PRIVACY POLICY

COOKIE POLICY

CONTACT FORM NOTICE

NEWSLETTER NOTICE

COMPANY EMAIL NOTICE

WORK WITH US NOTICE

REGISTER NOW NOTICE

PROCEDURE FOR HANDLING DATA SUBJECTS’ RIGHTS REQUESTS

Privacy Policy Notice

INTRODUCTION

This page describes the management methods of the site https://www.olmiresidence.com/ regarding the processing of personal data of users who consult it. This information is provided pursuant to Article 13 of the European Regulation 2016/679 to those who interact with the company’s web services.

The notice identifies some minimum requirements for the online collection of personal data, and in particular, the methods, timing, and nature of the information that data controllers must provide to users when they connect to web pages, regardless of the purposes of the connection.

DATA CONTROLLER

The data controller is Olmi Residence located at Viale Giuseppe Pietri, 944 – 57034 Marina di Campo (LI), IT049003C2YQR24E8U, email info@olmiresidence.com.

DATA PROCESSING LOCATION

The processing related to the web services of this site takes place at the company’s headquarters and is handled only by technical staff of the office in charge of processing, or by any persons in charge of occasional maintenance operations. No data deriving from the web service is communicated or disseminated. The personal data provided by users who submit requests for information material are used only to perform the service or provision requested.

TYPES OF DATA PROCESSED

  • Browsing data: The computer systems and software procedures used to operate this website acquire, during their normal operation, some personal data whose transmission is implicit in the use of Internet communication protocols. This information is not collected to be associated with identified data subjects, but by its very nature could, through processing and association with data held by third parties, allow users to be identified. This category of data includes IP addresses or domain names of the computers used by users who connect to the site, URI (Uniform Resource Identifier) addresses of the requested resources, the time of the request, the method used to submit the request to the server, the size of the file obtained in response, the numerical code indicating the status of the response given by the server (successful, error, etc.) and other parameters related to the user’s operating system and computer environment. These data are used only to obtain anonymous statistical information on the use of the site and to check its correct functioning and are deleted immediately after processing. The data could be used to ascertain responsibility in case of hypothetical computer crimes against the site: except for this possibility, the data on web contacts do not persist for more than seven days.
  • Data voluntarily provided by the user: The optional, explicit, and voluntary sending of emails to the addresses indicated on this site entails the subsequent acquisition of the sender’s address, necessary to respond to requests, as well as any other personal data included in the message. Specific summary information will be progressively reported or displayed on the pages of the site prepared for particular services on request.

USE OF COOKIES

Regarding the methods of use of cookies, please refer to the further and specific “extended information” (see 03I_PR-12.4-02 Cookie Policy Olmi Residence) published on this site and prepared based on the provision of May 8, 2014, issued by the Italian Data Protection Authority as amended by Provision No. 231 of June 2021, which integrates and completes this document.

OPTIONAL PROVISION OF DATA

Apart from what is specified for browsing data, the user is free to provide personal data. Failure to provide them may make it impossible to obtain what is requested.

PROCESSING METHODS

Personal data are processed with automated tools for the time strictly necessary to achieve the purposes for which they were collected. Specific security measures are observed to prevent data loss, unlawful or incorrect use, and unauthorized access.

TRANSFERS TO THIRD COUNTRIES

Personal data may be transferred to foreign countries within the European Union or outside the EU and transmitted to private companies and institutional entities for purposes related to the requested services and for territorial competence needs. Data are sent for cross-border processing, according to the principles of necessity, limited to strictly necessary information. Data transfer occurs exclusively under the following conditions:

  • Countries covered by adequacy decisions pursuant to Article 45 GDPR 679/16 EU;
  • in the absence of adequacy decisions, processing, with reference to Article 46 GDPR 678/16 EU, takes place by agreement with the data recipient in compliance with binding corporate rules in accordance with Article 47; standard data protection clauses adopted by the Commission according to the examination procedure referred to in Article 93, paragraph 2;
  • in the absence of adequate safeguards, the Data Controller, pursuant to Article 49 GDPR 679/16 EU, if the transfer is necessary to fulfill contractual and/or legal obligations, communicates the data by preparing all technical-organizational security measures such as, where possible, data minimization, pseudonymization, verification of the recipient’s reliability.

