WHY WE PROVIDE THIS INFORMATION

Pursuant to Regulation (EU) 2016/679 (hereinafter the “Regulation”), this page describes how the following data are processed:

• the personal data of users who visit the website (hereinafter the “Website”) of COMMED I A S.r.l. (hereinafter the “Company”), accessible at https://www.commediasrl.it
• personal data entered or collected through the Company’s social media pages.

This information does not apply to other websites, pages or online services that may be accessed through hyperlinks published on the Website but relating to resources outside the Company’s domain.

WHO PROCESSES USERS’ DATA

DATA CONTROLLER

The Data Controller is:

COMMED I A S.r.l., with registered office in Lecce, 73100, Via di Pettorano 22, Tax Code and VAT No. 03485250751, e-mail [email protected], pec [email protected], telephone 0832 228509, fax 0832 220867.

DATA PROTECTION OFFICER

The Company has appointed a Data Protection Officer (DPO) to monitor compliance of processing activities with Italian and European data protection legislation.

The Data Protection Officer can be contacted at:

COMMED I A S.r.l. – Data Protection Officer, Via di Pettorano 22, Lecce, 73100, e-mail [email protected], pec [email protected].

LEGAL BASIS FOR PROCESSING

The Company will process personal data only where there is a lawful basis for doing so.

Data protection legislation provides that the processing of personal data is lawful only if and to the extent that at least one of the following conditions set out in Article 6 of the Regulation applies:

1. the data subject has given consent to the processing of their personal data for one or more specific purposes;
2. processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract;
3. processing is necessary for compliance with a legal obligation to which the Data Controller is subject;
4. processing is necessary in order to protect the vital interests of the data subject or of another natural person;
5. processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the Data Controller;
6. processing is necessary for the purposes of the legitimate interests pursued by the Data Controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject requiring the protection of personal data, in particular where the data subject is a child.

The legal basis for processing will therefore depend on the reasons for which the Company has collected and uses the data.

In certain cases, such as requests submitted through the contact section, processing is necessary in order to respond to the request received and is therefore based on the performance of a contract and/or pre-contractual measures. In other cases, processing may be necessary to comply with legal and/or regulatory obligations or to pursue a legitimate interest of the Company, which will be identified on a case-by-case basis. Where the data subject’s consent is required, such consent will be requested in accordance with applicable law.

TYPES OF DATA PROCESSED AND PURPOSES OF PROCESSING

Personal data means any information relating to a user through which that user may be identified. Personal data therefore includes, for example, first name, surname, contact details, telephone number, e-mail address, IP address and information relating to the user’s access to the Website.

Following use of the Website and of the services made available through it, the Company may collect users’ personal data through telephone communications to the contact details published on the Website, e-mails sent to the addresses listed on the Website, completion of forms available in the contact section, or through the use of social network plug-ins integrated into the Website.

The types of data processed may be classified as follows:

BROWSING DATA

The IT systems and software procedures used to operate the Website acquire, as part of their normal operation, certain personal data whose transmission is implicit in the use of Internet communication protocols.

Such information is not collected in order to be associated with identified data subjects but, by its very nature, could allow users to be identified through processing and association with data held by third parties.

This category includes IP addresses or domain names of the computers used by users connecting to the Website, URI/URL (Uniform Resource Identifier/Locator) addresses of requested resources, the time of the request, the method used to submit the request to the server, the size of the file received in response, the numerical code indicating the status of the server response (successful, error, etc.) and other parameters relating to the user’s operating system and IT environment.

Such data, which are necessary for the provision of web services, are also processed for the purposes of:

• obtaining statistical information on the use of services, such as the most visited pages, number of visitors by time or day, geographical areas of origin, etc.;
• monitoring the proper functioning of the services provided;
• identifying anomalies and/or misuse.

Browsing data are retained for no longer than seven days, except where a longer retention period is required for the investigation of criminal offences by the Judicial Authorities.

PERSONAL DATA VOLUNTARILY PROVIDED BY USERS

The optional, explicit and voluntary sending of messages to the Company’s contact addresses, private messages sent by users to the Company’s official social media profiles/pages, where this option is available, as well as the completion and submission of forms available on the Company’s Website, result in the acquisition of the sender’s contact details, which are necessary in order to respond, together with any other personal data included in the communication.

