Privacy Policy


The companies belonging to the Kiwa Group, namely Kiwa Cermet Italia spa, Kiwa Cermet Idea Srl, Kiwa UNAVIAcert Srl and Kiwa Italia Holding srl, hereinafter referred to as “Kiwa", consider the protection of your privacy a fundamental value.

Through this Privacy Policy, updated to comply with the regulatory provisions introduced by EU Regulation 2016/679, Kiwa shall illustrate what types of personal data it collects, how the personal data is processed and what rights you can exercise in this regard.

Who we are (Data Controller)

Kiwa, a leader in the Testing, Inspections and Certifications (TIC) sector, specifies how the processing of your personal data shall take place, in co-ownership among the following companies, all part of the Kiwa Group:

  • Kiwa Cermet Italia Spa (VAT no. 00627711203), in the person of its legal representative pro tempore, with registered office in Via Cadriano 23, 40057 - Granarolo dell'Emilia (BO), Italy;
  • Kiwa Cermet Idea Srl (VAT no. 03358231201), in the person of its legal representative pro tempore, with registered office in Via Ferrarese 156, 40128 - Bologna (BO), Italy;
  • Kiwa UNAVIACert Srl, (VAT no. 06882941005), in the person of its legal representative pro tempore, with registered office in Via Cadriano 23, 40057 - Granarolo dell'Emilia (BO), Italy;
  • Kiwa Italia Holding srl, (VAT no. 08335970961) in the person of its legal representative pro tempore, with registered office in Viale Venezia 45, 31020 - San Vendemiano (TV), Italy.

Which personal data do we collect (Type of data processed)

Browsing data

IT systems and software procedures responsible for the functioning of Kiwa’s websites acquire, as part of their normal operation, certain personal data whose transmission is implicit in the use of Internet communication protocols (Internet domain and IP protocol, type of browser and operating system of the computer used, date, time and length of stay on the website, pages viewed, possible search engine from which the user accessed the website). This data is not collected in order to be associated with identified users, but it could, by its very nature, make it possible to identify the site users if processed and associated with data held by third parties.

This category includes “IP addresses” or the domain names of computers used by those connecting to the Kiwa Group websites, the URI (Uniform Resource Identifier) addresses of the requested resources, the time of the request, the method used to support the request to the server, the size of the file obtained in response, the numerical code indicating the status of the response given by the server (successful, error, etc.) and other parameters relating to the operating system and the user’s IT environment. This data is only used in order to obtain anonymous statistical data concerning the use of the website and to check its correct operation and is deleted immediately after the relative processing.

The automatically collected data may be used by Kiwa to ascertain responsibility in case of hypothetical computer crimes against the website, for statistical purposes and to improve the navigation and content of the website.

Data voluntarily provided through the various contact channels

Kiwa only collects personal data strictly necessary for the provision of its services. The type of data collected varies according to the nature of the service provided to the customer or requested thereby. The requested/supplied data concerns, by way of example but not limited to, personal data (first and last name, date and place of birth, place of residence/professional domicile, tax code or VAT number), contact data (email address, landline or mobile number), billing data, as well as, when necessary, details relating to the company for which you are working.

The requested/supplied data may include so-called “special data categories”, namely data defined as “sensitive”, processed by Kiwa only when this is deemed necessary for the provision of the service requested by the customer. These “special data categories” are processed, with your consent, in accordance with current legislation on the protection of personal data.

Why do we collect your personal data (Purpose and legal basis of the data processing)

The data you supply is aimed at providing the requested service, at the evaluation of your spontaneous professional candidacy, or the transmission of marketing newsletters and communications.

This data shall be processed only after obtaining your free consent, to enable the performance of this contract, for the execution of pre-contractual measures or for the purpose of fulfilling an obligation imposed by applicable law, as provided for in Article 6 paragraph 1, letters a), b) and c) and Article 9 paragraph 2 letter a) of EU Regulation 2016/679.

Marketing and newsletter purposes

With particular reference to your subscription to Kiwa newsletters, this activity shall consist of the periodic sending of commercial/marketing data relating to the services offered by Kiwa, through any electronic or paper means of communication available, including via email.

If you no longer wish to receive marketing communications, regardless of the channel used for this purpose, you can communicate your decision to the address found at the end of this Privacy Policy. It should however be understood that the eventual withdrawal of your consent, while fully valid, shall have no retroactive effect.

Why is the provision of personal data mandatory

Your personal data is required to enable Kiwa to provide the contractual services requested. It is therefore understood that failure to provide the data, partial or incorrect provision of the requested data may consequently determine the impossibility by Kiwa to provide the service requested.

Without prejudice to the obligation referred to above, functional to the provision of the service as outlined, it is however understood that, where your personal data is collected for marketing purposes/subscription to the newsletter, your consent for this purpose, being optional in nature, may however be expressly denied or subsequently revoked, determining your free choice to provide your consent or otherwise for such processing.

How do we collect your personal data (Method for collecting the data)

Your data may be collected by Kiwa through the following channels:

  • formal request for a quotation for the provision of one or more services offered by Kiwa;
  • digital compilation of contact forms available on Kiwa Group company websites, as described in the introduction, or by filling out paper contact forms;
  • subscription to the Kiwa Newsletter;

Moreover, the data under examination could also originate from third parties, such as, for example, your employer, where the latter enrols you in training or certification sessions organised and/or managed by Kiwa.

