This document ("Information") intends to provide you with information regarding the processing of information, as specified below, which will be provided by you or otherwise available at our facility and which will be processed by the same and/or by other subjects identified for the purposes indicated below. The information, in particular, is provided pursuant to EU Regulation no. 679/2016 ("GDPR") and subsequent national adaptation regulations (together with the GDPR hereinafter "Applicable Regulations").
1. Identity and contact details of the Data Controller The data controller, pursuant to articles. 4 and 24 of EU Reg. 2016/679, is Cappelletti S.r.l., with registered office in Via Mazzini, 108 - 64011 Alba Adriatica (TE), VAT number 01046360671 in the person of the legal representative pro-tempore (hereinafter "Owner" ).
2. Contact details of the Data Protection Officer (so-called "RPD-DPO") The Data Controller does not carry out activities that require the designation of the figure of the Personal Data Protection Officer.
3. Purpose and legal basis of the processing The Personal Data collected will be processed for the purposes and under the legal bases set out below:
Purpose
point 3, letter a): for the management of your contractual relationship or to execute pre-contractual measures (such as, for example, the request for information or the request for a quote). In this case, you are free to provide your Personal Data, however failure to provide it will not allow you to establish the aforementioned relationship and satisfy your request.
Legal basis of the processing
the processing is necessary in relation to the execution of a contract of which you are a party and is necessary to fulfill a legal obligation to which the Data Controller is subject
point 3, letter b): subject to your specific consent, revocable at any time, to send you promotional communications relating to the Owner and communications relating to events organized by the Owner (hereinafter "marketing purposes")
Legal basis of the processing
your consent
4. Categories of personal data processed Within the limits of the purposes and methods described in this Policy, information may be processed that can be considered as "Personal Data", which includes your personal details, your contact details (such as, for example, number mobile phone number, e-mail address, etc.).
5. Recipients and categories of recipients Personal data will not be disclosed, i.e. it will not be disclosed to indeterminate subjects. They may instead be communicated to well-defined subjects, in full compliance with legal requirements, for purposes strictly related to those previously indicated. Any access to your personal data is limited to persons authorized by the Data Controller. Communication to the identified recipients, only if involved and functional, is linked to the achievement of the purposes referred to in point 3 above, therefore the personal data collected and processed may be:
◉ used anonymously for statistical purposes;
◉ made available to the Data Controller's collaborators, as Managers or persons authorized to process personal data;
◉ communicated to third parties, whether natural or legal, public administrations, professionals, law enforcement agencies, government bodies, regulatory bodies, courts or other public authorities authorized by law;
◉ subjects who provide services for the management of the information system and communication networks including email, newsletters and website management;
◉ firms or companies in the context of assistance and consultancy relationships;
◉ if necessary, transferred to another Data Controller in accordance with the provisions of the GDPR, also with regard to the right to data portability.
The information may also be communicated whenever communication may be necessary to comply with requests from the Judicial or Public Security Authorities. The data collected will under no circumstances be disclosed.
The list of those responsible for processing personal data is available at the headquarters of the Data Controller.
6. Transfer of data abroad
The data will not be transferred outside the European Union.
7. Data retention period (determination criteria)
In compliance with the provisions of the art. 5 paragraph 1 letter. e) of EU Regulation 2016/679, the personal data collected will be stored in a form that allows the identification of the interested parties for a period of time not exceeding the achievement of the purposes for which the personal data are processed. Below is a table containing indications of the retention times (i.e. the determination criteria) of Personal Data:
Purpose
point 3, letter a): contract management
Storage times
For the entire duration of the relationship and subsequently for 10 years (ordinary prescription).
Purpose
point 3, letter b): marketing purposes
Storage times
5 years from collection, without prejudice to the possibility for the interested party to modify and/or revoke his/her will at any time
8. Data processing methods
The processing of Personal Data will take place using manual, IT or telematic tools, suitable to guarantee its security and confidentiality and will be carried out by personnel duly trained in compliance with the Applicable Regulations. There is no automated decision making.
In addition to cases in which it is necessary to contact you for needs related to the management of your position, where you consent to the processing of your data for the purposes referred to in point 3, letter. b), You may be contacted via e-mail, newsletter, text message, instant messaging systems or through any equivalent electronic tool or by paper mail or call via operator to all contact details provided. If you prefer to be contacted only at one or some of these addresses, you may make an express written request addressed without formalities to the Data Controller.
9. Rights that are recognized to you
We inform you that you may exercise the rights recognized by the Applicable Regulations including, by way of example, the right:
◉ a) to access their Personal Data and know its origin, the purposes and purposes of the processing, the data of the subjects to whom they are communicated, the data retention period or the criteria useful for determining it (art.15);
◉ to request rectification (art.16);
◉ cancellation ("oblivion"), if no longer necessary, incomplete, incorrect or collected in violation of the law (art.17);
◉ to request that the processing be limited to part of the information concerning you (art.18);
◉ to the extent that it is technically possible, to receive in a structured format or to transmit to you or to third parties indicated by you the information concerning you (so-called "portability") or that which has been voluntarily provided by you (art.20) ;
◉ to oppose their processing based on legitimate interest (art. 21);
◉ as well as to revoke your consent at any time, in the event that this constitutes the basis of the processing (the revocation of consent in any case does not affect the lawfulness of the processing based on the consent carried out before the revocation itself).
The aforementioned rights may be exercised by means of a written request addressed without formalities to the Data Controller at the contacts indicated in point 1.
The Data Controller must do so without delay and, in any case, at the latest within one month of receiving the request. The deadline may be extended by two months, if necessary, taking into account the complexity and number of requests received by the Data Controller. In such cases, the Data Controller will inform you and inform you of the reasons for the extension within one month of receiving your request.
We remind you that, if the response to your requests has not been satisfactory in your opinion, you can contact and lodge a complaint with the Guarantor Authority for the Protection of Personal Data (http://www.garanteprivacy.it/) in the ways provided for by the Regulations Applicable.