RIGHTS OF DATA SUBJECTS

The subjects to whom the personal data refer have the right at any time to request access to the data and their rectification, deletion, limitation of processing, the right to object to their processing, as well as the right to data portability; they also have the right to lodge a complaint with the supervisory authority.

Requests should be addressed to the Data Controller

CONTACT DETAILS:

This constitutes the “Privacy Policy” of this site which will be subject to updates.

Cookie Notice

INTRODUCTION

This Cookie Policy has been drafted and customized specifically for the site www.olmiresidence.com owned by Olmi Residence located at Viale Giuseppe Pietri, 944 – 57034 Marina di Campo (LI), IT049003C2YQR24E8U, email info@olmiresidence.com. This Policy was drafted based on the provision of the Data Protection Authority No. 229 of May 8, 2014 “Identification of simplified methods for the information and acquisition of consent for the use of cookies” and the New provision No. 231 of June 10, 2021 “Cookie guidelines and other tracking tools”. It integrates and updates other information already present on the site and/or previously released by the company, in combination with which it provides all the elements required by Article 13 of the EU Regulation 2016/679.

IMPORTANT NOTICE

All third parties are informed that the use of this information, or even just parts of it, on other websites where it would certainly be irrelevant and/or incorrect and/or inconsistent, may result in the imposition of heavy penalties by the Data Protection Authority.

WHAT ARE COOKIES

In practical and non-technical terms, a cookie can be considered a tracking system consisting of a small file, stored by the website on the user’s browsing device, used to save preferences expressed during navigation and to improve the website’s performance, optimizing the browsing experience.

In technical terms, cookies are defined as text strings (generally consisting of a combination of letters and numbers) that websites (so-called first parties) visited by the user or different websites/web servers (so-called third parties) place and store, directly and/or indirectly within a terminal device (PC, tablet, smartphone, etc.) available to the user. The servers for internet browsing or device operation can store cookies to then retransmit them to the same sites that generated them, in view of a subsequent visit by the same user. Specifically, these tracking tools allow the Site to recognize a particular device or browser.

TYPES OF COOKIES AND THEIR PURPOSES

Cookies can be classified into:

  • Technical cookies used solely to carry out the transmission of a communication over an electronic communications network, or to the extent strictly necessary for the provider of an information society service explicitly requested by the subscriber or user to provide such service as provided by Article 122, paragraph 1 of the Privacy Code. These types of cookies do not require the user’s consent but must be indicated in the cookie policy.
  • Profiling cookies used to link specific actions or behavioral patterns to identified or identifiable subjects to allow the owner to tailor the provision of the service more personalized and send advertising messages in line with the preferences expressed by the user during navigation.
  • Analytics cookies installed on the user’s terminal by the operators of the visited site or third-party sites. Third-party cookies, mainly for analysis purposes, mostly derive from Google Analytics functionalities. More information on Google Analytics can be found by clicking on the following link: http://www.google.it/intl/it/analytics. In any case, cookies do not allow the identification of the data subject and are intended to refer to the individual device or application to avoid tracking the user’s browsing data. Analytics cookies can be treated like technical cookies, and therefore do not require the user’s consent, under the following conditions:
    • The use is limited to the production of aggregate statistics usable in relation to the site visited by the user;
    • Regarding so-called third-party analytics cookies, the fourth part of the tracked IP address must be masked;
    • Regarding so-called third-party analytics cookies, the third party must be prevented from using analytics cookies in combination with other processing or transmitting them to further third parties.

APPLICABLE REGULATIONS

For the use of cookies and other technical tracking tools, the data controller is subject only to the obligation to provide specific information to the data subject. Regarding cookies and other tracking tools for purposes other than technical ones, use is allowed only after obtaining the user’s informed consent, which must be expressed with an unequivocal act pursuant to Recital 32.

CONSENT ACQUISITION MECHANISM

The data controller guarantees the consent acquisition mechanism through the presentation of a banner upon the user’s first access to the site.

