Privacy Policy

INFORMATION PURSUANT TO ARTICLES 13 AND 14 OF REGULATION (EU) 2016/679 – WEB

version n.1 dated 12-02-2021

With this document ("Information") the Data Controller, as defined below, wishes to inform you about the purposes and methods of processing of your personal data and the rights recognized to you by Regulation (EU) 2016/679 relating to the protection of natural persons, with regard to the processing of personal data as well as their free movement ("GDPR"). This Information may be integrated by the Data Controller if any additional services requested by you involve further processing.

HOLDER OF THE TREATMENT

Management Advisor srl

DATA PROTECTION OFFICER

Legal representative

TYPES OF DATA PROCESSED

The processing activities carried out are aimed at acquiring the following personal data:

Category	Type
Common data	Navigation log
Common data	Personal data
Common data	Profiling cookies
Special data	Geo-localized data

CATEGORIES OF INTERESTED PARTIES

The processing activities carried out are aimed at the following categories of interested parties:

Category

Natural persons, legal entities, public and private organizations.

PURPOSE OF THE PROCESSING AND CONDITION WHICH MAKES THE PROCESSING LAWFUL

1. SITE – NAVIGATION DATA

Obtain anonymous statistical information on use, check the correct functioning of the site, ascertain responsibility in case of hypothetical computer crimes against the Owner.

The data you provide will be processed for the following purposes:

Condition Lawfulness of Processing	Purpose	Description
Legitimate Interest – Art. 6, c.1, let. f. GDPR	Technological maintenance of the site.	Data analysis to perform the evolution and maintenance of the website.
Legitimate Interest – Art. 6, c.1, let. f. GDPR	Illegal use of the site.	Ascertainment of responsibility in the event of potential computer crimes to the detriment of the site and/or the data subjects.
Legitimate Interest – Art. 6, c.1, let. f. GDPR	Statistical analysis.	Statistical analysis, anonymous, on the use of the site.

Nature of the provision: Mandatory
Consequences of refusal to provide data: Failure to provide data will make it impossible for the company to provide the web service provided.
Personal data retention period: The data is retained for 30 days.
Minimum data protection measures: Standard Protection Measures
Processing methods: The processing is carried out using IT tools.

2. SITE – REQUESTS FROM THE SITE

Requests made by interested parties via the website of the Data Controller. The data you provide will be processed for the following purposes:

Condition Lawfulness of Processing	Purpose	Description
Contract Execution – Art. 6, c.1, let. b. GDPR	Sending requests via web platform tools.	Sending requests via web platform tools.

Nature of the provision: Optional
Consequences of refusal to provide data: Failure to provide data will make it impossible for the Data Controller to respond to the interested party's requests.
Personal data retention period: Processing of the request.
Minimum data protection measures: Standard Protection Measures
Processing methods: The processing is carried out using IT tools.

3. FACEBOOK SOCIAL PAGE

When a user uses the Page administered by the Owner, Facebook (" Social Media ") collects information such as the types of content viewed or interacted with, the actions performed as well as information on the devices used (IP addresses, operating system, type of browser, language settings, cookie data).

Page Insights are aggregate statistics created from certain events recorded by Facebook servers when users interact with Pages and the content contained therein.

As illustrated in Facebook's Privacy Policy (https://www.facebook.com/policy) , the Social Media also collects and uses information to provide statistical data collection services called Page Insights (https://facebook.com/ business/pages/manage#page_insights) to page administrators to allow them to understand how people interact with the content present on them.

Details on the processing methods carried out by Facebook are available at the following link:

https://www.facebook.com/privacy/explanation

Details on the personal data processed for Insights are available at the following link:

https://www.facebook.com/legal/terms/information_about_page_insights_data

Details on the cookies used by Facebook are available at the following link:

https://www.facebook.com/policies/cookies/

The Data Controller as administrator of the Page and Facebook Ireland Limited (4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland) are joint data controllers in accordance with Article 26 of the GDPR for the processing of such personal data registered for the events delivered via Page Insights ( https://www.facebook.com/business/pages/manage#page_insights ) (“Insights Data”).

The joint ownership agreement ( https://www.facebook.com/legal/terms/page_controller_addendum ), between the Owner and Facebook, covers the creation of such events and their aggregation in Insights on the Page provided to each administrator.

The legal basis of the processing is the legitimate interest of the Data Controller , art. 6, paragraph 1, letter f), GDPR. Therefore, it is not necessary to obtain your prior consent to the processing.

