DATA PROCESSING INFORMATION

EU REGULATION 679/2016 on the protection of individuals with regard to the processing of personal data, as well as on the free movement of such data

NORD44 SRLS processes the data in compliance with the provisions of the European Regulation 679/16 concerning the protection of individuals with regard to the processing of personal data, as well as the free movement of such data.

Pursuant to articles 13 and 14 of the aforementioned regulation, the information regarding the identification data of the data controller and the data controller regarding the processing of personal data relating to contracts and the provision of services are provided below.

The Data Controller is NORD44 SRLS the owner of the data treatment is NORD44 SRLS)

SIMONE GARUTI

Type of data processed

The data provided and processed by NORD44 SRLS are: Administrative, Accounting, Shared Data, Personal Data.

Purpose of the treatment

We inform you that personal data, provided directly by the interested party and or collected through the compilation of forms available on the websites managed by NORD44 SRLS, are processed for purposes related to the provision of the service object of the contract and for purposes of sending them to third parties in all the cases foreseen by the law or to fulfill orders of the Authority.

Data processing and access

The data collected through the signing of standard contracts in analog format are processed both in paper form and with IT and telematic tools and can be processed in aggregate form for statistical purposes and to verify the quality standards of assistance and maintenance services, excluding in that case the processing of identification data. The data collected through the compilation of online forms are processed electronically and through management information systems. The data are accessible only by persons in charge, adequately trained and informed about their duties and the activities allowed to them on the collected data, who work on behalf of NORD44 SRLS and who are the recipients of instructions and tasks given by the controller, to means of engagement (appointment) letter. The data controller will process the data for the purposes indicated above, pursuing its legitimate interests and that do not prevail over the interests or rights and freedoms of the data subject (owner).

Goal of communication and possible dissemination

The data of customers and buyers can be communicated to public administrations or public service when the application for participation in procedures for the selection of the contractor is presented, for the purpose of awarding contracts or concessions for the supply of goods or services, according to the provisions of the law on public procurement, for technical qualification purposes the data relating to the contract and service activity can be communicated to commercial consultants for administrative and accounting purposes and to lawyers for the eventual management of disputes.

The data, with the exception of those of a sensitive and judicial nature, may be disclosed to whom (private or public administration), even outside the European Union, in its legitimate interest and taking advantage of a right expressly attributed to it by specific legislation in force, requires an assessment of the identity of the user of the service provided by NORD44 SRLS for investigative purposes, or in any case for the protection of its own legitimate interest. The data may also be communicated or made accessible to the subsidiaries and/or affiliated companies of NORD44 SRLS, to other subjects involved in the maintenance of the IT systems, as well as to the subjects involved in specific processing phases, as managers of NORD44 SRLS whose names can be verified at the request of the interested parties. The data can also be communicated to police bodies or judicial authorities for the purpose of ascertaining or repression of crimes committed by users of the telematic services, where necessary.

The data are not subject to disclosure, except for the data of companies and companies for commercial reference purposes.

The data may be processed in order to identify certain characteristics of certain types of recipients in order to convey communication and advertising activities aimed at the interests of the recipients themselves.

Storage of personal data

The NORD44 SRLS will keep the data of the interested parties in a form that allows them to be identified for a period not exceeding the achievement of the purposes for which the data were collected; they will therefore be kept until the existence of the existing contractual relationship.

The data strictly necessary for the fiscal and accounting obligations, having failed the purpose for which they were collected, will be kept for a period of 10 years as required by the relevant regulations.

The interested party has the right to request, at any time, the modification of the structures governed by this paragraph through the exercise of the rights referred to in the following paragraph.

In this sense, the interested party is allowed to access his/her data to: Verify its veracity; Change them if they become inaccurate; Integrate it also with a supplementary declaration; Request its cancellation; Limit its treatment; Oppose its treatment. The data controller is obliged to fulfil without undue delay.

Data cancellation

NORD44 SRLS in compliance with the corresponding right of access of the interested party, has set up procedures for which the interested parties can request the cancellation without unjustified delay of personal data or the limitation of the processing of personal data concerning themselves for the following reasons: data are no longer necessary for the purposes for which they were collected; Because the interested party has revoked the consent; Because the interested party opposes the treatment; Because the data is treated illegally.

To exercise the rights provided by the articles from 15 to 22 of Reg Ue 679/16 the interested party must send a written request addressed to:

NORD44 SRLS at the registered office or at the Pec address resulting from public records.


