INFORMATION DOCUMENT PURSUANT TO AND FOR THE PURPOSES OF ARTICLE 13 REGULATION (EU) 2016/679 (GDPR).
In compliance with Regulation (EU) 2016/679 (GDPR) and subsequent additions and amendments, we provide the necessary information regarding the processing of personal data provided. It concerns a policy provided pursuant to the art. 13 GDPR.
- DATA SUBJECTS
DATA CONTROLLER, pursuant to art. 26 of EU Reg. 2016/679:
3TI PROGETTI ITALIA – INGEGNERIA INTEGRATA S.P.A. in the person of the legal representative, based in LUNGOTEVERE VITTORIO GASSMAN 22 – ROME (RM) – 00146 and its contact details are the following GDPR@3tiprogetti.it
, Phone: +39 06 55301518 – Fax: +39 06 55301522.
- TYPES OF DATA PROCESSED
3TI PROGETTI ITALIA – INGEGNERIA INTEGRATA S.P.A. carries out the processing of common personal data, limited to what is necessary for the identification of the customer, to the performance of the contractual services in the following fields: Designs, feasibility studies, works supervision, assessments of technical and economic adequacy of public and private works, consulting activities in the engineering and architecture disciplines.
The data is also processed for compliance with obligations related to payment and tax aspects.
As a rule, the data controller does not carry out any processing of sensitive personal data for customers under art. 9 and 10 GDPR.
The data controller processes the common personal data of employees as well as the sensitive data limited to what is necessary to manage the employment relationship with them.
The data controller processes the common personal data of suppliers of goods or services, within the limits of what is necessary to manage the contractual relationship with them.
Data processing is carried out both by hard copy or electronic means.
- PURPOSES OF THE PROCESSING FOR WHICH CONSENT IS GRANTED WHERE REQUIRED (ART. 13 EU Reg. 2016/679 lett. c)
The personal data provided will be processed, in compliance with the conditions of lawfulness under art. 6 EU Reg. 2016/679, for purposes concerning the fulfilment of contractual and legal obligations and for administrative-accounting purposes (art. 6 lett. b).
Specifically, the personal data of the customers will be processed for the provision of the contractual service, as well as for the invoicing of the service.
Activities that involve automated decision-making or profiling processes are not carried out as a rule, with the exception of cataloguing the data of the internal personnel and candidates who send curricula based on technical skills and the suppliers’ register, which contains a quality assessment. In any case, no data profiling is performed pursuant to art. 9 and 10 GDPR.
- RECIPIENTS OR CATEGORIES OF RECIPIENTS OF PERSONAL DATA
Personal data provided may be communicated to recipients, appointed under art. 28 of the EU Reg. 2016/679, which will process the data as processors and / or as natural persons acting under the authority of the Controller and Processor, in order to comply with contracts or related purposes. The data may be communicated to recipients belonging to the following categories:
- any private third parties, such as tax consultants or workplace health and safety consultants, IT consultants, law firms;
- Revenue Agency;
- social security and financial administration, for the purpose of fulfilling all social security, welfare, insurance and tax obligations;
- competent authorities for the fulfilment of legal obligations and / or provisions imposed by public bodies.
The data subjects belonging to the aforementioned categories perform the function of Data processors, that is operate in total autonomy as separate Data controllers. The list of possible external data processors is constantly updated and available at the headquarters of the Data controller for the necessity that the interested party should express and document.
The data is not normally transferred to third parties for marketing purposes and, if necessary, may be transferred for these purposes only after a specific and separate written consent of the interested party.
- TRANSFER OF PERSONAL DATA TO THIRD COUNTRIES AND / OR INTERNATIONAL ORGANIZATIONS
Personal data provided is not transferred abroad within or outside the European Union, with the only possible exception of using e-mail servers or cloud programs, instant messaging or internet site domains with offices outside Europe, for the sole purpose of storing or transmitting data.
- RETENTION PERIOD OR CRITERIA FOR DETERMINING THIS PERIOD
The processing will be carried out in an automated and / or manual form, with methods and tools aimed at guaranteeing maximum security and confidentiality, by persons specifically appointed for this purpose. In compliance with the provisions of art. 5 paragraph 1 lett. e) of EU Reg. 2016/679, the personal data collected will be stored in a form that allows the identification of the interested parties for a period of time not exceeding the achievement of the purposes for which the personal data is processed.
The storage of personal data provided is determined based on the current legislation on the preservation of accounting records and based on limitation periods for civil rights, in particular, currently for a maximum period of 10 years.
- NATURE OF THE CONFERMENT OF DATA AND CONSEQUENCES OF REFUSAL
The provision of data for the purposes referred to in point 3 and the consent to processing is a necessary requirement to be able to execute the request for professional service, as well as to be able to invoice. In the event of failure to provide the data, the Data controller will not be able to provide the service requested.
The Data controller does not use the data for activities other than those relating to the professional service and those connected to it (such as tax compliance obligations), unless explicit and separate consent request for additional activities, such as promotional ones, as a rule not carried out by the data controller.
If the subject who provides the data is under the age of 16, such processing is lawful only if and to the extent that, such consent is given or authorized by the holder of parental responsibility for whom the identification data and a copy of the identification documents are acquired.
- RIGHTS OF THE INTERESTED PARTIES
You can assert your rights, as expressed by art. 15, 16, 17, 18, 19, 20, 21, 22 of EU Regulation 2016/679, by contacting the Data controller, or the Data processor, or the Data Protection Officer under art. 38 paragraph 4 if appointed. You have the right, at any time, to ask the Data controller at GDPR@3tiprogetti.it
for access to your personal data, the rectification, cancellation of the same, and limitation of processing.
Furthermore, you have the right to object, at any time, to the processing of your data (including automated processing, e.g. profiling), as well as to the portability of your data. Without prejudice to any other administrative and judicial remedy, if you consider that the processing of data that concerns you breaches the provisions of EU Reg. 2016/679, pursuant to art. 15 letter f) of the aforementioned EU Reg. 2016/679, you have the right to complain to the Guarantor for the protection of personal data and, with reference to art. 6 paragraph 1, letter a) and art. 9, paragraph 2, letter a), you have the right to revoke the consent given at any time.
In the case of request for data portability, the Data Controller will provide you in a structured, commonly used and readable format, based on an automatic device, the personal data concerning you, without prejudice to paragraphs 3 and 4 of art. 20 of the EU Reg. 2016/679.
||3TI ITALIA S.p.A.