PRIVACY POLICY
COOKIE POLICY
CONTACT FORM NOTICE
NEWSLETTER NOTICE
CORPORATE EMAIL NOTICE
WORK WITH US NOTICE
REGISTER NOW NOTICE
PROCEDURE FOR MANAGING DATA SUBJECT RIGHTS REQUESTS

Privacy Policy Notice

INTRODUCTION

This page describes how the site https://www.roncucciandpartners.com/ is managed with regard to the processing of personal data of users who consult it. This is the notice provided pursuant to Article 13 of European Regulation 2016/679 to those who interact with the company’s web services.

The notice identifies certain minimum requirements for the collection of personal data online and, in particular, the methods, timing, and nature of the information that data controllers must provide to users when they connect to web pages, regardless of the purpose of the connection.

THE DATA CONTROLLER

The data controller is Roncucci&Partners Srl with registered office at via A.Alessandrini,26 – 400126 Bologna, VAT No. 02156431203, email info@roncucciandpartners.com.

PLACE OF DATA PROCESSING

The processing connected to the web services of this site takes place at the registered office and is handled only by technical personnel of the Office responsible for processing, or by any persons responsible for occasional maintenance operations. No data derived from the web service is communicated or disseminated. Personal data provided by users who send requests for informational material are used solely to perform the requested service or provision.

TYPES OF DATA PROCESSED

  • Browsing data: the IT systems and software procedures used to operate this website acquire, during their normal operation, certain personal data whose transmission is implicit in the use of Internet communication protocols. This is information that is not collected to be associated with identified data subjects, but which by its very nature could, through processing and association with data held by third parties, allow users to be identified. This category of data includes IP addresses or domain names of computers used by users connecting to the site, URI (Uniform Resource Identifier) addresses of requested resources, the time of the request, the method used to submit the request to the server, the size of the file obtained in response, the numerical code indicating the status of the response given by the server (success, error, etc.), and other parameters relating to the user’s operating system and IT environment. These data are used solely to obtain anonymous statistical information on site usage and to check its correct functioning, and are deleted immediately after processing. The data could be used to ascertain responsibility in the event of hypothetical computer crimes against the site: except for this eventuality, at present the data on web contacts do not persist for more than seven days.
  • Data voluntarily provided by the user: the optional, explicit, and voluntary sending of email to the addresses indicated on this site entails the subsequent acquisition of the sender’s address, necessary to respond to requests, as well as any other personal data included in the message. Specific summary notices will be progressively reported or displayed on the pages of the site prepared for particular services on request.

USE OF COOKIES

Regarding the methods of using cookies, please refer to the additional and specific “extended notice” (see 03I_PR-12.4-02 Cookie Policy Roncucci&Partners) published on this site and prepared based on the provisions of the Provision of May 8, 2014 issued by the Italian Data Protection Authority as amended by Provision No. 231 of June 2021, which supplements and completes this document.

OPTIONAL NATURE OF DATA PROVISION

Apart from what is specified for browsing data, the user is free to provide personal data or not. Failure to provide it may result in the inability to obtain what is requested.

METHOD OF PROCESSING

Personal data are processed using automated tools for the time strictly necessary to achieve the purposes for which they were collected. Specific security measures are observed to prevent data loss, unlawful or incorrect use, and unauthorized access.

TRANSFERS TO THIRD COUNTRIES

Personal data may be transferred to foreign countries within the European Union or outside the EU and transmitted to private companies and institutional bodies for purposes related to the requested services and for territorial jurisdiction needs. Data are sent for cross-border processing according to the principles of necessity, limited to strictly necessary information. Data transfer takes place exclusively under the following conditions:

  • Countries covered by adequacy decisions pursuant to Article 45 GDPR 679/16 EU;
  • in the absence of adequacy decisions, processing, with reference to Article 46 GDPR 678/16 EU, takes place following agreement with the data recipient in compliance with standard contractual clauses and binding corporate rules in accordance with Article 47; standard data protection clauses adopted by the Commission according to the examination procedure referred to in Article 93, paragraph 2;
  • in the absence of adequate safeguards, the data controller, pursuant to Article 49 GDPR 679/16 EU, if the transfer is necessary to fulfill contractual and/or legal obligations, communicates the data by implementing all technical-organizational security measures such as, where possible, minimization, pseudonymization of data, verification of the recipient’s reliability.

DATA SUBJECT RIGHTS

The individuals to whom the personal data refer have the right at any time to request access to the data and their rectification, erasure, restriction of processing, the right to object to their processing, as well as the right to data portability; they also have the right to lodge a complaint with the supervisory authority.

Requests should be addressed to the data controller

CONTACT DETAILS:

This constitutes the “Privacy Policy” of this site, which will be subject to updates.

Cookie Notice

INTRODUCTION

This Cookie Policy has been drafted and customized specifically for the site www.roncucciandpartners.com owned by Roncucci&Partners Srl with registered office at via A.Alessandrini,26 – 400126 Bologna, VAT No. 02156431203, email info@roncucciandpartners.com. This Policy has been drafted on the basis of the provision of the Data Protection Authority No. 229 of May 8, 2014 “Identification of simplified methods for information and acquisition of consent for the use of cookies” and the New Provision No. 231 of June 10, 2021 “Guidelines on cookies and other tracking tools.” It supplements and updates other notices already present on the site and/or previously issued by the company, in combination with which it provides all the elements required by Article 13 of EU Regulation 2016/679.

