INFORMATION ON THE PROCESSING OF PERSONAL DATA OF USERS WHO FILL-IN THE “COMPLAINTS” FORM pursuant to Article 13 of Regulation (EU) 2016/679 – GDPR
Definitions
The definitions of the terms used in this Policy are to be understood as per Article 4 of Regulation (EU) 2016/679 (hereinafter also referred to as “GDPR” for brevity).
Identification details of the Data Controller
Identity of the Data Controller:
The Data Controller is Drafinsub S.r.l., VAT number 02627860105, a single-member company subject to the management and coordination of Sparrows Holding S.r.l., with registered office in Milan, Corso Concordia no. 11, postcode 20129 (MI), in the person of its pro tempore legal representative (hereinafter also referred to as the ‘Data Controller’).
Contact details of the Data Controller:
The Data Controller may be contacted:
- by e-mail, at [email protected]
- by mail, writing to the operational headquarters in Genoa, Via Molo Giano sn, postcode 16128 (GE) – Italy.
Purpose of the Policy
Drafinsub S.r.l. hereby provides the information referred to in Article 13 of the GDPR regarding the processing of the personal data you have provided by completing the form in the “Complaints” section of the Data Controller’s official website (www.drafinsub.com ).
Processing methods
Your personal data will be processed using manual, IT and electronic means, in accordance with procedures strictly related to the processing purposes set out below, with the implementation of security measures designed to ensure the confidentiality of the data in accordance with current legislation and to prevent unauthorised access by third parties or unauthorised personnel.
Your personal data is processed by authorised persons, namely employees or associates of the Data Controller, who have been identified in advance, trained and made aware of the legal obligations, and to whom specific access to the data has been granted for the performance of their duties.
Purpose of processing
The personal data you provide by completing the form on this website will be processed by the Data Controller for the following purposes:
- to manage and respond to the complaint submitted by the User;
- to protect the Data Controller’s rights in relation to the complaint submitted.
Legal basis for processing
The legal basis justifying the processing of your personal data for:
- the purpose indicated above in point 1) is the Data Controller’s legitimate interest in the proper management of its contractual relationships and in improving the service offered, pursuant to Article 6(1)(f) of the GDPR, balanced against the interest of the User who lodged the complaint in receiving a response in this regard (balancing test);
- the purpose indicated above in point 2) is the Data Controller’s legitimate interest in exercising or defending its rights in an out-of-court setting and, where necessary, in court, pursuant to Article 6(1)(f) of the GDPR, in relation to the objections raised by the User in the complaint. Following the balancing test carried out by the Data Controller, it has emerged that the interests or fundamental rights and freedoms of the data subject, taking into account their reasonable expectations, do not override the legitimate interest of the Data Controller.
Retention period for personal data
Your personal data, processed for the purposes set out above, will be retained in accordance with the principles of proportionality and necessity:
- in relation to the purpose referred to in point 1), until the complaint has been resolved;
- in relation to the purpose referred to in point 2), until the ordinary limitation period for the right expires (10 years, Article 2946 of the Italian Civil Code) or the time limit applicable to the specific case, or until the dispute is resolved, without prejudice to any retention obligations arising from applicable legislation or any requests from the competent authorities.
The obligation to provide personal data and the consequences of failure to do so
In accordance with Article 13(2)(e) of the GDPR, we inform you that the provision of your personal data (first name and surname, email address, telephone number, description of the issue) in the fields of this form marked with an asterisk (*) is mandatory to enable the Data Controller to initiate the verification process and respond to your complaint.
Failure to provide your personal data will make it impossible for the Data Controller to receive your complaint and process it correctly.
Recipients or categories of recipients of personal data
In order to achieve the purposes described above, personal data may also be disclosed to third parties acting as independent data controllers, including, but not limited to:
- Public authorities;
- Supervisory authorities;
- Professional firms or professionals;
- Legal advisers assisting the Data Controller.
Third parties who manage the website and provide IT and system support on behalf of the Data Controller, specifically appointed by the Data Controller as data processors pursuant to Article 28 of the GDPR, may have access to the areas where your personal data is stored.
Given the variable nature of the relationships, the updated list of Data Processors is available at any time by sending a request to: [email protected] .
Rights of the Data Subject
The Data Controller informs you that, as a data subject, pursuant to Article 15 et seq. of the GDPR and within the limits prescribed therein, you have:
| Article | Right | Description and Conditions |
|---|---|---|
| Art. 15 | Right of Access | the right to obtain data and information on the processing, in particular in relation to the type of personal data processed, the purposes for which the personal data are processed, the period of processing and the subjects to whom the data are communicated. |
| Art. 16 | Right to Rectification | the right to obtain the rectification or integration of inaccurate personal data concerning you. |
| Art. 17 | Right to Erasure – ‘Right to be Forgotten’ | the right to obtain the erasure of personal data concerning you in the following cases:
However, the storage of your personal data by the Data Controller is lawful if it is necessary to enable the Data Controller to fulfil a legal obligation or to establish, exercise or defend a right in court. |
| Art. 18 | Right to Restriction of Processing | the right to obtain that personal data concerning you be only stored without being used in the following cases:
|
| Art. 20 | Right to Data Portability | the right to receive personal data concerning you in a commonly used, machine-readable and interoperable format, where such data is processed on the basis of a contract or on the basis of your consent, and/or to request that the data be transmitted to another data controller, where feasible. |
| Art. 21 | Right to object | the right to object at any time to the processing of your personal data. |
| Art. 22 | Right not to be subject to automated decision-making | the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you, and the right to request, on any automated decision, including profiling, human intervention on the part of the Data Controller on the automated intervention carried out by the latter, to express your opinion and to contest the decision. |
The aforementioned rights may be exercised upon request, to be sent to the Data Controller at the dedicated email address [email protected] or by writing by mail to Drafinsub S.r.l., Via Molo Giano sn, 16128 Genoa (GE) – Italy.
| Article | Right | Description and Details |
|---|---|---|
| Art. 77 | Right to lodge a complaint with the supervisory authority | Without prejudice to any other administrative or judicial remedy, if you, as the data subject, believe that the processing of your personal data by the Data Controller is in breach of Regulation (EU) 2016/679, you have the right to lodge a complaint with the Data Protection Authority (GPDP).
Italian Data Protection Authority: |
| Art. 79 | Right to effective judicial remedy | Without prejudice to any other administrative or non-judicial remedy available, including the right to lodge a complaint with a supervisory authority pursuant to Article 77, every Data Subject shall have the right to an effective judicial remedy where they consider that their rights under the GDPR have been infringed as a result of processing. |
The Data Controller reserves the right to update or amend this policy at any time in the event of regulatory, organisational or technological changes. Any amendments will be published on the website.
The Data Controller
Drafinsub S.r.l.