Information in accordance with articles 13 and 14 of the EU Reg. n° 2016/679 in the matter of Personal Data Protection
Purpose of data processing
TOUREXP SRL (P.IVA 07497270723) as data Controller, informs You that personal data and information provided will be treated in compliance with the provisions of Regulation n° 2016/679 in the matter of Personal Data Protection as detailed below. The data controller communicates in a transparent, intelligible, and clear manner that the personal data collected will be processed exclusively for the purposes related to the activities of the same data controller and related Companies. Such subject may time by time be appointed independent Holders or Co-holders of the data, in the context of the complete execution of the assignement , as provided for in art. 4, par. 7) of the EU Regulation for which the holder of the data is “the natural or legal person , public authority, service or other body which, individually, or together with others, determines the purposes and means of processing personal data”. Purposes of use other than those of collection and here not declared are prohibited. Personal data collected, including the particular data (former sensitive data) directly from the interested party or through the compilation of paper forms, are treated by the data controller as contractual (art. 6 par. 1 of EU Regulation 2016/679) as part of the activity for which the personal data and other information have been collected, the Company may carry out any operation related to this statement within the limits of the relative consent given by the holder of the data for registration, organization, structuring, conservation, adaptation, modification, communication, making available.
Legal basis and lawfulness of processing
The data Controller, in order to give effect to the contractual relationship, as well as to the relative fulfillments, needs to collect and process some of the personal data acquired (Art. 6 EU Reg.2016/679). The processing of personal data, will be conducted by the Data Controller to comply with legal obligations and will be legally based on the rules on the protection of personal data, for mere contractual purposes as well as the provision of services. The provision of data is mandatory for the complete performance of activities and therefore the failure to provide such information may make it impossible to define the procedures related to the execution of the assignment.
The period of data retention will always and exclusively be linked and referable to the purpose for which the data have been acquired and are processed (Recital 39 to Reg). The data acquired as part of the assignment may be stored by the data Controller for the time strictly necessary for the execution of the professional activities required. However, the Company may continue to store such data for a longer period to protect its interests in the event of any disputes. Once the consent has been revoked, the data will no longer be used but only stored, without being the subject of processing.
Arrangements for extra-EU treatment
The Data Controller does not transfer the personal data collected to foreign countries, not even limited to the storage of the same on virtual servers outside the EU. Should this be the case, all the necessary precautions will be taken for the protection of personal data and information collected and a careful analysis will be carried out through a prior verification of adequacy regarding the protection and retention of personal data (adequacy decisions, Standard Contractual Clauses, Guarantor’s authorizations).
Area of communication and processing of personal data
We inform you that the acquisition of personal data is necessary for the full performance of the assignment. The impossibility of processing will not allow the execution of the contract. The information provided will not be subject to any automated decision-making pursuant to art. 13 paragraph 2 letter f of EU Reg. 2016/679, including their profiling. The data will be acquired electronically or on paper and processed to meet the needs of the Customer. We also inform you that the data acquired will be used exclusively by the data controller for reasons relating to the performance of professional services performed for the management and execution of contractual purposes. If for these purposes the involvement of external parties is necessary, such Companies and/or Professionals, will be formally appointed External Data Processors (ex art. 28 Reg. EU 2016/679).
Processing of data via the Website
Further technical information may be requested directly from the Data Controller. As far as usage data is concerned, this information is collected automatically through this Website (also by third-party applications integrated into this Website) including : IP addresses or domain names of computers used by the User that connects with this Website, addresses in URI notation(Uniform Resource Identifier), the time of the request,the method used to forward the request to the server,the size of the file obtained in response, the numerical code indicating the status of the response from the server, the country of origin, the characteristics of the browser and the operating system used by the visitor, the various temporal connotations of the visit (for example, the time spent on each page) and details of the itinerary followed within the Application, with particular reference to the pages consulted, the parameters related to the operating system and the computer environment of the user. Cookies, on the other hand, concern a small amount of data stored within the user’s device.
Rights of the holder of the personal data
We inform you that it is your right ,as provided by art. 15 of EU Regulation 2016/679, to be able to access and control at any time the personal data provided concerning you, obtain confirmation of the same in an intelligible form, request the modification, cancellation or restriction of processing, within the limits provided by the regulations in force regarding “obligations to retain personal data”. Any modification, cancellation or other activity requested in relation to the personal data provided, will be subject to the Data Controller’s appropriate registration of the intervention performed. In particular: Right of access: art. 15 paragraph 1 of the Regulation, in order to obtain access to such personal data and information (purpose of processing, type of personal data collected, recipients or categories of recipients to whom the personal data are or will be communicated, retention period, right to lodge a complaint, existence of an automated decision-making process). Right of rectification: right to obtain, in accordance with art. 16 of the Regulation, the rectification of personal data that are inaccurate, incomplete. Right to cancellation: art. 17, paragraph 1 of the Regulation, for which it will be possible to request cancellation if the data are no longer necessary, withdrawal of consent, opposition to processing pursuant to art. 21 paragraph 1 or 2 of the Regulation, unlawful processing. Right to restriction of processing, Right to data portability. Right to object: art. 21, paragraph 2 of the Regulation (Recital 70), for which you can object, at any time, to the processing of your personal data if these are processed for purposes other than those indicated in the information, including profiling. Pursuant to art. 77 Reg. EU 2016/679, it is possible to propose, at any time, a formal complaint to the Guarantor for the Protection of Personal Data with headquarters in Rome, Piazza Venezia no. 11, in the event that he considers to report an improper or unauthorized use of his personal data. In addition, you can contact Studio Legale Busco & Partners, at the firstname.lastname@example.org for the exercise of your rights or in case of observations and/or disputes relating to the processing of personal data.