POLICY ON PROCESSING OF PERSONAL DATA

pursuant to art. 13 of Regulation (EU) 2016/679

Last updated: September 15, 2020

GENERAL INFORMATION

With this information the company STUDIO AMBIENTE S.R.L. with registered office in via Monte Baldo, 4 – 37069 Villafranca di Verona (VR), F.C. and VAT no. 03427230234, R.E.A. VR-335460, share capital € 10.000, tel. +39 045 987304, fax +39 045 8618049, e-mail info@studioambiente.biz, PEC studioambiente@legalmail.it, as Data Controller – wishes to inform you about the processing of the personal data you provide by browsing this Website www.studioambiente.biz.

For any clarification, information, exercise of the rights listed in this information, the contact details of the Data Controller are:
e-mail: info@studioambiente.biz;
address for registered mail: via Monte Baldo, 4 – 37069 Villafranca di Verona (VR).

EU Reg. 2016/679 and Legislative Decree 196/2003, as amended by Legislative Decree 101/2018, establish the rules to protect and safeguard individuals with regard to the processing of their personal data and this information notice is drawn up in accordance with the new legislative decree.

The information may be subject to changes as a result of the introduction of new regulations, so please visit this section periodically for updates.

The Privacy Policy that you are reading is exclusively referable to the Website www.studioambiente.biz and the Data Controller is not responsible for the management of personal data processing carried out by third party websites that can be linked through the Cookie section, or through any window-links present on the Homepage.

According to the law, the processing of personal data is based on the principles of correctness, lawfulness, transparency, accuracy, limitation of purposes and storage, minimization, data integrity, protection of the user’s privacy and protection of his rights.
The Data Controller undertakes to observe the above principles and, also for this purpose, informs you from the outset that – with the exception of those processing operations to which your explicit consent is required by law – by browsing this Website, uploading or providing personal data, you agree and consent to be bound by the conditions and terms set out in this information notice. The consent to the processing of data issued by the user may be revoked at any time by contacting the above addresses.

The Data Controller will process this data in compliance with the applicable legislation, assuming that it refers to the user or to third parties who have expressly authorised him/her to provide it on the basis of an appropriate legal basis that legitimates the processing of the data in question. With respect to these hypotheses, the user is the autonomous data controller, assuming all the obligations and responsibilities of the law. In this sense, he or she grants the widest possible indemnity on this point with respect to any dispute, claim, request for compensation for damage caused by processing, etc. that may reach the Data Controller by third parties whose personal data has been processed through his or her use of the Site in violation of applicable legislation.

If you are under 16 years of age, your consent is legitimate only if given or authorised by the person with parental responsibility towards you, in accordance with the provisions of Art. 8 EU Reg. 2016/679. For the interested parties who are on Italian territory, consent is legitimate, under the same conditions as above, also for the person who has reached the age of 14.

In any case, we would like to give you some information on the personal data processing activities carried out by this Website and on the subjects who manage them.

SUMMARY

DATA CONTROLLER
PERSONAL DATA PROCESSED
PURPOSE OF THE PROCESSING
LEGAL BASIS FOR DATA PROCESSING
DATA RETENTION PERIOD
TREATMENT MODALITIES
RECIPIENTS OF PERSONAL DATA
SCOPE OF DATA CIRCULATION
USER’S RIGHTS ACCORDING TO REG. UE 2016/679

1. DATA CONTROLLER

The Data Controller is the natural or legal person, public authority, service or other body which, individually or jointly with others, determines the purposes and means of the processing of personal data. It also deals with security profiles.
With regard to this Website, the Data Controller is the company Studio Ambiente S.r.l., as specified above, and for any clarification or exercise of your rights you may contact it at the following e-mail address: info@studioambiente.biz.

2. PERSONAL DATA PROCESSED

Personal data means all information that could directly or indirectly allow the identification of users.

a) Browsing data

The computer systems and software procedures used to operate this Site acquire, during their normal operation, some personal data whose transmission is implicit in the use of Internet communication protocols.