The banner contains:

  • Information on the site’s use of technical cookies with a link to the privacy policy and cookie policy.
  • Button that allows consent to be accepted.
  • Button that allows consent to be denied.
  • Button that allows configuring cookie settings/preferences. This leads to an additional band where it is possible to select and customize “privacy settings.”

In the event that the user does not consent to the use of cookies and other tracking tools and in the event that the user has chosen to give consent only for the use of certain cookies, the choice is recorded and no longer solicited, except in the following cases:

  • when one or more processing conditions change significantly
  • when it is impossible for the site manager to know if a cookie has already been stored on the device
  • when at least 6 months have passed since the previous presentation of the banner.

COOKIES USED – RETENTION TIMES – PURPOSES – DATA TRANSFER TO THIRD PARTIES

Cookie names Type of cookie First or Third party Can be blocked Session or Persistent Expiry Time Purpose

BROWSER SETTINGS

We also inform you that the user can freely and at any time configure their privacy parameters regarding the installation and use of cookies, directly through their browsing program (browser) following the relevant instructions.

In particular, the user can set the so-called “private browsing,” thanks to which their browsing program stops saving the history of visited sites, any passwords entered, cookies, and other information on the pages visited.

We warn that if the user decides to disable all cookies (including those of a technical nature), the quality and speed of the services offered by this website could drastically worsen and access to some sections of the site itself could be lost.

RIGHTS OF DATA SUBJECTS

We inform you that as a data subject, you have the right to exercise the following rights:

Right of access pursuant to Article 15 of the EU Reg. 20167679 the data subject has the right to confirm whether or not personal data concerning them is being processed and, if so, can obtain, among other things, access to their personal data and information regarding the purposes of the processing, the categories of personal data in question, the recipients or categories of recipients to whom the personal data have been or will be communicated.

Right to rectification pursuant to Article 16 of the Regulation:

  • rectification of inaccurate personal data concerning you without undue delay
  • completion of your personal data, if incomplete.

Right to erasure (“right to be forgotten”) pursuant to Article 17 of the Regulation erasure of personal data concerning you without undue delay

Right to restriction of processing pursuant to Article 18 of the Regulation restriction of processing in the following cases:

  • the data subject contests the accuracy of the personal data, for the period necessary for the data controller to verify the accuracy of such personal data;
  • the processing is unlawful and the data subject opposes the erasure of personal data and requests instead that its use be restricted;
  • although the data controller no longer needs it for processing purposes, the personal data is necessary for the data subject to establish, exercise, or defend a right in court;
  • the data subject has objected to processing pursuant to Article 21, paragraph 1, pending verification of whether the legitimate reasons of the data controller prevail over those of the data subject

Right to data portability pursuant to Article 20 of the Regulation it is possible to receive in a structured, commonly used, and machine-readable format, the personal data concerning you and in our possession;

Right to transmit such data to another data controller without hindrance from the data controller to whom you have provided them in the cases referred to in Article 20 of the Regulation.

Right to object for processing carried out pursuant to Article 6, paragraph 1 letters e) or f) and pursuant to Article 21 of the Regulation objection, at any time, for reasons related to your particular situation, to the processing of personal data concerning you including profiling.

The above requests can be addressed to the Data Controller.

The Data Controller is Olmi Residence located at Viale Giuseppe Pietri, 944 – 57034 Marina di Campo (LI), IT049003C2YQR24E8U, email info@olmiresidence.com

Requests can be sent via:

  • a registered letter with return receipt to Olmi Residence Viale Giuseppe Pietri, 944 – 57034 Marina di Campo (LI)
  • email to info@olmiresidence.com

Furthermore, if it is believed that the processing has been carried out in violation of personal data protection regulations, the right to lodge a complaint with the Data Protection Authority, Piazza Venezia, 11 – 00187 – Rome, is recognized.

Contact Form Information

INTRODUCTION

Pursuant to Article 13 of Regulation (EU) 2016/679, Olmi Residence, located at Viale Giuseppe Pietri, 944 – 57034 Marina di Campo (LI), IT049003C2YQR24E8U, email info@olmiresidence.com, as the Data Controller, informs users about the processing of personal data resulting from the completion of the contact form.

