DISCLOSURE ACCORDING TO ART. 13 OF THE EU REGULATION no. 2016/679
(General Data Protection Regulation)
1. Data processing incumbent
The Incumbent for data processing is Oesse S.r.l. (Registration number IT00632300935), represented by its pro tempore legal representative, with headquarters in Porcia, 81/83, via Maestri del Lavoro – www.oesse.com, hereafter referred to as “the Incumbent”.
The following paragraphs relate to the information from the Incumbent to the involved entities about the purposes and the procedure their data will be handled with.
2. Personal data management
Personal data (e.g.: personal records, telephone number, mail address, etc.) will be handled through computer systems or through computer or automated tools in compliance with the minimum safety limits, but to assure data integrity, safety and confidentiality.
3. Management purposes
The Incumbent will be handling your personal data for the following purposes:
6) Development of contractual and pre-contractual activities
7) Fiscal or legal obligations fulfilment
8) Development of customer satisfaction surveys and of service quality surveys
9) Promotional/commercial information dispatch
10) Information newsletters.
Personal data will be handled for purposes that are exclusively related and functional to the completion of the obligations connected to the previous paragraphs.
Your disclaimer will be the juridical fundament for data management according to GDPR art. 13, paragraph 1), letter c).
4. Disclaimer type
The release of your data for the purposes mentioned at paragraphs 1) and 2) of art. 3 does not need any formal disclaimer as this is a preparatory and vital process for any contractual or pre-contractual relationship.
Your disclaimer for the purposes mentioned at paragraphs 3), 4), 5) of art. 3 is an option and your express consent is needed. Should your consent be missing, consequences will exclusively be as follows: no dispatch of commercial and/or promotional information, of information newsletters and communication of your personal data for marketing purposes to third parties will be effected.
Should you release your express consent to grant the Incumbent the right to pursue the purposes in paragraphs 3), 4), 5) of art. 3, you will always be able to withdraw it by sending an informal plain notice to the mail address: gdpr@oesse.com. Upon receipt of your opt out request the Incumbent will promptly proceed to cancel and remove your data from all databases which are used for direct and indirect marketing operations and for newsletter dispatch. The Incumbent will provide by informing those third parties to whom your data might have been released about the cancellation. The mere receipt of your cancellation request will be automatically deemed as a confirmation of cancellation.
5. Addressee or personal data addressee type
Once you disclose your personal data for the above-mentioned purposes, they can be disclosed to the Incumbent employees and/or co-workers and they can be disclosed to the following entities:
c) Third companies the Incumbent might have appointed in order to provide the completion of the obligations the Incumbent might have entered into for the application of the handling measures mentioned in paragraphs 1) and 2) of art.3
d) All entities (Public Authorities included) entitled to access data for regulatory or administrative measures.
Any co-workers or suppliers the Incumbent might work with in order to handle your personal data have been adequately and legally authorized and empowered about the measures and purposes of the management of your data for the process they were entrusted to and they will operate in compliance with this disclosure.
The personal data you disclosed, for the above-mentioned purposes, can be transferred to commercial partners for the data management purposes mentioned in paragraphs 3), 4), 5) of art. 3.
Your disclosed personal data that have been subsequently handled for service management will not be disclosed.
6. Data storage time
Your personal data will be stored for the period stated in the regulation, which is mentioned in GDPR art. 13, paragraph 2, letter a):
4) For the purposes stated in paragraph 1), 2) of art.3 for the period stated by the applicable law which shall not be less than 10 (ten) years
5) For the purposes stated in paragraph 3), 5) of art.3 for a period of 2 (two) years from the time the disclaimer for data management was released
6) For the purposes stated in paragraph 4) of art.3 for a period of 1 (one) year from the time the disclaimer for data management was released.
7. Rights application of the entity concerned
According to GDPR articles 13, paragraph 2, letter b) and d), 15, 18, 19 and 21 the entity concerned will have the following rights:
g. Access to personal data: receipt of the confirmation that your data are being handled, in such event, access to the following information: purposes, data type, addressees, storage period, the right to complain to the regulatory authority, the right to ask for an amendment or cancellation or a limit to the management or opposition to data management as well as the existence of an automated-decision procedure
h. Requests for data amendment or cancellation or limit to the management of your data; “limit” means tagging the stored data in order to limit their management in the future
i. Opposition to handling operations: opposition to data management for purposes which are connected to your specific situation to carry out tasks relying within the public interest or in order to follow the incumbent legal interest
j. Data transferability: for automated management deriving from a disclaimer or from a contract execution, in order to receive your data under a structured format, commonly used and readable from automatic devices; you will receive your data directly from the incumbent under a .xml format
k. Disclaimer termination for direct or indirect marketing purposes, marketing researches and profiling operations; the right can be asserted without affecting lawfulness of any handling operation carried out before the disclaimer termination;
l. To lodge a complaint according to GDPR art. 77 with the legal regulatory authority according to your current domicile, workplace or where your rights were violated; the Italian data protection authority will be responsible for, contact data can be found within the following website address: //www.garanteprivacy.it.
You can assert the above-mentioned rights by sending your request to the Incumbent for data management through the contacts stated in art. 1 of this disclosure.
Your requests for rights assertion will be promptly dealt with, nevertheless within a month from your request; this deadline might be delayed by a further 2 (two) months owing to the request complexity and if requests quantity is relevant.
Please be informed that according to GDPR art. 21, should your personal data be handled for marketing purposes, you will have the right to complain at any time and that if you complain for data management, and your personal data will never be handled for this purpose.
Rights assertion will not be subject to any obligation and it is free of charge. Mail address for your assertion is gdpr@oesse.com.
