Version 1.1 dated 4.4.2019
Pursuant to art.s 13 and 14 of Regulation (EU) no. 2016/679 (hereinafter “GDPR”) on the protection of natural persons with regard to the processing of personal data and on the free flow of such data, Alta-Serra Srl , in its capacity as Data Controller, is obliged to provide you with complete information concerning the purposes for which your personal data are processed and the procedures used, the entities to which your data may be disclosed, and all your legal rights with regard to the processing of your personal data by the Data Controller.
The Data Controller.
The Data Controller is Alta-Serra S.r.L. with registered office in Rome, at Via Paolo II 3, Rome, Register of Companies and VAT reg. no. 09440521004.
The Data Controller will collect and process your personal data, meaning any data which may identify you and which can be directly or indirectly traced to you, such as (but not limited to):
and all other data necessary to provide the activities covered by point 4. Special categories of data will also be processed, including:
Personal data are contributed to the Data Controller directly by the data subject or collected through other entities such as:
The personal data collected by the Data Controller will be processed for the
Legal basis of processing
Personal data will be processed in strict compliance with legal requirements, in accordance with principles of lawfulness and ethics and without breaching your right to privacy. Personal data will be processed for:
Data will be processed in automated and/or manual form, in accordance with
the provisions of art. 32 of GDPR 2016/679, and in particular:
Nature of the contribution of data and Refusal to contribute them
With regard to the purposes of the data processing for which your consent is requested, the refusal will not affect the obligations undertaken.
Your data may be transferred to and processed by other entities, in the capacity
of authorised processors, data processors or independent data controllers, for the fulfilment of precontractual, contractual or statutory obligations, or on the grounds of legitimate interest.
Categories of recipients may therefore include:
The data contributed to and collected by the Data Controller are not publicly disseminated or used for profiling.
Personal data may be transferred to European Union Countries, non‐European Union Countries or an international organisation if this is necessary to provide the activities covered by point 4 and in general will be unable to fulfil the obligations undertaken. As of the date of this document, the countries to which your data are transferred are:
Your data will be stored for the time strictly necessary for the performance of
the activities related to the purposes set out in this Statement. Specifically, the storage times will be:
data (Points 2.1 to 2.7), unless otherwise specified by the data subject;
In all cases, longer storage periods will apply if required by specific legislation in the sector. In the event of disputes, personal data will be stored until the end of the expiration period envisaged by law for the protection of rights relating to the contractual relationship.
Rights of the data subject
Via a specific written communication, sent by certified email or registered letter with return receipt to the Data Controller's address, you have:
Right of access to data (Art. 15, GDPR)
To obtain from the Data Controller confirmation as to whether or not personal data concerning you are being processed, and, where that is the case, access to the personal data and specific information detailed in art. 15 of the GDPR.
Right to rectification (Art. 16, GDPR)
To obtain from the Data Controller, without undue delay, the rectification of inaccurate personal data concerning you, depending on the purposes of the processing, you also have the right to the supplementation of incomplete personal data, also by providing an additional statement;
Right to erasure (Art. 17, GDPR)
To obtain from the controller the erasure of personal data concerning you without undue delay, and the controller has the obligation to erase your personal data without undue delay, unless there are grounds impeding the exercise of the above right.
Right to restriction of processing (Art. 18, GDPR)
To obtain the restriction of processing of your personal data when possible, or to withdraw consent given previously. The withdrawal of consent is without prejudice to the lawfulness of the processing prior to the withdrawal.
Right to the portability of the data (Art. 20, GDPR)
If the processing is based on consent or on a contract, and is undertaken by automated means, you have the right to receive the personal data concerning you, which you have provided to the controller, in a structured, commonly used and machine‐readable format and to transmit them to another data controller, or have them transferred by the controller itself, if technically feasible.
Right to object (Art. 21, GDPR)
The right to object, on grounds relating to your situation at any time to processing of personal data concerning you which is based on the legitimate interest of the data controller or your consent, including profiling, unless the controller demonstrates compelling legitimate grounds for the processing which override your rights.
Right to ensure that your data are not subject to an automated decision‐making process, including profiling (art. 22, GDPR)
Not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you.
As stated in point 7, the Data Controller does not use automated decision‐ making processes.
The right to lodge a complaint with a supervisory authority (Art. 77, GDPR)
Without prejudice to any other administrative or judicial remedy, if you consider that the processing of personal data relating to you infringes these regulations, you may lodge a complaint with the Supervisory Authority, and exercise all your rights under current legislation in general.
If you request information concerning your data, the Data Controller will reply as soon as possible ‐ unless this is impossible or implies a disproportionate effort ‐ and in all cases not more than 30 days after the application. Any inability to reply or delays on the part of the data controller will be justified.
(Version 1.1 dated 4.4.2019)
Name and Surname:
Declaration of consent to processing
Rome, 01 March 2020 ALTA-SERRA SRL