IMPORTANT WARNING

All third parties are informed that the use of this notice, or even just parts of it, on other websites in reference to which it would certainly be irrelevant and/or incorrect and/or inconsistent, may result in the imposition of heavy penalties by the Data Protection Authority.

WHAT COOKIES ARE

In practical and non-technical terms, a cookie can be considered a tracking system consisting of a small file, stored by the website on the user’s browsing device, used with the objective of saving preferences expressed during browsing and improving website performance, optimizing the browsing experience.

In technical terms, cookies are defined as text strings (generally formed by the combination of letters and numbers) that websites (so-called first parties) visited by the user or different sites/web servers (so-called third parties) place and store, directly and/or indirectly, within a terminal device (PC, tablet, smartphone, etc.) that is available to the user. Servers for internet browsing or for device operation can store cookies and then retransmit them to the same sites that generated them, in view of a subsequent visit by the same user. Specifically, these tracking tools allow the site to recognize a particular device or browser.

TYPES OF COOKIES AND RELATED PURPOSES

Cookies can be classified into:

  • Technical cookies used solely for the purpose of carrying out the transmission of a communication over an electronic communications network, or to the extent strictly necessary for the provider of an information society service explicitly requested by the subscriber or user to provide such service as provided by Article 122, paragraph 1 of the Privacy Code. These types of cookies do not require the acquisition of consent from the user but must be indicated in the cookie policy.
  • Profiling cookies used to trace specific actions or behavioral patterns to specific individuals, identified or identifiable, in order to allow the controller to modulate the provision of the service in a more personalized way and send advertising messages in line with the preferences expressed by the user during browsing.
  • Analytics cookies installed on the user’s terminal by managers of the visited site or third-party sites. Third-party cookies, mainly for analytical purposes, derive mostly from Google Analytics functionalities. More information about Google Analytics can be obtained by clicking on the following link: http://www.google.it/intl/it/analytics. In any case, cookies do not allow the identification of the data subject and are intended to refer to the individual device or individual application in order to avoid tracking the user’s browsing data. Analytics cookies can be treated like technical cookies, and therefore without user consent, when the following conditions are met:
    • Use is limited to the production of aggregate statistics usable in relation to the site visited by the user;
    • With regard to so-called third-party analytics cookies, the fourth part of the tracked IP address must be masked;
    • With regard to so-called third-party analytics cookies, the third party must be prevented from using analytics cookies in combination with other processing or transmitting them to further third parties.

APPLICABLE REGULATIONS

For the use of cookies and other technical tracking tools, the data controller is subject only to the obligation to provide specific information to the data subject. With regard to cookies and other tracking tools for purposes other than technical ones, use is permitted exclusively upon acquisition of the informed consent of the user, which must be expressed by an unambiguous act pursuant to Recital 32.

CONSENT ACQUISITION MECHANISM

The data controller ensures the consent acquisition mechanism through the presentation of a banner upon the user’s first access to the site.

The banner contains:

  • Information on the site’s use of technical cookies with a link to the privacy policy and cookie policy.
  • Button that allows consent to be accepted.
  • Button that allows consent to be denied.
  • Button that allows cookie settings/preferences to be configured. The latter leads to a further band where it is possible to select and customize “privacy settings.”

In the event that the user does not consent to the use of cookies and other tracking tools and in the event that the user has chosen to give consent only for the use of certain cookies, the choice is recorded and no longer solicited, except in the following cases:

  • when one or more conditions of processing change significantly
  • when it is impossible for the site manager to know whether a cookie has already been stored on the device
  • when at least 6 months have elapsed since the previous presentation of the banner.

COOKIES USED – RETENTION TIMES – PURPOSES – TRANSFER OF DATA TO THIRD PARTIES

Cookie names Type of cookie First or Third party Can be blocked Session or Persistent Expiry Time Purpose

BROWSER SETTINGS

We also inform you that the user can configure, freely and at any time, their privacy parameters in relation to the installation and use of cookies, directly through their browsing program (browser) by following the relevant instructions.

In particular, the user can set so-called “private browsing,” thanks to which their browsing program stops saving the history of visited sites, any passwords entered, cookies, and other information about visited pages.

We warn that if the user decides to disable all cookies (including technical ones), the quality and speed of the services offered by this website may deteriorate drastically and access to some sections of the site itself may be lost.

DATA SUBJECT RIGHTS

We inform you that as a data subject you have the right to exercise the following rights:

Right of access pursuant to Article 15 of EU Reg. 2016/679, the data subject has the right to confirmation as to whether or not processing of personal data concerning them is underway and, if so, can obtain, among other things, access to their personal data and information concerning the purposes of processing, the categories of personal data in question, the recipients or categories of recipients to whom the personal data have been or will be communicated.

Right to rectification pursuant to Article 16 of the Regulation:

  • rectification of inaccurate personal data concerning you without undue delay
  • completion of your personal data, if incomplete.

Right to erasure (“right to be forgotten”) pursuant to Article 17 of the Regulation: erasure of personal data concerning you without undue delay

Right to restriction of processing pursuant to Article 18 of the Regulation: restriction of processing in the following cases:

  • the data subject contests the accuracy of the personal data, for the period necessary for the data controller to verify the accuracy of such personal data;
  • the processing is unlawful and the data subject opposes the erasure of the personal data and requests instead the restriction of their use;
  • although the data controller no longer needs it for processing purposes, the personal data are necessary for the data subject for the establishment, exercise, or defense of legal claims;
  • the data subject has objected to processing pursuant to Article 21, paragraph 1, pending verification as to whether the legitimate grounds of the controller override those of the data subject

Right to data portability pursuant to Article 20 of the Regulation: it is possible to receive in a structured, commonly used, and machine-readable format the personal data concerning you in our possession;

Right to transmit such data to another controller without hindrance from the controller to which they have been provided in the cases referred to in Article 20 of the Regulation.

