PRIVACY POLICY
Information on the processing of personal data – Information document pursuant to and for the purposes of Article 13, Regulation (EU) 2016/679.

Data controller
BTS S.p.A., Viale Forlanini 40, 20024 Garbagnate Milanese MI – Italy, in the person of the legal representative pro-tempore
E-mail: privacy@btsbioengineering.com

PURPOSE AND LICENSE OF THE SERVICE
The personal data provided will be processed in compliance with the conditions of lawfulness pursuant to art. 6 EU Reg. 2016/679 as shown in the table below.

Service purposes wdt_ID Legal basis Data retention period
A) Surfing this website 2 Art. 6, parag.1, lett. b) GDPR: the interested party, as a customer, is allowed to interact with the platform made available by the owner, by virtue of the contract between the parties.

Legitimate interest
Art. 6, parag.1, lett. f) GDPR: taking into account the reasonable expectations of the data subject at the time and in the collection of personal data, when the data subject can reasonably be expected to be processed for this purpose.
Web surfing session – see cookie policy

B) Further contact or information request 3 Contract
Art. 6, parag.1, lett. b) GDPR: the interested party, as a customer, is allowed to interact with the platform made available by the owner, by virtue of the contract between the parties.

Legitimate interest
Art. 6, parag.1, lett. f) GDPR: taking into account the reasonable expectations of the data subject at the time and in the collection of personal data, when the data subject can reasonably be expected to be processed for this purpose.
Data will be kept for 1 year or in any case for the time necessary to perform the specified activities and the services requested
C) Possible registration to reserved areas of the website 4 Contract
Art. 6, parag.1, lett. b) GDPR: the interested party, as a customer, is allowed to interact with the platform made available by the owner, by virtue of the contract between the parties.

Legitimate interest
Art. 6, parag.1, lett. f) GDPR: taking into account the reasonable expectations of the data subject at the time and in the collection of personal data, when the data subject can reasonably be expected to be processed for this purpose.
Until your cancellation request
D) Registration to the newsletter of the Owner through e-mailing list, by filling out the dedicated form 5 Consent
Art 6 lett a)
Until consent withdrawal (opt - out)
E) Direct marketing through newsletters to promote products or services of the holder similar to those already purchased by the interested party (c.d. "soft spam") 6 Legitimate interest of the owner to carry out marketing activities to its customers. Art. 130 c4 dlgs 196/2003 s.m.i. Up to opposition (opt-out) and cancellation from the mailing list
F) Formalization of the application, with a view to a possible selection and for future selections 7 Contract
Art. 6, parag.1, lett. b) GDPR: the interested party, as a customer, is allowed to interact with the platform made available by the Owner, by virtue of the pre-contractual activities in force between the parties.
12 months
G) Administrative and accounting activities in general 11 Contract
Art. 6, parag.1, lett. b) GDPR: the interested party, as a customer, is allowed to interact with the platform made available by the owner, by virtue of the contract between the parties.

Obligation of the law art. 6, par. 1 lett. c)
10 years
Art. 2220 of the Civil Code
Accounting records and in any case for all related legal obligations

ADDRESSEES OR CATEGORIES OF DATA ADDRESSEES
The personal data provided will be shared with recipients, who will process the data as responsible (Article 28 of the GDPR), as natural persons acting under the authority of the Owner and the Manager (Article 29 of the GDPR) or autonomous Data Controllers, for the purposes listed above. Precisely, the data will be communicated to:
– Subjects that provide services for the management of the information system of the Data Controller (including e-mail);
– Studies or companies in the context of assistance and consultancy relationships;
– Competent authorities for compliance with legal obligations and / or provisions of public bodies, upon request;
In the case of administrative and accounting purposes, the data may eventually be sent to commercial information companies for the assessment of solvency and payment habits and / or to subjects for debt collection purposes.
The updated list of external processors and independent Data Controllers is available at the offices of the Data Controller.

DATA TRANSFER TO A THIRD COUNTRY AND/OR AN INTERNATIONAL ORGANIZATION AND GUARANTEES
The personal data provided will not be transferred abroad.
In the event that they should be transferred abroad, inside or outside the European Union, such dislocation of your data, would occur within the limits and under the conditions set forth in articles. 44 and ss. of the 2016/679 EU Regulation, in order to comply with the purposes related to the treatments. In this case, the interested party may obtain a copy of the conditions imposed on the eventual transfer by writing an email to privacy@btsbioengineering.com.

NATURE OF THE CONFERENCE AND REFUSAL
Apart from that specified for navigation data, the user is free to provide their personal data.
The provision of personal data for the aforementioned purposes is optional but necessary to use the services made available by the Data Controller through the site or to obtain feedback to requests for information. Failure to provide personal data may make it impossible to get feedback from the Owner and to use the services requested. With reference to the purpose D) the conferment is optional, the lack of consent will not preclude the achievement of the other purposes indicated above.

RIGHTS OF THE INTERESTED
You can assert your rights as expressed in articles 15, 16, 17, 18, 20, 21, 22 of EU Regulation 2016/679, by contacting the Data Controller, writing to privacy@btsbioengineering.com. You have the right, at any time, to ask the Data Controller to access your personal data (Article 15), the correction (Article 16) or the cancellation (Article 17) of the same, or the limitation of processing (Article 18) the portability of your data (Article 20) or to oppose at any time their processing (including automated processing, eg profiling (Article 21) Without prejudice to any other administrative and judicial appeal, if that the processing of data concerning you, violates the provisions of EU Reg. 2016/679, pursuant to art. 15 letter f) of the aforementioned EU Reg. 2016/679, you have the right to lodge a complaint with the Guarantor for the protection of personal data and, with reference to art. 6 paragraph 1, letter a), has the right to revoke the consent given at any time. In the case of requesting data portability, the Data Controller will provide you in a structured format, in common and legible, by automatic device, the personal data concerning you, without prejudice to paragraphs 3 and 4 of the art. 20 of the EU Reg. 2016/679

Date of update: 10 October 2018