Article 13 of EU Regulation 2016/679
1. Who are we and why are we providing you with this document?
CANALAIR SERVICE S.r.l VIA PREALPINA OROBICA n. 64 – 24028 PONTE NOSSA (BG) – Italy (herein referred to asDATA CONTROLLER) deals with the creation of system design solutions for industrial applications. 25 years of experience in design, production, installation and testing of industrial aerotextile systems, of every type and size, which are able to satisfy multiple environmental and processing requirements. Reliability and experience in customer service, consultancy, after sales, up to “turnkey” systems. For years, as the DATA CONTROLLER it has for years placed the personal data protection of both its clients and potential clients and users to the fore, guaranteeing the processing of personal data, using both manual and automatic means, in strict compliance with the regulations and rights sanctioned by Regulation (EU) 2016/679 of the European Parliament and Council, on the 27 April 2016, based on the protection of natural people, as well as the circulation of such data (Subsequently defined the “Regulation” and by all application standards in terms of personal data protection.
Article 13 of EU Regulation 2016/679
CANALAIR SERVICE S.r.l VIA PREALPINA OROBICA n. 64 – 24028 PONTE NOSSA (BG) – Italy DATA CONTROLLER) deals with the creation of system design solutions for industrial applications. 25 years of experience in design, production, installation and testing of industrial aerotextile systems, of every type and size, which are able to satisfy multiple environmental and processing requirements. Reliability and experience in customer service, consultancy, after sales, up to “turnkey” systems. For years, as the DATA CONTROLLER, it has for years placed the personal data protection of both its clients and potential clients and users to the fore, guaranteeing the processing of personal data, using both manual and automatic means, in strict compliance with the regulations and rights sanctioned by Regulation (EU) 2016/679 of the European Parliament and Council, on the 27 April 2016, based on the protection of natural people, as well as the circulation of such data (Subsequently defined the “Regulation” and by all application standards in terms of personal data protection.
The writing PERSONAL DATA refers to the definition inserted in Article 4 of point 1) of the Regulation i.e. “any information regarding a physical person identified or identifiable; a natural person is considered identifiable if they can be identified, directly or indirectly, with particular reference to an identification, such as a name, identification number, data relating to location, an order identification, the Navigation IP or one or more elements characterising his or her physical, physiological, genetic, mental, economic, cultural or social identity” (herein referred to as “PERSONAL DATA”).
The Regulation states that, to undertake PERSONAL DATA PROCESSING, i.e. any operator or set of actions, undertaken with or without the help of automated processes and applied to personal data or the set of personal data, such as acquisition, adjustment, organisation, structuring, preservation, adaptation or modification, extraction, consultation, use, communication by transmission, dissemination or any other form of making available, comparison or interconnection, limitation, cancellation or destruction (definition in Article 4) point 2 of the Regulation) (hereinafter referred to as “Processing”) – it is compulsory that the person to whom such Personal Data belong is informed of why such data are required and in what way they will be used.
Therefore, this document is intended to provide you, in a simple and intuitive way, all the necessary and useful information for you to know all about your Personal Data in a conscious and informed manner and, at any time, request and obtain clarifications and/or corrections. Therefore, this information follows the principle of transparency of all the principles outlined by Article 13 of the Regulation and is articulated in the following sections (subsequently defined “Sections” or “Section”) each of which deals with a specific issue to ensure easy understanding of the information.
The present document, where necessary, may be accompanied by a special Form to obtain the consent, as provided by Article 7 of the Regulation, for any further use that we intend to perform with your Personal Data.
2. Who will process your Personal Data?
The company that will process your Personal Data for the main purpose referenced in Section 4 of this Information and which therefore acts as the DATA CONTROLLER according to the relevant definition contained in Article 4, point 7) of the Regulation, “the natural or legal person, public authority, service or other body which, individually or together with others, determines the purposes and means of processing personal data” shall be:
CANALAIR SERVICE S.r.l.
VIA PREALPINA OROBICA n. 64
24028 PONTE NOSSA (BG)
3. To whom may you refer?
In order to simplify relations between you “DATA SUBJECT”, and the DATA CONTROLLER, the Regulation provides that you can contact the DATA CONTROLLER at any time through the means that it provides you, namely:
- The e-mail: firstname.lastname@example.org
- Registered office address: CANALAIR SERVICE S.r.l VIA PREALPINA OROBICA n. 64 – 24028 PONTE NOSSA (BG) – Italy
Whenever you want, you can consult the “Privacy” section of the Internet sites in which you will find all the modalities and information regarding the use and processing of your Personal Data and up-to-date information about contacts and communication channels to all the parties concerned by the DATA CONTROLLER.