Right to object for processing carried out pursuant to Article 6, paragraph 1, letters e) or f) and pursuant to Article 21 of the Regulation: objection, at any time, on grounds relating to your particular situation, to the processing of personal data concerning you, including profiling.

The above requests may be addressed to the data controller.

The data controller is Roncucci&Partners Srl with registered office at via A.Alessandrini,26 – 400126 Bologna, VAT No. 02156431203, email info@roncucciandpartners.com

Requests may be sent via:

  • a registered letter with return receipt to Roncucci&Partners Srl via A.Alessandrini,26 – 400126 Bologna
  • email to info@roncucciandpartners.com

Furthermore, if you believe that the processing has been carried out in violation of personal data protection regulations, you have the right to lodge a complaint with the Data Protection Authority, Piazza Venezia, 11 – 00187 – Rome.

 

Contact Form Notice

INTRODUCTION

Pursuant to Article 13 of Regulation (EU) 2016/679, Roncucci&Partners Srl with registered office at via A.Alessandrini,26 – 400126 Bologna, VAT No. 02156431203, email info@roncucciandpartners.com, as data controller, informs users of the processing of personal data resulting from completion of the contact form.

DATA CONTROLLER

The data controller is Roncucci&Partners Srl with registered office at via A.Alessandrini,26 – 400126 Bologna, VAT No. 02156431203, email info@roncucciandpartners.com

DATA SUBJECTS

Users of internet services interested in contacting the data controller and registering via the contact form.

DATA PROCESSED

The data processed are those entered in the contact form, namely identifying data such as name, surname, and company, and contact data such as personal email. The data collected are only those strictly necessary for the requested fulfillment, with the controller respecting the principle of minimization established by Article 5 of the European Regulation.

The data provided will be processed by the controller in order to contact the user as requested by the user to the data controller.

PURPOSE OF PROCESSING

The personal data entered in the registration form, sent by the user’s choice and voluntarily, will be used to respond to the requests submitted by the user or to fulfill the contact requested by the form itself. The IT systems of this process involve the use of email configured in a manner that guarantees the confidentiality and integrity of information.

NATURE OF PROVISION AND LEGAL BASIS OF PROCESSING

The provision of data is mandatory to respond to the user’s request; the legal basis of processing is found in Article 6, letter b) of EU Reg. 679/2016, the performance of pre-contractual measures adopted at the request of the data subject.

METHOD OF PROCESSING

Data processing is carried out through IT procedures or in any case by electronic means and paper supports by internal or external persons specifically appointed and authorized for this purpose and committed to confidentiality. Data are processed and stored with tools suitable to ensure their security, integrity, and confidentiality through the adoption of adequate security measures as required by regulations.

RETENTION PERIOD

Data will be retained for 2 years from transmission of the contact request.

COMMUNICATION, DISSEMINATION, TRANSFER

The data collected will not be disseminated, sold, or exchanged with third parties without the express consent of the data subject, except for any communications to authorized third parties—committed to confidentiality or, if appointed as data processors pursuant to Article 28 of Regulation (EU) 2016/679. The complete and updated list of data processors is available, upon request, through the methods indicated in this notice. Data may be communicated to competent authorities, according to legal terms.

Personal data may be transferred to foreign countries within the European Union or outside the EU and transmitted to private companies and institutional bodies for purposes related to the requested services and for territorial jurisdiction needs. Data are sent for cross-border processing according to the principles of necessity, limited to strictly necessary information. Data transfer takes place exclusively under the following conditions:

  • Countries covered by adequacy decisions pursuant to Article 45 GDPR 679/16 EU;
  • in the absence of adequacy decisions, processing, with reference to Article 46 GDPR 678/16 EU, takes place following agreement with the data recipient in compliance with standard contractual clauses and binding corporate rules in accordance with Article 47; standard data protection clauses adopted by the Commission according to the examination procedure referred to in Article 93, paragraph 2;
  • in the absence of adequate safeguards, the data controller, pursuant to Article 49 GDPR 679/16 EU, if the transfer is necessary to fulfill contractual and/or legal obligations, communicates the data by implementing all technical-organizational security measures such as, where possible, minimization, pseudonymization of data, verification of the recipient’s reliability.

DATA SUBJECT RIGHTS

At any time, data subjects have the right to access their personal data, to request their rectification, updating, and erasure. It is also possible to object to processing and request its restriction.

The above requests may be addressed to Roncucci&Partners Srl with registered office at via A.Alessandrini,26 – 400126 Bologna, VAT No. 02156431203, email info@roncucciandpartners.com. Furthermore, if you believe that the processing has been carried out in violation of personal data protection regulations, you have the right to lodge a complaint with the Data Protection Authority, Piazza Venezia, 11 – 00187 – Rome.

Newsletter Registration Form Notice

INTRODUCTION

Pursuant to Article 13 of Regulation (EU) 2016/679, Roncucci&Partners Srl with registered office at via A.Alessandrini,26 – 400126 Bologna, VAT No. 02156431203, email info@roncucciandpartners.com, informs users of the processing of personal data resulting from newsletter registration.

