Privacy Information

Personal data are processed pursuant to Legislative Decree 196/03 “Code regarding the protection of personal data”, with the indication of the following articles:

Art. 7. Right to access personal data and other rights
1. The interested party has the right to receive confirmation about the existence or non-existence of his personal data, even if the data have not yet been registered, and to have them communicated in a comprehensible manner.
2. The interested party has the right to obtain information regarding:
a) the origin of the personal data;
b) the purpose and method of processing;
c) the logic applied when processing with the use of electronic instruments;
d) details regarding the identification of the data controller and the representative designated according to article 5, paragraph 2;
e) the individuals or category of individuals to whom the personal data can be communicated or who may become aware of the data as the designated representative in the state territory, or as managers or officers.
3. The interested party has the right to obtain:
a) the update, correction or, if interested, addition of data;
b) the cancellation, transformation into an anonymous form or blocking of data processed in the violation of law, including those that do not need to be stored in relation to the purpose for which the data were collected or subsequently processed;
c) acknowledgement that the operations indicated in sections a) and b) were carried out, also with regard to their content, by those to whom the data had been communicated or distributed, with the exception of the case in which this fulfilment is impossible or involves the use of means that are clearly disproportionate with regard to the protected right.
4. The interested party has the right to fully or partially object:
a) for legitimate reasons to the processing of his personal data, even if pertinent to the purpose of the collection; b) to the processing of personal data that concern him for the purpose of sending advertising or direct sales material or in order to carry out market research or commercial communications.

Art. 8. Exercising of rights
1. The rights indicated in article 7 are exercised by sending an informal request to the data controller or the manager, also by means of a representative, to whom a suitable reply will be sent without delay.
2. The rights in article 7 cannot be exercised with a request to the data controller or with a claim pursuant to article 145 if the personal data were processed:
a) based on the provisions of degree-law 3 May 1991, no. 143, converted, with changes, to law July 1991, no. 197, and as amended, concerning money laundering;
b) based on the provisions of degree-law 31 December 1991, no. 419, converted, with changes to Law 18 February 1992, no. 172, and as amended, concerning the support of victims of extortive requests;
c) by parliamentary inquiry commissions established pursuant to article 82 of the Italian Constitution;
d) by a public individual, other than industrial public institutions, based on an explicit provision of law, for the exclusive purpose inherent to monetary policy, the payment system, control of brokers and credit and financial markets as well as the protection of their stability;
e) pursuant to article 24, paragraph 1, letter f), limited to the period of time during which an effective and concrete prejudice can result for the performance of defensive investigations or for the exertion of the right during judicial proceedings;
f) from suppliers of electronic communication services accessible to the public regarding incoming telephone communications, unless an effective and concrete prejudice can result for the performance of defensive investigations as specified by Law 7 December 2000, no. 397;
g) for reasons of law, at legal offices of all levels or the Supreme Magistrates’ Council or other self-governing bodies or the Ministry of Justice;
h) pursuant to article 53, without prejudice to what is set forth by law 1 April 1981, no. 121.
3. The Guarantor, also upon indication of the interested party, in the cases specified in paragraph 2, letters a), b), d), e) and f) shall proceed as specified in articles 157, 158 and 159 and, in the cases specified in letters c), g) and h) of the same paragraph, shall proceed according to the methods indicated in article 160.
4. The exertion of the rights specified in article 7, in the case of data that are not objective, can take place providing that this concerns the correction or addition of evaluative personal data regarding judgements, opinions or other subjective aspects, as well as the indication of behaviour to be carried out or decisions made via assumptions by the data controller.

