Information for the processing of personal data

(updated version of 05 August 2022)

Consulnet Italia S.r.l., VAT number 11512810968, as the data controller (hereinafter, “Data Controller”), informs you according to EU Regulation 2016/679 (“GDPR”) and Legislative Decree no. 196/2003, as amended by Legislative Decree no. 101/2018, that your data will be processed in the following ways and for the following purposes.

1. Subject of processing

The Data Controller processes personal identifying data and non-specific/sensitive data (hereinafter, “Personal Data” or even “Data”) communicated by you during the navigation on the website www.consulnet.it (hereinafter, “Website”) the request for information or the subscription to the newsletter (hereinafter “Events”). In particular:

• name, surname, telephone number, email required to request information or to subscribe to the newsletter;
• navigation data such as the IP addresses or domain names of the computers used by users connecting to the Site, the Uniform Resource Identifier (URI) notation of the requested resources, the time of the request, the method used to submit the request to the server, the size of the file obtained in response, the numeric code indicating the status of the response given by the server (good end, error, etc.) and other parameters related to the operating system and the computer environment of the user. This information is collected through the cookies described in the Website Cookie Policy to which you refer.

2. Purpose and legal basis of processing

The Data Controller will process your Personal Data for the following service purposes and legal basis:

Without your consent for the following purposes A:

• the execution of the contract and/or the fulfilment of pre-contractual commitments, that is to allow you to navigate the Website, as well as to manage contact requests and information;
• the fulfillment by the Data Controller of legal obligations, that is to comply with obligations provided by laws, regulations or national and Community legislation or imposed by the competent Authorities;
• the pursuit of a legitimate interest of the Data Controller, that is to exercise rights in court and manage any litigation, as well as to verify and prevent events harmful to the Website and to maintain and update the Website;

The Data Controller will process your data only with your express consent for the following purposes B:

• statistical purposes: to carry out non-anonymous statistical activities aimed at optimizing and improving navigation on the website through the use of cookies described in the Cookie Policy of the Website to which you refer. In this case, the consent, specific to each type of cookie, will be requested through the cookie banner of the Website;
• communication and marketing purposes: to send you, by ordinary letters, email and/or through your newsletter, news and updates related to the main news and events in relation to the consulting and training services offered, and to inform you of initiatives and offers also for promotional purposes. In this case, the consent can also be provided through the subscription request to the newsletter.

3. Methods of processing

The processing of Personal Data is carried out, electronically and on paper, by the operations of collection, registration, organization, storage, consultation, processing, modification, selection, extraction, comparison, use, interconnection, blocking, communication, deletion and destruction of data.

4. Retention of Data

The Data Controller will process Personal Data, except for the different timing indicated in the Cookie Policy in relation to the processing carried out through the use of cookies, for:

• the execution of the contract and/or the fulfilment of pre-contractual commitments: 10 years from the conclusion of the relationship;
• the fulfillment by the Data Controller of legal obligations: 10 years from the data collection or the different legal time;
• the pursuit of a legitimate interest of the Data Controller: 10 years from data collection
• marketing purposes under B: 5 years from data collection and in any case up to the withdrawal of consent.

5. Provision of Data

The provision of Data for the purposes under A is mandatory and failure to provide it will prevent you from browsing the Website or request information. The provision of Data for purposes under B is optional and failure to provide it will prevent the Data Controller to process your Personal Data to make statistics on the use of the Website and to send you updates or commercial communications.

6. Access to Data

Your Data may be made accessible for the purposes mentioned above to:

• employees and/or collaborators of the Data Controller, in their capacity as data processors and/or internal data processors and/or system administrators;
• third parties (for example, IT providers, etc.) that carry out outsourcing activities on behalf of the Data Controller, in their capacity as data processors.

7. Communication of Data

Your Data may be communicated, even without your consent, to control bodies, law enforcement, judiciary and competent authorities, upon their express request that they will treat the Data as independent Data Controllers for institutional and/or legal purposes during investigations and controls. Your Data may also be disclosed to third parties (for example, partners, freelancers, etc.), as autonomous data controllers, for the conduct of activities instrumental to the purposes mentioned above.

8. Transfer of Data

Data is not disseminated or transferred to non-EU countries.

9. Rights of the data subject

The Data Controller informs you that, as a data subject, if the limitations provided by the law are not applied, you have the right to:

• obtain from the Data Controller the confirmation of the existence of your personal data, even if not yet recorded, and that such data are made available to you in an intelligible form;
• obtain from the Data Controller an indication and, where appropriate, a copy: a) of the origin and category of personal data; b) of the logic applied in the case of the data processing is carried out with the help of electronic tools; c) of the purposes and methods of the data processing; d) the identification details of the data controller and those responsible; e) the subjects or categories of subjects to whom personal data may be communicated or who may become aware of them, in particular if recipients of third countries or international organizations; f) where possible, the data retention period or the criteria used to determine that period; g) the existence of an automated decision-making process, and in this case the logic used, the importance and consequences expected for the data subject; h) the existence of adequate safeguards in the event of data being transferred to a non-EU country or international organization;
• obtain from the Data Controller, without undue delay, the updating and correction of inaccurate data or, where it is of interest, the integration of incomplete data;
• revoke at any time, easily, without hindrance, the consents given, using, if possible, the same channels used to provide them;
• obtain from the Data Controller the cancellation, the transformation in anonymous form or the blocking of the data: a) unlawfully processed; b) no longer necessary in relation to the purposes for which they were collected or subsequently processed; c) if the consent on which the processing is based is withdrawn and there is no other legal basis, d) if you are opposed to the processing and there is no overriding legitimate reason to continue the processing; c) if a legal obligation is fulfilled; f) in the case of data relating to minors. The Data Controller may refuse cancellation only in the case of: a) exercise of the right to freedom of expression and information; b) fulfilment of a legal obligation, execution of a task carried out in the public interest or exercise of public authority; c) reasons of public health interest; d) storage in the public interest, scientific or historical research or for statistical purposes; c) exercise of a legal right;
• obtain from the Data Controller the limitation of the processing in the case of: a) dispute of the accuracy of the personal data; b) unlawful processing of the Data Controller to prevent its cancellation; c) exercise of your right in court; d) verification of the possible prevalence of the legitimate reasons of the Data Controller compared to those of the data subject;
• receive from the Data Controller, if the processing is carried out by automatic means, without hindrances and in a structured format, commonly used and readable personal data concerning you to transmit them to another holder or – if technically feasible – to obtain direct transmission from the Data Controller to another holder;
• oppose, in whole or in part: a) for legitimate reasons, related to your particular situation, the processing of personal data concerning you; b) the processing of personal data concerning you for the purpose of sending communication material, by email and/or by traditional means by telephone and/or paper mail;
• lodge a complaint with the Data Protection Authority.

In the cases above, if necessary, the Data Controller will inform third parties to whom your personal data are disclosed of the possible exercise of your rights, except in specific cases (e.g. where such fulfillment is impossible or involves the use of means manifestly disproportionate to the protected right).

10. Procedures for exercising rights

You may at any time exercise these rights against the Owner:

• by sending a registered mail with acknowledgment of receipt to the address of the Owner;
• by sending an email to mazzucchelli@consulnet.it;
• by calling +39 02 89011933.

11. Data controller and processor

The data controller is Consulnet Italia S.r.l., with registered office in Via del Lauro 2, 20121 Milano (MI), VAT number 11512810968. The updated list of data processors is kept at the headquarters of each Data Controller.

Consulnet Italia S.r.l.