INFORMATION ON THE PROCESSING OF PERSONAL DATA

Pursuant to and for the purposes of Articles 6 and 13 of Regulation 2016/679/EU of the European Parliament and of the Council of 27 April 2016, concerning the protection of natural persons with regard to the processing of personal data and the free movement of such data.

 

This information is provided to inform you about the processing of your personal data, in compliance with the aforementioned regulations and based on the principles of fairness, lawfulness, and transparency, safeguarding your privacy and your rights.

 

  1. **IDENTITY AND CONTACT DETAILS OF THE DATA CONTROLLER**: The data controller is PISCINE ARCOBALENO SRL, located at Via Carlo Felice 40/A, Sassari (SS) – Tax Code and VAT No. 02586880904 – email: info@piscinearcobaleno.it – certified email: piscinearcobalenosrl@pec.it. The data processing manager is Geom. Claudio Conti.

 

  1. **CATEGORIES OF DATA**: The personal data of natural persons processed by PISCINE ARCOBALENO SRL are exclusively those not belonging to the so-called “special categories” (see Art. 9 GDPR) such as, for example, personal data, telephone contact, email, bank references. If the person providing the data is under 14 years old, the relevant consent must be given or authorized by the holder of parental responsibility, for whom identification data and a copy of identification documents will be acquired.

 

  1. **PURPOSES AND LEGAL BASIS OF THE PROCESSING**: Your personal data will be processed for the following purposes:
  2. Fulfillment of mandatory administrative, accounting, civil, and fiscal obligations related to the data subject;
  3. Administrative and commercial management of the contractual relationship;
  4. Management and execution of contracts concluded with the data subject, including the necessary services to ensure supplies, after-sales support, and warranties;
  5. Fulfillment of specific requests from the data subject;
  6. Sending newsletters and any direct and indirect promotional activities;
  7. The possibility of being included among references and case histories on the data controller’s website and social networks;
  8. The possibility of being recorded at trade fairs, events, etc. at the data controller’s stand or premises, with photos and videos that may be published on the web and social networks.

 

Processing under letters a), b), and c) is necessary for the requested service by the data subject, while processing under letters d), e), and f) requires the express consent of the data subject. Promotional activities aim to collect and use data within the activities of PISCINE ARCOBALENO SRL to conduct studies, research, market statistics, send you advertising and informative material (including newsletters), send you commercial information, and conduct interactive commercial communications.

 

  1. **SOURCE OF DATA**: The personal data of the data subject are collected at the data controller’s premises, during fairs, events, conferences, or meetings at the data subject’s premises, or through specific collection forms on the PISCINE ARCOBALENO SRL website. The processing of the provided personal data will be carried out by persons expressly and specifically designated by the Data Controller, operating at the main or peripheral offices; these persons, as part of the organization, will process the data according to the instructions received from the Data Controller, as processors (Art. 28 GDPR) or authorized persons (Art. 29 GDPR), in compliance with the Regulation and the national law adapting to the GDPR provisions. These include employees or

collaborators assigned to the Data Controller’s structures for the functions they perform and exclusively for the specific purposes indicated in this notice.

 

  1. **PROCESSING METHODS**: The processing will be carried out with manual and automated systems to store, manage, and transmit the data, with logic strictly related to the purposes themselves, based on the data provided by the data subject and with the commitment by the latter to promptly notify the data controller of any corrections, additions, and updates; such data will be managed and protected in environments whose access is constantly under the data controller’s control. In particular, the information systems and software programs used are configured to limit the processing of personal data to the strictly necessary (always within the aforementioned purposes). The data are stored in such a way as to minimize the risks of destruction, loss, unauthorized access, or unauthorized or non-compliant processing.

 

  1. **DATA RETENTION**: The collected and processed data will be retained for a period not exceeding the achievement of the purposes for which they are processed (“principle of storage limitation,” Art. 5 GDPR) or based on deadlines set by legal provisions (with specific reference to Art. 2220 of the Italian Civil Code). For the purposes indicated in letters a), b), c), d) of point 3, the retention period is necessary to fulfill contractual obligations and, in any case, not exceeding 10 years, to fulfill legal obligations, and in any case, within the terms set by law for the prescription of rights; for the purposes of letters e) and f) of point 3, the duration is 36 months from the moment of consent release or updates.