Art. 9. Method for the exertion of rights
1. The request made to the data controller or manager may be sent via registered letter, fax or email. The Guarantor may identify another suitable system in reference to new technological solutions. With regard to the exertion of the rights indicated in article 7, paragraphs 1 and 2, the request can also be made verbally and in this case, written down briefly by the officer or manager.
2. When exerting the rights indicated in article 7, the interested party may appoint, in writing or by proxy/power of attorney, other individuals, institutions, associations or bodies. The interested party may also be assisted by a trusted individual.
3. The rights specified in article 7 that refer to personal data for a deceased individual can be exercised by someone with a personal interest, or who acts to protect the interested party or for family reasons worthy of protection.
4. The identity of the interested person is checked based on suitable elements of evaluation, also using available documents or by exhibiting or attaching a copy of an identification document. A person who acts on behalf of an interested party shall exhibit or attach a copy of the power of attorney or proxy signed in the presence of an official or signed and presented together with an unauthenticated photocopy of the identification document of the interested party. If the interested party is a legal entity, institution or association, the request shall be presented by an individual who is legitimated based on the respective articles of association or regulations.
5. The request specified in article 7, paragraphs 1 and 2 shall be formulated freely and without constrictions, and can be represented, unless there are justified reasons, after a minimum period of 90 days have elapsed.

Art. 10. Response to the interested party
1. In order to guarantee the effective exertion of the rights specified in article 7, the data controller is required to adopt suitable measures that are targeted towards the following, in particular:
a) facilitating access to personal data by the interested party, also by using suitable computer programs targeted towards an accurate selection of the data that concern the individual interested parties that are identified or identifiable;
b) simplifying the methods and reducing the times for responding to the requesting party, also with offices or services used for contact with the public.
2. The data are extracted by the manager or officers and can also be communicated verbally to the requesting party, or can be provided in visual form using electronic tools, as long as the data can be comprehended, also considering the quality and quantity of the information. If requested, the data will be transferred to paper or a data carrier, or transmitted telematically.
3. Unless the request refers to a particular processing of data or specific personal data or category of personal data, the response to the interested party will include all the personal data that concern the interested party or in any case processed by the data controller. If the request is directed towards a health care provider or a health care facility, the provisions specified in article 84, paragraph 1 shall apply.
4. If the extraction of the data is particularly difficult, the response to the request of the interested party can also take place by exhibiting or delivering copies of documents that contain the requested personal data.
5. The right to obtain the communication of the data in an intelligible form does not concern the personal data of third parties, unless the breakdown of the processed data or the deprivation of some elements would make the personal data relative to the interested party incomprehensible.
6. The data can also be communicated in an intelligible form using comprehensible handwriting. If communicating codes or abbreviations, also the parameters for understanding their meaning shall be provided, also by the officers.
7. If, following a request specified in article 7, paragraphs 1 and 2, letters a), b) and c) the existence of data concerning the interested party is not confirmed, a fee may be requested that does not exceed the costs that were actually incurred for the search carried out in the specific case.
8. The fee specified in paragraph 7 may not exceed the amount determined by the Guarantor with measures of a general nature, who can identify them on a flat rate basis in the case in which the data are processed electronically and the response is provided verbally. The Guarantor can also make provisions for requesting the fee if the personal data are located on a special support that must be specifically reproduced or when one or more data controllers determine a considerable use of means in relation to the complexity or extent of the requests and the existence of data concerning the interested party is confirmed.
9. The fee specified in paragraphs 7 and 8 can be paid via a postal payment or bank transfer, or using a payment or credit card, if possible upon receiving the response and in any case within 15 days from receiving the response.

Art. 11. Data requirements and processing method
1. The personal data subject to processing are:
a) processed in a legal and correct manner;
b) collected and recorded for determinate, explicit and legitimate purposes and used in other processing operations in terms that are compatible with those purposes;
c) exact and, if necessary, updated;
d) pertinent, complete and do not exceed the purpose for which they were collected or subsequently processed;
e) stored in a form that permits the identification of the interested party for a period of time that does not exceed what is necessary for the purposes for which they were collected or subsequently processed.
2. Personal data processed in violation of the regulations regarding the processing of personal data cannot be used.