Privacy Policy

This document of privacy policy, updated with the EU Regulation (GDPR) 2016/679 concerning the processing of personal data, as well as with the Legislative Decree 181/18 which modifies the Legislative Decree 196/2003, adjust the modes of data processing collected from a website during the navigation by the user.

It has the specific purpose of inform the user about the processing of your personal data in accordance with the law and the recent EU Regulation 679/2016, which has profoundly changed the discipline.

A website must have a Data Controller (Data Controller) . The data controller is the one who has decision-making and organizational power over the treatment, as well as deciding the methods of data processing and is responsible towards the privacy guarantor. Two or more co-owners can also be appointed. In this case, it is mandatory for the user to know what the responsibilities of each joint controller are, through a link indicating the agreement between them.

The data controller is supported by the Data Processor . This figure is the person who processes the data on behalf of the data controller. This means that it will be a subject close to the owner, from whom it receives directives on how to manage the data. The Data Processor must be a competent figure capable of fully satisfying the security implemented by the Data Controller.

These two figures are flanked by the Data Protection Officer (DPO), which, despite being appointed directly by the owner, is in any case an independent subject from the latter. The DPO, previously only optional, is now a sometimes mandatory figure under Article 37 of Regulation (EU) 679/2016. This article indicates the obliged subjects and those who are exempt from them. In any case, the DPO, called DPO in Italian, is an independent subject and processes the data autonomously. Furthermore, he is directly responsible and communicates with the privacy guarantor. Ultimately, the designation of the DPO reflects the new approach of the GDPR, towards a accountability for data processing, being aimed at facilitating the implementation of the regulation by the owner and the manager. The role of DPO is to protect personal data, not the interests of the data controller.

Therefore, while the Data Processor is a figure close to the Data Controller, the DPO is a much more independent figure, who cannot and must not receive orders from the Data Controller on effective data protection.

Returning to the information, the place where the data will be processed, which coincides with the headquarters of the data controller.

It is essential to also include the purpose of data processing. In fact, according to the new legislation, the data must be kept for a period suitable for achieving the purposes set by the site, to then be deleted. Therefore it is mandatory that the purposes are indicated in a clear and concise manner within the information.

The document must also indicate the types of Cookies which are used on the web page. Cookies are small pieces of information that can be saved on the user's computer when the browser calls up a specific website. With them, the server sends information that will be read and updated every time the user returns to the site.

There are various types of cookies:

  • Technical cookies : according to the law, they are those used for the sole purpose of "carrying out the transmission of a communication over an electronic communications network, or as strictly necessary for the provider of an information society service explicitly requested by the subscriber or user to provide this service". They are not used for other purposes and are normally installed directly by the owner or manager of the website.
  • Third party cookies: they occur when a third party places cookies on an internet page. In this case, the user must be informed that there will be cookies of other subjects in addition to those of the web page. Typical third-party cookies are those of social networks
  • Profiling cookies: they are aimed at creating profiles relating to the user and are used in order to send advertising messages in line with the preferences expressed by the same in the context of surfing the net. According to the privacy guarantor these can be:
    • Of advertising profiling , i.e. they collect and process user data for advertising purposes (e.g. to pass them on to advertising agencies);
    • Of retargeting activities , consisting of forms of online advertising chosen on the basis of the user's previous actions or searches on the web (e.g. Google AdWords);
    • set by social networks ;
    • Of statistical activities, managed by third parties (e.g. Google Analytics).

In the document you must also indicate if the site allows social network plug-ins and the possible transfer of data to companies located in non-continental countries.

It is also important to mention what are the new rights of the data subject under the new European legislation, such as the right to data deletion, the update of the same or of oppose to any data transfer.

How to use the document?

Through this document you will be able to:

  • Indicate the website for which the following document is used;
  • Indicate the data owner and the place in which these will be treated;
  • Indicate the possible presence of multiple holders of the treatment;
  • Indicate the responsible of data (DPO);
  • Indicate which are the purpose of data processing, and the time that the site will need to use them;
  • Determine which ones Cookies will be used by the site, if only technical cookies, third-party cookies and/or profiling cookies;
  • Indicate if the site uses social network plug-ins;
  • Indicate whether the user will receive notifications for any site updates.

Once you have the document, it must be inserted into the web page of the site and made available to the user.

Reference legislation

REGULATION (EU) 2016/679 of the European Parliament and the Council, of 27 April 2016, concerning the protection of natural persons with regard to the processing of personal data, as well as the free movement of such data and which repeals Directive 95/46/EC (general regulation on data protection).

Legislative Decree 181/18, containing "Provisions for the adaptation of national legislation to the provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data, as well as on the free movement of such data and repealing Directive 95/46/EC (general regulation on data protection)" amending the Legislative Decree 196/2003 , "Personal data protection code."

Provision of the Privacy Guarantor n. 229/2014 , relating to the "Identification of simplified procedures for the information and the acquisition of consent for the use of cookies."