This category of data includes IP addresses or domain names of the computers and terminals used by users, URI/URL (Uniform Resource Identifier/Locator) addresses of the resources requested, the time of the request, the method used to submit the request to the server, the size of the file obtained in reply, the numerical code indicating the status of the reply given by the server (successful, error, etc.) and other parameters relating to the user’s operating system and computer environment.

These data, necessary for the use of web services, are also processed for the purpose of:

obtain statistical information on the use of the services (most visited pages, number of visitors per time slot or day, geographical areas of origin, etc.);
check the correct functioning of the services offered.

b) Data provided by the user

The optional, explicit and voluntary sending of messages to the Data Controller e-mail address, private messages sent by users to the Data Controller social profiles, as well as the filling in and forwarding of the contact form on the Website, involves the acquisition of the sender contact data, necessary to reply, as well as all personal data included in the communications.

With regard to the “Contact Us” form, the release of the requested data does not depend on a legal or contractual obligation. Their release is therefore optional, however the omission of the data to be entered in the mandatory fields does not allow the Data Controller to verify the request sent.
The data retention period ends with the fulfilment of the requested service, unless a contract is stipulated from this. In this case, the data will be kept for ten years from the stipulation of the contract for judicial protection in the event of disputes arising from the contract.

c) Cookies and other tracking systems

Cookies are not used for user profiling, nor are other tracking methods used.
Please read the Cookie Policy regarding the types of cookies loaded on this Website.

3. PURPOSE OF THE PROCESSING

With the exception of the provisions concerning the individual processing activities of personal data present on the Site, in general the purposes of the processing pursued are as follows:

to respond to requests for information and, in general, to contact the user;
to carry out pre-contractual and contractual obligations with respect to established legal relationships, even at a distance;
to fulfil legal obligations;
to manage management, administrative, accounting and fiscal obligations;
storage, hosting and backend infrastructure management of the Site;
statistics and cookie management;
preventing and detecting any abuse in the use of the Website, or any fraudulent activity and therefore allowing the Data Controllers to protect themselves in court.

4. LEGAL BASIS FOR DATA PROCESSING

The legal bases for the processing of personal data provided by the user during navigation on the Site are:

the fulfilment of a legal obligation to which the Data Controller is subject pursuant to Art. 6 co 1 letter c) GDPR with regard to the fulfilment of obligations provided for by law, regulations, Community legislation or an order of the Authority;
the execution of a contract to which the Data Subject is an interested party i.e. the execution of pre-contractual measures adopted at the request of the same, pursuant to art. 6 co 1 letter b) GDPR with regard to the data collected in order to respond to requests for information from users sent via the appropriate contact form;
the legitimate interest ex art. 6 co 1 lett. f) GDPR for the management of the backend infrastructure of the Site, for the management of technical and analytical cookies present on the Site and, more generally, for the exercise of its rights in the context of the information society

5. DATA RETENTION PERIOD

The data processed to fulfil legal obligations will be kept until fulfilment of the same, and in any case for the period of time necessary to prove fulfilment; the data processed to fulfil contractual purposes until fulfilment of the same and, if a contract is concluded or there have been pre-contractual negotiations, for ten years from the stipulation of the same in order to allow possible judicial or extra-judicial protection as well as the demonstration of the correct fulfilment of the obligations contractually assumed.

When the processing of personal data is necessary for the pursuit of a legitimate interest of the Data Controller, the personal data will be kept until such interest is satisfied or until the possible opposition of the Data Subject, to be exercised in the manner indicated below.

The data processed for the purposes of Prevention of Abuse and Fraud for the time strictly necessary to allow the Data Controller to defend himself in court.

6. TREATMENT MODALITIES

On this Website, data is collected electronically and processed through operations carried out mainly with the use of electronic instruments, ensuring the use of suitable measures for the security of the data processed and guaranteeing its confidentiality.
This Website does not provide for the existence of an automated decision making process for commercial profiling purposes (a targeted marketing technique that includes the collection and processing of users’ data for the purpose of understanding their choices and behaviour in order to divide interests into “profiles”, i.e. into homogeneous groups for increasingly specific behaviour or characteristics).

