This privacy notice is provided pursuant to Article 13 of Regulation (EU) 2016/679 – General Data Protection Regulation (GDPR) – to individuals who submit comments or complaints.
Type and Source of Data
The data processed include:
- Identification data (name and surname, date of birth, residence);
- Contact information;
- Additional information inferred from the content of the request.
Data are provided directly by the data subject via the forms available on the website, at information points, or through direct contact.
Purpose and Legal Basis of Processing
The data are processed to respond to comments or complaints submitted by the data subject.
Legal basis: consent (Art. 6(1)(a) GDPR).
Nature of Data Provision
In the case of complaints concerning products or services, providing personal data is essential to identify the data subject and provide an appropriate response. Therefore, failure to provide such data will prevent the request from being processed.
For general comments or reports, providing personal data is optional but helpful to ensure a suitable response. Lack of data may make it impossible to address the issue submitted.
Withdrawal of Consent
Pursuant to Article 7 of the GDPR, the data subject may withdraw their consent at any time. Withdrawal of consent, which can be carried out via the unsubscribe link in the footer of any newsletter message, will result in the cessation of newsletter communications.
Data Retention Period
Data will be stored for one year, unless longer retention is required depending on the nature of the request.
Data Recipients
The collected data may be communicated to:
- Authorized personnel (employees and collaborators) of the Controller;
- External entities appointed as Data Processors (e.g. website provider).
Data may also be communicated to entities legally entitled to access them under applicable laws, regulations, or EU provisions.
Data will not be disclosed to the public.
The complete and up-to-date list of Data Processors is available upon request.
Data Transfers
The Controller does not transfer personal data to third countries or international organizations. However, cloud services may be used. In such cases, data will only be transferred to providers located in countries recognized as adequate pursuant to Article 45, that have joined the EU-U.S. Privacy Framework, or that provide adequate safeguards in accordance with Article 46 GDPR.
More information on data transfers and/or a copy of the applicable safeguards can be obtained by contacting the Controller.
Data Subject Rights
The data subject may exercise their rights under Articles 15–22 of the GDPR, insofar as compatible with the nature of the processing activity.
In particular, the data subject may request:
- Confirmation as to whether their personal data are being processed and, if so, access to such data (right of access);
- Rectification of inaccurate data and completion of incomplete data (right to rectification);
- Erasure of their data unless legal obligations or legitimate interests of the Controller apply (right to erasure / right to be forgotten);
- Restriction of the processing (right to restriction);
- Transmission of their data to another controller (right to data portability) – applicable only where processing is based on consent or a contract;
- Objection to the processing of personal data for reasons related to their particular situation (right to object), to be detailed in the request.
These rights may be exercised by contacting the Controller via the email address provided, specifying the subject of the request, the right being exercised, and any element suitable to verify the legitimacy of the request (e.g. a copy of identification).
Right to Lodge a Complaint
The data subject has the right to lodge a complaint with the Italian Data Protection Authority (Garante per la Protezione dei Dati Personali).