How and for how long will your personal data be processed (Method and duration of the data processing)

The personal data voluntarily provided by you through the aforementioned channels, shall be subject to collection, storage, archiving, access and reading exclusively by authorised staff commissioned by Kiwa.

Kiwa shall process your personal data in full compliance with the data retention obligations established by law, for the duration strictly necessary to allow the same to create offers for you, to provide the service requested or to evaluate your professional application.

Your personal data shall be primarily processed using computerised/telematic tools. Moreover, for the processing in question, the use of adequate technical and organisational security measures shall be ensured, pursuant to and for the purposes of Article 32 of EU Regulation 2016/679, appropriate to reduce the risk of destruction, loss, unauthorised access or processing of personal data, not permitted or in any case not compliant with the purposes for which the data was originally collected. It should be noted that, with regard to the processing of so-called “special data”, Kiwa declares to have adopted enhanced security measures, intended to rigorously preserve the confidentiality of such data.

It should also be noted that, in order to ensure the proper handling of personal data, Kiwa has taken steps to train and educate its employees and collaborators, in order to provide them with the necessary skills and knowledge aimed at protecting the security of personal data collected.

Where is your personal data stored

Your personal data shall be stored in our data centre and/or cloud, on servers located in the European Union.

In order to safeguard the security of your personal data, Kiwa relies on industry-leading suppliers that offer guarantees on the implementation of the most extensive and stringent security measures for managing your personal data.

With whom do we share your personal data (Transmission of data to third parties)

Your personal data may be disclosed to those “third parties”, all operating within the European Union, which Kiwa relies on for the provision of the service offered and the attainment of the relative purposes, including:

  1. Kiwa external collaborators/consultants who deal with certification and training activities;
  2. companies and professional firms that provide Kiwa with assistance, consultancy or collaboration activities in accounting, administrative and legal matters, each within the scope of their respective functions, in accordance with the instructions given by Kiwa;
  3. judicial and/or administrative authorities and/or other public bodies entitled to request your data, in the cases expressly provided for by the applicable legislation;
  4. other subjects on whom Kiwa relies for the correct and diligent execution of the contract and therefore, in particular, for the provision of the service requested.

Such “third parties”, with the exception of those identified in letter c) above, cover, pursuant with the provisions of Article 28 of EU Regulation 2016/679, the role of Data Processors and consequently are held to comply with, under a specific contractual agreement, the security standards communicated to them concerning the processing of personal data, respecting current legislation on the protection of personal data.

What are your rights with regard to the personal data provided (Rights of the interested parties)

Please note that in accordance with the provisions of Article 7 of Legislative Decree 196/03 and Article 15 and subsequent amendments of EU Regulation 2016/679, you may, at any time, as an “interested party/data subject” in relation to the data processing and with regard to each of the aforementioned co-Data Controllers (Kiwa Cermet Italia spa, Kiwa Cermet Idea Srl, Kiwa UNAVIAcert Srl and Kiwa Italia Holding srl), exercise the following rights:

  1. Right of Access, which gives you access to your personal data and entitles you to obtain a copy thereof, or to request information concerning the processing purposes and methods;
  2. Right of Rectification, which entitles you to request the correction of your data, where the data is inaccurate, or integration of your data, where the data is incomplete;
  3. Right of Deletion, (the so-called “right to be forgotten”) which entitles you to the deletion of your data in the cases provided for by Article 17 of EU Regulation 2016/679;
  4. Right of Limitation of the Data Processing, which entitles you to the limitation of the processing of your data in the cases provided for by Article 18 of EU Regulation 2016/679;
  5. Right of Portability, which entitles you to receive your personal data in a structured, commonly used and machine-readable format and, if technically feasible, to transmit such data, under the responsibility of each co-Data Controller (Kiwa Cermet Italia spa, Kiwa Cermet Idea Srl, Kiwa UNAVIAcert Srl and Kiwa Italia Holding srl), to another Data Controller. Please note that such right is exercisable to the extent that the processing is based on consent or on the execution of a contract, is carried out by automated means and is not prejudicial to the rights and freedoms of third parties.
  6. Right to Object, which entitles you, at any time, to object to the processing of your personal data for direct marketing purposes;
  7. Right to file a Complaint, which entitles you to submit a complaint with the Authority for the Protection of Personal Data in accordance with and for the purposes of Article 77 of EU Regulation 2016/679.

For the purposes of exercising the rights referred to in Article 7 of Legislative Decree 196/03 and Article 15 and subsequent amendments of EU Regulation 2016/679 or to obtain more information on Kiwa’s Privacy Policy, you may contact each of the co-Data Controllers (Kiwa Cermet Italia spa, Kiwa Cermet Idea Srl, Kiwa UNAVIAcert Srl and Kiwa Italia Holding srl) by sending an email to (the email address is shared among the aforementioned co-Data Controllers).

Please hereby note that before being able to proceed with providing or modifying any data, it may be necessary to verify your identity.

Information about this Privacy Policy

This Privacy Policy was last updated on 25 may 2018. The Co-Data Controllers hereby reserve the right to modify or update this document, publishing such changes on the Kiwa Group company websites or alternatively by sending you the appropriate updated Privacy Policy.