Privacy Policy

The Data Controller of the personal data listed below, pursuant to art. 13 of EU Regulation no. 679/16 on the protection of natural persons with regard to the processing of personal data (hereinafter “Regulation”) informs that it will proceed with the processing of data for the purposes and in the manner indicated below.

1. TYPE OF PERSONAL DATA PROCESSED
The data processed by the Data Controller are:
1.1. personal identification data: 1 ☐ name; ☐ 2 surname; ☐ 3 date of birth; ☐ 4 place of birth; ☐ 5 tax code; ☐ 6 address/city; ☐ 7 IBANs; ☐ 8 credentials; 9 ☐ Phone; 10 ☐ email address; 11 ☐ economic data; 12 ☐ financial data; 13 ☐ images; 14 ☐ audio; 15 ☒ IP address; 16 ☐ Identification document number; 17 ☐ Car license plate; 18☐ social accounts;19 ☐ VAT number;;
1.2. special personal data: 1 ☐ biometric; ☐ 2 genetic; ☐ 3 health; ☐ 4 sexual orientation; ☐ 5 political opinions; ☐ 6 union membership; ☐ 7 racial origin; ☐ 8 religious or philosophical beliefs;
1.3. judicial personal data: 1 ☐ Criminal convictions/offences
1.4. type of possible profiling: 1 ☐ professional performance; ☐ 2 economic situation; ☐ 3 health; ☐ 4 personal preferences; ☐ 5 interest; ☐ 6 reliability; ☐ 7 behaviour; ☐ 8 Location/Shifts.
The processing of data will be carried out in accordance with the provisions of the Regulation as specified below.

1. SOURCE OF PERSONAL DATA SUBJECT TO PROCESSING.
The personal data subject to processing are those collected from the data subject.

2. PURPOSE OF DATA COLLECTION, RELATED RETENTION PERIOD AND LEGAL BASIS (art.13 par.1 letter c Regulation)
1.5. (IP address) This purpose is to process your data released during normal navigation on the website for technical purposes only and to allow safe and correct use of the website. For this purpose, the data will be kept for the time strictly necessary not exceeding 3 years (plus 6 months to carry out the deletion). For this purpose, consent is not required pursuant to Article 6 paragraph 1 letter f of the Regulation (legitimate interest). The data used for this purpose are all those indicated in point 1.1 n°15.
For all other data collected in the contact forms (if present on the various pages of the site) it is advisable to refer to the specific information that can be viewed through the links in the individual contact forms.
1.6. (Technical cookies) This purpose is to process your data, relating to access to the website, for the sole purpose of ensuring the correct functioning of the site by improving navigation within it. For this purpose, the data will be kept for the time strictly necessary not exceeding 3 years (plus 6 months to cancel). For this purpose, consent is not required pursuant to Article 6 paragraph 1 letter f of the Regulation (legitimate interest).
Also for analytical cookies only if “Anonymized” consent is not required while for all other cookies where consent is required (e.g. profiling, marketing) it is necessary to refer to the cookie policy in the banner, viewing it in the specific area where you can customize the choice of cookies.
2.1. (General statistics) This purpose is to inform you how we want to manage your data in order to carry out general statistics in anonymous and/or aggregate form for the sole purpose of improving the quality of the services/products offered. The storage of data will last for the time strictly necessary not exceeding 3 years (plus 6 months to carry out the deletion). For this purpose, consent is not required pursuant to Article 6 paragraph 1 letter f of the Regulation (legitimate interest). The data used for this purpose are all those indicated in point 1.1 n°15.

3. LEGAL BASIS FOR THE PROCESSING (art.13 par.1 letter c of the Regulation)
The legal basis is made explicit in the individual purposes referred to in point 3.

4. NATURE OF THE PROVISION OF DATA – CONSEQUENCES OF REFUSAL OF CONSENT (art.13 par.2 letter e of the Regulation)
In compliance with Article 13 paragraph 2 letter e of the Regulation, see the specific purposes for information with respect to the legal obligation, contract or requirement to conclude a contract. If the data subject does not intend to provide the personal data referred to above, the consequence would be that it would be impossible to establish or continue the relationship between the parties.