DATA CONTROLLER

The data controller is Roncucci&Partners Srl with registered office at via A.Alessandrini,26 – 400126 Bologna, VAT No. 02156431203, email info@roncucciandpartners.com

DATA SUBJECTS

Users of internet services interested in newsletter registration

DATA PROCESSED

The data processed are personal identifying data such as name and surname, and contact data such as institutional email address necessary for sending regulatory updates.

PURPOSE OF PROCESSING

The purpose of processing is to receive regulatory updates regarding products and services offered by the data controller.

NATURE OF PROVISION AND LEGAL BASIS OF PROCESSING

The provision of data is optional. Any refusal to provide data does not entail negative consequences but results in the impossibility for the data controller to proceed with requests to send the newsletter. The legal basis of processing is found in the legitimate interest of the data controller, pursuant to Article 6, letter f) of EU Reg. 679/2016. Consent is considered given by checking the appropriate boxes at the bottom of the online form. Consent is always revocable.

METHOD OF PROCESSING

Data processing is carried out through IT procedures or electronic means and paper supports by internal or external persons specifically appointed, authorized, and committed to confidentiality. Data are processed and stored with tools suitable to ensure their security, integrity, and confidentiality through the adoption of adequate measures as required by regulations.

RETENTION PERIOD

Data will be retained in a form that allows identification of the data subject for two years from registration, without prejudice to the fact that upon revocation using the opt-out technique, the data controller will proceed to delete your data.

COMMUNICATION, DISSEMINATION, TRANSFER

The data collected will not be disseminated, sold, or exchanged with third parties without the express consent of the data subject, except for any communications to authorized third parties—committed to confidentiality or, if appointed as data processors pursuant to Article 28 of Regulation (EU) 2016/679. The complete and updated list of data processors is available, upon request, through the methods indicated in this notice. Data may be communicated to competent authorities, according to legal terms.

Transfer of data outside the European Union is not envisaged.

Data are sent for cross-border processing according to the principles of necessity, limited to strictly necessary information. Data transfer takes place exclusively under the following conditions:

– Countries covered by adequacy decisions pursuant to Article 45 GDPR 679/16 EU;

– in the absence of adequacy decisions, processing, with reference to Article 46 GDPR 678/16 EU, takes place following agreement with the data recipient in compliance with standard contractual clauses and binding corporate rules in accordance with Article 47; standard data protection clauses adopted by the Commission according to the examination procedure referred to in Article 93, paragraph 2;

– in the absence of adequate safeguards, the data controller, pursuant to Article 49 GDPR 679/16 EU, if the transfer is necessary to fulfill contractual and/or legal obligations, communicates the data by implementing all technical-organizational security measures such as, where possible, minimization, pseudonymization of data, verification of the recipient’s reliability.

DATA SUBJECT RIGHTS

At any time, data subjects have: the right to access their personal data, to request their rectification, updating, and erasure. It is also possible to object to processing and request its restriction.

The above requests may be addressed to Roncucci&Partners Srl with registered office at via A.Alessandrini,26 – 400126 Bologna, VAT No. 02156431203, email info@roncucciandpartners.com

Furthermore, if you believe that the processing has been carried out in violation of personal data protection regulations, you have the right to lodge a complaint with the Data Protection Authority, Piazza Venezia, 11 – 00187 – Rome.

CONSENT STATEMENT FOR NEWSLETTER REGISTRATION

The undersigned declares their specific consent for the processing of contact personal data (personal email) which may be processed by Roncucci&Partners Srl, as data controller, through newsletter registration.

Corporate Email Notice

The content of emails is to be considered confidential. Therefore, the information contained in them or in any attachments is reserved exclusively for the recipients. Persons or entities other than the recipients themselves, also pursuant to Article 616 of the Criminal Code, are not authorized to read, copy, modify, or disseminate the message to third parties. Anyone who receives our communication by mistake should not use it or bring it to anyone’s attention, but should delete it from their mailbox and notify the sender. The authenticity of the sender and the contents are not guaranteed, except for digitally signed documents.

All email boxes of the domain “[…]@complifegroup.com” are corporate mailboxes and, as such, are used for work-related communications. At any time, data subjects have the right to access their personal data, to request their rectification, updating, and erasure. It is also possible to object to processing and request its restriction.

Furthermore, if you believe that the processing has been carried out in violation of personal data protection regulations, you have the right to lodge a complaint with the Data Protection Authority, Piazza Venezia, 11 – 00187 – Rome.

Work With Us Notice

INTRODUCTION

Roncucci&Partners Srl with registered office at via A.Alessandrini,26 – 400126 Bologna, VAT No. 02156431203, email info@roncucciandpartners.com, as data controller pursuant to Articles 4 and 13 of EU Regulation 2016/679, informs you that it will process your personal data manually and/or with the support of IT means exclusively to evaluate your application for the purpose of a possible future establishment of an employment relationship with the company. We invite you to include in your CV only information relevant to the position for which you intend to apply, and which is not strictly personal and private in nature.

TYPE OF DATA

The data subject to processing are:

  • identifying data such as name and surname
  • contact data such as personal email and any other information contained in the attached curriculum vitae. These include information relating to:
  1. educational qualifications, professional experience, skills, abilities, and competencies essential to fill the role you have chosen or for any position we deem appropriate to offer you;
  2. the controller may also process special data pursuant to Article 9 of EU Regulation 679/2016 relating to you for purposes strictly necessary for recruitment if it is essential for the procedure itself.

