NOTICE PURSUANT TO ART. 13 of EU REG. No. 679/2016
ON THE PROCESSING OF PERSONAL DATA OF CUSTOMERS
Ustec S.r.l., with registered office at Via L. da Vinci, 28 – 47021, San Piero in Bagno (FC) – Italy, email address privacy@ustecgroup.com, tel. 0543 1902111, represented pro tempore by its legal representative, in the capacity of DATA CONTROLLER (hereinafter referred to as the “Controller”), hereby informs you, pursuant to Art. 13 of EU Regulation no. 2016/679 (hereinafter “GDPR”), that the data you provide will be processed for the following purposes:
Subject of processing
For the purpose of establishing and managing its relationship with you, the Controller processes:
- your personal (not including special categories), identifying, contact and fiscal data (e.g. name, surname, company name, address, telephone number, email, bank and payment details, etc.).
Purpose of processing and legal basis
Your personal data is processed for the following purposes:
- to conclude contracts for the services provided by the Controller and to fulfil the corresponding contractual obligations undertaken by the parties. Legal basis: performance of a contract or pre-contractual measures (Art. 6, lett. b, GDPR);
- to comply with fiscal and statutory obligations required by law (e.g. issuing invoices), regulations, EU legislation, or orders of the competent Authority. Legal basis: legal obligation (Art. 6, lett. c, GDPR);
- to exercise the rights of the Controller (e.g. the right of defence in legal proceedings). Legal basis: legitimate interest of the Controller (Art. 6, lett. f, GDPR).
Provision of data and consequences of non-disclosure
Providing data for the purposes listed in points 2.a), 2.b), 2.c) does not require consent. If this data is not provided, we will not be able to provide our services.
Data access
Your data may be made accessible:
- To employees and collaborators of the Controller in their capacity as data processors and/or system administrators;
- To third-party companies or other parties (e.g.: professional firms, consultants, software providers, banks, insurance companies, etc.) carrying out outsourced activities on behalf of the Controller, in their capacity as external data processors.
Data disclosure
The Controller may disclose your data to Public Authorities, Supervisory Bodies, and/or Judicial Authorities, as well as to any other parties to whom disclosure is mandatory or necessary under the law. Your personal data will not be disclosed publicly.
Data transfers
We inform you that your data is stored within Europe. However, should it be necessary, the Controller may transfer data to non-EU countries. In this case, the Controller ensures that the transfer of data to non-EU countries will comply with applicable legal provisions, including, if necessary, entering into agreements guaranteeing an adequate level of protection and/or adopting the standard contractual clauses provided by the European Commission and/or binding corporate rules.
Data retention
All personal data provided will be processed in compliance with principles of lawfulness, fairness, relevance and proportionality, using only methods, including electronic means, that are strictly necessary to achieve the purposes described above.
The personal data referred to in points 2.a) and 2.b) will be kept for 10 (ten) years from the date of the last record (in accordance with Art. 2220 of the Italian Civil Code). The personal data referred to in point 2.c) will be kept for as long as necessary to exercise or defend a right in court, and in any case until the expiry of the statutory limitation periods provided by law.
Data subjects’ rights
Pursuant to Art. 15-22 of EU Reg. no. 679/2016, the data subject can exercise specific rights. In particular, the data subject has the right to: a) obtain confirmation of the existence of personal data concerning them and access such data; b) obtain the rectification of inaccurate personal data and the completion of incomplete personal data; c) obtain the erasure of personal data where permitted by the Regulation; d) obtain restriction of processing in the cases provided by the Regulation; e) be informed of the recipients to whom their personal data has been disclosed in case of requests for rectification/erasure or restriction of processing, unless this proves impossible or involves disproportionate effort;; f) receive personal data provided to the Controller in a structured, commonly used, machine-readable format, and transfer such data to another Controller, at any time, including after the termination of any relationship with the Controller; g) object at any time, for reasons relating to their particular situation, to the processing of personal data concerning them, pursuant to Art. 6, para. 1, lett. e) or f), including profiling. If personal data is processed for direct marketing purposes, the data subject has the right to object at any time to such processing, including profiling related to direct marketing; h) not be subject to a decision based solely on automated processing, including profiling, producing legal effects concerning them or similarly significantly affecting them; i) lodge a complaint with a supervisory authority pursuant to Art. 77.
Exercising your rights
You may exercise your rights at any time by contacting the Controller at the addresses indicated at the beginning of this notice.
External data processors and appointed persons
An updated list of external processors and appointed persons is kept at the Controller’s registered office.
Right to lodge a complaint with the Data Protection Authority
If you believe that the processing of your data infringes your rights in any way, you may lodge a complaint with the Italian Data Protection Authority, as provided under Art. 77 of the GDPR, following the procedures on the website: www.garanteprivacy.it.