5. RECIPIENTS WHO MAY BECOME AWARE OF YOUR PERSONAL DATA (art.13 par.1 letter e of the Regulation)
The categories of subjects who may become aware of your personal data are: authorised persons (employees), Data Processors (suppliers) of the Data Controller, recipients (customers), DPO where appointed, any supervisory bodies. Public authorities responsible for controls or legal obligations.

2. TRANSFER OF PERSONAL DATA (art. 13, par.1 letter f of the Regulation)
5.1. The data will be/may be transferred to EU member countries YES ☒NO☐. For further information, please contact the Data Controller.
5.2. The data will be/may be transferred to non-EU third countries YES ☐NO☒. For further information, please contact the Data Controller. In the event of data transfer outside the EU, the Data Controller hereby ensures that the transfer will take place in accordance with art. 44 et seq. of the GDPR and applicable legal provisions by concluding, if necessary, agreements for the transfer of personal data established in third countries that do not ensure an adequate level of protection of personal data.

6. METHODS OF PROCESSING
The processing will be carried out in electronic form with the aid of computerized tools.

7. RIGHTS OF THE DATA SUBJECT (art. 13, par.1 letter b of the Regulation)
Arts. 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23 of the Regulation confer on the data subject the exercise of specific rights, including:
2.1. art.12 Information, communications and transparent methods for exercising the rights of the data subject;
2.2. art.13 Information to be provided if personal data are collected from the data subject;
2.3. art.14 Information to be provided if personal data have not been obtained from the data subject;
2.4. art.15 Right of Access: right to obtain from the data controller confirmation as to whether or not personal data concerning him/her is being processed;
2.5. art.16 Right to rectification: right to obtain from the data controller the rectification of inaccurate personal data concerning him/her;
2.6. Art.17 Right to erasure (“right to be forgotten”): right to obtain from the data controller the erasure of personal data concerning him/her;
2.7. Art.18 Right to restriction of processing: the right to obtain from the data controller a limited processing of your data when you contest the accuracy of your personal data, when the processing is unlawful and if you have objected to the processing;
2.8. art.19 Right to receive notification from the Data Controller in the event of rectification or erasure of personal data or limitation of processing;
2.9. art.20 Right to data portability: obtain data portability, i.e. receive them from a data controller, in a structured, commonly used and machine-readable format, and transmit them to another data controller without hindrance;
2.10. art.21 Right to object: object to the processing at any time, even in the case of processing for direct marketing purposes;
2.11. Art.22 Automated decision-making relating to natural persons, including profiling;
2.12. Art.23 Limitation.
The documents are available at the operational headquarters of the Data Controller (shown in box A), which, as above, undertakes to guarantee the exercise of the rights. The data subject may lodge a complaint with the Guarantor for the protection of personal data (art. 13, par.2 letter d of the Regulation), following the procedures and indications published on the official website of the Authority on www.garanteprivacy.it.
In exercising the rights referred to in art. 12-23 of the Regulation, the interested party may confer, in writing, a proxy or power of attorney to natural persons or associations. Requests may be forwarded to the data controller or to the DPO, if appointed, via the e-mail addresses listed in boxes A and B.

8. DURATION OF PROCESSING (art.13 par.2 letter a Regulation)
The data processing will have a duration as indicated in the individual purposes, with an increase of 180 days for technical reasons. This is without prejudice to storage for a longer period in the event of the Data Controller’s defence in court for the entire duration of the litigation.

9. DATA CONTROLLER (art.13 par.1 letter a Regulation)
The identification details of the Data Controller are those shown in box A with the respective contact points.

10. DATA PROTECTION OFFICER (DPO) (art.13 par.1 letter b) Regulation)
The identification details of the DPO (Data Protection Officer), if appointed, are reported in box B.