrative activities carried out through the websites.

4.3 Data relating to requests and communications

Any additional information voluntarily provided by the user in the free-text fields of contact forms, request forms or other means of submitting requests made available on the websites, strictly limited to what is relevant and necessary for handling the request.

4.4 Data relating to telephone and technical support

Where the user contacts Nice using the customer service or technical support contact details published on the websites, the Company may process the personal data voluntarily provided during the interaction, including, where applicable:

  • the telephone number used (where not set as private or withheld);
  • the date, time and duration of the call;
  • Interactive Voice Response (IVR) navigation data, such as the selections made to access specific services;
  • technical information strictly necessary to provide the requested support.

Where, at the user’s request and only upon express consent, video-supported technical assistance is activated, the user’s image may be processed solely to enable technical staff to provide adequate support.

In such cases:

  • video streams are not recorded;
  • images are not retained;
  • the processing is strictly limited to the duration of the support session.

4.5 Website usage data and technical data

Information relating to the use of the websites, including interactions, browsing behaviour and engagement with communications made available through the websites, collected by means of cookies or similar technologies.

Further details on such processing activities, including the categories of cookies used and their respective purposes, are provided in the dedicated Cookie Policy, accessible through the websites and managed through the consent management platform.

4.6 Additional data relating to Professional Users

In the case of Professional Users, Nice may also process further personal data necessary for the management of the professional services made available through specific sections of the websites.

Registration and account data: Information provided upon the creation and management of a professional account on the website https://www.nicespares.com/, including:

  • login credentials and unique account identifiers;
  • first name and surname;
  • VAT number;
  • country and language preferences;
  • e-mail address;
  • username and security-related information.

Such personal data is processed exclusively for purposes connected with account management, authentication, access to restricted areas and the provision of the professional services requested through the websites.

 

5. PURPOSES AND LEGAL BASES OF PROCESSING

Nice processes personal data for the purposes set out below, in accordance with Article 6 of the GDPR and in compliance with the principles of purpose limitation and data minimisation.

5.1 Purposes common to Retail Users and Professional Users

a) Management of requests submitted through the websites

Nice may process Contact data and Data relating to requests and communications in order to receive, analyse and respond to requests for information, requests for assistance or other communications submitted through the contact forms or other request channels made available on the websites.

Legal basis: the processing is necessary for the performance of pre-contractual measures taken at the request of the data subject or, where applicable, for the performance of a contract to which the data subject is party, pursuant to Article 6(1)(b) of the GDPR.

Mandatory nature of the provision of data: the provision of such personal data is necessary in order to handle the request. Failure to provide the requested data may prevent Nice from providing an adequate response, or from responding at all.

5.2 Telephone and technical support services

b) Provision of telephone and video-supported technical assistance

Nice may process Contact data and Data relating to telephone and technical support in order to provide customer service and technical support relating to its products and solutions, where such services are requested through the telephone support channels published on the websites.

Legal basis: the processing is necessary for the performance of a contract to which the data subject is party or for the implementation of pre-contractual measures taken at the request of the data subject, pursuant to Article 6(1)(b) of the GDPR.

Mandatory nature of the provision of data: the provision of the relevant personal data is necessary in order to receive technical assistance. Failure to provide such data may prevent Nice from properly handling or responding to the request.

In the context of the technical support service and only where strictly necessary to facilitate diagnostic and troubleshooting activities, the user may be requested to activate the video function of their device.

In such cases:

  • activation of the camera is entirely optional and is subject to the express and informed consent of the user;
  • the user remains free to decline activation without prejudice to the possibility of receiving alternative forms of assistance, where technically feasible;
  • where the user gives consent, Nice may process their image solely for the duration of the support session.

Nice confirms that:

  • video streams are not recorded;
  • images are not stored or retained in any form;
  • the processing is limited exclusively to enabling the technician to provide adequate and effective assistance.

Where possible, the user is invited to point the camera exclusively at the product for which assistance is requested. Any incidental capture of the user’s image will in any case be processed solely for the purposes described above, in full compliance with the principles of data minimisation and purpose limitation.

5.3 Protection of rights in legal proceedings (legitimate interest)

c) Establishment, exercise or defence of a legal claim

Nice may process personal data where necessary to establish, exercise or defend its rights in judicial, administrative or out-of-court proceedings, including any disputes relating to the use of the websites, the services provided or the performance of contractual relationships.

