INFORMATION ON THE PROCESSING OF PERSONAL DATA

 This is to inform you that we process your personal data in our organization, in full compliance with current national and European Union legislation on the processing of personal data.

Pursuant to Articles 13 and 14 of EU Regulation 2016/679 we inform you that:

1. Data Controller is ECS SRL in the person of its legal representative pro tempore, with registered office Via Industria 2 – 10022 Carmagnola (TO) Telephone: 011 19.51 – E-Mail: m.abate@ecsitalia.net
2. Data Processor is Massimo Abate, Telephone: 011 19.51 – E-Mail: m.abate@ecsitalia.net
3. Data Protection Officer Appointment is not envisaged for the above-mentioned company as the processing carried out does not fall under 37 of Reg. 2016/679.
4. Legal basis of the treatment: The processing of personal data carried out by our organisation is based on compliance with the conditions of lawfulness defined in Article 6 of Regulation 2016/679, of which we provide evidence below:
   • Consent provided by the data subject for one or more of the purposes contained in point 5 of the Information Notice;
   • Necessary for the purposes of the performance of a contract or pre-contractual measures taken at the request of the data subject;
   • Necessary in order to comply with a legal obligation to which the Data Controller is subject;
   • Necessary in order to safeguard the vital interests of the data subject;
   • Necessary for the performance of a task carried out in the public interest or in connection with the exercise of public authority vested in the Data Controller;
   • Necessary for the pursuit of the legitimate interest of the Data Controller;

5. Purpose of processing: Personal data are processed in the normal course of the association’s activities for the following purposes:
   a) directed exclusively to the management of information relating to the interested party’s requests for supplies and services.
   b) connected to the obligations provided for by laws, regulations and EU legislation as well as provisions issued by authorities empowered to do so and by supervisory and control bodies.
   c) for communication activities, also of a commercial nature.
6. Category of data collected: The data collected fall into the category of personal contact details (personal details, e-mail address, telephone number, details of identification documents) that are strictly connected with and instrumental to the management of relations with website users (e.g. acquisition of information prior to the fulfilment of requests).
7. Modalities of data processing: The data is processed using paper, computer and telematic tools with logic strictly related to the purposes and, in any case, in such a way as to guarantee the security and confidentiality of the We inform you that your data are:
   • processed in a lawful, correct, and transparent manner.
   • collected for the purposes specified above, explicit, and legitimate, and subsequently processed in a way that is not incompatible with those purposes.
   • adequate, relevant, and limited to what is necessary in relation to the purposes for which they are processed (“data minimization”).
   • accurate and, if necessary, updated, deleted and/or rectified.
   • kept in a form which permits identification for a period not exceeding the purposes for which they are processed.

processed in such a way as to ensure appropriate security of personal data, including protection, by appropriate technical and organizational measures, against unauthorized or unlawful processing and against accidental loss, destruction, or damage.

8. Data Communication: For the pursuit of the purposes indicated in point 5, your data may be communicated to companies that carry out the acquisition, registration and processing of data contained in documents, archives or supports for preparing texts; to legal assistance companies; to companies for information technology, to enable the management of electronic instruments, for filing procedures, for printing correspondence and for managing incoming and outgoing mail to companies in charge of fraud control; to Public Administrations, in accordance with the law; to service companies for the management of the company’s information system; to companies that carry out activities of transmission, enveloping, transport and sorting of communications; to firms or companies within the scope of assistance and consultancy relationships. The complete list of data processors is in any case available at the headquarters of the organization and can be found by contacting the Data Controller indicated above.

9. Data Dissemination: Personal data are not subject to dissemination.

10. Transfer abroad: Your data may be transferred to non-EU countries exclusively if they are covered by an adequacy decision of the European Commission pursuant to Article 45 of the European Regulation; they may also be transferred outside the national territory by virtue of possible services, Cloud platforms, provided by providers located outside the European Union.

11. Obligatory/optionality of data provision: Without prejudice to the personal autonomy of the data subject, the provision of personal data, whether common or falling into categories, may be

• • compulsory in relation to obligations provided for by laws, regulations, and European Union legislation, as well as provisions issued by authorities empowered to do so and by supervisory and control bodies, as well as obligations in tax and accounting matters
  • essential to the conclusion of new relationships or to the management and execution of existing or ongoing contractual relationships.

12. Refusal to provide data: Any refusal on the part of the person concerned to provide personal data for the purposes indicated in point 5 of this information notice will make it impossible to proceed with the correct and complete execution of the requests made.

13. Data retention period: the personal data concerning you will be stored in a form that enables their identification for a period of time not exceeding the achievement of the purposes for which they are processed, and in any case in compliance with legal obligations concerning the time limits for storing data (tax assessments and limitation periods for exercising rights).

14. Rights of the data subject: You may contact the Data Controller to assert your rights, as provided for in the Regulation, and you have the right to:

a) to request from the Data Controller access to and rectification or erasure of your personal data or restriction of the processing of personal data concerning you and to object to their processing, in addition to the right to data

b) to lodge a complaint with a supervisory authority.

c) to know the source from which the personal data originate and, if applicable, whether the data come from publicly accessible sources

d) to obtain from the controller confirmation as to whether or not personal data relating to him are being processed and, if so, to obtain access to the personal data and to the following information:
– the purposes of the processing.
– the categories of personal data concerned.
– the recipients or categories of recipients to whom the personal data have been or will be disclosed, in particular if they  are recipients in third countries or international organizations.
– where possible, the period for which the personal data will be retained or, if this is not possible, the criteria used to determine that period.

e) to request from the controller the rectification or erasure of personal data or the restriction of the processing of personal data concerning him/her or to object to their processing.
f) to know, if the data are not collected from the data subject, all available information on their origin, on the existence of an automated decision-making process, including profiling, and, at least in such cases, meaningful information on the logic used, as well as the importance of such processing for the data subject and the envisaged consequences thereof.

g) to obtain from the data controller the rectification of inaccurate personal data concerning him/her without undue delay.

h) to obtain, having regard to the purposes of the processing, the integration of incomplete personal data, also by providing a supplementary declaration.

i) obtain from the data controller the erasure of personal data concerning him/her without undue delay.

j) obtain from the data controller the restriction of processing in the event that the data controller disputes the accuracy of the personal data, or objects to the erasure of the data, or – although the data controller no longer needs the data for processing purposes – the data are necessary for the establishment, exercise or defense of a legal claim, or the data controller has objected to the processing carried out by the data controller in pursuit of a legitimate interest of its own;

k) to receive in a structured, commonly used and machine-readable format the personal data concerning him/her and to transmit such data to another Data Controller without hindrance from the Data Controller to whom he/she has provided them (so-called right to data portability);

l) to object at any time, on grounds relating to his or her particular situation, to the processing of personal data concerning him or her (when the processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the Data Controller, or when the processing is necessary for the purposes of pursuing a legitimate interest of the Data Controller), including profiling on the basis of such provisions, as well as to object to the processing of data carried out for direct marketing purposes.

15. The above rights may be exercised by written request addressed to the Internal Data Processor by registered letter, or also by e-mail to abate@ecsitalia.net.