We hereby wish to inform you that European Regulation 679/2016, concerning the protection of individuals with regard to the processing of personal data, provides for the protection of individuals with regard to the processing of personal data. CENTOFORM processes personal data of natural persons belonging to customer organisations (actual and potential), suppliers, employees and external collaborators, personnel belonging to third party organisations, including affiliated or associated companies. In accordance with Article 13 of EU Regulation 679/2016, therefore, we provide you with the following information regarding the processing of personal data: 1. The processing of the data provided by you is necessary to carry out contractual or pre-contractual commitments and to fulfil legal obligations. In particular, the data will be processed for the following purposes: to provide the products/services foreseen by the contractual relations in place between the Training Centre and the Client; to provide information and/or send communications relating to the service, both before and after it has been provided; to provide all the accounting and fiscal fulfilments required by law relating to the contractual relationship;
- The processing of the data supplied by you is necessary to carry out contractual or pre-contractual commitments and to fulfil legal obligations. In particular, the data will be processed for the following purposes: to provide the products/services provided for by the contractual relationship between the Training Centre and the Client; to provide information and/or send communications relating to the service, both before and after the supply of the same; to provide for all accounting and fiscal fulfilments of the law relating to the contractual relationship; For the legitimate interest of the Training Centre, the personal data provided will also be processed for the following purposes: to send information and/or offers on the services of the Training Centre and/or affiliated and/or controlled companies, which may be considered of interest to the Client, without this determining the transfer of personal data to third parties. The Training Centre undertakes never to transfer its customers’ data to third parties; to verify the quality of the services offered, also by offering after-sales services; to send commercial and/or advertising communications and information relating to its own services and initiatives; to satisfy market surveys and statistics, marketing and preferences on the services provided; credit protection.
2. The processing will be carried out both manually and automatically with the aid of electronic means, and include any operation or set of operations, such as collection, recording, organization, structuring, storage, adaptation or modification, extraction, consultation, use, communication by transmission, comparison or interconnection, limitation, cancellation or destruction, excluding dissemination or any other form of making available. The Data Controller has in any case adopted adequate technical and organisational measures to protect the confidentiality, integrity and availability of the data collected. These measures have been assessed as suitable following the assessment of all risks – with relative seriousness and probability of occurrence – that are inherent to the personal data processed.
3. The provision of the data is: mandatory for the processing referred to in points a), b), c) above; in this case any refusal to provide such data could result in the failure or partial performance of the contract entered into between the parties and/or the failure to continue the relationship. optional for the processing referred to in points d), e), f), g), h) above; in this case any refusal to provide such data has no effect on compliance with contractual requirements, but could prevent you from receiving future information about our services and to take advantage of a service tailored to your needs.
4. The data may/will be communicated to: affiliated and/or controlled companies; external companies or consulting firms to carry out legal obligations; banks and insurance companies; social security agencies; law firms for credit protection; only for the purposes indicated in point 1 above. The data will not be disclosed. Personal data will not be transferred outside the European Union and will not be subject to profiling.
5. The personal data subject to processing will be kept during the contractual relationship and, in case of interruption of the relationship, the period necessary to fulfil accounting and legal obligations will be kept. The data used to carry out promotional activities may be stored for this purpose if the data subject does not request their deletion.
6. The data controller is: Centoform Srl – Via Nino Bixio, 11 – 44042 Cento (FE)
7. Rights of the data subject: at any time, you may exercise your rights vis-à-vis the Data Controller, pursuant to Articles 15 (“Data subject’s rights of access”), 16 (“Right of rectification”), 17 (“Right to cancellation”) and 18 (“Right to limit processing”) of the Regulations – which, for your convenience, we reproduce in full below – by addressing your request to the aforementioned address of the Data Controller, at c. a. of the Data Processor for the purposes of exercising the aforementioned rights of access, or to the e-mail address privacy@centoform.it in the same manner you may revoke your consent for the processing of data concerning you. It is also possible to lodge a complaint about the processing of personal data carried out by the Company with the National Control Authority, or the Guarantor for the Protection of Personal Data (www.garanteprivacy.it).