Legal basis: the processing is based on the legitimate interest of the Company in protecting and exercising its rights, pursuant to Article 6(1)(f) of the GDPR.

Such processing is carried out following careful assessment of the balance between the legitimate interest of the Company and the rights and freedoms of the data subject, and is limited to what is strictly necessary for the purposes pursued.

5.4 Compliance with legal and regulatory obligations

d) Compliance with applicable law and binding requests from authorities

Nice may process personal data where necessary to comply with obligations arising from laws, regulations, European Union legislation, or binding orders or requests of competent authorities, as well as of supervisory and control bodies.

Legal basis: the processing is necessary for compliance with a legal obligation to which the Company is subject, pursuant to Article 6(1)(c) of the GDPR.

Mandatory nature of the provision of data: the provision of personal data for such purposes is mandatory. Failure to provide such data may prevent Nice from complying with its legal obligations.

 

6. TRANSFERS OF PERSONAL DATA OUTSIDE THE EUROPEAN ECONOMIC AREA

In the course of the activities carried out through the websites, Nice may transfer personal data to recipients located outside the European Economic Area (EEA), including other companies of the group or external service providers.

Such transfers are carried out in full compliance with Articles 44 to 49 of the GDPR and on the basis of appropriate safeguards, including, where applicable:

  • the adoption of the Standard Contractual Clauses (SCCs) approved by the European Commission;
  • the implementation of supplementary technical and organisational measures, where required;
  • documented assessments regarding the lawfulness and proportionality of the transfer, in accordance with the applicable data protection requirements.

Further information on international data transfers and the safeguards adopted may be requested by contacting the Data Protection Officer directly at the following address: niceprivacy@niceforyou.com.

 

7. FURTHER PURPOSES FOR RETAIL USERS

7.1 Marketing and promotional communications

e) Marketing activities directed at Retail Users

Subject to prior and explicit consent, Nice may process Contact data in order to carry out marketing and promotional activities, including:

  • the sending of commercial communications relating to products, promotions and sales initiatives;
  • the conduct of market research, surveys and statistical analyses aimed at improving products and services.

Such activities may be carried out by means of automated contact methods (such as e-mail, SMS or other mass-messaging tools) and traditional contact methods (such as telephone calls with an operator), in compliance with the applicable legislation on personal data protection, e-privacy and telemarketing.

With specific reference to telephone marketing activities, Nice ensures full compliance with the applicable national telemarketing legislation and the provisions relating to the Public Opt-Out Register (Registro Pubblico delle Opposizioni), pursuant to Article 130, paragraph 3-bis, of Legislative Decree No. 196/2003, as amended.

Legal basis: the processing is based on the consent of the data subject, pursuant to Article 6(1)(a) of the GDPR.

Optional nature of consent: the provision of consent is optional. Refusal or withdrawal of consent shall not prejudice existing or future contractual relationships with the Company.

Withdrawal of consent: consent may be withdrawn at any time, without affecting the lawfulness of the processing carried out prior to withdrawal, by contacting Nice at the following address: niceprivacy@niceforyou.com.

 

8. FURTHER PURPOSES FOR PROFESSIONAL USERS

8.1 Creation and management of professional accounts

f) Creation and management of a professional user profile on https://www.nicespares.com/ 

Nice may process Registration and account data in order to create and manage the professional user profile necessary to access the restricted areas of the website https://www.nicespares.com/ and to use the related services made available through the site.

Legal basis: the processing is necessary for the performance of a contract to which the data subject is party, pursuant to Article 6(1)(b) of the GDPR.

Mandatory nature of the provision of data: failure to provide the requested personal data will prevent the creation and management of the professional account.

8.2 Performance of orders and contractual relationships

g) Fulfilment of purchase orders and performance of contractual obligations

Nice may process Contact data and Sales and transaction data in order to manage, perform and fulfil purchase orders, supply agreements and the related contractual obligations entered into through https://www.nicespares.com/ or other authorised sales channels accessible through the websites.

Legal basis: the processing is necessary for the performance of a contract to which the data subject is party, pursuant to Article 6(1)(b) of the GDPR.

Mandatory nature of the provision of data: the provision of such personal data is necessary in order to process and fulfil the order. Failure to provide the requested data will make it impossible to perform the required contractual obligations.