DATA CONTROLLER

The data controller is Olmi Residence, located at Viale Giuseppe Pietri, 944 – 57034 Marina di Campo (LI), IT049003C2YQR24E8U, email info@olmiresidence.com

INTERESTED PARTIES

Internet service users interested in contacting the data controller and subscribing to the contact form.

DATA PROCESSED

The data processed are those entered in the contact form, namely identifying data such as name, surname, and Company, and contact data such as personal email. The data collected are only those strictly necessary to fulfill the request, with the Data Controller respecting the principle of minimization as established by Article 5 of the European Regulation.

The data provided will be processed by the Data Controller in order to contact the user as requested by the Data Controller.

PURPOSE OF PROCESSING

The personal data entered in the registration form, sent by the user’s choice and voluntarily, will be used to respond to the requests submitted by the user or to fulfill the contact requested by the form itself. The IT systems of this process involve the use of email configured to ensure confidentiality and integrity of the information.

NATURE OF PROVISION AND LEGAL BASIS OF PROCESSING

The provision of data is mandatory to respond to the user’s request, and the legal basis for processing is found in Article 6 letter b) of Reg. EU 679/2016, with pre-contractual measures being adopted at the request of the interested party.

METHODS OF PROCESSING

Data processing is carried out through IT procedures or in any case telematic means and paper supports by subjects, internal or external, specifically appointed and authorized and committed to confidentiality. The data are processed and stored with tools suitable to ensure their security, integrity, and confidentiality through the adoption of adequate security measures as required by law.

STORAGE PERIOD

The data will be stored for 2 years from the transmission of the contact request.

COMMUNICATION, DISSEMINATION, TRANSFER

The collected data will not be disseminated, sold, or exchanged with third parties without the express consent of the interested party, except for any communications to authorized third parties – committed to confidentiality or in case appointed as data processors pursuant to Article 28 of Regulation (EU) 2016/679. The complete and updated list of data processors is available, upon request, through the methods indicated in this information. The data may be communicated to competent authorities, according to legal terms.

Personal data may be transferred to foreign countries within the European Union or outside the EU and transmitted to private companies and institutional bodies for purposes related to the requested services and for territorial competence needs. The data are sent for cross-border processing, according to the principles of necessity, limited to strictly necessary information. The data transfer occurs exclusively under the following conditions:

  • Countries covered by adequacy decisions pursuant to Article 45 GDPR 679/16 EU;
  • in the absence of adequacy decisions, processing, with reference to Article 46 GDPR 678/16 EU, takes place by agreement with the data recipient in compliance with binding corporate rules in accordance with Article 47; standard data protection clauses adopted by the Commission according to the examination procedure referred to in Article 93, paragraph 2;
  • in the absence of adequate guarantees, the Data Controller, pursuant to Article 49 GDPR 679/16 EU, if the transfer is necessary to fulfill contractual and/or legal obligations, communicates the data by providing all technical-organizational security measures such as, where possible, data minimization, pseudonymization, verification of the recipient’s reliability.

RIGHTS OF THE INTERESTED PARTIES

At any time, interested parties have the right to access their personal data, request their rectification, update, and deletion. It is also possible to object to processing and request its limitation.

These requests can be addressed to Olmi Residence, located at Viale Giuseppe Pietri, 944 – 57034 Marina di Campo (LI), IT049003C2YQR24E8U, email info@olmiresidence.com. Furthermore, if it is believed that the processing has been carried out in violation of personal data protection regulations, the right to lodge a complaint with the Data Protection Authority, Piazza Venezia, 11 – 00187 – Rome, is recognized.

Newsletter Subscription Form Information

INTRODUCTION

Pursuant to Article 13 of Regulation (EU) 2016/679, Olmi Residence, located at Viale Giuseppe Pietri, 944 – 57034 Marina di Campo (LI), IT049003C2YQR24E8U, email info@olmiresidence.com, informs users about the processing of personal data resulting from newsletter subscription.