 

  1. **RECIPIENTS OF PERSONAL DATA**: Within the indicated purposes, the data of the data subject may be communicated to:
  2. a) Data processing centers, service companies, including electronic data processing and software and IT consulting services, external to the data controller’s organization but closely related to operational purposes;
  3. b) Credit and financial companies, subjects responsible for transportation and delivery services;
  4. c) Subjects responsible for managing correspondence;
  5. d) Tax consultants, labor consultants, lawyers, other subjects appointed by PISCINE ARCOBALENO SRL for the performance of their duties or credit recovery;
  6. e) Public and private entities, also following inspections or checks or to fulfill obligations arising from the law or mandatory regulations, EU law, or secondary legislation;
  7. f) Subjects who can access your data by virtue of legal or secondary or EU legislative provisions;
  8. g) Other subjects external to the PISCINE ARCOBALENO SRL organization dealing, on behalf of the same, with technical assistance, warranty, and provision of goods and services.

 

The scope of data communication is functionally and strictly related to what is necessary for the completion of the supply and service provision. The subjects belonging to the aforementioned categories may act as Data Processors or operate autonomously as Data Controllers in outsourcing. The list of designated Data Processors is constantly updated and available at the PISCINE ARCOBALENO SRL headquarters. Data subjects can request this list by contacting the data controller through the channels indicated in point 1 of this notice.

 

  1. **DISSEMINATION**: There is no provision for the dissemination of personal data, except for the web and social part (see point 3).

 

  1. **CONSENT PROVISION**: The data subject’s consent to their data towards PISCINE ARCOBALENO SRL is not necessary if there is a contract between the parties or for pre-contractual measures taken at the data subject’s request: pursuant to Art. 6 paragraph 1 letter b) such data will be processed without any need for consent for data necessary for such purposes, as indicated in point 3) letters a), b) and c). For any further purposes under point 3, letters d), e) and f) it is possible to freely give consent, according to the model on the following page. In case of refusal of the data subject to provide data or consent to their processing, it may result in the impossibility of performing the activities themselves.

 

  1. **DATA TRANSFER**: The provided personal data will not be transferred outside the European Union.

 

  1. **REFERENCES**: Please be informed that for any clarification you may contact the data controller, even in case of uncertainty about the nature of a data and the behavior to be taken for its processing. The company’s references are listed, in addition to point 1 of this notice, also on the website https://www.piscinearcobaleno.it/privacy/.

 

  1. **RIGHTS OF THE DATA SUBJECT**: The data subject may, at any time, exercise the rights listed below:
  2. a) Access to personal data: obtain confirmation whether or not personal data concerning him/her are being processed, and in such case, access to the following information: purposes, data categories, recipients, retention period, right to lodge a complaint with a supervisory authority, right to request rectification or erasure or restriction of processing or object to such processing;
  3. b) Request rectification or erasure of such data or restriction of processing concerning him/her; restriction means marking stored data with the aim of limiting their future processing;
  4. c) Object to the processing: object, in whole or in part, for reasons related to his/her particular situation, to the processing of personal data concerning him/her, even if relevant to the purpose of the collection;
  5. d) Data portability: in the case of automated processing based on consent or in the execution of a contract, receive in a structured, commonly used, and machine-readable format the data concerning him/her;
  6. e) Withdrawal of consent to processing for the purposes under points d), e) and f) of point 3; exercising this right does not prejudice the lawfulness of processing based on consent before its withdrawal;
  7. f) Lodge a complaint with the competent supervisory authority (for Italy, it is the Privacy Guarantor, contactable through the contact details listed on the website www.garanteprivacy.it).

 

These rights can be exercised by sending a specific request to the data controller through the contact channels indicated in Art. 1 of this notice. Requests relating to the exercise of the user’s rights will be processed without delay and, in any case, within one month from the request.