1. DATA CONTROLLER
Stad S.r.l. with registered office in Scandiano - Fraz. Arceto - Via per Reggio 30/P Reggio Emilia - Tax number 01847550355, in the person of the Privacy Manager Ms Monica Bergianti, as controller of the processing of your personal data, pursuant to and for the purposes of EU Regulation 2016/679 (hereinafter "GDPR"), hereby informs you that the aforementioned regulation provides for the protection of data subjects with regard to the processing of personal data and that such processing will be based on principles of fairness, lawfulness, transparency and protection of your privacy and your rights. Your personal data will be processed in accordance with the law provisions of the above-mentioned regulation and the confidentiality obligations provided for therein.
2. PURPOSE OF THE PROCESSING
The personal data collected, including identification, accounting, commercial, administrative, fiscal and any judicial data directly related to you (when a natural person) or, essentially identifying and possibly judicial data, communicated to other stakeholders (such as employees, collaborators, persons in charge, etc.) to fulfil and in the conduct of relations with the Controller and in compliance with the provisions on processing and protection of personal data, are used by the Controller in full compliance with the principle of correctness and lawfulness and with the law provisions for purposes instrumental and conducive to the fulfilment of the relationship in question, be it pre-contractual and/or contractual. This relationship takes concrete form in the finding of new partners, in the management of orders/procurement of goods or services, including professional and qualified services, and also related to the said activities, such as filing, invoicing, processing and recording.
3. METHODS OF PROCESSING
Personal data voluntarily provided in the context of the business relationship with the Controller, communicated directly by the data subject, will be processed by means of manual and/or automated tools for the purposes set out in point 3. The data processing will be carried out by personnel directly employed by the company Stad S.r.l. and by natural or legal persons specifically identified by it as data processors or in charge with the processing. The data may be communicated to professional firms/companies that provide assistance, advice or collaboration to the data controller in accounting, administrative, tax, legal and financial matters, to public administrations for the performance of institutional functions within the limits established by law or regulations and to third-party service providers (e.g. logistics companies, transport companies, etc.), players operating in the distribution chain, to whom communication is necessary for the performance of the services covered by the contract entered into by and between the parties. Personal data will not be disclosed. The data will be processed using manual and automatic systems in order to store, manage and transmit the data, in a way strictly related to the purposes, on the basis of the data in our possession and with an undertaking on your part to promptly notify us of any corrections, additions and/or updates.
Your data will be communicated only to competent and duly appointed subjects for the fulfilment of the services necessary for a correct management of the relationship, with guarantee of protection of the rights of the data subject. Your data will be processed only by personnel expressly authorised and appointed by the Controller. Your data may be communicated to third parties duly appointed as data Processors, namely: - to subjects who can access your data by virtue of provisions of law or secondary or Community legislation; - to banks for the management of collections and payments arising from the fulfilment of contracts; - to public and private bodies, also further to inspections or audits (Financial Administration, Revenue Police bodies, judicial authorities, Ufficio Italiano Cambi, Department of Labour, ASL, Social Security institutions, ENASARCO, Chamber of Commerce, etc.); - carriers for the transport of materials.
Personal data collected will be processed in Italy and will not be transferred to a third country outside the EEC or to any international organisation.
The provision of personal data is of a contractual nature. It follows that the communication of data is optional but any refusal by the data subject or even the subsequent request for erasure, could make it impossible or extremely difficult to fulfil the contract to which it is a party.
7. DATA RETENTION
We point out that, in accordance with the principles of lawfulness, purpose limitation and minimisation of data, pursuant to art. 5 of the GDPR, the retention period of your personal data is: - established for a period of time not exceeding the achievement of the purposes for which they are collected and processed for the fulfilment and performance of contractual purposes; - established for a period of time not exceeding the performance of the services provided; - established for a period of time not exceeding the achievement of the purposes for which they are collected and processed and in compliance with the mandatory time limits prescribed by law.
8. TRANSFER OF DATA TO THIRD PARTIES
Personal data will not be transferred to third-party companies for them sending their commercial communications for a fee.
9. RIGHTS OF THE DATA SUBJECT
EU Regulation 2016/679: Articles 15, 16, 17, 18, 19, 20, 21, 22 - Rights of the data subject: - At any time, pursuant to articles 15-22 of EU Regulation 2016/679, you may exercise the right to: - request confirmation that their personal data are being processed or not and to obtain access to them; - obtain rectification, erasure of data, restriction of processing; - object to processing at any time; - lodge a complaint with a supervisory authority; - obtain information on the existence of an automated decision-making process, including profiling; and, at least in such cases, obtain significant data on the logic used, and on the severity and consequences for the data subject; in such cases, the data subject has the right to object at any time; - obtain portability of the data, i.e. to receive data from a data controller in a structured, commonly used and machine-readable format, and transmit them to another data controller without hindrance; - withdraw consent at any time without prejudice to the lawfulness of processing based on consent given prior to withdrawal, both in the case of processing of personal data and of particular categories of personal data (articles 6, paragraph 1(a) and 9 paragraph 2(a)). The provisions of art. 7 of the Regulation, Right of access to personal data and other rights: - 1. The data subject has the right to obtain confirmation of the existence or not of personal data concerning him/her, even if not yet recorded, and their communication in intelligible form. - 2.The data subject has the right to be informed: a) of the origin of the personal data; b) of the purposes and methods of processing; c) of the logic applied in the event of processing carried out with the help of electronic means; d) of the identification data concerning the data controller, data processors and the representative designated under article 5, paragraph 2; e) of the entities or categories of entities to whom or which the personal data may be communicated and who or which may get to know said data in their capacity as designated representative(s) in the State's territory of data processor(s) or person(s) in charge of the processing. - 3. The data subject has the right to obtain: a) update, rectification or, where interested therein, integration of the data; b) erasure, anonymisation or blocking of data processed unlawfully, including data whose retention is unnecessary for the purposes for which they were collected or subsequently processed; c) certification to the effect that the operations under letters a) and b) have been notified, also related to their contents, to the entities to whom or which the data were communicated or disseminated, unless this requirement proves impossible or requires disproportionate means compared to the right being protected. - 4.The interested party has the right to object, in whole or in part: a) for legitimate reasons, to the processing of personal data concerning him/her, even if pertinent to the purpose of their collection; b) to the processing of personal data concerning him/her for the purpose of sending advertising materials or direct selling or for the performance of market or commercial communication surveys. - You may exercise your rights by written request sent to the Data Controller by registered letter with return receipt to the address Via per Reggio 30/P, to any new address of the company or by e-mail to firstname.lastname@example.org - lodge a complaint with the Italian Data Protection Authority, following the procedures and guidelines published on the official website of the Authority on www.garanteprivacy.it. The full text of EU Regulation 2016/679 on the rights of the data subject is available at www.garanteprivacy.it.
10. AUTOMATED DECISION-MAKING