Privacy

INFORMATION PURSUANT TO ARTICLES 13 AND 14 OF REGULATION (EU) 2016/679 – WEB

version n.1 dated 12-02-2021

With this document ("Information") the Data Controller, as defined below, wishes to inform you of the purposes and methods of processing of your personal data and of the rights that are recognized by the Regulation (EU) 2016/679 relating to the protection of natural persons, with regard to the processing of personal data as well as their free movement ("GDPR"). This Information may be integrated by the Data Controller if any additional services requested by you involve further processing.

DATA CONTROLLER

Management Advisor srl

DATA PROTECTION OFFICER

Legal representative

TYPES OF DATA PROCESSED

The processing activities carried out are aimed at acquiring the following personal data:

The processing activities carried out are aimed at the following categories of interested parties:

Obtain anonymous statistical information on use, check the correct functioning of the site, ascertain responsibility in case of hypothetical computer crimes against the Owner.

The data you provide will be processed for the following purposes:

• Nature of the provision: Mandatory
• Consequences of refusal to provide data: Failure to provide data will make it impossible for the company to provide the web service provided.
• Personal data retention period: The data is retained for 30 days.
• Minimum data protection measures: Standard Protection Measures
• Processing methods: The processing is carried out using IT tools.

Requests made by interested parties via the website of the Data Controller. The data you provide will be processed for the following purposes:

• Nature of the provision: Optional
• Consequences of refusal to provide data: Failure to provide data will make it impossible for the Data Controller to respond to the interested party's requests.
• Personal data retention period: Processing of the request.
• Minimum data protection measures: Standard Protection Measures
• Processing methods: The processing is carried out using IT tools.

When a user uses the Page administered by the Owner, Facebook (" Social Media ") collects information such as the types of content viewed or interacted with, the actions performed as well as information on the devices used (IP addresses, operating system, type of browser, language settings, cookie data).

Page Insights statistics servers when users interact with Pages and the content contained therein.

As illustrated in Privacy Policy ( https://www.facebook.com/policy ) , the Social Media also collects and uses information to provide statistical data collection services called Page Insights ( https://facebook.com/ business/pages/manage#page_insights ) to page administrators to allow them to understand how people interact with the content present on them.

Details on the processing methods carried out by Facebook are available at the following link:

https://www.facebook.com/privacy/explanation

Details on the personal data processed for Insights are available at the following link:

https://www.facebook.com/legal/terms/information_about_page_insights_data

Details on the cookies used by Facebook are available at the following link:

https://www.facebook.com/policies/cookies/

The Data Controller as administrator of the Page and Facebook Ireland Limited (4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland) are joint data controllers in accordance with Article 26 of the GDPR for the processing of such personal data registered for the events delivered via Page Insights ( https://www.facebook.com/business/pages/manage#page_insights ) (“Insights Data”).

The joint ownership agreement ( https://www.facebook.com/legal/terms/page_controller_addendum ), between the Owner and Facebook, covers the creation of such events and their aggregation in Insights on the Page provided to each administrator.

The legal basis of the processing is the legitimate interest of the Data Controller , art. 6, paragraph 1, letter f), GDPR. Therefore, it is not necessary to obtain your prior consent to the processing.

The data you provide will be processed for the following purposes:

• Nature of provision: Mandatory
  Consequences of refusal to provide data: Failure to provide the requested data will make it impossible for the Owner to provide services via the Page published on Facebook.
• Personal data retention period: The data collected will be processed for the time strictly for the realization of the purposes described above as specified in the Facebook policies described above.
• Minimum data protection measures: Security measures adopted by the Co-Owner Facebook Ireland Limited
• Method of Processing: The processing is carried out by IT means by the Facebook Joint Controller

In relation to the processing described in this Information, as an interested party you may, under the conditions established by the GDPR, exercise the rights established by articles 15 to 22 of the GDPR and, in particular, the following rights:

• right of access – article 15 GDPR: right to obtain confirmation as to whether or not personal data concerning you is being processed and, in this case, obtain access to your personal data;
  right of rectification – article 16 GDPR: right to obtain, without unjustified delay, the rectification of inaccurate personal data concerning you and/or the integration of incomplete personal data;
• right to cancellation (right to be forgotten) – article 17 GDPR: right to obtain, without unjustified delay, the cancellation of personal data concerning you. The right to erasure does not apply to the extent that processing is necessary for the fulfillment of a legal obligation or for the performance of a task carried out in the public interest or for the establishment, exercise or defense of a right. in court.
• right to limit processing – article 18 GDPR: right to obtain the limitation of processing, when: a) the interested party disputes the accuracy of the personal data; b) the processing is unlawful and the interested party opposes the deletion of the personal data and instead requests that their use be limited; c) the personal data are necessary for the interested party to ascertain, exercise or defend a right in court; d) the interested party has opposed the processing pending verification of the possible prevalence of the legitimate reasons of the data controller with respect to those of the interested party.
• right to data portability – article 20 GDPR: right to receive, in a structured format, commonly used and readable by an automatic device, the personal data concerning you provided to the Data Controller and the right to transmit them to another data controller without impediments, if the processing is based on consent and is carried out by automated means. Furthermore, the right to have your personal data transmitted directly from this owner to another owner if this is technically feasible;
• right of opposition – article 21 GDPR: right to object, at any time, to the processing of personal data concerning you based on the condition of legitimacy of legitimate interest, including profiling, unless there are legitimate reasons for the Data Controller to continue the processing which prevail over the interests, rights and freedoms of the interested party or for the establishment, exercise or defense of a right in court.
• right not to be subjected to an automated decision-making process – article 22 GDPR: the interested party has the right not to be subjected to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or which significantly affects similarly significantly on your person, unless this is necessary for the conclusion or execution of a contract or you have given your consent. In any case, an automated decision-making process cannot concern your personal data and you will be able to obtain human intervention from the data controller at any time, express your opinion and contest the decision.
• right to lodge a complaint with the Guarantor Authority for the protection of personal data: http://www.garanteprivacy.it
  revoke the consent given on any occasion and with the same ease with which it was provided without prejudice to the lawfulness of the processing based on consent provided before revocation.

The above rights may be exercised against the Data Controller by contacting the references indicated in the previous point 1.
The exercise of your rights as an interested party is free of charge pursuant to Article 12 GDPR.
However, in the case of manifestly unfounded or excessive requests, also due to their repetitiveness, the Owner may charge you a reasonable fee, in light of the administrative costs incurred to manage your request, or deny satisfaction of your request. Finally, we inform you that the Data Controller may request further information necessary to confirm the identity of the interested party.

• RIGHT OF WITHDRAWAL:
  The interested party has the right to withdraw his consent at any time. The revocation of consent does not affect the lawfulness of the processing based on consent before the revocation.
• RIGHT TO COMPLAIN:
  At any time the interested party has the right to lodge a complaint with the Guarantor Authority for the protection of personal data, www.garanteprivacy.it