PRIVACY POLICY OF THE WEBSITE

The “Data Controller”, as identified in Section 7 of this notice, pursuant to and for the purposes of Article 13 of EU Regulation 679/2016, hereby provides you with the following information regarding the processing of your personal data carried out through this website.

1. Types of data processed, purposes and legal basis of processing

a. Data voluntarily provided by the user

The Data Controller collects and processes personal data voluntarily provided by visitors to this website. Visitors may browse the website without disclosing personal information or data. Each visitor may choose to provide limited personal data as required in order to obtain information about our services. Once registered, the personal data collected will be used solely for the services indicated in the relevant notice. The legal basis for processing is therefore the performance of contractual obligations (requests) of the requesting user and/or consent.

Visitors to the website may provide their data for the following services, where available:

• subscribe to our newsletter;
• request information on services/products, offers, quotations;
• register for events;
• purchase services/products/vouchers;
• careers (“Work with us”).

Specific provisions relating to website sections.

• Section: Contact Request

The “Contact Request” section allows users to request information on services, products, events/courses and to request quotations. If you decide to submit your personal data, such data will be processed exclusively for these purposes by duly authorized personnel and in accordance with standard internal procedures.

• Section: Online Purchases

The “Online Shopping” sections allow users to purchase products offered on this website. If you decide to submit your personal data, such data will be processed exclusively for these purposes by duly authorized personnel and in accordance with standard internal procedures. For this purpose, the user is required to provide certain mandatory data, failing which access to the online sales service will be denied. The purchase is also subject to the explicit acceptance, by ticking the appropriate checkbox, of the Privacy Policy as well as the Company’s terms and conditions of sale.

• Section: Newsletter

If the user decides to subscribe to our newsletter, they must provide their personal data (e.g., email address, etc.) by completing the relevant form in the “Newsletter” section. The data collected will be processed for the purpose of sending the newsletter and in any case as indicated in the notice provided at the bottom of the subscription form.

• Section: Careers (“Work with us”)

If the user decides to submit an online application, they must provide their personal data (e.g., name, surname, email address, etc.) and their CV and request by completing the appropriate form in the “Work with us” section. The data collected will be processed for the purpose of evaluating the position for a maximum period of 24 months.

• Cookies / Advertising

Cookies are small text files that are stored on the visitor’s device by certain websites. Cookies are not harmful to the visitor’s computer, tablet or smartphone.

For this website and its subdomains, cookies are used, subject to user consent where required by applicable laws or regulations, in order to facilitate navigation and personalize the information provided to users. Systems are also used to collect user information, such as IP address, browser type and operating system used and/or web pages visited by the user, for statistical or security purposes.

The legal basis for processing is therefore the legitimate interest of the Data Controller in the case of technical cookies and the consent of the data subject in the case of profiling cookies.

With regard to cookies, please refer to the specific COOKIE POLICY available from the website homepage.

b. Browsing Data

The IT systems and software procedures used to operate this website acquire, during their normal operation, certain personal data whose transmission is implicit in the use of Internet communication protocols.

Such information is not collected in order to be associated with identified data subjects, but by its very nature could, through processing and association with data held by third parties, allow users to be identified.

This category of data includes IP addresses or domain names of users’ computers, URI (Uniform Resource Identifier) addresses of requested resources, time of request, method used to submit the request to the server, size of the file obtained in response, numerical code indicating the status of the server response (successful, error, etc.) and other parameters relating to the user’s operating system and IT environment.

These data are used solely for the purpose of obtaining anonymous statistical information on website use and to check its correct functioning, and are deleted immediately after processing. The data may be used to ascertain liability in case of hypothetical cybercrimes against the website; except for this eventuality, currently the data on web contacts are not retained.

The legal basis for processing is therefore the legitimate interest of the Data Controller in the operation and improvement of the services provided via the website.

2. Nature of data provision and consequences of failure to provide data

The provision of data for the purposes referred to in point 1(a) (performance of services requested by the user) is optional but necessary in order to perform the requested services, except for data for which optional provision is indicated. Refusal to provide personal data or failure to give consent for their processing, where required, will make it impossible for the Data Controller to perform the requested services.

The provision of data for the purposes referred to in point 1(b) of this notice (browsing data) is necessary for the functioning of the website, except for the possibility of anonymous browsing. In such case, no browsing data of the user will be processed.

