Privacy Curricula - Faraone Industrie Spa

PURSUANT TO REGULATION (EU) 2016/679 (“GDPR”) ARTICLES 13 AND 14 AND SUBSEQUENT NATIONAL ADAPTATION PROVISIONS

This document (“Information”) intends to provide you with information regarding the processing of information, as specified below, which will be provided by you or in any case available at our facility and which will be processed by the same and/or by other subjects identified for the purposes indicated below. The Information, in particular, is provided pursuant to EU Regulation no. 679/2016 (“GDPR”) and subsequent national adaptation provisions (jointly with the GDPR hereinafter “Applicable Regulations”).

1. Identity and contact details of the Data Controller The data controller, pursuant to articles 4 and 24 of EU Reg. 2016/679, is FARAONE INDUSTRIE spa, with registered office in C.da Salino Via San Giovanni, 20 - 64018 TORTORETO (TE), VAT number 00732060678, Tel. (0861) 772245, email: info@faraone.com, in the person of the legal representative pro-tempore (hereinafter “Data Controller”).

2. Contact details of the Data Protection Officer (so-called “RPD-DPO”) The Data Controller does not carry out activities that require the designation of the figure of the Data Protection Officer.

3. Purpose and legal basis of the processing The Personal Data collected will be processed for the purposes and under the legal bases listed below:

4. Categories of personal data processed
Within the limits of the purposes and methods described in this Policy, information that can be considered as “Personal Data” may be processed, which includes your personal details, your contact details (such as, for example, mobile number, e-mail address, etc.). Together with the “Personal Data” information defined as “Special Data” (art. 9 GDPR) may also be processed as they are characterised, pursuant to the Applicable Regulations, by a particular nature, because they are able to provide, for example, information on the user's health status. Your consent will be required for any processing of such “Special Data”. For ease of reference, within this Notice, the expression “Personal Data” should be understood as a reference to all your personal data, unless otherwise specified

5. Recipients and categories of recipients
The personal data will not be disclosed, i.e. they will not be made known to unspecified subjects. They may, however, be communicated to well-defined subjects, in full compliance with the provisions of the law, for purposes strictly related to those previously indicated. Any access to your personal data is limited to those authorized by the Data Controller. Communication to the identified recipients, only if involved and functional, is linked to the achievement of the purposes referred to in the previous point 3, therefore the personal data collected and processed may be:

a) used anonymously for statistical purposes;
b) made available to the Data Controller's collaborators, in their capacity as Managers or persons authorized to process personal data;
c) communicated to third parties, natural or legal, Public administrations, professionals, law enforcement agencies, government bodies, regulatory bodies, courts or other public authorities authorized by law;
d) if necessary, transferred to another Data Controller as provided for by the GDPR, also with regard to the right to data portability.

The information may also be communicated whenever communication may be necessary to comply with requests from the Judicial Authority or Public Security. The data collected will not be disclosed under any circumstances. The list of Data Processors is available at the Data Controller's headquarters.

6. Transfer of data abroad
The data will not be transferred outside the European Union.

7. Data retention period (determination criteria)
Below is a table containing the indications of the retention times (or the determination criteria) of the Personal Data:

8. Methods of data processing
The processing of Personal Data will be carried out using manual, computerised or telematic tools, suitable to guarantee their security and confidentiality and will be carried out by personnel duly trained in compliance with the Applicable Regulations. There is no automated decision-making process.
In cases where it is necessary to contact you for needs related to the management of your position, you may be contacted via e-mail, text message, instant messaging systems or through any equivalent electronic tool or by post or call via an operator to all the contact details provided. If you prefer to be contacted only at one or some of these addresses, you can make an express written request addressed informally to the Data Controller.

9. Rights that are recognized to you
We inform you that you can exercise the rights recognized by the Applicable Regulations including, by way of example, the right:
a) to access your Personal Data and know its origin, the purposes and aims of the processing, the data of the subjects to whom they are communicated, the data retention period or the criteria useful for determining it (art.15);
b) to request rectification (art.16);
c) cancellation (“oblivion”), if no longer necessary (art.15);
necessary, incomplete, erroneous or collected in violation of the law (art.17);
d) to request that the processing be limited to a part of the information concerning you (art.18);
e) to the extent that it is technically possible, to receive in a structured format or to transmit to you or to third parties indicated by you the information concerning you (so-called "portability") or that which has been voluntarily provided by you (art.20);
f) to oppose their processing based on legitimate interest (art. 21);
g) as well as to withdraw your consent at any time, in the event that this constitutes the basis of the processing (the withdrawal of consent does not affect the lawfulness of the processing based on the consent carried out before the withdrawal itself).

The aforementioned rights may be exercised by means of a written request made without formalities to the Data Controller at the contacts indicated in point 1.

The Data Controller must proceed in this direction without delay and, in any case, no later than one month after receiving the request. The deadline may be extended by two months, if necessary, taking into account the complexity and number of requests received by the Data Controller. In such cases, the Data Controller will inform you and inform you of the reasons for the extension within one month of receiving your request.

We remind you that, if the response to your requests has not been satisfactory in your opinion, you may contact and lodge a complaint with the Personal Data Protection Authority (http://www.garanteprivacy.it/) in the ways provided for by the Applicable Regulations.

Tortoreto, 22/05/18
The Data Controller