8.3 Sending of technical and informational materials

h) Technical, commercial and informational communications directed at Professional Users

In the context of an existing or prospective professional or commercial relationship, Nice may process Contact data in order to send technical, informational or service-related communications concerning its products and solutions, such as catalogues, price lists, technical specifications, product updates and similar materials.

In this context, Nice may also process professional contact data voluntarily provided by the data subject, including information contained in business cards collected at trade fairs, exhibitions, events, or during direct interactions with the Company’s commercial or sales departments.

Legal basis: the processing is based on the legitimate interest of Nice in establishing and maintaining effective commercial and professional relationships with its partners and customers, pursuant to Article 6(1)(f) of the GDPR.

Such processing is carried out on the basis of a documented balancing assessment, which takes into account the reasonable expectations of Professional Users and ensures that their rights and freedoms do not override the legitimate interests of the Company.

8.4 Marketing activities directed at Professional Users

i) Marketing communications directed at Professional Users

Subject to the consent of the data subject, Nice may process Contact data for marketing and promotional purposes directed at Professional Users, in accordance with the methods, safeguards and contact channels described in Section 7.1 above.

Legal basis: the processing is based on the consent of the data subject, pursuant to Article 6(1)(a) of the GDPR.

 

9. MARKETING COMMUNICATIONS

Consent-based marketing activities

Subject to prior, specific and informed consent, Nice may process Contact data to carry out marketing, advertising and promotional activities, as further described in Sections 7.1 (Retail Users) and 8.4 (Professional Users) above, including:

  • communications relating to promotional initiatives, commercial offers and sales activities;
  • market research, surveys and statistical analyses aimed at improving products and services.

Such activities may be carried out by means of:

  • automated contact methods, such as e-mail, SMS, instant messaging systems or other mass-messaging tools; and
  • traditional contact methods, such as telephone calls with an operator,

in compliance with the applicable legislation on personal data protection, e-privacy and telemarketing.

With specific reference to marketing communications made by telephone, Nice ensures full compliance with the applicable national telemarketing legislation and the provisions relating to the Public Opt-Out Register (Registro Pubblico delle Opposizioni), pursuant to Article 130, paragraph 3-bis, of Legislative Decree No. 196/2003, as amended.

Legal basis: the processing is based on the consent of the data subject, pursuant to Article 6(1)(a) of the GDPR.

Optional nature of consent: the provision of consent is entirely optional. Refusal to give consent, or its subsequent withdrawal, shall not prejudice existing or future contractual or professional relationships with the Company.

Withdrawal of consent: consent may be withdrawn at any time, free of charge and without particular formalities, by contacting Nice at the address of the Data Protection Officer: niceprivacy@niceforyou.com

The withdrawal of consent does not affect the lawfulness of the processing carried out prior to such withdrawal.

 

10. PERSONAL DATA SECURITY MEASURES

Nice adopts appropriate technical and organisational measures, pursuant to Article 32 of the GDPR, designed to ensure a level of security appropriate to the risks associated with the processing of personal data. Such measures are aimed, in particular, at protecting personal data from unauthorised or unlawful processing, as well as from accidental loss, destruction or damage.

Personal data processed through the websites is stored on:

  • protected IT systems and servers, managed directly by Nice; and/or
  • systems of carefully selected third-party providers, acting as data processors pursuant to Article 28 of the GDPR,

in both cases in compliance with security standards, internal policies and contractual safeguards aligned with industry best practices and, where applicable, with equivalent or higher standards adopted by the Company.

Access to personal data is strictly limited to duly authorised personnel and to external parties solely on the basis of the need-to-know principle, in compliance with the principles of confidentiality, integrity and availability, and is subject to appropriate access control and authentication mechanisms.

 

11. DATA RETENTION PERIODS

Nice retains personal data only for the period strictly necessary to achieve the purposes for which it was collected, or for other compatible and lawful purposes, in compliance with the principles of storage limitation and data minimisation set out in Article 5 of the GDPR.

Where personal data is no longer necessary for the purposes for which it was collected, or where the applicable legal basis ceases to apply, such data is securely deleted or irreversibly anonymised, in accordance with the Company’s internal data retention and deletion procedures.