DATA CONTROLLER

The data controller is Olmi Residence, located at Viale Giuseppe Pietri, 944 – 57034 Marina di Campo (LI), IT049003C2YQR24E8U, email info@olmiresidence.com

INTERESTED PARTIES

Internet service users interested in subscribing to the newsletter

DATA PROCESSED

The data processed are personal identifying data such as name, surname, and contact data such as institutional email address necessary for sending regulatory updates.

PURPOSE OF PROCESSING

The purpose of processing is to receive regulatory updates regarding products and services offered by the Data Controller.

NATURE OF PROVISION AND LEGAL BASIS OF PROCESSING

The provision of data is optional. Refusal to provide data does not result in negative consequences but makes it impossible for the data controller to proceed with the newsletter sending requests. The legal basis for processing is found in the legitimate interest of the data controller, pursuant to Article 6 letter f) of Reg. EU 679/2016. Consent is considered given by checking the appropriate boxes at the bottom of the online form. Consent can always be revoked.

METHODS OF PROCESSING

Data processing is carried out through IT procedures or telematic means and paper supports by subjects, internal or external, specifically appointed, authorized, and committed to confidentiality. The data are processed and stored with tools suitable to ensure their security, integrity, and confidentiality through the adoption of adequate measures as required by law.

STORAGE PERIOD

The data will be stored in a form that allows identification for the interested party for two years from subscription, without prejudice to the fact that upon revocation with the opt-out technique, the Data Controller will proceed to delete your data.

COMMUNICATION, DISSEMINATION, TRANSFER

The collected data will not be disseminated, sold, or exchanged with third parties without the express consent of the interested party, except for any communications to authorized third parties – committed to confidentiality or in case appointed as data processors pursuant to Article 28 of Regulation (EU) 2016/679. The complete and updated list of data processors is available, upon request, through the methods indicated in this information. The data may be communicated to competent authorities, according to legal terms.

No data transfer outside the European Union is foreseen.

The data are sent for cross-border processing, according to the principles of necessity, limited to strictly necessary information. The data transfer occurs exclusively under the following conditions:

– Countries covered by adequacy decisions pursuant to Article 45 GDPR 679/16 EU;

– in the absence of adequacy decisions, processing, with reference to Article 46 GDPR 678/16 EU, takes place by agreement with the data recipient in compliance with binding corporate rules in accordance with Article 47; standard data protection clauses adopted by the Commission according to the examination procedure referred to in Article 93, paragraph 2;

– in the absence of adequate guarantees, the Data Controller, pursuant to Article 49 GDPR 679/16 EU, if the transfer is necessary to fulfill contractual and/or legal obligations, communicates the data by providing all technical-organizational security measures such as, where possible, data minimization, pseudonymization, verification of the recipient’s reliability.

RIGHTS OF THE INTERESTED PARTIES

At any time, interested parties have: the right to access their personal data, request their rectification, update, and deletion. It is also possible to object to processing and request its limitation.

These requests can be addressed to Olmi Residence, located at Viale Giuseppe Pietri, 944 – 57034 Marina di Campo (LI), IT049003C2YQR24E8U, email info@olmiresidence.com

Furthermore, if it is believed that the processing has been carried out in violation of personal data protection regulations, the right to lodge a complaint with the Data Protection Authority, Piazza Venezia, 11 – 00187 – Rome, is recognized.

CONSENT DECLARATION FOR NEWSLETTER SUBSCRIPTION

The undersigned declares their specific consent for the processing of personal contact data (personal email) that may be processed by Olmi Residence, as the Data Controller, through newsletter subscription.

Corporate Email Information

The content of the emails is to be considered confidential. Therefore, the information contained therein or in any attachments is reserved exclusively for the recipients. Persons or entities other than the recipients themselves, even pursuant to Article 616 of the Criminal Code, are not authorized to read, copy, modify, or disclose the message to third parties. Anyone who receives our communication by mistake should not use it or bring it to anyone’s attention but should delete it from their mailbox and notify the sender. The authenticity of the sender and the contents are not guaranteed, except for digitally signed documents.

