Mod. ICONT – Date Updated 03/2023
Pursuant to Article no. 13 of EUROPEAN REGULATION No. 679/2016
Dear Data Subject,
GRS srl as Data Processor in accordance with article no. 13 of the European Regulation no. 679/2016 "General Data Protection Regulation (GDPR)" (hereinafter referred to as the EU Regulation), containing provisions on the processing of personal data, would like to inform you about the processing of your personal data.
The provision requires that anyone who processes personal data must inform the data subject of the data processed and the elements qualifying the processing, which must in any case be carried out in a lawful, correct and transparent manner, as well as protect the confidentiality and guarantee the rights of the data subject.
It should be noted that data processing means any operation or series of operations concerning the collection, recording, organisation, storage, consultation, processing, modification, selection, extraction, comparison, use, interconnection, blocking, communication, distribution and destruction of data.
1.The Data Processor
The Data Controller is GRS srl, with registered office in Via Cavalieri di Vittorio Veneto 14 in Martellago (VE) and an operational headquarters in Via Chiesa Campocroce 4 – real estate unit 0/1 – 31021 Mogliano Veneto (TV), tax code and VAT No. 04071710273, which can be contacted at the following addresses: phone +39 041 4069438, e-mail: firstname.lastname@example.org.
Nature of the data processed. In relation to the purposes of the processing below, please note that only "common personal data" will be processed, such as, for example:
Purpose of processing. Your personal data will be processed for the following purposes:
Legal basis of processing. Personal data for the purposes set out in 2A and 2B will be lawfully processed to fulfil pre-contractual and contractual obligations between us and the user (article 6, paragraph1 letter b), to fulfil our legal obligations (article 6 paragraph1 letter c).
Your personal data, for the purposes referred to in point 2C of this policy, may be processed lawfully only with your consent (Article 6. par.1 letter a EU Regulation), specific, separate, express, documented, prior and entirely optional.
The consent you have given may be withdrawn at any time, without affecting the lawfulness of the processing based on the consent given before the withdrawal (article 7 paragraph 3 EU Regulation)
We also inform the data subject that, pursuant to article 21 of the EU Regulation, the data subject has the right to object at any time to the processing of personal data concerning them carried out for the purposes of direct marketing (including profiling) and that, should the data subject object to the processing, the personal data may no longer be processed for such purposes.
3.Recipients of the data and processing methods
The processing of your personal data will be based on the principles of fairness, lawfulness and transparency and may be carried out using paper and electronic tools both by the staff of the undersigned Company, authorised/charged with the processing of personal data, and by external parties called upon to carry out specific tasks, on behalf of the Data Processor, in their capacity as Data Processors, pursuant to article 28 of the EU Regulations, subject to our letter of appointment requiring them to observe the duty of confidentiality and security in the processing of personal data, and the adoption of suitable security measures to prevent the loss of data, unlawful and incorrect use, and unauthorised access, in compliance with the provisions in force on the protection of personal data.
For the sake of brevity, the detailed list of these figures is available at the Data Controller's headquarters and is at your disposal.
Your personal data will not be disclosed and will not be transferred to third countries or international organisations, will not be disclosed to third parties except for legal or contractual obligations
Your personal data will be retained for a period of time not exceeding the purposes for which they are processed, in compliance with the principle of retention limitation provided for in the EU Regulation and/or for as long as necessary for legal and contractual obligations or until you revoke your specific consent, and therefore
In order to guarantee the stated retention periods, a periodic check is to be carried out annually on the data processed and on whether it can be deleted if it is no longer needed for the intended purposes.
The personal data referred to in points 2A-2B of this information sheet are necessary, without which it would be impossible for us to proceed with registration (creation of your personal account) and fulfil our contractual and legal obligations.
On the other hand, the personal data referred to in point 2C are optional, and refusal to provide them will not result in any consequences and will not affect your request to proceed with registration or to perform your contractual and legal obligations. You may therefore decide not to provide any data or subsequently refuse to process data already provided at any time.
Data subjects have the rights set out in articles 15 to 22 of the EU Regulation below, and more specifically, data subjects have the right to:
Please note that there may be conditions or limitations to the rights of the data subject. It is therefore not certain whether, for example, data subjects have the right to data portability in all cases as this depends on the specific circumstances of the processing activity.
A further example: if you choose to object to the processing of your data, the Data Processor is entitled to assess your request, which may not be accepted if there are clear legitimate grounds for processing that override your interests, rights and freedoms.
At any time, you may exercise your rights in a clear and explicit manner by submitting:
- a registered letter with advice of receipt to the company (see address on letterhead);
- an email to email@example.com.
Or by contacting the Data Processor directly on the following number: +39 041 4069438.
What the Data Controller offers and what is the subject of the relationship with you in existence does not provide for the intentional acquisition of personal information referring to minors. If information on minors is unintentionally recorded, the Data Processor will delete it in a timely manner on the request or indication of the data subject.
Below we provide you with some information that we need to bring to your attention, not only in order to comply with legal obligations, but also because transparency and fairness towards the Interested Parties is a fundamental part of our business.
DPO (Data Protection Officer). You may also contact the Data Protection Officer to obtain information, send requests about your data or to report service disruptions or other issues.
The Data Controller has appointed Mr Nicola Ghinello, who can be contacted as follows: telephone +39 348 3165267, email: firstname.lastname@example.org.
Appointees/Authorised Persons. The updated list of the appointees/Authorised persons and the staff involved in data processing is kept at the Data Controller's registered offices.
Data controllers. For the sake of brevity, the detailed list of these figures is available at our office and is at your disposal.