The rights of the interested party

The interested party may exercise the rights referred to in Articles 15 to 22 of the European regulation 679/16

Art 15 - Right of access of the interested party 1.The interested party has the right to obtain from the data controller confirmation that it is or is not undergoing treatment of personal data concerning him and in this case, to obtain access to personal data and the following information: a) the purposes of the processing; b) the categories of personal data in question; c) the recipients or categories of recipients to whom the personal data have been or will be communicated, in particular if recipients of third countries or international organizations; d) where possible, the retention period of the personal data provided or, if not possible, the criteria used to determine this period; e) the existence of the right of the interested party to request the data controller to rectify or delete personal data or limit the processing of personal data concerning him or to oppose their treatment; f) the right to lodge a complaint with a supervisory authority; g) if the data are not collected from the data subject, all information available on their origin; (h) the existence of an automated decision-making process, including the user profiling referred to in Article 22, paragraphs 1 and 4 and, at least in such cases, significant information on the logic used, as well as the importance and expected consequences of such processing for the interested party. 2.If personal data are transferred to a third country or to an international organization, the data subject has the right to be informed of the existence of adequate safeguards pursuant to Article 46 relating to the transfer. 3.The data controller provides a copy of the personal data being processed. In the event of further copies requested by the data subject, the data controller may charge a reasonable fee contribution based on administrative costs. If the interested party submits the request by electronic means, and unless otherwise indicated by the interested party, the information is provided in a commonly used electronic format. 4.The right to obtain a copy referred to in paragraph 3 shall not affect the rights and freedoms of others.

Art 16 – Diritto di rettifica - L'interessato ha il diritto di ottenere dal titolare del trattamento la rettifica dei dati personali inesatti che lo riguardano senza ingiustificato ritardo. Tenuto conto delle finalità del trattamento, l'interessato ha il diritto di ottenere l'integrazione dei dati personali incompleti, anche fornendo una dichiarazione integrativa.


Art. 16 - Right of rectification - The data subject has the right to obtain from the data controller the correction of inaccurate personal data concerning him without undue delay. Taking into account the purposes of the processing, the data subject has the right to obtain the integration of incomplete personal data, also by providing an additional declaration.

Art 17 - Right to cancellation – 1. The data subject has the right to obtain from the data controller the deletion of personal data concerning him without undue delay and the data controller is obliged to cancel the personal data without undue delay if it exists one of the following reasons: a) personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed; 4.5.2016 IT Official Journal of the European Union L 119/43 b) the data subject revokes the consent on which the processing is based in accordance with Article 6, paragraph 1, letter (a) or Article 9, paragraph 2, letter (a), and if there is no other legal basis for processing; c) the data subject opposes the processing pursuant to Article 21, paragraph 1 and there is no legitimate overriding reason to proceed with the processing, or opposes the processing pursuant to Article 21, paragraph 2; d) personal data have been processed unlawfully; e) personal data must be deleted to fulfill a legal obligation under Union or Member State law to which the controller is subject; f) the personal data have been collected in relation to the information society service offer referred to in Article 8, paragraph 1.

2. The controller, if he has made personal data public and is obliged, in accordance with paragraph 1, to delete them, taking into account the available technology and implementation costs, takes reasonable measures, including technical ones, to inform the data controllers who are processing personal data of the request of the party concerned to delete any link, copy or reproduction of its personal data.

3. Paragraphs 1 and 2 shall not apply to the extent that processing is necessary: a) for the exercise of the right to freedom of expression and information; b) for the fulfillment of a legal obligation requiring treatment under Union or Member State law to which the controller is subject or for the performance of a task carried out in the public interest or in the exercise of official authority of which the data controller is invested; c) for reasons of public interest in the field of public health in accordance with Article 9, paragraph 2, letters (h) and (i) and Article 9, paragraph 3; d) for the purposes of archiving in the public interest, for scientific or historical research or for statistical purposes in accordance with Article 89, paragraph 1, insofar as the right referred to in paragraph 1 risks making it impossible or to seriously affect the achievement of the objectives of this treatment; or e) for the assessment, exercise or defense of a right in court.

Art. 18 - Right to limit processing - 1. The data subject has the right to obtain from the data controller the limitation of processing when one of the following hypotheses occurs: a) the data subject disputes the accuracy of personal data, for the period necessary for the data controller to verify the accuracy of such personal data; b) the processing is illegal and the interested party opposes the cancellation of personal data and asks instead that its use is limited; c) although the data controller no longer needs it for processing purposes, personal data are necessary for the data subject to ascertain, exercise or defend a right in court; d) the interested party has opposed the treatment pursuant to Article 21, paragraph 1, pending verification of the possible prevalence of the legitimate reasons of the data controller with respect to those of the interested party. 2. If the processing is restricted pursuant to paragraph 1, such personal data shall only be processed, except for storage, with the consent of the data subject or for the establishment, exercise or defense of a right in court, or to protect the rights of another natural or legal person or for reasons of significant public interest of the Union or of a Member State. L 119/44 IT Official Journal of the European Union 4.5.2016 3. A data subject which has obtained a processing restriction pursuant to paragraph 1 shall be informed by the controller before the limitation is revoked.

