Processing of personal data
Dear Sir/Madam
We would like to inform you that the EU Reg. 2016/679 (‘European Data Protection Regulation’) provides for the protection of persons and other subjects with respect to the processing of personal data.
Pursuant to Articles 13 and 14, we therefore provide you with the following information: 1. Purpose, legal basis of the processing for which the data are intended
The processing that we intend to carry out, with your specific consent where necessary, has the following purposes;
a. To allow the provision of the Services requested by you for the purposes of the establishment and subsequent operational, technical and administrative management of the relationship connected with the provision of the Services and the execution of communications relating to the performance of the relationship established;
b. allow browsing and consultation of Edirama’s websites
c. respond to requests for assistance or information, which we will receive by e-mail, telephone or chat through the ‘Contact us’ page of our Site, or through the ‘Support’ form accessible from the ‘Support’ page of the Site
d. comply with legal, accounting and tax obligations;
e. to carry out direct marketing by e-mail for services and products similar to those you have purchased, unless you object to such processing initially or in subsequent communications, in pursuit of Edirama di M. Rapparini’s legitimate interest in promoting products or services in which you may reasonably be interested The legal basis for the processing of Personal Data for the purposes referred to in section a-b-c is art. 6(1)(b) of the Regulation as the processing is necessary for the provision of the contracted services. The provision of Personal Data for these purposes is optional but failure to provide it would make it impossible to activate the Services requested.
The purpose referred to in section d is a lawful processing of Personal Data within the meaning of Article 6(1)(c) of the Regulation. Once Personal Data have been provided, processing may indeed be necessary to fulfil legal obligations to which Edirama di M. Rapparini is subject.
On the other hand, the processing referred to in section ‘e’, carried out for e-mail marketing purposes on products or services similar to those purchased by you, finds its legal basis, pursuant to art. 6.1.f of the Regulation, in the legitimate interest of Edirama di M. Rapparini to promote its products or services in a context in which the data subject can reasonably expect such processing, to which he/she may object at any time. In fact, should you wish to object to the processing of your data for marketing purposes, referred to in section ‘e’, you may do so at any time through your control panel, or by sending a request to in**@*****ma.org or even through the mechanism proposed in the footer of the commercial emails. 2. Processing methods
In relation to the aforementioned purposes, your data are subject to computerised and paper processing. Processing operations are carried out in such a way as to guarantee the logical and physical security and confidentiality of your personal data. 3. Nature of personal data
The processing of your personal data relates to the performance of the service you have requested. 4. Compulsory or optional nature of provision
The provision of your personal and sensitive data is not compulsory, but refusal to provide it may make it impossible or extremely difficult to provide the services you have requested. 5. Scope of communication and dissemination of data
Your data may be communicated to
all subjects whose right of access to such data is recognised by virtue of regulatory provisions;
to our collaborators, employees, within the scope of their duties;
to all those natural and/or legal, public and/or private persons when the communication is necessary or functional to the performance of our activity and in the manner and for the purposes described above; 6. Transfer of personal data to a third country
Personal data collected by Edirama di M. Rapparini are not transferred to a third country 7. Modalities and storage duration of personal data
Personal data processed for the purposes referred to in sections a-b-c will be kept for the time strictly necessary to achieve those purposes. In any case, Edirama di M. Rapparini will process Personal Data for as long as permitted by Italian law to protect its interests (Art. 2946 c.c. and following).
The Personal Data processed for the purposes referred to in section ‘d’ will be kept until the time provided for by the specific obligation or applicable law.
For the purposes referred to in section ‘e’, your Personal Data will instead be processed until you revoke your consent or until five years after you cease to be a customer of Edirama di M. Rapparini, or you simply register on the Site, and you have not made any purchase of products or services. This is without prejudice to the possibility for Edirama di M. Rapparini to retain your Personal Data for as long as permitted by Italian law to protect its interests (Art. 2947(1)(3) c.c.). Further information on the data retention period and the criteria used to determine this period may be requested by writing to the Data Controller 6.
