INFORMATION NOTICE REGARDING PERSONAL DATA PROCESSING IN ACCORDANCE WITH EU REGULATION 2016/679 (“GDPR”) – “NEWSLETTER”
1. DATA CONTROLLER
Via degli Agresti, 6 – 40123 Bologna, Italy
T. +39 051 2917599
2. DATA PROCESSING PURPOSES
i. Send, by e-mail, informational communications (“Newsletter”) to those who make explicit request, by entering their e-mail address in the appropriate data collection form. Legal basis for processing data is the performance of the contract involving the data subject.
ii. Generic marketing: by way of example, sending – by automated (such as text messages and e-mail) and traditional (such as telephone calls) methods – commercial information relating to services/products offered by the Company or reporting of company events, and carrying out market research and statistical analysis. Consent (which is optional and can be withdrawn at any time).
iii. Profiled marketing: analysis of data subject’s preferences, habits, behaviours, interests in order to provide personalized commercial information/targeted actions/offers and services tailored to data subject’s needs/preferences. Consent (which is optional and can be withdrawn at any time).
3. DATA RETENTION PERIOD
Collected data will be retained until revocation of consent (“unsubscription” from newsletter service)
After the expiration of the above-mentioned retention terms, the Data will be destroyed, erased or anonymized, consistently with the technical procedures of erasure and backup.
4. DATA PROVISION COMPULSORINESS
The provision of data marked with an asterisk (*) in the registration form is mandatory for the completion and pursuit of the contract; any denial to provide the above data does not therefore authorize the subscription to newsletter service.
The user is able to opt out of this service by clicking on the “unsubscribe” link present in every e-mail.
6. DATA RECIPIENTS
Data may be processed by external parties in the capacity of data controllers such as, by way of example, authorities and supervisory and control authorities and, in general, public or private parties entitled to request the data.
The data may also be processed, on behalf of the Company, by external parties appointed as data processors, entrusted with adequate operating instructions. These subjects are essentially included in the following categories:
a. IT support companies and hosting companies;
b. companies offering website management and maintenance services.
c. subsidiaries of the Company, if consent is given
7. PARTIES AUTHORISED TO PROCESS DATA
Data may be processed by employees in company departments who are responsible for carrying out the activities outlined above and have been authorized to process the data and have received suitable operating instructions.
8. PERSONAL DATA TRANSFERS OUTSIDE THE EU
The data may be transferred to non-EU Countries, in particular to:
a) Extra UE Countries whose data protection level is deemed adequate by the European Commission in accordance with article 45 of the GDPR;
b) Extra UE Countries other than those referred to in the preceding paragraph a), after signing Standard Contractual Clauses adopted/approved by the European Commission in accordance with article 46, 2, letters c) and d) of the GDPR.
A copy of the above-mentioned safeguards can be obtained sending a specific request to the Controller, according to the modalities specified in the following paragraph “Data Subject’s rights – Complaint to the Supervisory Authority”.
9. DATA SUBJECTS’ RIGHTS – COMPLAINT TO THE SUPERVISORY AUTHORITY
The data subjects can require the data controller to access their personal data, erase them, correct inaccurate data, integrate incomplete data, limit the processing in the cases provided for by art. 18 GDPR, as well as object to the processing in cases of legitimate interest of the data controller, by contacting the company by e-mail to firstname.lastname@example.org
Furthermore, data subjects shall be entitled, if the processing is based on consent or contract and is carried out by automated tools, to receive the data in a structured, commonly used and machine-readable format and, where technically feasible, to transfer them to another controller without hindrance.
Data subjects are entitled to withdraw their consent at any time for marketing and/or profiling purposes and to object to the processing of their data for marketing purposes, including profiling related to direct marketing. However, if a data subject prefers to be contacted for this purpose exclusively by traditional means, it shall be possible for him/her to express his/her opposition only to the receipt of communications by automated methods.
Data subjects shall be entitled to submit a complaint to the relevant supervisory authority in the Member State where they have their habitual abode or their place of work or in the Member State where the alleged infringement has occurred.