PURPOSE OF PROCESSING

Your data will be processed for the purpose of carrying out personnel selection activities. Processing is necessary to respond to your application or to offer you, at a later time, a new proposal if your profile is deemed suitable for our needs.

LEGAL BASIS OF PROCESSING

The legal basis for data processing is represented by the fulfillment of pre-contractual obligations as identified by Article 6, letter b) of the EU Regulation, as well as by the legitimate interest of the data controller

DATA RECIPIENTS

Data may be disclosed to employees and collaborators of the controller who may process your data in compliance with the instructions given by the controller itself.

Your personal data may be processed by third parties who collaborate with the controller for the same purposes. Such parties may, depending on the case, operate as independent data controllers or as specifically appointed data processors.

DATA TRANSFER

Personal data are not transferred to foreign countries within the European Union or outside the EU.

DATA RETENTION

The personal data you provide will be retained for the time strictly necessary to pursue the purposes highlighted and in any case for a period not exceeding 24 months: at the expiry of this term, your data will be deleted.

DATA SUBJECT RIGHTS

Pursuant to Articles 13, paragraph 2, and 15 to 21 of the Regulation, we inform you that with regard to the processing of your personal data you may exercise the following rights:

  1. Right to obtain access to personal data and the following information:
  • confirmation as to whether or not processing of your personal data is underway;
  • the purposes of processing;
  • the categories of personal data;
  • the recipients or categories of recipients to whom the personal data have been or will be communicated;
  • where the data are not collected from the data subject, all available information about their origin;
  • the existence of automated decision-making, including profiling;
  • a copy of the personal data undergoing processing.
  1. Right to rectification and completion of personal data;
  2. Right to erasure of data (“right to be forgotten”) if one of the following reasons exists:
  • the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;
  • the data subject withdraws consent to data processing and there is no other legal basis for processing;
  • the data subject objects to processing and there is no overriding legitimate reason to proceed with processing;
  • the personal data have been processed unlawfully;
  • the personal data must be erased to comply with a legal obligation under Union or Member State law to which the controller is subject.

The data controller, if they have made personal data public and are obliged to erase it, must inform other controllers processing the personal data of the request to erase any link to, copy, or replication of such data.

  1. Right to restriction of processing in the event that:
  • the data subject contests the accuracy of the personal data, for the period necessary for the data controller to verify the accuracy of such personal data;
  • the processing is unlawful and the data subject opposes the erasure of the personal data and requests instead that its use be restricted;
  • although the data controller no longer needs it for the purposes of processing, the personal data is required by the data subject for the establishment, exercise, or defense of a legal claim;
  • the data subject has objected to the processing, pending verification as to whether the legitimate grounds of the data controller override those of the data subject.
  1. Right to lodge a complaint with the Data Protection Authority, following the procedures and instructions published on the Authority’s official website garanteprivacy.it.
  2. Right to data portability, meaning the data subject’s right to receive the personal data concerning them, which they have provided to a data controller, in a structured, commonly used, and machine-readable format, and potentially transmit it to another data controller, provided the processing is based on consent or a contract and is carried out by automated means. Where technically feasible, the data subject has the right to have the data transmitted directly from one data controller to another.
  3. Right to object at any time to the processing of personal data, including profiling, particularly in the event that:
  • the processing is based on the legitimate interest of the controller, following an explanation of the reasons for the objection;
  • personal data is processed for direct marketing purposes.
  1. Right not to be subject to a decision based solely on automated processing, including profiling, except in cases where the decision: is necessary for entering into or performing a contract between the data subject and a data controller, is authorized by Union or Member State law to which the data controller is subject, or is based on the data subject’s explicit consent.

The exercise of rights is not subject to any formal constraints and is free of charge.

DATA CONTROLLER

The Data Controller is Roncucci&Partners Srl with registered office in via A. Alessandrini, 26 – 40126 Bologna, VAT no. 02156431203, e-mail info@roncucciandpartners.com

PROCEDURES FOR EXERCISING RIGHTS

The data subject may exercise their rights at any time by sending:

  • registered mail with return receipt to Roncucci&Partners Srl via A. Alessandrini, 26 – 40126 Bologna
  • an e-mail to the address info@roncucciandpartners.com

Register Now Information Notice

INTRODUCTION

Pursuant to Art. 13 of Regulation (EU) 2016/679, Roncucci&Partners Srl with registered office in via A. Alessandrini, 26 – 40126 Bologna, VAT no. 02156431203, e-mail info@roncucciandpartners.com, in its capacity as Data Controller, informs users of the processing of personal data resulting from filling out the Register Now section.

DATA CONTROLLER

The Data Controller is Roncucci&Partners Srl with registered office in via A. Alessandrini, 26 – 40126 Bologna, VAT no. 02156431203, e-mail info@roncucciandpartners.com

DATA SUBJECTS

Internet service users interested in contacting the Data Controller and the relative registration in the Register Now section.

DATA PROCESSED

The data processed includes identification data such as name, surname, and Company, and contact data such as personal email. The data collected is only that which is strictly necessary for the requested fulfillment, with the controller respecting the principle of minimization established by Art. 5 of the European Regulation.

The data provided will be processed by the controller in order to contact the user as per the request submitted to the data controller.