Matteo Rapparini – email ed********@***il.com 7. Rights of the data subject
7.1 Art. 15 (right of access) , 16 (right of rectification) of EU Reg. 2016/679
The data subject shall have the right to obtain from the controller confirmation as to whether or not personal data relating to him are being processed and, if so, to obtain access to the personal data and the following information
(a) the purposes of the processing;
(b) the categories of personal data concerned
(c) the recipients or categories of recipients to whom the personal data have been or will be disclosed, in particular if they are recipients in third countries or international organisations
(d) the period for which the personal data are to be retained or, if that is not possible, the criteria used to determine that period
(e) the existence of the right of the data subject to request from the controller the rectification or erasure of personal data concerning him/her or to object to the processing of personal data concerning him/her
(f) the right to lodge a complaint with a supervisory authority;
(h) the existence of an automated decision-making process, including profiling, and, at least in such cases, meaningful information on the logic used, as well as the importance and expected consequences of such processing for the data subject.
7.2 Right under Article 17 of EU Reg. 2016/679 – right to erasure (‘right to be forgotten’)
The data subject shall have the right to obtain from the controller the erasure of personal data concerning him/her without undue delay, and the controller shall be obliged to erase the personal data without undue delay if one of the following grounds exists:
(a) the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;
(b) the data subject withdraws the consent on which the processing is based in accordance with point (a) of Article 6(1) or point (a) of Article 9(2) and if there is no other legal basis for the processing
(c) the data subject objects to the processing pursuant to Article 21(1) and there is no overriding legitimate ground for the processing, or objects to the processing pursuant to Article 21(2);
(d) the personal data have been unlawfully processed;
(e) the personal data must be erased in order to comply with a legal obligation laid down by Union or Member State law to which the controller is subject;
(f) the personal data have been collected in connection with the provision of information society services as referred to in Article 8(1) of EU Reg. 2016/679 7.3 Right referred to in Art. 18 Right to restriction of processing
The data subject shall have the right to obtain from the controller the restriction of processing when one of the following cases occurs:
(a) the data subject contests the accuracy of personal data, for the period necessary for the controller to verify the accuracy of such data
(b) the processing is unlawful and the data subject objects to the erasure of the personal data and requests instead that their use be restricted
(c) although the controller no longer needs the personal data for processing purposes, the personal data are necessary for the establishment, exercise or defence of legal claims by the data subject
(d) the data subject has objected to the processing pursuant to Article 21(1) EU Reg 2016/679 pending verification as to whether the legitimate grounds of the data controller override those of the data subject.
7.4 Right under Article 20 Right to data portability
The data subject shall have the right to receive in a structured, commonly used and machine-readable format the personal data concerning him/her that he/she has provided to a data controller and shall have the right to transmit such data to another data controller without hindrance from the data controller 8. Withdrawal of consent to processing
You have the right to revoke your consent to the processing of your personal data by sending a registered letter with return receipt to the following address: via Fratelli Cervi 15/6 – 40129 – Bologna accompanied by a photocopy of your identity document. At the end of this operation, your personal data will be removed from the archives as soon as possible.
If you wish to receive further information on the processing of your personal data, or if you wish to exercise the rights referred to in point 7 above, you may send a registered letter with return receipt to the following address: via Fratelli Cervi 15/6 – 40129 – Bologna. Before we can provide you with, or modify any information, we may need to verify your identity and answer some questions. An answer will be provided as soon as possible. This privacy policy is in force as of 9 May 2018. Edirama di M. Rapparini reserves the right to modify or simply update its content, in part or completely, also due to changes in applicable legislation. Should the amendments to this Policy concern substantial changes in the processing operations or otherwise have a material impact on the data subjects, Register.it will take care to notify the data subjects accordingly.