7. RECIPENTS OF PERSONAL DATA

The categories of recipients who may become aware of your personal data during or after the execution of the contract are:

the subjects who process the data in execution of specific legal obligations;
external consultants who provide services functional to the purposes indicated above, identified in writing and to whom specific written instructions have been given with reference to the processing of personal data;
subjects with whom it is necessary to interact in order to provide the requested services (e.g. hosting providers, etc.);
subjects necessary for the provision of the services offered by the Site including, by way of example, the sending of e-mails and the analysis of the functioning of the Site, who typically act as data processors on behalf of the Data Controller;
persons authorised by the Data Controller to process personal data necessary to carry out activities strictly related to the provision of the Services, who are committed to confidentiality or have an adequate legal obligation of confidentiality (e.g. employees and collaborators of the Data Controller);
in general, to all those public and private subjects for whom communication is necessary for the correct and complete fulfilment of the purposes indicated.

Users’ personal data may be communicated to Judicial Authorities and Police Forces only in cases where this is provided for by law and used by the Data Controller for the purpose of possible defence of his rights in court, where strictly necessary.

8. SCOPE OF DATA CIRCULATION

The processing of personal data relating to the services of the Website takes place at the headquarters of the Data Controller and is carried out only by personnel authorised to process such data. The data collected will not be disclosed.
However, for the effective performance of the service requested, some data will be shared with external parties called to perform specific tasks on behalf of the Data Controller (e.g. hosting, housing, cloud, email service providers for the needs of Site publication and management of the email/PEC service, web agencies, marketing consultants, professionals, etc.).
The data collected will not be transferred to third countries or international organisations.
If, in order to provide certain services, personal data should be transferred to third countries or organisations (e.g. where the hosting servers or suppliers are located), the Data Controller ensures that the processing of your personal data by these recipients is carried out in compliance with the applicable legislation, or based on an adequacy decision pursuant to art. 45 of EU Regulation 2016/679 or, where there is no such decision, on the use of standard contractual clauses approved by the European Commission pursuant to art. 46 of EU Regulation 2016/679.

Further information is available from the Data Controller by writing to the following address: info@studioambiente.biz.
The Data Controller undertakes to protect the security of personal data by taking all necessary computer and physical measures to protect the personal data provided. No security system guarantees this protection with absolute certainty, therefore, except in cases of liability for negligence, the Data Controller is not liable for third parties who illegally access the systems without due authorisation. For these reasons, users of the Site are advised to ensure that their computer is equipped with software suitable for the protection of network data transmission (e.g. updated antivirus software) and that their Internet provider has adopted suitable measures for the security of network data transmission.

9. USER’S RIGHTS ACCORDING TO REG. UE 2016/679

Article 13 par. 2 and Articles 15 to 22 of EU Reg. 2016/679 (GDPR) list the user’s rights.
The Data Controller therefore wishes to inform you of their existence:

the right of the data subject to ask the data controller for access to personal data (art. 15 GDPR), rectification (art. 16 GDPR) or limitation of processing concerning him/her (art. 18 GDPR) or to oppose, for legitimate reasons, their processing (art. 21 GDPR), as well as the right to data portability (art. 20 GDPR);
the right to request cancellation (art. 17 GDPR), transformation into anonymous form or blocking of data processed unlawfully, including data whose retention is unnecessary for the purposes for which the data were collected or subsequently processed.

Requests may be addressed to the Data Controller, without formality or, alternatively, using the model provided by the Personal Data Protection Guarantor available on the Site: http://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/1089924, by sending an e-mail to: info@studioambiente.biz.

Where the processing is based on Article 6(1)(a) or Article 9(2)(a), the user has the right to withdraw consent at any time without prejudice to the lawfulness of the processing based on the consent given before the withdrawal.

Likewise, in case of violation of the law, the user has the right to lodge a complaint with the Guarantor for the Protection of Personal Data, as the authority responsible for monitoring the processing in the Italian State. The model for submitting a complaint to the Privacy Guarantor can be found at the address: http://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/4535524.

For a more detailed examination of your rights, see Articles 15 et seq. GDPR. For the exercise of one or more of the aforementioned rights, you may contact us at the following e-mail address: info@studioambiente.biz.