PURPOSES OF PROCESSING

The personal data entered in the registration form, sent by the user’s choice and voluntarily, will be used to respond to requests submitted by the user for registration for events organized by Roncucci&Partners Srl. The IT systems of this process involve the use of email configured in a way that guarantees the confidentiality and integrity of the information.

NATURE OF PROVISION AND LEGAL BASIS FOR PROCESSING

The provision of data is optional. The legal basis for processing is found in Art. 6 letter a) of EU Reg. 679/2016, namely in the freely expressed consent which is revocable at any time.

PROCESSING METHODS

Data processing is carried out through computer procedures or electronic means and paper supports by internal or external subjects specifically appointed and authorized for this purpose and committed to confidentiality. Data is processed and stored with tools suitable to guarantee its security, integrity, and confidentiality through the adoption of adequate security measures as provided by the regulations.

RETENTION PERIOD

The data will be kept until consent is revoked by the data subject and in any case for a maximum period of 24 months.

COMMUNICATION, DISSEMINATION, TRANSFER

The collected data will not be disseminated, sold, or exchanged with third parties without the express consent of the data subject, except for any communications to authorized third parties committed to confidentiality or, if applicable, appointed as data processors pursuant to Art. 28 of Regulation (EU) 2016/679. The complete and updated list of data processors is available, upon request, through the methods indicated in this information notice. Data may be communicated to the competent authorities according to the terms of the law.

Personal data may be transferred to foreign countries within the European Union or outside the EU and transmitted to private companies and institutional bodies for purposes related to the requested services and for territorial jurisdiction needs. Data is sent for cross-border processing, according to the principles of necessity, limited to strictly necessary information. Data transfer takes place exclusively under the following conditions:

– Countries covered by adequacy decisions pursuant to Art. 45 GDPR 679/16 EU;

– in the absence of adequacy decisions, processing, with reference to Art. 46 GDPR 679/16 EU, takes place following an agreement with the data recipient in compliance with binding corporate rules and clauses in accordance with Article 47; standard data protection clauses adopted by the Commission according to the examination procedure referred to in Article 93, paragraph 2;

– in the absence of adequate safeguards, the Data Controller, pursuant to Art. 49 GDPR 679/16 EU, if the transfer is necessary to fulfill contractual and/or legal obligations, communicates the data by preparing all technical-organizational security measures such as, where possible, minimization, pseudonymization of data, and verification of the recipient’s reliability.

RIGHTS OF DATA SUBJECTS

At any time, data subjects have the right to access their personal data, to request its rectification, updating, and relative erasure. It is also possible to object to the processing and request its restriction.

The aforementioned requests may be addressed to Roncucci&Partners Srl with registered office in via A. Alessandrini, 26 – 40126 Bologna, VAT no. 02156431203, e-mail info@roncucciandpartners.com. Furthermore, in the event that it is believed that the processing has been carried out in violation of the regulations on the protection of personal data, the right to lodge a complaint with the Data Protection Authority, Piazza Venezia, 11 – 00187 – Rome, is recognized.

DECLARATION OF CONSENT FOR EVENT REGISTRATION

The undersigned declares their specific consent for the processing of the personal data entered, which may be processed by Roncucci&Partners Srl, in its capacity as Data Controller, through registration for organized events.

Procedure for managing requests for the exercise of data subjects’ rights

INTRODUCTION

PURPOSE

The purpose of this procedure is to define the tasks, responsibilities, and operational methods to be adopted when a request is submitted to the Data Controller by data subjects for the exercise of rights regarding the processing of personal data carried out by or on behalf of Roncucci&Partners Srl.

The procedure applies:

  • to all workers of Roncucci&Partners Srl, regardless of whether they are employees or collaborators;
  • to requests relating to all categories of data, regardless of whether they are common or special;
  • to requests from any data subject, regardless of the category they belong to (such as employees/collaborators, subjects of video surveillance footage, website users/visitors).

REGULATORY REFERENCES

  • Legislative Decree no. 196/2003 and subsequent amendments and additions (Privacy Code);
  • Regulation (EU) 2016/679 (GDPR).

ACRONYMS AND DEFINITIONS USED

GDPR EU Regulation 2016/679 (General Data Protection Regulation).
Code Legislative Decree 196/2003 Code regarding the protection of personal data as amended by Legislative Decree 101/2018.
Supervisory Authority Garante per la protezione dei dati personali (Data Protection Authority).
Data Controller Roncucci&Partners Srl
Data Processor External subject who processes personal data on behalf of the Controller (Art. 28 of the GDPR).
Contact Person Internal subject appointed for the management of requests for the exercise of rights regarding personal data protection.
Personal data Any information relating to an identified or identifiable natural person (data subject); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person.
Processing Any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
Data subject The identified or identifiable natural person to whom the personal data refers.

RIGHTS OF DATA SUBJECTS

Data subjects may exercise, pursuant to Art. 15 et seq. of the GDPR, with reference to their personal data held by Roncucci&Partners Srl, the following rights:

Art. 15 – Right of access

Recitals 63, 64

The data subject has the right to obtain, at any time, from the Data Controller, confirmation as to whether or not personal data concerning them is being processed to allow them to verify the lawfulness of the processing. The data subject has the right to request access to the following information: the purposes of the processing; the categories of personal data concerned; the recipients or categories of recipients to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organizations; where possible, the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period; the existence of the right of the data subject to request from the controller rectification or erasure of personal data or restriction of processing of personal data concerning the data subject or to object to such processing; the right to lodge a complaint with a supervisory authority; where the data are not collected from the data subject, any available information as to their origin; the existence of automated decision-making, including profiling, referred to in Article 22(1) and (4) and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject.

