ACME Produzioni Srl, with registered offices in Circonvallazione Clodia, 163/171 – 00195 Rome, Tax Number and VAT number 10245151005, as the data controller (hereinafter, “Controller”), pursuant to art.13 of Regulation EU 2016/679 (“GDPR”) and the current national standard on personal data protection, is informing you that your data will be processed according to and for the following purposes:
Subject matter of processing
The Controller processes personal identification and non-specific data (hereinafter “Data” or “Personal Data”) given by you when using the Controller’s “SmartQ – Coda Intelligente” (hereinafter “App”) and, in particular:
name, surname, gender, e-mail address, phone number, date of birth;
navigation data such as used IP addresses, devices or connections. This information is also collected through cookies and metadata.
Objectives and legal basis of processing
Your Data is processed for the following purposes and legal basis:
without your prior consent for the purposes of the service and, in particular, to:
perform the contract and/or the pre-contractual commitments:
through the App, obtain all of the logistical and/or service information about the business, including, for example, directions to the place, maps and opening hours for access;
through the App, access all of the offered services;
manage a contact request from you;
provide suitable technical assistance.
pursue a legitimate interest of the Controller:
manage and maintain the App;
prevent or discover fraudulent activities or harmful misuse for the App;
exercise the Controller’s rights, for example, the right to defence before the court;
send you sales correspondence to the e-mail address provided by you, about activities organised by the Controller similar to those that you signed up for on the App. Every e-mail sent allows you to unsubscribe to future notices by clicking on a link.
fulfilment of legal requirements:
fulfilment of legal requirements, regulations, Community standards, orders and prescriptions of the competent authorities.
only with your prior consent (and/or, if applicable, checking the register of subscribers opting out of the use of their phone numbers for the purposes of commercial selling and/or promotions), to:
send you sales notices about the Controller’s products and services.
give your data to our sales partners to send you initiatives and sales offers on their products and services.
Your data is processed - with electronic modalities - through Data collection, recording, updating, organising, storage, consulting, elaborating, modifying, selecting, extracting, comparing, using, interconnecting, blocking, erasure and destruction operations.
The Controller processes the Data for the amount of time required to fulfil the aforementioned purposes and in any case, with the exception of the terms of limitation laws, for no more than 5 years for all processing stated in point 2 A). Data processed for the purposes of point 2 B), is processed for no more than 2 years.
Providing the Data for the purposes of the service is mandatory and failure to do so shall not allow you to use the App. Providing Data for the purposes of point 2 B) is optional and failure to provide it will not prevent you from using the App but in this case you will not receive information about products and services of the Controller/Controller’s sales partners.
Access to Data
The following can access your Data for the aforementioned purposes:
Controller employees and/or collaborators, as they are appointed to processing and/or are internal processors and/or system administrators;
Third parties (for example IT service providers, vendors, credit institutes, professional firms, etc...) who perform outsourced jobs for the Controller, as the external processors.
Your Data can be communicated, even without your consent, for the aforementioned purposes, to control bodies, police forces or magistratures who will process it, on their express request, as independent process controllers for institutional purposes and/or binding by law over the course of investigations and controls. Your Data can also be given to third parties (for example partners, self-employed workers, agents, etc.) as independent process controllers, to perform the instrumental activities of the aforementioned purposes. Exclusively with your consent, your data can be given to sales partners to suggest sales initiatives and offers to you for their products and services, as stated in point 2 B).
Your Data will not be spread or transferred outside of the European Union.
Rights of the data subject
The Controller informs you that, as the data subject, if there are no limitations established by law, you have the right to:
obtain confirmation as to whether or not personal data concerning him/her is being processed;
obtain access to the personal data (and a copy, if applicable) and to the following information: a) the purposes of processing; b) the categories of personal data being processed; c) the recipients or categories of recipients that the personal data can be given to, especially if recipients of third countries or international organisations; d) when possible, the expected storage period of the personal data or, if that is not possible, the criteria used to determine said period; e) the existence of the right to ask for rectification or erasure of one’s personal data or limiting the processing of one’s personal data or object to processing; f) the right to lodge a complaint to a control authority; g) if the data is not collected with the data subject, the information available on its origin; h) the existence of automated decision-making, including profiling and, in that case, the applied logic, the importance and the expected consequences for the data subject; i) the existence of suitable guarantees in case of data transfers to a non European country or to an international organisation;
obtain, without undue delay, the rectification of inaccurate personal data or have incomplete data completed;
obtain the erasure of your personal data: a) no longer necessary in relation to the purposes it was collected for or otherwise processed; b) in case consent is withdrawn that processing is based on and if there is no other legal ground; c) if you have objected to processing and there are no other overriding legitimate grounds to continue processing; d) if your data has been processed unlawfully; e) if for compliance with legal obligation; f) if the data refers to minors. The Controller can refuse erasure only to: a) exercise the right of freedom of expression and information; b) comply with legal obligation, performing a task carried out in the public interest or exercise of official authority; c) for reasons of public interest in the area of public health; d) for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes; e) exercise legal claims;
obtain the restriction of processing in the following cases: a) contesting the accuracy of the personal data; b) unlawful processing of the Controller to prevent erasure; c) exercise of legal claims; d) verifying that the Controller’s legitimate grounds override those of the data subject;
receive, if processing was carried out by automated means, without hindrance and in a structured, commonly used and readable format, the personal data that refer to the data subject to transmit it to another controller or - if technically feasible - to have the data transmitted directly by the Controller to another controller;
to object, in whole or in part: a) on grounds relating to his/her particular situation to the processing of personal data concerning him/her; b) processing personal data concerning him/her either to send advertising material or for direct sales or to perform market research or marketing purposes, through the use of automated call systems without operators through e-mail and/or traditional marketing modalities over the phone and/or mail;
withdraw any consent given for data processing. Withdrawal does not prejudice the lawfulness of the processing carried out prior to withdrawal;
seek Legal Authority;
lodge a complaint with the Supervisory Authority for Personal Data Protection.
In the cases above, where necessary, the Controller will inform the third party subjects that your data has been given to, that you are exercising your rights, with the exception of specific cases (for ex. when said compliance is impossible or requires a manifestly excessive use of means in relation to the right being protected).
Modalities for exercising rights
You may exercise these rights at any time:
by sending a letter through registered mail with return receipt to the Controller’s address;
by sending an e-mail to email@example.com
Data protection Controller and Processor - DOP
The processing controller is ACME Produzioni Srl, with registered offices in Circonvallazione Clodia, 163/171 – 00195 Rome, tax Number and VAT Number 10245151005.
The appointed Data Protection Officer – DPO is:
Ms. Elisa Prepi (lawyer), by sending an e-mail to firstname.lastname@example.org
Every time you use our App the Controller and third parties working for him adopt due and suitable security measures to prevent unauthorised access, disclosure, modification or destruction of your data, pursuant to the GDPR and current national regulations on personal data protection.
Restrictions to use of the App
The Controller informs you that the use of the App is limited to users who are at least 14 years of age.
Spoleto, __ March 2020
ACME Produzioni Srl
[yes] [no] that I wish to receive sales initiatives and offers from ACME Produzioni Srl.
[yes] [no] that I wish to receive correspondence from ACME Produzioni Srl partners on initiatives, sales offers and information about their products and services.