The Data Controller below, in accordance with the EU Regulation 2016/679 of April 27, 2016 on the protection of individuals with regard to the processing of personal data (hereinafter “Regulation”) informs that it will process the data for the purposes and in the manner set out below. “Processing” of personal data means any operation or set of operations, performed with or without the aid of automated processes and applied to personal data or sets of personal data, even if not recorded in a database, such as collecting, recording, organizing, structuring storage, processing, selection, blocking, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, comparison or interconnection, restriction, erasure or destruction. Processing will be done manually (e.g., collection of paper forms) and electronically or otherwise using computerized or automated means. According to the rules of the Regulations, processing will be based on the principles of fairness, lawfulness, transparency and protection of confidentiality. In accordance with Article 13 of the Regulations, we therefore provide the following information.

1. TYPE OF PERSONAL DATA PROCESSED

The data being processed by the Data Controller are:

• personal identifying data: 1 ☒ name; 2 ☒ surname; 3 ☐ date of birth; 4 ☐ place of birth; 5 ☐ tax code; 6 ☐ IBAN; 7 ☐ credentials; 8 ☒ phone number; 9 ☒ email address; 10 ☐ economic data; 11 ☐ financial data; 12 ☐ images;
• special personal data: 1 ☐ biometrics; 2 ☐ genetics; 3 ☐ health; 4 ☐ sexual orientation; 5 ☐ political orientation;

6 ☐ union membership; 7 ☐ racial origin; 8 ☐ religious or philosophical beliefs;

• judicial personal data: 1 ☐ Criminal convictions/offenses
• type of possible profiling: 1 ☐ professional performance; 2 ☐ economic situation; 3 ☐ health; 4 ☐ personal preferences; 5 ☐ interests; 6 ☐ reliability; 7 ☐ behavior; 8 ☐ location/movements.

Special personal data may be processed with the consent of the person concerned. Otherwise, the data will be immediately destroyed. Data will be processed in accordance with the provisions of the Regulations as specified below.

2. SOURCE OF THE PERSONAL DATA BEING PROCESSED.

The personal data being processed are those collected from the data subject.

3. PURPOSE OF DATA COLLECTION (art.13 par.1 letter c EU Regulation 2016/679)

Data will be processed exclusively for the following purposes:

1. I authorize the creation of the data base for commercial communications (Marketing) also through automated systems (fax, sms, email) (art.6 par 1 – letter a) of the Regulations) and its storage for 3 years from the last intercourse;
2. LEGAL BASIS FOR PROCESSING (art.13 par.1 letter c) of the Regulations)

The lawfulness of the processing of personal data by the Data Controller is guaranteed insofar as it complies with paragraphs (a) and (c) of Art. 6 paragraph 1 of the Regulations.

5. NATURE OF PROVISION OF DATA – CONSEQUENCES OF REFUSAL OF CONSENT (art.13 par.2 letter e) of the Regulation)

In case of the occurrence of letter c) paragraph 1 of Article 6 of the Regulations, the Data Controller is not obliged to acquire the specific consent. If the data subject does not wish to give the above personal data anyway, the consequence would be that it would be impossible to establish or continue the contractual relationship. Outside the assumptions described above, the processing of personal data is optional and of free choice and may be carried out only with express consent.

6. COMMUNICATION OF DATA (art.13 par.1 letter e) of the Regulation)

With reference to Art. 13(1)(e) of the EU Regulation 2016/679, an indication is given of the subjects or categories of subjects who might become aware of your personal data:

• Data processors (employees and contractors);
• Processors (consultants, hosting service providers);
• co-owners (client companies and network of entrepreneurs).

7. MODE OF TREATMENT

The processing will be carried out by employees in manual and/or automated form in compliance with Articles 30, 32 and 35 of EU Regulation 2016/679 under the supervision of the Data Protection Officer, if appointed;

8. RIGHTS OF THE DATA SUBJECT (Chapter III EU Reg. 2016/679).

Articles 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22 of the Regulations give the data subject the exercise of specific rights, such as:

• 15 Right of Access: the right to obtain confirmation from the data controller that personal data concerning him or her is or is not being processed;
• 16 Right of rectification: right to obtain from the data controller the rectification of inaccurate personal data concerning him/her;
• 17 Right to erasure (“right to be forgotten”): right to obtain from the data controller the erasure of personal data concerning him/her;
• 18 Right to restrict processing: the right to obtain from the controller limited processing of one’s data when the accuracy of personal data is disputed, when processing is unlawful, and if one has objected to processing;
• Article 19 Right to receive notification from the Data Controller in case of rectification or erasure of personal data or restriction of processing;
• 20 Right to data portability: to obtain data portability, i.e., to receive data from a data controller, in a structured, commonly used, machine-readable format, and to transmit it to another data controller without hindrance;
• 21 Right to object: object to processing at any time, including in the case of processing for direct marketing purposes;
• 22 Automated decision-making process related to natural persons, including profiling: right to object to automated decision-making related to natural persons, including profiling.

A data subject may file a complaint with the Garante per la protezione dei dati personali, following the procedures and directions published on the Authority’s official website at www.garanteprivacy.it. In exercising the rights under Articles 15-22 of the Regulations, the data subject may grant, in writing, proxy or power of attorney with natural persons or associations. Requests may be forwarded to the data controller or DPO, if appointed, via the email addresses below.

9. DURATION OF THE PROCESSING (art.13 par.2 letter a) EU Regulation 2016/679)

The processing of data will last no longer than is necessary for the purposes for which the data were collected as stated in the individual purposes, however, if the data subject considers, for any reason, that the purpose of the processing has been exhausted, he/she may exercise his/her right by sending a formal request, to the address of the data controller or data protection officer.

10. TITOLARE DEL TRATTAMENTO (art.13 par.1 lettera a) Regolamento UE 2016/679)

The identification details of the data controller are as given in box A

11. DATA PROTECTION RESPONSIBLE (DPO) (art.13 par.1 letter b) EU Regulation 2016/679).