The right of access also allows the data subject to request a copy of their personal data undergoing processing.

The data controller should take all reasonable measures to verify the identity of a data subject who requests access.
Art. 16 – Right to rectification

Recital 65

 The data subject has the right to obtain from the data controller the rectification of inaccurate personal data concerning them without undue delay. The data subject may also exercise this right when the data are incomplete, by providing a supplementary statement.
Art. 17 – Right to erasure

(“right to be forgotten”)

Recitals 15, 16, 17, 18, 19, 20, 21

 The data subject has the right to obtain from the data controller the erasure of personal data concerning them without undue delay in the following cases: a) the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed; b) the data subject withdraws consent on which the processing is based; c) the data subject objects to the processing and there are no overriding legitimate grounds for the processing, or objects to the processing of their data for direct marketing purposes, including profiling to the extent that it is related to such direct marketing; d) the personal data have been unlawfully processed; e) the personal data have to be erased for compliance with a legal obligation in Union or Member State law to which the Data Controller is subject; f) the personal data have been collected in relation to the offer of information society services to children.

Paragraph 3 of Art. 17 lists the limitations to the exercise of the right, which are based on the legal basis underlying the processing and which therefore justify both the storage of data and further processing. The Controller can therefore reject the request for erasure if the processing is based on:

– the exercise of the right of freedom of expression and information;

– compliance with a legal obligation, for the performance of a task carried out in the public interest or in the exercise of official authority;

– reasons of public interest in the area of public health;

– archiving purposes in the public interest, scientific or historical research purposes or statistical purposes, in so far as the erasure is likely to render impossible or seriously impair the achievement of the objectives of that processing;

– the establishment, exercise, or defense of legal claims.
Art. 18 Right to restriction of processing

Recital 67

The data subject has the right to request the restriction of processing where one of the following applies: a) the accuracy of the personal data is contested by the data subject, for a period enabling the data controller to verify the accuracy of the personal data; b) the processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of their use instead; c) the data controller no longer needs the personal data for the purposes of the processing, but they are required by the data subject for the establishment, exercise, or defense of legal claims; d) the data subject has objected to processing pursuant to Article 21(1) pending the verification whether the legitimate grounds of the data controller override those of the data subject.

Paragraph 2 provides that, in some cases, despite the restriction of processing having been ordered, personal data may exceptionally be processed in cases of: consent of the data subject; establishment of legal claims; protection of the rights of another person; important public interest.

Recital 67 illustrates some practical ways to implement the right to restriction; this could be ensured by:

– temporarily moving the selected data to another processing system (so as not to make them available for normal processing activities);

– making the selected personal data inaccessible to users (where the processing is so configured);

– temporarily removing published data from a website.

– in automated filing systems, the restriction of processing of personal data should, in principle, be ensured by technical means in such a way that the personal data are not subject to further processing and can no longer be changed (where the data subject does not request their erasure).
Art. 20 – Right to data portability

Recitals 57, 68

The data subject has the right to receive the personal data concerning them, which they have provided to a data controller, in a structured, commonly used, and machine-readable format and has the right to transmit those data to another data controller without hindrance from the data controller to which the personal data have been provided, where: a) the processing is based on consent; b) the processing is carried out by automated means. This right does not apply to non-automated processing (paper archives or registers). This right must not, however, adversely affect the rights and freedoms of others.
Art. 21 – Right to object

Recitals 69, 70

 The data subject has the right to object, on grounds relating to their particular situation, at any time to processing of personal data concerning them, where the processing is necessary for:

– the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;

– the pursuit of the legitimate interest of the controller, provided that the interests or fundamental rights and freedoms of the data subject do not override them;

– scientific or historical research purposes or statistical purposes.

It is therefore the controller’s burden to demonstrate that the legal basis on which the processing is based overrides the interests or fundamental rights and freedoms of the data subject.

Recital 70 specifies that where personal data are processed for direct marketing purposes, the data subject should have the right to object to such processing at any time and free of charge, with regard to both initial and further processing, including profiling to the extent that it is related to such direct marketing. That right should be explicitly brought to the attention of the data subject and presented clearly and separately from any other information.

Art. 22 – Right not to be subject to a decision based solely on automated processing, including profiling

Recitals 71, 72

The data subject has the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning them or similarly significantly affects them. This right does not apply if the automated decision:

– is necessary for entering into, or performance of, a contract between the data subject and a data controller;

– is authorized by Union or Member State law to which the controller is subject;

– is based on the data subject’s explicit consent.

Such decisions are explicitly excluded for special categories of data governed by Art. 9 EU Reg. 679/2016, except in cases where:

– the data subject has given their explicit consent to the processing of such personal data for one or more specific purposes;

– processing is necessary for reasons of substantial public interest, on the basis of Union or Member State law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject.

ROLES AND RESPONSIBILITIES

The procedure applies to all employees and collaborators of Roncucci&Partners Srl as well as to Data Processors, appointed pursuant to Art. 28 of the GDPR. Compliance with this procedure is mandatory and the prompt and active involvement of the subjects referred to is required.

They are consequently required to provide the Data Controller with maximum cooperation for compliance with the provisions of current legislation on the protection of personal data.

PHASES OF THE PROCEDURE

SUBMISSION AND RECEIPT OF THE REQUEST

The request to exercise rights may reach the Controller directly or be intercepted by third parties who, operating as Data Processors, are in direct contact with the data subjects.

