WHY THIS POLICY?
With this document, as provided for by current legislation (art. 13 General Regulations on Data Protection, hereinafter also referred to as RGPD), we provide users interested in forwarding their request by filling out the form on the website with information related to the processing of their data.
WHO IS THE OWNER
The requests will be handled by the Real Estate Company Enea Srl, with registered offices at Via Goito 7, 40126, Bologna, P. IVA 02062650375, (hereinafter also referred to as “ENEA”) and the Company Broccoindosso Srl, with registered offices at Via Goito 7, 40126, Bologna, P. IVA 02569281203, (hereinafter also referred to as “BROCCAINDOSSO”) The two Companies (also known as the “Adriano Group”) operate as joint holders, since they jointly determine the purposes for which the data is acquired and the means of its processing. ENEA is responsible for the management of technical aspects, also through the activities carried out on its behalf by consultants and companies with specific skills that in some cases operate as data controllers.
WHICH DATA IS PROCESSED
The data processed is that provided by the user through the completion of the information request form.
WHAT ARE THE PURPOSES AND LEGAL BASES OF THE PROCESSING?
The personal data provided by the user through the appropriate form is used only to respond to the request of the person concerned.
The legal bases for the processing of such data are therefore: the adoption of measures related to the pre-contractual relationship.
HOW IS THE DATA MANAGED?
The collected data is processed with IT tools and only in a residual way with paper methods.
Adequate security measures are adopted to prevent the loss of data, illegal or incorrect use and unauthorized access.
The data provided directly by the person concerned is kept for the time strictly necessary to process the requests of the person concerned and then deleted, except in cases of booking confirmation (against which the data can be maintained for the duration of the relationship and according to legal obligations) and defensive requirements (which may require further retention).
WHAT HAPPENS IF THE DATA IS NOT PROVIDED?
The provision of data is optional but, if it is not available, it will not be possible to respond to the requests made by the person concerned.
WHO CAN ACCESS THE DATA?
The data will be processed by the Company’s employees and by collaborators authorized by the latter to process the data. The data may also be accessed by consultants or companies providing IT supply and assistance services for purposes related to the activities carried out on behalf of the owner and by consultants for the management of litigation and legal assistance in the event of any disputes that may require their involvement.
The person concerned may request from the Owner the list of external subjects who carry out their activities as data controllers.
WHAT ARE THE RIGHTS OF THE PERSON CONCERNED?
The law accords the person concerned the right to ask the data controller for access to personal data and their rectification or deletion or to limit the processing of personal data concerning him or her or to object to their processing, in addition to the right to data portability.
The interested party may assert his/her rights at any time, without formality, by contacting ENEA or BROCCAINDOSSO, via the email address firstname.lastname@example.org
The rights recognized by current legislation on the protection of personal data are described in details below.
- The right of access, e the right to obtain from the data controller confirmation as to whether or not personal data concerning him or her is being processed and, if so, to obtain access to the personal data and the following information: a) the purposes of the processing; b) the categories of personal data in question; (c) the recipients or categories of recipients to whom the personal data have been or will be disclosed, particularly if they are recipients in third world countries or international organizations; (d) where possible, the retention period of the personal data provided or, if not possible, the criteria used to determine this period; (e) if there is the right of the interested party to request the data controller to rectify or delete his or her personal data or to limit the processing of his or her personal data or to object to the processing of his or her personal data; f) the right to lodge a complaint with a supervisory authority; g) if the data is not collected from the person concerned, any available information as to their source; (h) the existence of an automated decision-making process, including profiling and, at least in such cases, meaningful information on the logic used, as well as the envisaged importance and consequences of such processing for the person concerned. Where personal data is transferred to a third world country or an international organization, the person concerned shall then have the right to be informed of the existence of appropriate safeguards relating to the transfer.
- The right of rectification, i.e the right of rectification: the right to obtain from the data controller for the rectification of personal data relating to him or her which are inaccurate without unjustified delay. Taking into account the purposes of the processing, the person concerned has the right to obtain the integration of incomplete personal data, including providing a supplementary statement.
- The right to erasure i.e the right to obtain from the data controller the erasure of personal data concerning him or her without unjustified delay if: a) the personal data is no longer necessary with respect to the purposes for which they were collected or otherwise processed; b) the person concerned revokes the consent on which the processing is based and if there is no other legal basis for the processing; c) the person concerned opposes the processing carried out because it is necessary for the execution of a task in the public interest or in the exercise of official authority vested in the owner or for the pursuit of legitimate interest and there is no overriding legitimate reason for carrying out the processing or opposes the processing for purposes of direct marketing; d) the personal data has been processed unlawfully; (e) the personal data must be deleted in order to fulfil a legal obligation under Union law or the law of the Member State to which the data controller is subject; (f) the personal data has been collected in connection with the provision of information society services to minors. However, a request for erasure cannot be accepted if the processing is necessary: a) for the exercise of the right to freedom of expression and information; (b) for the fulfilment of a legal obligation requiring the processing provided for by Union law or the law of the Member State to which the data controller is subject or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the data controller; (c) for reasons of public interest in the field of public health; (d) for purposes of filing in the public interest, scientific or historical research or for statistical purposes, in so far as erasure would seriously jeopardise or render impossible the achievement of the objectives of such processing; or (e) for the establishment, exercise or defence of legal claims.
- The right of limitation, i.e the right to obtain that the data be processed, except for storage, only with the consent of the person concerned or for the establishment, exercise or defence of legal claims or to protect the rights of another natural or legal person or for reasons of substantial public interest of the Union or a Member State if such processing is carried out on the basis of the consent of the person concerned: a) the person concerned disputes the accuracy of the personal data within the period necessary for the data controller to verify the accuracy of such personal data; b) the processing is unlawful and the person concerned opposes the erasure of the personal data and requests instead that its use be limited; c) although the data controller no longer needs the data for the purposes of processing, the personal data are necessary for the person concerned to ascertain, exercise or defend a legal claim; d) the person concerned opposes the processing because it is necessary for the execution of a task carried out in the public interest or in the exercise of public authority vested in the data controller or for the pursuit of the legitimate interest of the data controller or third parties, pending verification of whether the legitimate reasons of the data controller prevail over those of the person concerned.
- The right to portability, i.e the right to receive in a structured format, commonly used and machine-readable, personal data concerning him/her provided to the data controller and has the right to transmit such data to another data controller without hindrance by the data controller to whom he/her has provided them, as well as the right to obtain direct transmission of personal data from one data controller to another, where technically feasible, where the processing is based on consent or on a contract and the processing is carried out by automated means. This right shall be without prejudice to the right to erasure.
- The right to object, i.e the right of the person concerned to object at any time, for reasons connected with his/her particular situation, to the processing of his/her personal data carried out because it is necessary for the execution of a task carried out in the public interest or in the exercise of official authority vested in the data controller or in the pursuit of the legitimate interests of the data controller or of third parties. Where personal data are processed for the purposes of direct marketing, the person concerned shall have the right to object at any time to the processing of personal data relating to him/her carried out for such purposes, including profiling insofar as it is related to such direct marketing.
The person concerned is then informed that the law gives him or her the possibility to assert their rights by appealing to the Privacy Guarantor or before the judicial authority.