For all processing related to the services 1-2-3-4-5 described above, it is stated that the data provided may be disclosed to the Data Controller's staff and collaborators and possibly to companies/systems and suppliers that process data in outsourcing on behalf of the Data Controller, in any case for the sole purpose of perfecting the activities requested and enabling the smooth operation of the services.
Some data may be processed by the Data Controller's technological partners for the only purpose of managing the technical/IT functions of the web service.
In any case, the data is never disseminated and is always stored within the territory of the EU until the User expressly requests the Data Controller to delete his/her account/personal data. In this case, however, it is possible that, in order to comply with specific regulatory obligations, it may not be possible to permanently delete all of the User's personal data on the Data Controller's systems.
Illustrated below are some specifications concerning the services/products that the User may access through the Data Controller's sites/apps:
Please note that, in order to benefit from some specific products and services that have been purchased by the User, it may be necessary for the Data Controller to issue and deliver a physical device (for example, a card). Delivery of the device may be free of charge or subject to payment of an additional fee. In any event, when purchasing services and products, the Data Controller undertakes to specify whether there are additional costs for the issue of the physical device. In the User's personal area, the identification data of the physical devices that have been issued and associated with the User's name are displayed.
For the purchase of the products and services mentioned above, Users are given a choice between the different payment methods provided by the Data Controller as indicated at the time of purchase.
Lastly, please note that by registering on the site/app and making purchases, the Data Controller may use the e-mail address provided by the User to send information material and communications, discount coupons and promotions, news and activities promoted by the Data Controller, unless the User expressly denies this option. These notifications are provided in compliance with article 130, paragraph 4, of Italian Legislative Decree Number 196/03, which prescribes that, unless the interested party expressly objects, it is possible for the Data Controller to send, by automated and non-automated tools, communications regarding "similar services" to the ones that have already been used. The User may object to such communications by contacting the Data Controller or the DPO using the contact details indicated above or by completing the cancellation procedure indicated at the bottom of each communication that is received (OPT - OUT). Users may also receive "questionnaires" concerning their satisfaction with the services they have received and suggestions for improvement. Participating in the questionnaire is optional and is permitted under article 6, paragraph 1, letter F of the GDPR (legitimate interest of the Data Controller).
THE RIGHTS OF DATA SUBJECTS
Users are always entitled to contact the Data Controller in order to claim the rights provided for in articles, 13, 15, 16, 17, 18, 20, 21, and 77 of EU Regulation 679/16, which are outlined below for convenience.
1) Right to withdraw consent (article 13): You are entitled to withdraw your consent at any time for all the processing operations for which the prerequisite of legitimacy is a declaration of Your consent. Specifically, the withdrawal of consent is valid for the processing of data performed for the purpose of sending advertising or direct sales material or for conducting market research or business communication activities for promotional purposes, including those performed in compliance with article 130, paragraph 4 of Italian Legislative Decree 196/03. Withdrawal of consent does not affect the legality of the processing that took place prior to the withdrawal of consent.
2) Right of access to data (article 15): You are entitled to request (a) the purposes of the processing; (b) the categories of personal data concerned; (c) the recipients or categories of recipients to whom the personal data have been or are going to be disclosed, specifically if they are recipients from third countries or international organisations; (d) if possible, the period for which the personal data are planned to be stored or, if this is not possible, the criteria used to determine this retention period; (e) the existence of the Data Subject's right to request the Data Controller to amend or delete the personal data or to restrict the processing of personal data concerning the Data Subject or to object to their processing; (f) the right to lodge a complaint with a supervisory authority; (g) if the data are not collected from the Data Subject, all the available information relating to their origin; (h) the existence of an automated decision-making process, including profiling as referred to in article 22, paragraphs 1 and 4, and, at least in such cases, significant information explaining the logic used and the importance and the envisaged consequences of such processing for the Data Subject. You are entitled to request a copy of the personal data which are being processed.
3) Right to rectification (article 16): You are entitled to request the rectification of inaccurate personal data relating to you and to obtain the integration of any incomplete personal data.
4) Right to be forgotten (article 17): You are entitled to have personal data concerning you deleted by the Data Controller if the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed, if you withdraw your consent, if there is no overriding legitimate reason to proceed with profiling processing, if the data have been processed unlawfully, if there is a legal obligation to erase the data; if the data are related to web services provided to minors with no consent. Deletion of data is possible unless the right to freedom of expression and information prevails, the data are retained for the fulfilment of a legal obligation or the performance of a task undertaken in the public interest or the exercise of official authority, for reasons of public interest in the health sector, for archiving in the public interest, for scientific or historical research or statistical purposes, or the establishment, exercise or defence of legal claims.
5) Right to the restriction of processing (article 18): You are entitled to obtain from the Data Controller the restriction of processing when you have disputed the accuracy of your personal data (for the period necessary for the Data Controller to verify the accuracy of such personal data) or if the processing is unlawful, if it is necessary for the establishment, exercise or defence of legal claims.
6) Right to data portability (article 20): You are entitled to receive in a structured, commonly used and machine-readable format the personal data that relates to you and that you have provided to us. You are also entitled to transmit to a third party if the processing has been undertaken based on your consent, by contract and if the processing is effected by automated means unless the processing is necessary for the performance of a task carried out in the public interest or in connection with the exercise of official authority and such transmission does not violate the rights of a third party.
7) Right to lodge a complaint with the Data Protection Authority.
The execution of the rights referred to above is subject to the limits, rules and procedures provided for in the Rules and Regulations referred to above, which the User is required to know and implement. In compliance with the provisions of article 12, paragraph 3, the Data Controller undertakes to also supply the data subject with information relating to the action undertaken without unjustified delay and, in any case, no later than one month from receipt of the request. This period may be extended by two months, if necessary, taking into account the complexity and number of requests. The Data Controller is required to inform the Data Subject of this time extension, including the reasons for the extension, within one month of receipt of the request.
To exercise the rights referred to above, the Data Subject is entitled to use the form on this
page to be submitted to the Data Controller, after it has been properly completed and undersigned.
