Snapshot 40392
Normalized text
Scripts and page chrome removed; this is what change detection compares.
Via delle Industrie 27/7 Alpenite S.r.l. soggetta a direzione
30175 Venezia Marghera, IT e coordinamento di Arsenalia GmbH
accounting.it@alpenite.com C.F./P.I. IT04022760278
+39 041 8872244 Reg. Imprese VE, REA VE-358612
www.alpenite.com Cap. soc. € 150.000 i.v.
PERSONAL DATA PROCESSING – PRIVACY POLICY (ART. 13 REG. (UE) 2016/679)
The processing of personal data of the people involved in internal reports
(reporting person, vis-à-vis facilitators, individuals mentioned in the internal
reports as people the reported breach was reffered to or as people
nevertheless implied in the reported breach) shall be carried out by Alpenite
Srl, with registered office in 30175 - Venezia Marghera in via delle industrie
27/7 P.IVA 04022760278, in the quality of personal data processor, pursuant
to EU Regulation 2016/679 (following referred to as “the Regulation”) and to
the applicable law in the matter of personal data protection and, especially, in
accordance with the principles expressed in the articles 5 and 25 of the
Regulation.
PERSONAL DATA PROCESSOR
The Processor may share personal data regarding the reports (if specified in
the report) with other companies of the Arsenalia GBMH group, though a joint
controlling agreement. In any case, an adequate level of protection is granted
by third parties that may process data on behalf of the personal data
controller.
PROCESSING OF PERSONAL DATA
In particular, with reference to internal reports, specific categories of personal
data may be processed (art. 9 GDPR), even those regarding criminal convictions
and offences (art. 10 GDPR) of the Reporting Person and/or the people
involved in the report. Personal data that are not strictly necessary for the
processing of a specific internal report shall not be collected and, in case of
accidental collection, shall be immediately deleted.
These are examples of the kind of data which may be processed:
- Data regarding the professional life of the reporting person (e.g.
company role);
- Any information regarding the reporting person or other individuals
involved in the report and shared by the reporting person to provide
useful details to the report;
- Documents or deeds that may be attached by the reporting person;
- Personal data of the reporting person (e.g. name, surname)
- Any information the reporting person, or other individuals involved in
the report may share to manage the report.
Pag. 1 di 5
Via delle Industrie 27/7 Alpenite S.r.l. soggetta a direzione
30175 Venezia Marghera, IT e coordinamento di Arsenalia GmbH
accounting.it@alpenite.com C.F./P.I. IT04022760278
+39 041 8872244 Reg. Imprese VE, REA VE-358612
www.alpenite.com Cap. soc. € 150.000 i.v.
In the case of anonymous report, no data regarding the reporting person shall
be collected.
PURPOSE AND LEGAL BASIS FOR DATA PROCESSING
Data shall be processed with the only purpose of managing and drafting the
internal reports and to fulfill any other necessary activity, in accordance with
limitations imposed by the Regulation 679/2016, which is the legal basis for
data processing.
The reporting person shall provide the personal data necessary to perform the
report: non disclosing such data implies the impossibility to perform the
internal report.
Conferring other personal data (e.g. biographic data of the reporting person)
is, otherwise, optional: non disclosing such data shall not imply the
impossibility perform the internal report.
By accepting this Privacy Policy, the reporting person specifically agrees to
have his/her personal data processed for the following purposes:
- Pursuant to article 12, paragraph 2 of the Decree, to authorize the
Processor to disclose his identity and any other information that may
reveal, directly or indirectly, the identity to any other subject that may
deemed appropriate to manage the report;
- Pursuant to art. 14, paragraph 4 of the Decree, if the report is carried
out orally during a meeting with the Processor, to document what is said
by registering the conversation with a suitable device or with an
accurate transcript;
- Pursuant to art. 12, paragraph 5 of the Decree, to authorize disclosure
of the Reporting Person identity for the purpose of using the report in a
disciplinary proceeding, if the claim is based on such report and it is
essential to disclose the Reporting Person’s identity to grant the subject
of disciplinary proceeding the right of defense.
DATA PROCESSING MODALITIES
The Data Controller takes all the technical and organizational measures that
grant the protection of the identity and the privacy of the reporting person, of
the people involved and/or mentioned in the report. The content of the report
and of the documentation possibly attached is also protected. In particular, the
processing of personal data may be carried out using automatized tools (e.g.
Pag. 2 di 5
Via delle Industrie 27/7 Alpenite S.r.l. soggetta a direzione
30175 Venezia Marghera, IT e coordinamento di Arsenalia GmbH
accounting.it@alpenite.com C.F./P.I. IT04022760278
+39 041 8872244 Reg. Imprese VE, REA VE-358612
www.alpenite.com Cap. soc. € 150.000 i.v.
online platforms that resort to the use of encryption tools and are for that
purpose designed).
