WHY THIS POLICY?
With this document, as provided for by current legislation (art. 13 General Regulations on Data Protection, hereinafter also referred to as RGPD), we provide users interested in subscribing to the Adriano Group newsletter with information regarding the processing of their personal data.
The subscription to the newsletter is reserved for users with an email address, who are at least 16 years old. The newsletter focuses on promotional and commercial communications.
WHO IS THE OWNER
The newsletter service is offered by the Real Estate Company Enea Srl, with registered offices at Via Goito 7, 40126, Bologna, P. IVA 02062650375, (hereinafter also referred to as “ENEA”) and the Company Broccaindosso Srl, with registered offices at Via Goito 7, 40126, Bologna, P. VAT 02569281203, (hereinafter also referred to as “BROCCAINDOSSO”) The two Companies (also known as the “Adriano Group”) operate as joint holders, since they jointly determine the purposes for which the data is acquired and the means of its processing. ENEA is responsible for the management of technical aspects, also through the activities carried out on its behalf by consultants and companies with specific skills that in some cases operate as data controllers.
WHICH DATA IS PROCESSED
The data processed is that provided by the user through the completion of the appropriate subscription form to the newsletter service.
WHAT ARE THE PURPOSES AND LEGAL BASES OF THE PROCESSING?
The personal data provided by the user through the appropriate form is used to enable the person concerned to subscribe to the newsletter and periodically receive promotional and commercial communications sent by e-mail to the e-mail address provided.
The legal basis for the processing of these data is the consent because the person concerned subscribes to a service that involves the sending of promotional emails.
If necessary, the data may also be used against the legitimate interest of the owner to carry out defensive activities or to assert or defend a right in court.
The email address, if authorized, can also be used to carry out an activity of remarketing through the service offered by Facebook; this activity can be carried out only if authorized and only if the email address released by the user when subscribing to the newsletter coincides with that used for your Facebook account. The legal basis in this case is the consent of the person concerned.
HOW IS THE DATA MANAGED?
The data is processed through the platform and the IT tools offered by the “MailChimp” service provided by the American company The Rocket Science Group, LLC, 675 Ponce De Leon Ave NE, Suite 5000, Atlanta, Georgia 30308; therefore, in the event of subscribing to the newsletter service, the data of the person concerned may be forwarded to and accessed by this American company providing the service, which complies with the adequacy decision of the European Commission called “Privacy Shield”, thereby ensuring that the personal data being processed and operated is respected for this service by the data controller. The specifications related to this service are available at the following links //mailchimp.com/legal/terms/ and //mailchimp.com/legal/privacy/.
The data is kept until the person concerned requests that they are against the sending of the newsletter and opt to stop receiving it, and in any case no later than five years after the registration of the personal data.
The email address, if authorized, can be entered into the Facebook platform to carry out a remarketing activity for the registered user on the social network with that address.
WHAT HAPPENS IF THE DATA IS NOT PROVIDED?
The provision of data is optional but, without it, it will not be possible to subscribe to the newsletter service and receive the emails sent periodically.
WHO CAN ACCESS THE DATA?
The data will be processed by the Company’s employees and by collaborators authorized by the latter to process the data. The data may also be accessed by consultants or companies providing IT supply and assistance services for purposes related to the activities carried out on behalf of the owner, marketing consultants providing assistance for the management of mailing lists and consultants for the management of litigation and legal assistance in the event of any disputes that may require their involvement.
As already mentioned, the data may also be accessed by the provider of the MailChimp service, which is used to manage the newsletter service.
Subject to your consent, your email address may also be used for remarketing through the service offered by Facebook Inc., an American company that adheres to the Privacy Shield.
The person concerned may request for the list of external subjects who carry out their activities as data controllers.
WHAT ARE THE RIGHTS OF THE PERSON CONCERNED?
The law grants the person concerned the right to ask the data controller for access to personal data and the rectification or deletion of such data or the limitation of the processing of personal data concerning him/her or to object to their processing, in addition to the right to data portability.
The person concerned may unsubscribe at any time from the newsletter through the link at the bottom of each email received and may assert his/her rights at any time, without any formalities, by contacting ENEA or BROCCAINDOSSO, through the email address email@example.com
You can also disable the Facebook advertisement at any time from the following page //www.facebook.com/ads/preferences/?entry_product=ad_settings_screen.
The rights recognized by current legislation on the protection of personal data are detailed below.