EU Regulation 679/2016 articles 15-16-17-18
Article 15 – Right of access of the data subject
The data subject has the right to obtain confirmation from the data controller as to whether or not personal data concerning him/her are being processed and, if so, to obtain access to the personal data and the following information:
- the purposes of the processing;
- the categories of personal data in question
- the recipients or categories of recipients to whom the personal data have been or will be disclosed, in particular if they are recipients from third countries or international organisations;
- where possible, the intended period of retention of personal data or, if that is not possible, the criteria used to determine that period;
- the existence of the right of the data subject to ask the data controller to rectify or erase the personal data or to limit the processing of personal data concerning him/her or to object to its processing;
- the right to lodge a complaint with a supervisory authority
- if the data are not collected from the data subject, all available information on their origin
- the existence of an automated decision-making process, including profiling as referred to in Article 22(1) and (4) and, at least in such cases, significant information on the logic used and the importance and expected consequences of such processing for the data subject.
Where personal data are transferred to a third country or an international organisation, the data subject shall have the right to be informed of the existence of adequate safeguards within the meaning of Article 46 relating to the transfer.
The data controller shall provide a copy of the personal data undergoing processing. In case of further copies requested by the data subject, the data controller may charge a reasonable fee based on administrative costs. If the data subject submits the request by electronic means, and unless otherwise indicated by the data subject, the information shall be provided in an electronic format in common use.
The right to obtain a copy referred to in paragraph 3 shall not adversely affect the rights and freedoms of others.
Article 16 – Right of rectification
The data subject has the right to obtain from the data controller the rectification of inaccurate personal data concerning him/her without undue delay. Taking into account the purposes of the processing, the data subject has the right to obtain the integration of incomplete personal data, also by providing a supplementary statement.
Article 17 – Right to erasure (“right to be forgotten”)
The data subject has the right to obtain from the data controller the deletion of personal data concerning him/her without unjustified delay and the data controller has the obligation to delete personal data without unjustified delay, if one of the following reasons exists:
- the personal data are no longer necessary with respect to the purposes for which they were collected or otherwise processed
- the data subject withdraws the consent on which the processing is based in accordance with Article 6(1)(a) or Article 9(2)(a) and if there is no other legal basis for the processing;
- the data subject opposes processing within the meaning of Article 21(1) and there is no overriding legitimate ground for processing, or opposes processing within the meaning of Article 21(2);
- personal data have been processed unlawfully
- personal data must be erased in order to comply with a legal obligation under Union law or the law of the Member State to which the controller is subject;
- personal data have been collected in connection with the provision of information society services referred to in Article 8(1).
Where the data controller has disclosed personal data to the public and is obliged, pursuant to paragraph 1, to delete them, taking into account available technology and implementation costs, the controller shall take reasonable steps, including technical measures, to inform the data controller who is processing the personal data of the data subject’s request to delete any link, copy or reproduction of his or her personal data.
- for the exercise of the right to freedom of expression and information
- for the performance of a legal obligation requiring processing under Union or Member State law to which the controller is subject or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
- on grounds of public interest in the field of public health in accordance with Article 9(2)(h) and (i) and Article 9(3);
- for purposes of archiving in the public interest, for scientific or historical research or for statistical purposes in accordance with Article 89(1), in so far as the right referred to in paragraph 1 is likely to render impossible or seriously jeopardise the attainment of the purposes of such processing;
- for the establishment, exercise or defence of a right in court.
Article 18 – Right of restriction of processing
The data subject has the right to obtain from the data controller the limitation of the processing when one of the following hypotheses applies:
- the data subject contests the accuracy of the personal data, for the period necessary for the data controller to verify the accuracy of such personal data;
- the processing is unlawful and the data subject opposes the deletion of the personal data and asks instead that its use be limited;
- although the data controller no longer needs them for the purposes of processing, the personal data are necessary for the data subject to ascertain, exercise or defend a right in court;
- the data subject has objected to the processing pursuant to article 21, paragraph 1, pending verification of whether the legitimate reasons of the data controller take precedence over those of the data subject.
Where processing is restricted pursuant to paragraph 1, such personal data shall be processed, except for storage, only with the consent of the data subject or for the establishment, exercise or defence of a right in court or for the protection of the rights of another natural or legal person or for reasons of substantial public interest of the Union or of a Member State.
The data subject who has obtained the restriction of processing pursuant to paragraph 1 shall be informed by the controller before the restriction is lifted