4. For what main purpose will your Personal Data be processed?
The DATA CONTROLLER, in order to allow the provision of his services, has provided the possibility to register, and/or send requests for information using the contact forms, needs to collect some of your Personal Data, as required in the registration form on the website or at the registered office of Canalair Service Srl. The website and the offices of the DATA CONTROLLER for which this Information is issued are those listed in the privacy section https://www.canalair.it/privacy (subsequently referred to as “Internet Sites”). The Processing of your Personal Data will be performed by the DATA CONTROLLER to give you the information requested according to Art 6 of the EU Regulation 2016/679, participate in initiatives promoted through Internet Sites, receive newsletters, send requests for information as well as take advantage of all other services, from time to time, offered by the Data Controller.
The Processing of your Personal Data will be legally based on the contractual relationship that will be created between you and the DATA CONTROLLER following your acceptance of the conditions relating to the services that the Data Controller offers.
In order to allow the DATA CONTROLLER to carry out the processing activities for the above purposes, it is necessary to provide Personal Data (NAME, SURNAME, BUSINESS NAME, VAT NO./TAX CODE, DOMICILE, TEL, MAIL). In the absence of even one of the above data, it will not be possible to process your Personal Data and, consequently, you will not be allowed to develop the relationship with the DATA CONTROLLER and/or benefit from the services provided by the Controller for which your Personal Data is required.
The DATA CONTROLLER, with your express, free and unequivocal consent in accordance with Article 6, paragraph 1, point a) of the Regulation, may request, in addition to the above data, additional Personal Data such as, for example, data on tastes, preferences, habits, needs and choices of consumption, for the following purposes, i.e. profiling data.
- Direct marketing purpose: this term means the il DATA CONTROLLER can involve you in promotional and/or marketing activities. All activities carried out to promote products, services, sold and/or provided on the basis of their legitimate interest in pursuing their social object fall within this category.
- Indirect marketing purpose: this term means the DATA CONTROLLER desires to involve you in promotional and/or marketing activities for third parties. This category includes all the activities carried out to promote products, services, sold and/or provided by third parties with whom the DATA CONTROLLER maintains legal relations without any communication of data in this case.
- Profiling purpose: this term means the DATA CONTROLLER desires to profile you, that is, to evaluate your tastes, preferences and consumer habits also related to market surveys and statistical analysis. This category covers any form of automated Processing of Personal Data to assess certain personal aspects such as those concerning, but not limited to, professional performance, economic situation, personal preferences, interests, reliability, behaviour, location, or movements.
The Processing of your Personal Data for the purposes set out in points (II) and (III) requires your express consent, which will necessarily have to comply with the conditions laid down in Article 7 of the Regulation, imposing the lawfulness of the Processing of your Personal Data.
With regard to direct marketing purposes referenced in point (I), it is appropriate to specify that, pursuant to Article 6, paragraph 1, point f) of the Regulation, the DATA CONTROLLER may perform this activity in relation to their legitimate interest, regardless of your consent and in any case up to your opposition to such processing as better explained in Recital 47 of the Regulation in which it is “considered legitimate interest to process personal data for direct marketing purposes”. This will also be possible as a result of the assessments made by the DATA CONTROLLER regarding the possible prevalence of your interests, rights and fundamental freedoms on the protection of Personal Data on their legitimate interest in sending direct marketing communications.
The contact methods aimed at direct, indirect and profiling marketing activities as in the previous points (I), (II) and (III), can be either automated (email, SMS, MMS, fax, telephone without operator) or traditional (telephone calls with operator, postal items). However, as defined in Section 8, you may revoke your consent, even partially, for example consenting to only traditional contact methods.
In relation to the contact methods that foresee the use of your telephone contacts, we remind you that the activities of direct marketing by the DATA CONTROLLER will be carried out after verification of your possible entry in the Register of Oppositions as established pursuant to and for the effects of Presidential Decree no. 178 of 7 September 2010 and subsequent amendments.
6. Who are the persons to whom your Personal Data may be disclosed?
Your Personal Data may be communicated to specific subjects considered as recipients of such Personal Data. In fact, Article 4, point 9) of the Regulation defines as the recipients of a Personal Data “the natural or legal person, public authority, service or other body that receives communication of Personal Data, whether it is a third party or not” (hereinafter defined as the “Recipients”).