The principal retention periods applied by Nice in connection with the processing activities carried out through the websites are as follows:

  • Management of requests submitted through the websites and telephone support: personal data is retained for up to a maximum of three (3) months from the date of collection. In the case of telephone support services, personal data may be retained for up to six (6) months, where necessary to ensure continuity of support, quality control and the handling of follow-up requests. Any images processed during video-supported technical assistance sessions are not retained and are processed solely for the duration of the call.
  • Performance of orders and contractual relationships: personal data is retained for the entire duration of the contractual relationship and, thereafter, for ten (10) years, in accordance with applicable civil, tax and accounting obligations.
  • Creation and management of user accounts on https://www.nicespares.com/: personal data is retained for as long as the user account remains active and until it is deleted by the user or following a prolonged period of inactivity, in accordance with the applicable account management policies.
  • Sending of technical and informational materials: personal data is retained for up to twenty-four (24) months from the date of the last interaction with Nice.
  • Marketing activities: personal data is retained for twenty-four (24) months from the date consent was given, without prejudice to the periodic review of the continued validity of the consent and the user’s right to withdraw it at any time.

For technical and organisational reasons, the definitive deletion or irreversible anonymisation of personal data will be completed within thirty (30) days of the expiry of the relevant retention period. Where the processing is carried out for the purposes of establishing, exercising or defending a legal claim in judicial, administrative or out-of-court proceedings, or in response to binding requests from competent authorities, personal data will be retained for the time necessary to pursue such purposes and in compliance with the applicable limitation periods.

 

12. RECIPIENTS OF DATA AND DISCLOSURE

Personal data may be accessible to:

  • duly authorised employees of Nice, acting under the authority of the Company and bound by confidentiality obligations; and
  • external service providers that support Nice in managing the websites and providing related services, appointed as data processors pursuant to Article 28 of the GDPR.

Where required by applicable laws, regulations or binding orders of competent authorities, personal data may also be disclosed to public bodies, judicial authorities or supervisory authorities.

An updated list of data processors and other recipients may be requested by contacting Nice’s Data Protection Officer at: niceprivacy@niceforyou.com.

 

13. CONTACT DETAILS OF THE DATA CONTROLLER

The data controller is:

Nice S.p.A. – Via Callalta 1, 31046 Oderzo (TV) – Italy

For any request relating to the processing of personal data, or to exercise the rights provided for under the GDPR, Nice may be contacted through the appointed Data Protection Officer at the following address: niceprivacy@niceforyou.com

Requests may also be submitted using the relevant forms made available by the Company, where applicable.

 

14. RIGHTS OF THE DATA SUBJECT AND RIGHT TO LODGE A COMPLAINT

Under the conditions set out in the GDPR, the data subject has the right to:

  • obtain confirmation as to whether or not personal data concerning them is being processed, and to access such data;
  • receive a copy of the personal data provided (right to data portability);
  • obtain the rectification of inaccurate or incomplete personal data;
  • obtain the erasure of personal data in the absence of a legal basis for processing;
  • withdraw consent at any time, where the processing is based on consent;
  • obtain the restriction of processing in the cases provided for by law.

Right to object

Pursuant to Article 21 of the GDPR, the data subject has the right to object at any time to the processing of their personal data carried out on the basis of the legitimate interest of the Company.

The data subject also has the unconditional right to object at any time to the processing of their personal data for marketing purposes.

The exercise of such rights is free of charge and does not require compliance with any particular formalities. Nice will verify the legitimacy of the request and provide a response without undue delay and, in any event, within one (1) month, save for any extensions provided for by law. Nice S.p.A. has made available an editable template to facilitate the exercise of such rights: https://www.niceforyou.com/pdf/modulo-esercizio-diritti-interessato-en.pdf.

Where the data subject considers that the processing of their personal data infringes the GDPR, they have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la Protezione dei Dati Personali) (https://www.garanteprivacy.it/home/docweb/-/docweb-display/docweb/4535524), as the lead supervisory authority for Nice, or with the supervisory authority competent for their habitual residence, place of work, or the place where the alleged infringement occurred, without prejudice to any other administrative or judicial remedy.

 

15. LOCAL PRIVACY NOTICES

Where required by applicable local data protection legislation, this Privacy Notice may be supplemented by local privacy notices or country-specific addenda, providing further information regarding the applicable local requirements and the rights of data subjects.

 

16. FINAL PROVISIONS AND GOVERNANCE

This Personal Data Protection Notice constitutes Nice’s principal notice for the processing activities carried out through its websites. It applies uniformly to the websites and is supplemented, where necessary, by local privacy notices or country-specific addenda, in order to ensure full compliance with the applicable local data protection legislation.