 

Art 19 - Right to obtain notification from the data controller in cases of rectification or cancellation of personal data or deletion of the same - The data controller communicates to each of the recipients to whom the personal data were transmitted any corrections or cancellations or limitations of processing carried out in accordance with Article 16, Article 17, paragraph 1 and Article 18, unless this proves impossible or involves a disproportionate effort. The data controller informs the data subject of these recipients if the data subject requests it.

Art. 20 - Right to portability - 1. The data subject has the right to receive, in a structured, and commonly used form, and in a readable form from an automatic device, personal data concerning him/her provided to a data controller and has the right to transmit such data to another data controller unimpeded by the data controller to whom he/she has provided them if: a) the processing is based on consent pursuant to Article 6, paragraph 1, letter (a) or Article 9, paragraph 2, letter (a), or on a contract within the meaning of Article 6, paragraph 1, letter (b); and b) processing is carried out by automated means. 2. In exercising its rights relating to the portability of data in accordance with paragraph 1, the data subject shall have the right to obtain direct transmission of personal data from one controller to another, if technically feasible. 3. The exercise of the right referred to in paragraph 1 of this Article shall be without prejudice to Article 17. This right does not apply to the treatment necessary for the performance of a task carried out in the public interest or in connection with the exercise of official authority as the data controller is invested. 4. The right referred to in paragraph 1 must not affect the rights and freedoms of others.


Art. 21 - Opposition right - The interested party has the right to object at any time, for reasons connected with his particular situation, to the processing of his personal data pursuant to Article 6, paragraph 1, letters e) or f), including the user profiling on the basis of these provisions. The data controller refrains from further processing personal data unless he demonstrates the existence of binding legitimate reasons to proceed with the processing that prevails over the interests, rights and freedoms of the data subject or for the assessment, exercise or the defense of a right in court. 2. If personal data are processed for direct marketing purposes, the data subject has the right to object at any time to the processing of personal data concerning him / her for such purposes, including the user profiling if it is related to such direct marketing. 3. If the data subject objects to processing for direct marketing purposes, personal data are no longer processed for these purposes. 4.5.2016 IT Official Journal of the European Union L 119/45 4. The right referred to in paragraphs 1 and 2 shall be explicitly brought to the attention of the interested party and shall be presented clearly and separately from any other information at the latest at the time of first communication with the interested party. 5. In the context of the use of information society services and without prejudice to Directive 2002/58/EC, data subject may exercise his right to object by automated means using technical specifications. 6. Where personal data are processed for the purposes of scientific or historical research or for statistical purposes in accordance with Article 89, paragraph 1, the data subject shall have the right to object to the processing of personal data for reasons connected with his particular situation concerning him, unless the processing is necessary for the performance of a task in the public interest.

Art 22 - Right to refuse the automated process – 1. The data subject has the right not to be subjected to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or which significantly affects his person in a similar way . 2. Paragraph 1 shall not apply in the event that the decision: a) is necessary for the conclusion or execution of a contract between the data subject and a data controller; b) is authorized by the law of the Union or of the Member State to which the controller is subject, which also specifies appropriate measures to protect the rights, freedoms and legitimate interests of the data subject; c) is based on the explicit consent of the interested party. 3. In the cases referred to in paragraph 2, letters (a) and (c), the controller shall implement appropriate measures to protect the rights, freedoms and legitimate interests of the data subject, at least the right to obtain human intervention from the holder of the treatment, to express their opinion and to challenge the decision. 4. The decisions referred to in paragraph 2 shall not be based on the particular categories of personal data referred to in Article 9, paragraph 1, unless Article 9, paragraph 2, letters (a) or (g) applies, and there are no adequate measures to protect the rights, freedoms and legitimate interests of the data subject.


NEWSLETTER - PRIVACY INFORMATION Pursuant to EU Regulation 2016/679 "General Data Protection Regulation”

PRIVACY INFORMATION IN BRIEF Nord44 srls is careful to respect the privacy of its customers and visitors to the web-site. Therefore, before providing your data, we invite you to read the following information that explains who we are, why we collect your data, how we will use it and it reminds you your rights. Attention: if you are a minor, you will have to request consent for registration to your parents. By subscribing to our newsletter Nord44 srls, as Data Controller it contact you (by sending newsletters, e-mails as well as instant messages, posts, messages or communications of initiatives on social networks, etc.) to update you on our products, initiatives, services or to make you participate in market surveys. The processing will take place for the entire duration of the registration and is therefore based on your specific consent, which can still be revoked at any time by writing to nord44@legalmail.it The customer can at any time access his/her data, update, delete, request to receive or transmit to another data holder his/her data in a structured format, commonly used and readable by automatic device, without prejudice to the possibility of changing or revoking its consent. You can also always oppose the processing of your data, in particular, for marketing purposes; it may also file a complaint with the Guarantor for the protection of personal data (www.garanteprivacy.it) or with the Guarantor of the Country in which he/she resides habitually, or of the place where the alleged violation has occurred. If you would like more detailed information, read the full text of the privacy statement below.