For this reason, in order to provide the services expressed in this statement, the following Recipients may be in a position to process your Personal Data:
- third parties (hereinafter the “Data Processor”) who carry out part of the Processing activities and/or related and instrumental activities to the same on behalf of the DATA CONTROLLER; the latter have been appointed responsible for processing in accordance with Article 4, point 8) of the Regulation, “the natural or legal person, the public authority, the service or other body that processes personal data on behalf of the DATA CONTROLLER for example “the accountant”;
- individual people, employees and/or collaborators (herein referred to as “Authorised People”) of the DATA CONTROLLER, to whom specific and/or multiple processing activities of your personal data were entrusted. These people have been trained on the subject of security and proper use of Personal Data and are defined, in accordance with Article 4, point 10) of the Regulation, “persons authorized to process Personal Data under the direct authority of the Data Controller or Data Processor”
- If required by law or to prevent or suppress the commission of a crime, your Personal Data may be disclosed to public bodies or to the judicial authorities without these being defined as Recipients. Indeed, in accordance with Article 4, point 9) of the Regulation, “public authorities which may receive communication of Personal Data in the context of a specific investigation in accordance with Union or Member State law are not considered Recipients”.
7. How long will your Personal Data be processed?
One of the principles applicable to the Processing of your Personal Data concerns the limitation of the retention period, governed by Article 5, paragraph 1, point e) of the Regulation that states “Personal Data shall be kept in a form that allows the identification of Data Subjects for a period of time not exceeding the achievement of the purposes for which they are processed in our case until the termination of the contractual relationship; Personal Data may be stored for longer periods provided they are processed exclusively for archival purposes in the public interest, for scientific or historical research or for statistical purposes, in accordance with Article 89, paragraph 1, subject to implementation of the appropriate technical and organisational measures required by this Regulation in order to safeguard the rights and freedoms of the Data Subject”.
In light of this principle, your Personal Data will be processed by the DATA CONTROLLER only for the time necessary for the pursuit of the purposes set out in Section 4 of this Information statement. In particular, your Personal Data will be processed for a period of time equal to the minimum necessary, as indicated in Recital 39 of the Regulation, i.e. until the termination of the contractual relationships between you and the DATA CONTROLLER, without prejudice to a further retention period that may be imposed by law as also provided for by Recital 65 of the Regulation.
With regard to the processing carried out for the purposes referenced in Section 5 of this Information, the DATA CONTROLLER may lawfully process your Personal Data until you communicate, using one of the means provided for in this Information, your willingness to revoke your consent for one or all of the purposes for which you were asked. Any withdrawal of consent will in fact require the DATA CONTROLLER to cease the activities of processing of your Personal Data for such purposes.
8. Is it possible to revoke the consent given and how?
As provided in the Regulation, if you have given your consent to the processing of your Personal Data for one or more purposes for which you have been requested, you may, when you wish, revoke it totally and/or partially without prejudice to the lawfulness of consent-based processing given prior to revocation.
The methods of withdrawal of consent are very simple and intuitive, just contact the DATA CONTROLLER using the contact channels provided in this Information and in sections 3 and 9 respectively.
n addition to the above and for simplicity, if you are in a position to receive advertising emails from the DATA CONTROLLER that are no longer of interest to you, simply click the unsubscribe placed at the bottom of them to no longer receive any communication, even through additional contact channels for which your consent was obtained (SMS, MMS, paper mail, fax, phone calls).
9. What are your rights?
As outlined in Article 15 of the Regulation, you may access your Personal Data, request its rectification and updating, if incomplete or erroneous, request its cancellation if the collection has occurred in violation of a law or regulation, as well as against Processing for legitimate and specific reasons.
In particular, all your rights are outlined below that you can exercise, at any time, against the DATA PROCESSOR:
- Right of access: you will have the right, in accordance with Article 15, clause 1 of the Regulation, to obtain from the DATA CONTROLLER confirmation whether or not Processing of your Personal Data is ongoing and, in this case, obtain access to such Personal Data and to the following information: a) the purposes of the Processing; b) the categories of Personal Data concerned; c) the Recipients or categories of Recipients to whom your Personal Data has been or will be communicated, in particular if Recipients from third world countries or international organisations; d) where possible, the period of storage of Personal Data planned or, if not possible, the criteria used to determine this period; e) the existence of the right of the relevant person to ask the DATA CONTROLLER to rectify or delete the Personal Data or to restrict the processing of his/her Personal Data or to oppose their processing; f) the right to lodge a complaint with a supervisory authority; g) if the Personal Data are not collected from the relevant party, all available information on their origin; h) the existence of an automated decision-making process, including profiling with reference to Article 22, clauses 1 and 4 of the Regulation and, at least in such cases, significant information on the logic used, as well as the importance and expected consequences of such processing for the relevant person. All this information may be found in this Information statement that will always be at your disposal within the Privacy section of each of the Internet sites or at the DATA CONTROLLER.
- Right of rectification: you may obtain, in accordance with Article 16 of the Regulation, the rectification of your Personal Data that is found to be inaccurate. Taking into account the purpose of the processing, moreover, it will be possible to obtain the integration of your personal data, which are incomplete, by providing a supplementary statement.
