Pursuant to articles 12, 13 and 14 of Regulation (EU) 2016/679 on the protection of personal data (hereinafter referred to as the Regulation) and in relation to your data, we inform you of the following:
Owner of the data processing
The data controller of your personal data is TIESSE S.p.A. based in via Asti 4, 10015 Ivrea (TO) ITALY (tel. +39.0125.230544 – fax +39.0125.631923) hereinafter simply referred to as “TIESSE”, which determines the purposes and means of processing the data collected.
Personal data means any information concerning you as a natural person, identified or identifiable, hereinafter simply “interested”. By way of example, the following categories of data are personal data: e-mail address and personal telephone number, even if corporate.
Processing means any operation or set of operations, carried out with or without the aid of automated processes and applied to personal data or sets of personal data, such as the collection, registration, organization, structuring, storage, ” adaptation or modification, extraction, consultation, use, communication by transmission, dissemination or any other form of making available, comparison or interconnection, limitation, cancellation or destruction.
Purpose and legal basis of the processing
Data processing is necessary for the following purposes: the establishment and management of TIESSE’s contracts with its customers and suppliers; the fulfillment of obligations and the exercise of rights deriving from these contractual relationships; the fulfillment of related regulatory, accounting and / or tax obligations.
The legal basis of the processing is the execution of a contract, in the event that you, as an interested party, are a party to the contract, or the execution of pre-contractual measures taken at your request, always as an interested party. In this case, failure to communicate the requested personal data makes it impossible to conclude the contract with the interested party; in the event that you are not a party to the contract but are an employee or collaborator of TIESSE’s customers or suppliers, or simply act on their behalf, the legal basis of the processing is constituted by the legitimate interest of TIESSE or of the customers or suppliers . Specifically, the legitimate interest is represented by the need to execute the contract between the parties for which it is essential to process the personal data of the respective employees, collaborators and representatives. Due to this balance and the assessment that there is a limited impact on the processing of personal data, TIESSE believes that it can rely on its legitimate interest as a prerequisite for the lawfulness of the processing.
However, the right of the interested party to object remains unaffected in the manner indicated below.
In the event of compliance with regulatory, accounting and / or tax obligations, which may also provide for the communication of personal data to competent authorities, supervisory bodies, public authorities and administrations, the legal basis of the processing is represented by the legal obligation to which it is subject the holder. The communication of personal data, in this case, is necessary for the fulfillment of this obligation and in the event of failure to communicate the data controller may not be able to fulfill.
For all the purposes listed, personal data will be processed limited to what is communicated to TIESSE, in order to minimize the invasiveness of the processing towards the data subject, taking into account the reasonable expectations of the same in relation to the information shared.
Recipients
The personal data acquired will be processed internally by TIESSE by authorized personnel or by subjects who will process personal data on behalf of TIESSE upon contract as data processors and the adoption of the necessary safeguards for the protection of personal data.
In any case, the data will not be transferred in any way to a country outside the European Union.
Duration of treatment
Personal data will be processed until the end of the limitation of the rights connected to the contractual relationship or within the term provided for by any legal obligations, if longer; all data not necessary for the execution of the contract or the exercise of related rights will be deleted within 24 months of their collection, following the periodic verification procedure that TIESSE performs so that personal data is not stored longer than necessary.
Automated decision making
It should be noted that the processing of personal data acquired will not involve any form of automated decision-making, including profiling that produce legal effects concerning the interested party or that significantly affect his person or that concern the particular categories of data of the art. 9 of the European Regulation 679/2016 (former sensitive data).
Rights of the interested party
obtain confirmation of the existence of personal data concerning him, of the sources from which they originate and the communication of such data in an intelligible form;
in the cases provided for by the law, receive, obtain the cancellation and limitation of the processing;
obtain the updating, rectification and integration of their data;
in the cases provided for by law, to receive, in a structured format of common use and readable by an automatic device, the personal data provided;
right to object, in the ways indicated below;
lodge a complaint with the Data Protection Authority and / or judicial remedy if you believe that your rights have been violated following a processing.
Right to object
In particular, as anticipated above, TIESSE wants to bring to the attention of the interested party the right to object to the processing of their personal data, at any time, for reasons connected with their particular situation, in the cases indicated above in which TIESSE needs to process data for the pursuit of a legitimate interest of TIESSE itself or of third parties (see: purpose and legal basis of the processing).
Exercise of rights
The aforementioned rights can be exercised by sending the request to the following email address: privacy@tiesse.com also using the following form: “exercise of rights”.
Likewise, any clarification on this information and in-depth information on rights can be obtained through the same e-mail address or by consulting the following information in extended form.
Information in extended form
Rights of the interested party
1) At any time, the interested party has the right to have confirmation from TIESSE that the processing of personal data concerning him is in progress and to know the following information (right of access):
the purposes of the data processing;
what data are processed;
the recipients or categories of recipients to whom the data have been or will be communicated, in particular if the recipients are based in third countries or are international organizations;
the data retention period that has been envisaged or the criteria used to determine this period;
the source from which the personal data originates.
In addition, the interested party can ask:
2) the correction of inaccurate personal data concerning him, also by providing an additional declaration (right of rectification).
3) The cancellation of their personal data (“right to be forgotten”).
It is specified that the interested party has the right to obtain the cancellation of their personal data if one of the following reasons exists:
the data are no longer necessary with respect to the purposes for which they were collected or otherwise processed by TIESSE
the interested party has revoked the consent on which the processing is based, if expressed after this collection and given for other specific purposes, and there is also no legal basis for the processing of the data;
the interested party has exercised the right to object to the processing and TIESSE has no legitimate reason to continue processing the data; or the interested party has exercised the right to object to the processing if TIESSE processes the data for direct marketing purposes, including profiling;
the personal data of the interested party have been unlawfully processed;
personal data must be deleted to fulfill a legal obligation under European Union law or Italian law.
Continuing in the list of the rights of the interested party, the latter may also request:
4) the limitation of processing when one of the following hypotheses occurs (right of limitation):
the interested party disputes the accuracy of their personal data, for the entire period necessary for TIESSE to verify the accuracy of such data;
the processing is unlawful and the interested party instead of opposing the cancellation of their data, instead requests that only its use be limited;
TIESSE no longer needs to process the personal data of the data subject, but the data is necessary for the data subject to ascertain, exercise or defend a right in court;
the interested party has exercised the right to object to the processing and awaits the verification of the possible prevalence of legitimate reasons by TIESSE to continue processing the data;
If the interested party exercises the right of limitation, his personal data will be processed, except for the conservation, only with your consent or for the ascertainment, exercise or defense of a right in court or to protect the rights of another natural or legal person or for reasons of significant public interest of the European Union or of a Member State.
The interested party, if he is a party to the contract, has the right to receive in a structured format, commonly used and readable by an electronic device, the personal data concerning him and that he has provided to TIESSE. You have the right to transmit such data, also through TIESSE, to another data controller, if technically feasible (right to data portability).
Right to object
In particular, TIESSE wants to bring to the attention of the interested party the right to object to the processing of their personal data, at any time, for reasons connected with their particular situation, in the cases indicated above in which TIESSE needs to process the data for the pursuit of a legitimate interest of TIESSE itself or of third parties (see: purpose and legal basis of the processing).
Complaint and judicial appeal
The interested party who deems that the treatment that concerns him is done in violation of the regulations on personal data protection has the right to lodge a complaint with the Guarantor for the protection of personal data, or of another Member State of the European Union in which habitually resides or works.
The interested party also has the right to propose a judicial remedy if he believes that his rights have been violated as a result of processing.