- The right of access, e the right to obtain from the data controller confirmation as to whether or not personal data concerning him or her is being processed and, if so, to obtain access to the personal data and the following information: a) the purposes of the processing; b) the categories of personal data in question; (c) the recipients or categories of recipients to whom the personal data have been or will be disclosed, particularly if they are recipients in third world countries or international organizations; (d) where possible, the retention period of the personal data provided or, if not possible, the criteria used to determine this period; (e) if there is the right of the interested party to request the data controller to rectify or delete his or her personal data or to limit the processing of his or her personal data or to object to the processing of his or her personal data; f) the right to lodge a complaint with a supervisory authority; g) if the data is not collected from the person concerned, any available information as to their source; (h) the existence of an automated decision-making process, including profiling and, at least in such cases, meaningful information on the logic used, as well as the envisaged importance and consequences of such processing for the person concerned. Where personal data is transferred to a third world country or an international organization, the person concerned shall then have the right to be informed of the existence of appropriate safeguards relating to the transfer.
- The right of rectification, i.e the right of rectification: the right to obtain from the data controller for the rectification of personal data relating to him or her which are inaccurate without unjustified delay. Taking into account the purposes of the processing, the person concerned has the right to obtain the integration of incomplete personal data, including providing a supplementary statement.
- The right to erasure i.e the right to obtain from the data controller the erasure of personal data concerning him or her without unjustified delay if: a) the personal data is no longer necessary with respect to the purposes for which they were collected or otherwise processed; b) the person concerned revokes the consent on which the processing is based and if there is no other legal basis for the processing; c) the person concerned opposes the processing carried out because it is necessary for the execution of a task in the public interest or in the exercise of official authority vested in the owner or for the pursuit of legitimate interest and there is no overriding legitimate reason for carrying out the processing or opposes the processing for purposes of direct marketing; d) the personal data has been processed unlawfully; (e) the personal data must be deleted in order to fulfil a legal obligation under Union law or the law of the Member State to which the data controller is subject; (f) the personal data has been collected in connection with the provision of information society services to minors. However, a request for erasure cannot be accepted if the processing is necessary: a) for the exercise of the right to freedom of expression and information; (b) for the fulfilment of a legal obligation requiring the processing provided for by Union law or the law of the Member State to which the data controller is subject or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the data controller; (c) for reasons of public interest in the field of public health; (d) for purposes of filing in the public interest, scientific or historical research or for statistical purposes, in so far as erasure would seriously jeopardise or render impossible the achievement of the objectives of such processing; or (e) for the establishment, exercise or defence of legal claims.
- The right of limitation, i.e the right to obtain that the data be processed, except for storage, only with the consent of the person concerned or for the establishment, exercise or defence of legal claims or to protect the rights of another natural or legal person or for reasons of substantial public interest of the Union or a Member State if such processing is carried out on the basis of the consent of the person concerned: a) the person concerned disputes the accuracy of the personal data within the period necessary for the data controller to verify the accuracy of such personal data; b) the processing is unlawful and the person concerned opposes the erasure of the personal data and requests instead that its use be limited; c) although the data controller no longer needs the data for the purposes of processing, the personal data are necessary for the person concerned to ascertain, exercise or defend a legal claim; d) the person concerned opposes the processing because it is necessary for the execution of a task carried out in the public interest or in the exercise of public authority vested in the data controller or for the pursuit of the legitimate interest of the data controller or third parties, pending verification of whether the legitimate reasons of the data controller prevail over those of the person concerned.
- The right to portability, i.e the right to receive in a structured format, commonly used and machine-readable, personal data concerning him/her provided to the data controller and has the right to transmit such data to another data controller without hindrance by the data controller to whom he/her has provided them, as well as the right to obtain direct transmission of personal data from one data controller to another, where technically feasible, where the processing is based on consent or on a contract and the processing is carried out by automated means. This right shall be without prejudice to the right to erasure.
- The right to object, i.e the right of the person concerned to object at any time, for reasons connected with his/her particular situation, to the processing of his/her personal data carried out because it is necessary for the execution of a task carried out in the public interest or in the exercise of official authority vested in the data controller or in the pursuit of the legitimate interests of the data controller or of third parties. Where personal data are processed for the purposes of direct marketing, the person concerned shall have the right to object at any time to the processing of personal data relating to him/her carried out for such purposes, including profiling insofar as it is related to such direct marketing.
The person concerned is then informed that the law gives him or her the possibility to assert their rights by appealing to the Privacy Guarantor or before the judicial authority.