- Right to cancellation: you may obtain, in accordance with Article 17, paragraph 1 of the Regulation, the cancellation of your Personal Data without undue delay and the DATA CONTROLLER will be obliged to delete your Personal Data, if there is even one of the following reasons: a) Personal Data are no longer necessary with respect to the purposes for which they were collected or otherwise processed; b) you have revoked the consent on which the processing of your Personal Data is based and there is no other legal basis for their processing; c) you have opposed the processing pursuant to Article 21, paragraph 1 or 2 of the Regulation and there is no longer any prevailing legitimate reason to proceed with the processing of your Personal Data; d) your Personal Data was unlawfully processed; e) it is necessary to delete your Personal Data in order to comply with a legal obligation provided by EU or national legislation. In some cases, pursuant to Article 17, paragraph 3 of the Regulation, the DATA CONTROLLER shall be entitled not to provide for the erasure of your Personal Data if their Processing is necessary, for example, for the exercise of the right to freedom of expression and information, for the fulfilment of a legal obligation, for reasons of public interest, for purposes of archiving in the public interest, for scientific or historical research or for statistical purposes, for the assessment, exercise or defence of a right in court.
- Right to restriction of processing: you may obtain the restriction of processing, in accordance with Article 18 of the Regulation, in the event that one of the following hypotheses is used: a) you have contested the accuracy of your Personal Data (the limitation will continue for the period necessary for the DATA CONTROLLER to verify the accuracy of such Personal Data); b) the Processing is unlawful but you have opposed the deletion of your Personal Data asking, instead, that its use is limited; c) although the DATA CONTROLLER no longer needs it for the purposes of processing, your Personal Data are used for the assessment, exercise or defence of a right in court; d) has opposed the Processing pursuant to article 21, paragraph 1, of the Regulation and is pending the verification of the possible prevalence of the legitimate reasons of the DATA CONTROLLER with respect to you. In case of restriction of processing, your Personal Data will be processed, subject to your consent for storage, or for the assessment, exercise or defence of a right in court, or to protect the rights of another natural or legal person or for reasons of significant public interest. We shall inform you, in any event, before this restriction is revoked.
- Right to data portability: you may, at any time, request and receive, in accordance with Article 20, clause 1 of the Regulation, all your Personal Data processed by the DATA CONTROLLER in a structured format, common and legible use or request its transmission to another DATA CONTROLLER without hindrance. In this case, it will be your responsibility to provide us with all the exact details of the new DATA CONTROLLER to whom you intend to transfer your Personal Data, giving us written authorisation.
- Right to be forgotten: in law, a particular form of guarantee which provides for NON-dissemination, without particular reasons, of prejudicial precedents of the honour of a person, mainly intending as such the judicial precedents of a person. According to this principle it is not legitimate, for example, to disseminate information about convictions received or in any case other sensitive data of similar subject matter, except in the case of special cases linked to news events and even in such cases the publicity of the fact must be proportionate to the importance of the event and the time elapsed since the event.
- Right to object: in accordance with Article 21, clause 2 of the Regulation and as also confirmed by Recital 70, you can oppose, at any time, the processing of your Personal Data if these are processed for direct marketing purposes, including profiling in so far as it is related to such direct marketing.
- Right to lodge a complaint with the supervisory authority: without prejudice to your right to appeal to any other administrative or judicial body, if you believe that the Processing of your Personal Data carried out by the Data Controller is in violation of the Regulation and/or applicable legislation, you may lodge a complaint with the competent Data Protection Authority.
To exercise all your rights as identified above, simply contact the DATA CONTROLLER in the following ways:
- The e-mail: email@example.com
- Registered office address: CANALAIR SERVICE S.r.l VIA PREALPINA OROBICA n. 64 – 24028 PONTE NOSSA (BG) – Italy
10. Where will your Personal Data be processed?
Your Personal Data will be processed by the DATA CONTROLLER within the territory of the European Union.
If, for technical and/or operational reasons, it is necessary to make use of entities located outside the European Union, we inform you that those entities will be appointed Data Processors pursuant to and for the purposes of Article 28 of the Regulation and the transfer of your Personal Data to such persons, limited to the performance of specific processing activities, will be regulated in accordance with the provisions of chapter V of the Regulation. All necessary precautions will be taken to ensure the full protection of your Personal Data based on this transfer: (a) on decisions about the adequacy of third country recipients expressed by the European Commission; (b) on adequate guarantees expressed by the third party recipient pursuant to Article 46 of the Regulation; (c) on the adoption of corporate binding rules.
In all cases, you may request more details from the DATA CONTROLLER if your Personal Data have been processed outside the European Union, and ask for evidence of the specific guarantees adopted.