The data you provide will be processed for the following purposes:

Condition Lawfulness of Processing	Purpose	Description
Legitimate Interest – Art. 6, c.1, let. f. GDPR	Insights consultation Facebook page	Statistical findings relating to the use of elements contained within the Facebook page administered by the Data Controller.

Nature of the provision: Mandatory
Consequences of refusal to provide data: Failure to provide the requested data will make it impossible for the Owner to provide services via the Page published on Facebook.
Personal data retention period: The data collected will be processed for the time strictly for the realization of the purposes described above as specified in the Facebook policies described above.
Minimum data protection measures: Security measures adopted by the Co-Owner Facebook Ireland Limited
Method of Processing: The processing is carried out by IT means by the Facebook Joint Controller

RECIPIENTS OF THE TREATMENT

Role	Recipient or Recipient Category	Economic sector
Data Controller	External consultant
Subject Designated for Processing (Internal)	Staff employed by the Owner
Data Controller	Sole director

RIGHTS OF THE INTERESTED PARTY - COMPLAINT TO THE SUPERVISORY AUTHORITY

In relation to the processing described in this Information, as an interested party you may, under the conditions established by the GDPR, exercise the rights established by articles 15 to 22 of the GDPR and, in particular, the following rights:

right of access – article 15 GDPR: right to obtain confirmation as to whether or not personal data concerning you is being processed and, in this case, obtain access to your personal data;
right of rectification – article 16 GDPR: right to obtain, without unjustified delay, the rectification of inaccurate personal data concerning you and/or the integration of incomplete personal data;
right to cancellation (right to be forgotten) – article 17 GDPR: right to obtain, without unjustified delay, the cancellation of personal data concerning you. The right to erasure does not apply to the extent that processing is necessary for the fulfillment of a legal obligation or for the performance of a task carried out in the public interest or for the establishment, exercise or defense of a right. in court.
right to limit processing – article 18 GDPR: right to obtain limitation of processing, when: a) the interested party disputes the accuracy of the personal data; b) the processing is unlawful and the interested party opposes the deletion of the personal data and instead requests that their use be limited; c) the personal data are necessary for the interested party to ascertain, exercise or defend a right in court; d) the interested party has opposed the processing pending verification regarding the possible prevalence of the legitimate reasons of the data controller with respect to those of the interested party.
right to data portability – article 20 GDPR: right to receive, in a structured format, commonly used and readable by an automatic device, the personal data concerning you provided to the Data Controller and the right to transmit them to another data controller without impediments, if the processing is based on consent and is carried out by automated means. Furthermore, the right to have your personal data transmitted directly from this owner to another owner if this is technically feasible;
right of opposition – article 21 GDPR: right to object, at any time, to the processing of personal data concerning you based on the condition of legitimacy of legitimate interest, including profiling, unless there are legitimate reasons for the Data Controller to continue the processing which prevail over the interests, rights and freedoms of the interested party or for the establishment, exercise or defense of a right in court.
right not to be subjected to an automated decision-making process – article 22 GDPR: the interested party has the right not to be subjected to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or which significantly affects similarly significantly on your person, unless this is necessary for the conclusion or execution of a contract or you have given your consent. In any case, an automated decision-making process cannot concern your personal data and you will be able to obtain human intervention from the data controller at any time, express your opinion and contest the decision.
right to lodge a complaint with the Guarantor Authority for the protection of personal data: http://www.garanteprivacy.it
revoke the consent given on any occasion and with the same ease with which it was provided without prejudice to the lawfulness of the processing based on the consent given before the revocation.

The above rights may be exercised against the Data Controller by contacting the contact details indicated in point 1 above.
The exercise of your rights as an interested party is free pursuant to Article 12 GDPR. However, in the case of manifestly unfounded or excessive requests, also due to their repetitiveness, the Owner may charge you a reasonable fee, in light of the administrative costs incurred to manage your request, or deny satisfaction of your request.
Finally, we inform you that the Data Controller may request further information necessary to confirm the identity of the interested party.

RIGHT OF WITHDRAWAL:
The interested party has the right to withdraw his consent at any time. The revocation of consent does not affect the lawfulness of the processing based on consent before the revocation.
RIGHT TO COMPLAINT:
At any time the interested party has the right to lodge a complaint with the Guarantor Authority for the protection of personal data, www.garanteprivacy.it