Personal data that are not useful to the processing of a specific report, in case
of accidental collection, shall be deleted once their relevance shall be
excluded.
RETENTION PERIOD
Personal data included in internal reports and their documentation shall be
retained for the time necessary to perform the internal report and, in any case,
for no longer than 5 (five) years from the moment when the final outcome of
the procedure is notified, according to the principle expressed in article 5, par.
1, lett) e of the Regulation.
COMMUNICATION OF PERSONAL DATA
Personal data included in internal reports may be processed by the Processor
and by the subjects appointed by him and shall not be communicated to third
parties, except for communication to competent administrative judicial
authorities, in accordance to the applicable law.
Personal data included in internal report shall not be shared outside the
company, unless for requests from competent authorities, and neither be
transferred in a third country outside the EU.
RIGHTS OF DATA SUBJECTS
Individuals whose data are identified or identifiable may exercise the following
rights, as provided in Regulation 2016/679:
- Right of access by the data subject (art. 15 GDPR): the right to have the
confirmation from the Company whether the processing of data is
performed or not and in case it is, to obtain the access to it. The data
subject has the right to obtain the disclosure (i) of the personal data
provenience; (ii) of the purposes and modalities of the processing; (iii)
of the logic applied in case of processing carried out with the aid of
electronic instruments; (iv) of the identification details of the Processor,
of the people responsible of the processing (art. 4 n.8) GDPR) and of the
subject responsible of the protection of data appointed by the
Processor, pursuant to art. 37 of the GDPR (DPO); (v) of the subjects or
the groups of subjects that can receive personal data or can get to know
Pag. 3 di 5
Via delle Industrie 27/7 Alpenite S.r.l. soggetta a direzione
30175 Venezia Marghera, IT e coordinamento di Arsenalia GmbH
accounting.it@alpenite.com C.F./P.I. IT04022760278
+39 041 8872244 Reg. Imprese VE, REA VE-358612
www.alpenite.com Cap. soc. € 150.000 i.v.
them, being the responsible or appointed or representative appointed in
the territory of the State;
- Right to rectification (art. 16 GDPR): the right to obtain the rectification
of inaccurate data and/or the integration of uncompleted data;
- Right to erasure - or to be forgotten – (art. 17 GDPR): the right to obtain
the erasure, transformation in anonymous form or the blockage of the
data processed in breach with the applicable law, including those that
are no longer necessary to retain for the purposes the data were
collected for, or processed Personal Data in specific circumstances
provided by law;
- Right to restriction of processing (art. 18 GDPR): the right to oppose to
the processing, or to obtain the limitation of the processing of Personal
Data, pursuant to the applicable law;
- Notification obligation regarding rectification or erasure of personal
data or restriction of processing (art. 19 GDPR)
- Right to data portability (art. 20 GDPR): the right to receive the Personal
Data in a format structured, of common usage and readable on the
computer level, as well as the right to convey the data to another
Processor – this right to portability is applied only to the Personal Data
disclosed by the interested person and may be subjected to some
restriction, as it is provided from Privacy Law. When a processing is not
automatized, this right is not applicable.
- Right to object (art. 21 GDPR): the right to object to the processing of
data if legitimate reasons exist, even with reference to the processing of
data for marketing and profiling, if provided;
- Right to withdraw the given consent (art. 7 GDPR): at any time, the data
subject can withdraw his consent to the processing without prejudice to
the lawfulness of the processing based on the consent given before the
withdrawal;
- Right to compensation (art. 82 GDPR): the right to obtain from the
Controller and/or from the Processor a compensation for the suffered
damage, material or immaterial, if caused by the processing of the
personal data of the data subject, in breach of the Regulation and the
Controller and/or the Processor cannot prove they are not liable for the
damage.
- Right to lodge a complaint to the national authority for the protection of
personal data (Piazza Venezia, 11 – 00817 Roma RM – PEC:
Pag. 4 di 5
Via delle Industrie 27/7 Alpenite S.r.l. soggetta a direzione
30175 Venezia Marghera, IT e coordinamento di Arsenalia GmbH
accounting.it@alpenite.com C.F./P.I. IT04022760278
+39 041 8872244 Reg. Imprese VE, REA VE-358612
www.alpenite.com Cap. soc. € 150.000 i.v.
protocollo@pec.gpdp.it) in case of unlawful processing, except for the
limitations contained in the D.Lgs. n. 101/2018, art. 2-undecies (Limitations of
the rights of the interested person) and art. 2-duodecies (limitations for
reasons of justice).
CONTACT DATA OF THE PROCESSOR AND THE RESPONSIBLE FOR DATA PROTECTION
For any further information regarding the processing of personal data, the processor
can be reached by writing an e-mail to gdpr@arsenalia.group.
Pag. 5 di 5