3. Processing Methods and Data Security

The processing of your personal data will be carried out in accordance with the principles of lawfulness, fairness and transparency, safeguarding your confidentiality as well as that of your family members, in compliance with Article 5 of the EU Regulation.

Processing may be carried out manually, using paper documents, as well as by electronic or automated means.

Your personal data are processed using appropriate technical and organizational security measures pursuant to Article 32 of the Regulation, so as to ensure a level of security appropriate to the risk, minimizing the risks of destruction or loss, unauthorized access or processing not consistent with the purposes of collection.

Your personal data are not subject to automated decision-making processes nor to profiling.

4. Data Disclosure and transfers abroad

For the purposes referred to in Section 1 of this notice (performance of requested services), the Data Controller may need to disclose your personal data to trusted third parties, including:

1. companies belonging to the Group;
2. banks for banking services and payments, companies managing computerized postal services, document storage and archiving companies, and other outsourced service providers;
3. legal and tax advisors of the Data Controller or IT consultants managing the website or services;
4. insurance or reinsurance companies or third parties liable in case of recourse actions by the Company.

The above-mentioned entities will process the data, as applicable, either as independent Data Controllers or as “Data Processors” duly appointed pursuant to contractual agreements in compliance with Article 28 of the Regulation.

Your personal data are not subject to dissemination.

Browsing data may be disclosed to Group companies for the purposes indicated.

5. Links to third-party websites

Please note that this website may contain links to other websites that are not governed by this Privacy Policy.

6. Retention period of personal data

Personal data voluntarily provided by the user will be retained for the period necessary to fulfill the purposes indicated.

Contractual or tax data will be retained for the entire duration of the contractual relationship and, after its termination, for the time necessary to comply with all applicable legal obligations (e.g., tax obligations) and/or administrative requirements related to or deriving from the contractual relationship (10 years).

Marketing or newsletter data will be retained for the period required by law and in any case until withdrawal of consent.

Data provided to request information will be deleted after the service has been provided.

Data provided for job applications will be processed for the time necessary to evaluate the application and for a further period of 24 months.

Browsing data are retained for the time necessary to fulfill the stated purposes and, in any case, for a maximum of 30 days from collection.

7. Identity and contact details of the Data Controller and the Data Protection Officer (DPO)

The Privacy Officer, whom you may contact in order to exercise the rights provided for under the EU Regulation, as listed in the following section, may be reached using the following contact details: Via G. Galilei 10, 39100 Bolzano (BZ), email: privacy@podinispa.it, telephone (switchboard/URP): +39 0471 533533.”

8. Rights of the Data Subject

At any time, pursuant to Articles 15 to 22 of EU Regulation 679/2016, you shall have the right to:

1. obtain confirmation as to whether or not personal data concerning you exist;
2. obtain information regarding the purposes of the processing, the categories of personal data, the recipients or categories of recipients to whom the personal data have been or will be disclosed and, where possible, the retention period;
3. obtain the rectification and erasure of the data;
4. obtain restriction of processing;
5. (where applicable) obtain data portability, i.e. receive the personal data from a data controller in a structured, commonly used and machine-readable format, and transmit those data to another data controller without hindrance;
6. object to the processing at any time, including in the case of processing for direct marketing purposes;
7. object to automated decision-making relating to natural persons, including profiling;
8. request from the Data Controller access to personal data and the rectification or erasure of the same or restriction of processing concerning you, or to object to their processing, in addition to the right to data portability;
9. withdraw consent at any time without affecting the lawfulness of processing based on consent before its withdrawal;
10. lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali), with registered office in Rome, Piazza Venezia no. 11, official website: www.garanteprivacy.it

The above rights may be exercised by contacting the Data Controller, the Privacy Contact Person or the Data Protection Officer, where appointed, using the contact details provided in the previous section.

The Data Controller reserves the right to amend, update, add or remove parts of this Privacy Policy following changes in the applicable legislation. The data subject is required to periodically review any updates on the Company’s website..

9. Minors

The website governed by this Privacy Policy is not intended for use by minors under 16 for digital services and under 18 for contractual, e-commerce services and job applications. We do not knowingly collect or retain personal data relating to minors.