(General Data Protection Regulation)
1. Data controller
The Data Controller is Studio Tosi in the person of Prof. Avv. Loris Tosi, with professional headquarters in 30172 Venezia – Mestre, Via Torino n. 151 / A, VAT number 03171850278.
The Data Controller provides the data subject with information on the purposes and methods of processing personal data.
2. Data Protection Officer.
The Data Controller has appointed a person responsible for the protection of personal data (Data Protection Officer, “DPO”). It is possible to contact the DPO at the following email address: firstname.lastname@example.org.
3. Methods of processing personal data
Personal data (personal data, telephone number, e-mail, etc.) are processed on computer media with the aid of computerized or automated tools in compliance with the minimum security measures in order to guarantee the integrity, security and confidentiality of the data.
4. Purpose of the processing
The Data Controller will process your personal data for the purposes:
1) performance of contractual and pre-contractual activities;
2) fulfillment of tax or legal obligations;
3) sending newsletters for information purposes and publications, event organization and conventions.
Personal data will be processed for purposes strictly connected and instrumental to the fulfillment of the obligations inherent to the aforementioned points.
The consent you have expressed is the legal basis of the processing pursuant to art. 13, paragraph 1), letter c) of the GDPR.
5. Nature of the contribution
The provision of your data for the purposes referred to in points 1) and 2) of Article 4 does not require formal consent as a preliminary and essential to the contractual or pre-contractual relationship.
The provision of your data for the purposes referred to in paragraph 3), of art. 4 is optional and requires your express consent. Failure to consent will make it impossible to send newsletters for information purposes and publications, event organization and conventions.
If you have given your consent to authorize the holder of the treatment to pursue the purposes set out in point 3), art. 4, will remain free at any time to revoke it by sending a notice to the email address email@example.com. Following receipt of the opt-out request, the Data Controller will proceed to the removal and deletion of data from the databases used for the treatment for sending newsletters and to inform, for the same purposes of cancellation, any third parties to whom the data are communicated. Simply receiving the cancellation request will automatically be validated as confirmation of cancellation.
6. Recipients or category of recipients of personal data
I dati personali da Lei conferiti, per le finalità sopra descritte, potranno essere portati a conoscenza di dipendenti e/o collaboratori de il Titolare e comunicati ai seguenti soggetti:
a) co-owned data companies, associations, natural person or other Studio Tosi offices co-owned data;
b) third party companies possibly appointed by the Data Controller to provide for the execution of the obligations assumed by the latter for the implementation of the treatments envisaged by the purposes set out in points 1) and 2) of article 4;
c) all the subjects (including Public Authorities) who have the right to access the data by virtue of regulatory or administrative provisions;
d) third-party companies that provide essential support services for processing and have direct or indirect access to your data;
e) third-party companies appointed by the Data Controller for processing data provided for by the purposes set out in point 3), article 4.
All the collaborators or suppliers used by the Data Controller for the processing of your personal data have been appropriately and legally authorized and empowered on the methods and purposes of the treatments attributed to them and will act in compliance with and in accordance with this information.
The personal data you have provided, for the purposes described above, may be transferred to partners for the processing of data provided for the purposes referred to in paragraph 3), article 4.
The personal data you have provided and subsequently processed in connection with the management of the service are not subject to disclosure.
Your personal data may be transferred outside the EEA area on condition that the recipient guarantees a level of data protection appropriate to the European one.
7. Data retention times
Your personal data will be kept for the times defined by the relevant legislation, which are specified below pursuant to art. 13, paragraph 2, letter a) GDPR:
1) for the purposes indicated in points 1), 2) of article 4 for the times prescribed by the laws in force and in any case for a period of no less than 10 (ten) years;
2) for the purposes indicated in point 3) of the art. 4 for 2 (two) years from the time of consent to treatment.
8. Exercise of rights by the interested party
Pursuant to article 13, paragraph 2, letters b) and d), 15, 18, 19 and 21 GDPR, the interested party is informed that he has the right to:
- Access to personal data. Obtain confirmation that data concerning you are being processed and, in this case, access to the following information: the purposes, the categories of data, the recipients, the retention period, the right to propose a complaint to a supervisory authority, the right to request the correction or cancellation or limitation of the treatment or opposition to the processing itself as well as the existence of an automated decision-making process;
- Request for rectification or cancellation of the same or limitation of the processing that concerns you; “limitation” means the marking of data stored with the aim of limiting its processing in the future;
- Opposition to processing: to oppose for reasons connected with your particular situation to the processing of data for the performance of a task of public interest or for the pursuit of a legitimate interest of the Controller;
- Data portability: in the case of automated processing carried out on the basis of consent or in execution of a contract, to receive data concerning you in a structured format, commonly used and readable by automatic device; in particular, the data will be provided by the Data Controller in .xml format;
- Revocation of consent to processing for marketing purposes, both direct and indirect; the exercise of this right does not prejudice in any way the lawfulness of the processing carried out before the revocation;
- Propose a claim pursuant to art. 77 GDPR to the competent supervisory authority based on your habitual residence, workplace or place of violation of your rights; for Italy, the Guarantor for the protection of personal data is competent, which can be contacted via the contact details on the website http://www.garanteprivacy.it.
The aforementioned rights may be exercised by sending a specific request to the Data Controller through the contact channels indicated in articles 1 and 5 of this information.
Requests relating to the exercise of your rights will be processed without undue delay and, in any case, within one month of the request; only in cases of particular complexity and in the number of requests can this term be extended by a further 2 (two) months.
We inform you specifically and separately, as required by art. 21 GDPR, that if personal data are processed for marketing purposes, the data subject has the right to object at any time and that if the data subject objects to the processing, personal data can no longer be processed for these purposes. The exercise of rights is not subject to any form constraint and is free. The e-mail address for the exercise of rights is firstname.lastname@example.org.