Specific privacy notices will be provided on Website pages dedicated to particular services.

CONSEQUENCES OF FAILURE TO PROVIDE DATA

Failure to provide data necessary to respond to a request may make it impossible for the Company to provide a complete response or to deliver the requested services.

Where appropriate, the Company will inform the user on a case-by-case basis whether the provision of personal data is mandatory or optional, for example in relation to a specific request.

In particular, mandatory or optional fields will be clearly identified by means of a notice or appropriate indication.

RECIPIENTS OF PERSONAL DATA

The recipients of personal data include Company personnel acting on the basis of specific instructions regarding the purposes and methods of processing.

Recipients also include parties appointed by the Company as Data Processors pursuant to Article 28 of the Regulation in connection with data collected through the Website.

Where social media plug-ins available on the Website are used, data may be shared with the relevant social media service and, where applicable, with the user’s social media profile. In such cases, users are invited to refer to the privacy notices published by the relevant social media providers.

In any event, personal data processed by the Company will not be publicly disclosed.

This is without prejudice to disclosures or dissemination required by law at the request of law enforcement authorities, Judicial Authorities, intelligence and security bodies, or other public authorities for purposes of national defence or security or for the prevention, investigation or prosecution of criminal offences.

METHODS AND SECURITY OF PROCESSING

Personal data will be processed:

• using manual, IT and electronic tools in a manner designed to ensure their availability, integrity and confidentiality;
• according to organisational procedures and logic strictly related to the purposes set out above and in compliance with the principle of data minimisation;
• by specifically appointed, identified and authorised individuals who have received appropriate instructions and have been informed of the obligations imposed by applicable legislation;
• using appropriate technical and organisational security measures designed to prevent and/or reduce the risks of unlawful access, destruction or loss of personal data.

PLACE OF PROCESSING

Personal data will be managed and stored in Italy and, in any event, within the European Union.

The servers currently used by the Company are located within the European territory.

Personal data are not currently transferred outside the European Union.

However, should the Company consider it necessary and/or appropriate, it may relocate servers within Italy, the European Union and/or countries outside the EU. In such cases, the Company will ensure that any transfer of personal data outside the EU is carried out in compliance with applicable law, entering into agreements that guarantee an adequate level of protection where necessary and/or adopting the Standard Contractual Clauses approved by the European Commission and/or otherwise complying with the requirements of applicable legislation.

DATA RETENTION

Data collected through the Website during registration will be used exclusively for the purposes indicated and retained only for as long as strictly necessary for the Company’s activities.

Personal data will not be retained for longer than necessary to fulfil the purposes for which they were processed. In determining the appropriate retention period, the Company will take into account the amount, nature and sensitivity of the personal data, the purposes for which they are processed and whether those purposes may be achieved by other means.

Data collected through the Website will therefore be retained for the period required to respond to requests and, where applicable, following the conclusion of the relevant relationship, for as long as necessary to fulfil contractual, pre-contractual, administrative or legal obligations arising from or connected with such relationship, or for the period permitted under Italian law for the protection of the Company’s legitimate interests.

RIGHTS OF DATA SUBJECTS

Where provided for by law, data subjects have the right to obtain from the Company access to their personal data and the rectification or erasure of such data, restriction of processing, to object to processing and to request data portability.

Data subjects may also withdraw their consent at any time, where processing is based on consent (see Articles 15 et seq. of the Regulation).

Requests to exercise these rights may be submitted to the Company by contacting the Data Protection Officer using the contact details provided above.

Data subjects who believe that the processing of personal data relating to them through the Website infringes the Regulation have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali) pursuant to Article 77 of the Regulation, or to seek an effective judicial remedy before the competent courts pursuant to Article 79 of the Regulation.

CHANGES AND UPDATES TO THIS PRIVACY POLICY

The Company may amend or update this Privacy Notice, in whole or in part, including as a result of changes to applicable legislation and/or regulations.

The Company undertakes not to restrict any rights previously granted without first obtaining the data subject’s explicit consent where such consent is legally required.

Any changes and updates will be made available on the Website homepage. Material changes will be highlighted through a more prominent notice, for example, where the services provided and the data collected allow it, by means of an e-mail notification.