INFORMATION NOTICE ON THE PROCESSING OF PERSONAL DATA
pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (“GDPR”)
Angela Moriggi (hereinafter also “Controller” or “Licensor”), as data controller, hereby informs you pursuant to Articles 13 and 14 of European Regulation 679/2016 on the protection of personal data (“GDPR”) as follows.
1. TYPES OF DATA PROCESSED
The Licensor is the controller of personal data provided at the time of signing the Contract and subsequently supplied during the performance of the Contract.
Personal data collected by the Licensor in connection with the management of the contractual relationship and any pre-contractual phases may be provided directly by the data subject (as defined below) or by the Customer, in the case of internal contacts designated by the Customer for Contract management.
Personal data processed by the Licensor may include, by way of example but not limited to: names, job titles, telephone numbers, tax codes, payment and banking details, company names and email addresses of individuals and legal representatives of companies as contracting parties to the Contract, as well as internal contacts for contract management (hereinafter, the “Data Subjects” and “Data”).
Certain information, such as data concerning representatives and attorneys or financial statements or customer creditworthiness, is also acquired from public sources (e.g., Chambers of Commerce or commercial information services).
2. PURPOSES OF THE PROCESSING
Data processing is carried out by the Licensor in the performance of its economic and commercial activities for purposes related to the establishment, management and execution of business relationships, including pre-contractual relationship management.
In particular, Data provided by Data Subjects will be processed, mainly through IT tools, for the following purposes:
a) performance of obligations strictly related to Contract management, including administrative and accounting management of contracts, payment and invoice management, service delivery and customer support services management. The provision of data for these activities is essential for proper Contract management and does not require the Data Subject’s consent (Article 6(1)(b) of the GDPR);
b) performance of ancillary activities related to Contract management, including activity planning, dispute management and credit recovery. The provision of data for these purposes, where necessary, is optional and processing is based on the Licensor’s legitimate interest;
c) compliance with obligations arising from laws, regulations or EU legislation (e.g., tax and accounting obligations) for which data provision is mandatory and processing does not require the Data Subject’s consent (Article 6(1)(c) of the GDPR).
3. METHODS OF PROCESSING
Data will be processed by the Company using both electronic and manual means in accordance with the principles of fairness, lawfulness and transparency provided by applicable data protection legislation, and protecting the Data Subject’s confidentiality through technical and organizational security measures to ensure an adequate level of security.
4. DATA RETENTION
Data necessary for Contract management and fulfillment of the obligations referred to in points 2(a) and 2(b) of this notice will be stored by the Controller in its records for 10 years following the recording of operations, in compliance with civil and tax obligations imposed by current legislation. Similarly, Data referred to in point 2(c) necessary for protection in case of disputes or controversies will be retained for 10 years from Contract termination.
5. COMMUNICATION, DISCLOSURE AND DATA TRANSFER
Data will be processed, to the extent necessary, by authorized personnel, adequately instructed and trained, of the Controller, as well as by personnel of third parties who provide services to the Controller and process Data on behalf of and under the instructions of the latter as data processors.
These include providers of IT services (e.g., hosting providers), call center services, credit recovery activities, customer support services (e.g., ticketing management), marketing support services (e.g., direct email marketing) and third-party companies, including Angela Moriggi group companies, providing complementary activities. The complete and updated list of entities processing Data as data processors is available upon request to the Data Protection Officer.
In cases where the contractual relationship involves our business partners, the Controller may share certain Data with distributors, resellers and partners in the Angela Moriggi products and services distribution chain.
In carrying out its ordinary business activities, Data may be communicated to entities performing audit, review and certification activities of the Controller’s operations, consultants and freelance professionals in the context of tax and legal assistance services and in case of corporate transactions requiring evaluation of company assets, to other Angela Moriggi group companies where necessary for group coordination and control purposes, to public entities and administrations, including tax authorities where necessary, as well as to persons legally entitled to receive such information, Italian and foreign judicial authorities and other public authorities, for purposes related to compliance with legal obligations, or for fulfillment of obligations assumed and arising from the contractual relationship, including for defense purposes in legal proceedings. Contact details may be shared occasionally with customers and/or suppliers of the Controller, for example when they must collaborate with such parties for service provision.
