Privacy statement

Privacy statement pursuant to Article 13 of Legislative Decree 196/03 and EU Regulation no. 679/2016 (GDPR)

Pursuant to art. 13 of Legislative Decree 196/03 and following the entry into force of EU Regulation no. 679/2016 in accordance with the provisions of art. 13 of the aforementioned European Regulation, we wish to inform you of the following:

1) Data controller

Data controller, pursuant to arts. 4 and 24 of the EU Reg. 2016/679 is Sant’Ambrogio Servizi Industriali Srl with registered office in Milan, Piazza Carlo Donegani 8.

2) Purpose of the treatment

The personal data provided will be processed in accordance with the conditions of compliance with applicable laws, pursuant to art. 6 of EU Reg. 2016/679 for the following primary purposes:

• registration to courses and events;
• sending information and communications regarding software, courses and events;
• administrative, tax, accounting and IT management purposes
• analysis on the use of software and management of customer support requests
• fulfillment of contractual obligations, of law regulations and administrative-accounting purposes. For the purposes of the application of the provisions regarding the protection of personal data, the processing performed for administrative-accounting purposes are those related to the performance of organizational, administrative, financial and accounting activities, regardless of the nature of the data processed.

Only subject to specific and separate consent (articles 23 and 130 of the Privacy Code and article 7 of the GDPR), for the following secondary purposes:

• sending newsletters, opinion polls, invitations to events which are organized by the data controller or in which he participates, by e-mail

3) Communication of data to third parties:

Personal data will be processed by the Data Controller and by strictly authorized processing personnel.  The data may be communicated to all the inspection bodies responsible for checks and verifications relating to the fulfilment of the legal obligations.  The data may also be disclosed to companies / professional firms that provide assistance, consultancy or collaboration to the data controller, in accounting, administrative, tax, legal and financial matters, as well as to public administrations for the performance of institutional activities within the limits established by law or by regulations and to third-party service providers to whom disclosure may be necessary for the performance of the services covered by the contract or for sending communications.  Personal data are not subject to general disclosure.  Communications can also be sent through the services provided by the following suppliers, whereas for further information their relative privacy policy can be referred to: Mailchimp: https://mailchimp.com/legal/privacy/Sendgrid: https://sendgrid.com/policies/privacy/services-privacy-policy/

4) Transfer of data to third countries

Personal data may be transferred to third countries for the purposes indicated in point 2 exclusively in countries for which the so-called “adequacy decisions” have already been issued by the European Commission.

5) Existence of an automated decision-making process

There is no automated decision making process.

6) Retention period and criteria

The treatment will be carried out in an automated and / or manual way, with methods and tools aimed at guaranteeing maximum security and confidentiality.

In compliance with the provisions of art. 5 paragraph 1 letter e) of Reg. UE 2016/679 the collected personal data will be stored in a form that allows identification of data subjects for a period of time not exceeding the achievement of the purposes for which the personal data are processed. The data will be kept for the time periods defined by the relevant legislation.

7) Mandatory or optional nature of consent for the pursuit of the purposes of data processing

The nature of the provision of data is mandatory for the data controller to provide the services listed as primary purposes in point 2. In case of denial, it will therefore be impossible to complete the registration process and the Controller will not be able to fulfil any contractual obligations.

The provision of personal data to the Data Controller and the granting of consent to the processing for secondary purposes are absolutely optional and granted on a voluntary basis.

8) Rights of the data subjects

The data subject may at any time exercise the rights reserved to him / her, as set out by art. 7 of which the full text is copied below.

Article 7 of Legislative Decree 196/03 and Art. 15 of  EU Regulation no. 679/2016 (GDPR)

 (Right to access personal data and other rights)

• The data subject has the right to obtain confirmation of the existence or non-existence of personal data concerning him / her, even if not yet recorded, and their communication in intelligible form

• The data subject has the right to obtain the indication: of the origin of personal data; of the purposes and methods of processing; of the logic applied in case of treatment carried out with the aid of electronic instruments; of the identification details of the data controller, of the responsible person and of the designated representative pursuant to art. 5 paragraph 2; of the subjects or categories of subjects to whom the personal data may be disclosed or who can learn about them as appointed representative or persons in charge in the territory of the State

• The data subject has the right to obtain: the updating, correction, or, in case of interest for this, the integration of data; the removal, the conversion into anonymous form or blocking of data processed unlawfully, including data whose retention is unnecessary for the purposes for which the data were collected or subsequently processed; the data subject also has the right to obtain the proof that the updating and correction operations have been brought to the attention, also with regard to their content, of those to whom the data have been disclosed or disseminated, except in the case where this fulfilment is found to be impossible or involves the use of resources clearly disproportionate to the protected right.

• The data subject has the right to object in whole or in part: on legitimate grounds, to the processing of personal data concerning him / her, even though they are relevant to the purpose of the collection, to the processing of personal data concerning him / her for the purpose of sending advertising or direct sales material or for carrying out market researches or commercial communication. In particular, the data subject may at any time request the Data Controller to access his / her personal data and to correct or delete them or limit their processing or to oppose their treatment, in addition to the right to data portability. The data subject has the right to withdraw the consent at any time without prejudice to the lawfulness of the treatment based on the consent given prior to the revocation and has the right to lodge a complaint with a supervisory authority

The exercise of the rights is not subject to any form constraint and can be exercised for free by writing to the e-mail address  privacy@sant-ambrogio.it

Last updated: 13/07/2018