Requests may be exercised using the appropriate form “Model for the exercise of rights regarding personal data protection” (see 01P_PR-14.1-00 Data Subject Rights Exercise Model), published in the appropriate section of the institutional website, to be forwarded via email to the address indicated. A copy of the applicant’s identity document must be attached to the request – under penalty of inadmissibility – (unless the request is with the applicant’s digital signature). The request is always subject to registration, in order to assign the date of receipt useful for calculating the deadlines.

The Internal Contact Person takes charge of the request and involves, as quickly as possible, the Manager of the organizational structure that holds the data being processed or the Data Processor who has competence in relation to the subject of the request.

From a subjective profile, requests must refer to information relating to “natural persons” held by Roncucci&Partners Srl. The data subject exercising a right, in fact, must be identified for the purposes of the most correct investigation of the requests.

EVALUATION OF THE REQUEST

The Data Controller evaluates the request submitted by the data subject, in order to verify the merits of the instance and implement the actions necessary to process the request. If reasonable doubts arise from the evaluation of the instance regarding the identity of the natural person submitting the request, the Controller will inform the data subject without delay, who must provide proof of their identity.

DATA RETRIEVAL AND EXECUTION OF OPERATIONS REQUESTED BY THE DATA SUBJECT

If the instance is deemed well-founded, the Controller will identify the organizational structure involved and ensure the necessary involvement of the Designated Subjects and/or Data Processors who hold the data subject to the instance. Once the existence of the data contained in the instance has been verified, the requested operations will be carried out pursuant to Articles 15 to 22 of the GDPR (e.g., rectification, integration, erasure). In the event that laws or regulations do not allow compliance with what is contained in the instance, appropriate reasons will be prepared and feedback provided to the data subject.

FEEDBACK TO THE DATA SUBJECT

Pursuant to Art. 12, paragraph 3, of the GDPR, the Data Controller provides the data subject with information on the action taken regarding the request to exercise the rights recognized to them, without undue delay and, in any case, within one month of receipt of the request, even if the response is negative. This period may be extended by two months, if necessary, taking into account the complexity and number of requests received.

In the event of an extension of the response deadline, the Data Controller is required to inform the data subject, within one month of receipt of the request, of such extension and the reasons for the delay.

In case of non-compliance with the data subject’s request, the Data Controller informs the data subject without delay, within one month of receipt of the request, of the reasons for non-compliance and of the possibility of lodging a complaint with a supervisory authority and seeking a judicial remedy. The response must be formulated in a concise, transparent, intelligible form and written in simple and clear language.

The response method must take into account the channel indicated by the data subject in the request.

In the event that the exercise of the right to portability referred to in Art. 20 of the GDPR is requested, the feedback must take place by attaching the data in electronic format according to the standard explained in the “Guidelines on the right to data portability” – adopted by the Article 29 Working Party and available at www.garanteprivacy.it/regolamentoue/portabilita.

Pursuant to Art. 12, paragraph 2, of the GDPR, in the case of data processing carried out for a purpose that does not require, or no longer requires, the identification of the data subject, the Controller cannot refuse to satisfy the data subject’s request for the purpose of exercising their rights, unless the Controller demonstrates that they are unable to identify the data subject. In this latter case, the rights may be exercised only when the data subject provides further information allowing their identification.

COSTS FOR MANAGING REQUESTS

Operations regarding the management of requests aimed at exercising the rights recognized by the GDPR are carried out without costs for the data subject. If the data subject’s requests are manifestly unfounded or excessive, in particular because of their repetitive character, the Data Controller may charge a reasonable fee, taking into account the administrative costs incurred to manage the request, or refuse to satisfy the request, as provided for by Art. 12, paragraph 5, of the GDPR.

The burden of demonstrating the manifestly unfounded or excessive character of the request lies with the Data Controller.

DOCUMENTATION ARCHIVING

Documentation relating to requests for the exercise of rights by data subjects is kept by the Data Controller.

NOTIFICATION IN CASE OF RECTIFICATION, ERASURE OR RESTRICTION OF PROCESSING

Pursuant to Art. 19 of the GDPR, the Data Controller has the responsibility to communicate to each of the recipients to whom the personal data have been transmitted, any rectifications or erasures or restrictions of processing carried out in accordance with Articles 16, 17, paragraph 1, and 18 of the GDPR, unless this proves impossible or involves a disproportionate effort.

Communication to these subjects is carried out by the Data Controller, within one month from the moment of the rectification and/or erasure intervention carried out on the data or restriction of processing. The Controller must keep track of these operations in the Register of requests for the exercise of data subjects’ rights.

If the data subject has requested it, the Data Controller provides evidence of the subjects to whom the personal data concerning them have been transmitted.

REGISTER OF REQUESTS FOR THE EXERCISE OF DATA SUBJECTS’ RIGHTS

The Controller documents the instances aimed at exercising the data subject’s rights by preparing an updated internal Register. The Register of requests for the exercise of data subjects’ rights (see 02P_PR-14.1-00 Data Subject Rights Request Register), must contain the information reported below:

  • progressive number;
  • date of receipt of the instance;
  • assigned protocol number;
  • name of the applicant;
  • name of the data subject (if different from the applicant);
  • description of the request;
  • organizational structures or databases involved;
  • action taken regarding the request;
  • references of the feedback note to the data subject (date and protocol);
  • notes and comments.