Data will not be disseminated under any circumstances nor will they generally be transferred outside the European Union. However, for specific needs related to the location of third parties with whom Data may be shared, as described above, some Data may be transferred outside the European Economic Area to countries offering adequate protection. In cases where the third country does not offer adequate protection, the Controller undertakes to ensure adequate levels of protection and safeguards, including contractual ones, such as standard contractual clauses (a copy of the commitments assumed by third parties in the context of such clauses may be requested by contacting the Data Protection Officer).
6. MARKETING AND PROFILING
With the Data Subject’s consent, Data may be processed by the Controller for the following purposes:
a) sending offers and commercial initiatives relating to Angela Moriggi companies’ products or services via email, automated messages or telephone, as well as conducting market research or other customer satisfaction initiatives promoted by the Controller. If any data is required for this purpose (a rare occurrence), its provision will be optional. It is understood that data processing for this purpose will only be possible with the Data Subject’s consent (Article 6(1)(a) of the GDPR). Consent may be withdrawn at any time, freely in the manner indicated in point 7 below or through the unsubscribe link available in each electronic communication. Any failure to provide or withdrawal of consent does not prejudice Contract execution in any way;
b) analysis of usage habits of Angela Moriggi products and services by the Data Subject based on what may be considered of interest, both to improve products and services with features that may be of greater interest to customers and to offer products that could more precisely meet the Data Subject’s needs. If any data is required for this purpose (a rare occurrence), its provision will be optional. It is understood that data processing for this purpose will only be possible with the Data Subject’s consent (Article 6(1)(a) of the GDPR). Any use of information relating to the use of products or services attributable to the Customer as a legal entity may be carried out by the Controller without specific consent, unless otherwise provided by law. Consent may be withdrawn at any time freely in the manner indicated in point 7 below; any failure to provide or withdrawal of consent does not prejudice Contract execution in any way.
With the Data Subject’s consent, for the purpose of receiving promotions and commercial initiatives, the Licensor may also communicate Data to Angela Moriggi group companies involved in software development, partner training, and Angela Moriggi suppliers for them to send promotions and commercial initiatives.
Subject to the exercise of data deletion rights and rights of objection and limitation of processing referred to in point 7 of this notice, Data processed for the purposes of this point will be stored and processed in compliance with applicable personal data protection legislation for the entire period necessary to fulfill the above purposes, up to a maximum of 24 months or the maximum period permitted by law for profiling as per point (a) above; otherwise, for the purposes referred to in point (b) above, processing will be carried out until the Data Subject withdraws consent.
7. DATA SUBJECT RIGHTS
The Data Subject may exercise, in relation to the data processing described herein, the rights provided by the GDPR (Articles 15-21), including:
– receiving confirmation of the existence of Data and accessing their content (right of access);
– updating, modifying and/or correcting Data (right to rectification);
– requesting deletion or limitation of processing of Data processed in violation of law, including those whose retention is not necessary in relation to the purposes for which Data were collected or otherwise processed (right to erasure and right to restriction);
– objecting to processing (right to object);
– withdrawing consent, where given, without prejudice to the lawfulness of processing based on consent given before withdrawal;
– lodging a complaint with the Supervisory Authority (Italian Data Protection Authority www.garanteprivacy.it) in case of violation of personal data protection regulations;
– receiving an electronic copy of Data concerning them as Data Subject, when such Data have been provided in the context of the contract, and requesting that such Data be transmitted to another controller (right to data portability).
To exercise these rights, the Data Subject may contact the Data Protection Officer by sending their request by mail to:
Angela Moriggi
angela.moriggi@unipd.it
