Information document pursuant to and for the purposes of Article 13 of Regulation (EU) 2016/679 (GDPR)
WHY THIS INFORMATION
WHO IS THE DATA PROCESSING OWNER? HOW TO CONTACT HIM?
The Data Controller is BTS SPA with legal head office in Garbagnate Milanese Via Forlanini, 40 in the person of its pro-tempore Legal Representative, who can be contacted for any information by telephone + 39 02 366 49000 e-mail [email protected]
TYPE OF DATA THAT CAN BE PROCESSED
Personal data: any information relating to an identified or identifiable natural person (“data subject”); an identifiable natural person is one who can be identified, directly or indirectly, with reference to an identifier such as a name, an identification number, location data, an online identifier or one or more characteristic elements of his physical identity, physiological, genetic, psychic, economic, cultural, or social. Any Particular Data: personal data revealing racial or ethnic origin and data relating to the health of the person and based on Laws on mandatory employment (e.g. protected categories and mandatory employment as per applicable regulations.
PURPOSE OF THE TREATMENT, LEGAL BASIS, PERIOD OF DATA STORAGE, PROVISION NATURE
TO WHOM WILL THE PERSONAL DATA BE COMMUNICATED? DATA RECIPIENTS
The data will not be disclosed.
Personal data will be communicated to subjects who will process the data as independent Data Controllers, or Data Processors (art. 28 GDPR) and processed by natural persons (art. 29 GDPR) who act under the authority of the Data Controller and the Responsible based on specific instructions provided in relation to the purposes and methods of treatment. The data will be communicated to recipients belonging to the following categories:
– entities that provide services for the management of the information system and communication networks (including e-mail and platforms/software); – studies or companies in the context of assistance and consultancy relationships; – any third parties and labor consultants and companies for recruitment purposes based in Italy;
– competent authorities for the fulfillment of legal obligations and/or provisions of public bodies, upon request. The subjects belonging to the aforementioned categories perform the function of data processing manager or operate in total autonomy as separate data controllers.
The list of data processors art. 28 is available by writing to [email protected] or to the other addresses indicated above.
IS THERE A DATA TRANSFER TO A NON-EEA COUNTRY?
Personal data will be transferred to non-EEA countries, to comply with related purposes based on the processing purposes indicated above. The data will be transferred based on Article 44 et seq. of the GDPR:
– art. 45 towards third countries international organizations for which the Commission has intervened with an assessment of adequacy;
– towards subjects who have provided adequate guarantees, with standard contractual clauses (SCC) of the European Commission (Article 46, paragraph 2, letter c and letter d).
For information about the guarantees concerning the transfer of data outside the EEA, write to [email protected]
IS THERE AN AUTOMATED PROCESS?
Personal data will be subjected to traditional manual, electronic and automated processing. It should be noted that fully automated decision-making processes are not carried out.
RIGHTS OF DATA SUBJECTS
You will be able to assert the rights as expressed by the articles 15 and following GDPR, Data Controller at the e-mail address [email protected], or at the contacts indicated above or. You have the right, at any time, to request access to your personal data (art.15), rectification (art.16), cancellation of the same (art.17), limitation of treatment (art.18). The data controller communicates (art. 19) to each of the recipients to whom the personal data have been transmitted any corrections or cancellations or limitations of the carried-out treatment. The data controller communicates these recipients to the interested party if requested. In the foreseen cases, you have the right to the portability of your data (art.20) and in this case they will be provided to you in a structured format, commonly used and readable, by automatic device. You have the right to oppose, in the envisaged cases (art.21), at any time, the processing of data based on legitimate interest, and in cases where the legal basis is consent, you have the right to revoke the consent given without prejudice to the lawfulness of the treatment based on the consent before the revocation. In the event that he believes that the processing of personal data carried out by the Data Controller is in violation of the provisions of Regulation (EU) 2016/679, the interested party has the right to lodge a complaint with the Supervisory Authority, in particular in the Member State where he/she habitually resides or works or in the place where the alleged violation of the regulation has occurred (Privacy Guarantor https://www.garanteprivacy.it/), or to take the appropriate judicial offices.
Updated date: November 30, 2022
The treatment owner