SMI Group has adopted a corporate governance structure that is aimed at sustainable and long-lasting development and is based on control processes optimization and on risk prevention and management, by paying particular attention to transparency and protection of the stakeholders' rights and interests.
The institutions and subjects that are involved in the control system and are looking for continuous improvements of the system efficiency can be divided into:
Institutional bodies: include the addressing institutions (Board of Directors, President and CEO) that define the guidelines of the control system and the supervisory bodies (Board of Auditors, Auditor and supervisory bodies) that deal with the control system monitoring and assessment.
Subjects operating on the second level: these subjects ensure the compliance with specific procedures and define rules applied to all staff members of the SMI Group (managers, persons in charge, privacy controller, etc).
Subjects operating on the first level: include all those who manage the risks of their own work activities and implement the established procedures, that is all employees of the SMI Group.
The definition of the procedures of the control system and the risk management is based on the principles contained in the following documents:
SMI Group's code of ethics: identifies the moral and social responsibilities (both outwards and inwards) and the values embraced by the company, thus representing a full-fledged tool that manages the ethical conduct of the SMI Group's employees, as well as of those who have relations of all kinds with the companies.
231 organization model: it is a management system put in place by the company which includes all procedures and activities aimed at preventing the commission of crimes against the public administration, cybercrimes, organized crimes, crimes against industry and trade, corporate crimes, crimes on market abuse, crimes on safety and health on the working environment, crimes on fencing, laundering and use of money, goods and benefits from an unlawful origin and self-laundering, crimes on copyright violation, on inducement not to make statements or to make false statements to the judicial authorities, crimes on environment, on illegal employment of illegally staying third-country nationals and crimes against individual personality.
Corporate social responsibility: is based on the defense of human rights, protection of labour standards, environmental protection and fight against corruption, as stated in the ten principles of the United Nations' Global Compact.
Lawfulness of processing All activities relating to personal data processing shall be lawful (consent, contract obligations, vital interests of the data subject or of third parties, compliance with legal obligations to which the controller is subject, public interest or exercise of official authority, legitimate interest pursued by the controller or by third parties).
Information statement The information statement has been improved and updated to the new regulations (art. 13 and 14 GDPR).
Rights of the data subjects (right of access, right to erasure-right to be forgotten, right to restriction of processing, right to object, right to data portability) Technical and organization measures have been adopted to ensure the data subject's exercise of his rights and to meet the data subject requirements.
Controllers, processors Based on the new principle of “accountability”, SMI Group organization was re-defined, in order to proactively ensure integral compliance with the Regulation. Redefinition of the role of data processors and service suppliers whose activity implies personal data processing.
Risk of data processing; accountability measures taken by controllers and processors (Impact assessment, record of processing activities, security of processing, data breach) The “Conformity document”, including records of data processing activity, plans, adopts and demonstrates all technical and organizational measures taken to adequately perform the data processing activities and specifies the necessary procedures to be adopted to notify data breach.
Transfer of personal data to international organizations Smipack adheres to the general principles and guarantees concerning the transfer of personal data to third Countries.
The Controller is: SMIPACK S.p.A. Head office: Via Carlo Ceresa, 10 - 24015 San Giovanni Bianco (BG) ITALY VAT nr: IT02529010163 - R.E.A. 234981 For further information, write to: email@example.com
According to the European Regulation 679/2016, the data subject is entitled to exercise the rights set forth in the Regulation. The integral version of art. 15; 16; 17; 18; 20; 21; 77 of the European Regulation is attached to this document.