All email boxes of the domain “[…]@olmiresidence.com” are corporate boxes and, as such, are used for work-related communications. At any time, interested parties have the right to access their personal data, request their rectification, update, and deletion. It is also possible to object to processing and request its limitation.

Furthermore, if it is believed that the processing has been carried out in violation of personal data protection regulations, the right to lodge a complaint with the Data Protection Authority, Piazza Venezia, 11 – 00187 – Rome, is recognized.

Work With Us Information

INTRODUCTION

Olmi Residence, located at Viale Giuseppe Pietri, 944 – 57034 Marina di Campo (LI), IT049003C2YQR24E8U, email info@olmiresidence.com, as the Data Controller of personal data pursuant to Articles 4 and 13 of Regulation EU 2016/679, informs you that it will process your personal data manually and/or with the support of IT tools exclusively to evaluate your application for the purpose of a possible future employment relationship with the Company. We invite you to indicate in your CV only information relevant to the position you intend to apply for, and that does not have a strictly personal and private nature.

TYPE OF DATA

The data subject to processing are:

  • identifying data such as name and surname
  • contact data such as personal emails and any other information contained within the attached Curriculum Vitae. Among these are included information related to:
  1. educational qualifications, professional experiences, skills, abilities, and competencies necessary to cover the role you have chosen or for the possible position we may propose to you;
  2. the data controller may also process special data pursuant to Article 9 of Regulation EU 679/2016 relating to your person for purposes strictly necessary for hiring if it is essential for the procedure itself.

PURPOSE OF PROCESSING

Your data will be processed to carry out personnel selection activities. Processing is necessary to respond to your application or to offer you, at a later time, a new proposal if your profile is deemed suitable for our needs.

LEGAL BASIS OF PROCESSING

The legal basis for data processing is represented by the fulfillment of pre-contractual obligations as identified by Article 6 letter b) of the EU Regulation, as well as by the legitimate interest of the data controller.

DATA RECIPIENTS

The data may be disclosed to employees and collaborators of the Data Controller who may process your data in compliance with the instructions given by the Data Controller itself.

Your personal data may be processed by third parties who collaborate with the Data Controller for the same purposes. These subjects may, depending on the case, operate as independent Data Controllers or as Data Processors specifically appointed.

DATA TRANSFER

Personal data are not transferred to foreign countries within the European Union or outside the EU.

DATA RETENTION

The personal data you provide will be stored for the time strictly necessary to achieve the highlighted purposes and in any case for a period not exceeding 24 months: at the end of this period, your data will be deleted.

RIGHTS OF THE INTERESTED PARTY

Pursuant to Articles 13, paragraph 2, and from 15 to 21 of the Regulation, we inform you that regarding the processing of your personal data, you may exercise the following rights:

  1. Right to obtain access to personal data and the following information:
  • confirmation of whether or not personal data processing is taking place;
  • the purposes of the processing;
  • the categories of personal data;
  • the recipients or categories of recipients to whom personal data have been or will be communicated;
  • if the data are not collected from the data subject, all available information on their origin;
  • the existence of automated decision-making, including profiling;
  • a copy of the personal data being processed.
  1. Right to rectification and integration of personal data;
  2. Right to erasure of data (“right to be forgotten”) if one of the following reasons exists:
  • personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;
  • the data subject withdraws consent to data processing and there is no other legal basis for processing;
  • the data subject objects to processing and there is no overriding legitimate reason to proceed with processing;
  • personal data have been unlawfully processed;
  • personal data must be erased to comply with a legal obligation under Union or Member State law to which the data controller is subject.

The data controller, if it has made personal data public and is obliged to erase them, must inform other controllers processing the personal data of the request to erase any links, copies, or reproductions of your data.

  1. Right to restriction of processing in the event that:
  • the data subject contests the accuracy of the personal data, for the period necessary for the data controller to verify the accuracy of such personal data;
  • the processing is unlawful and the data subject opposes the erasure of the personal data and requests instead that its use be restricted;
  • although the data controller no longer needs it for processing purposes, the personal data is necessary for the data subject to establish, exercise, or defend a legal claim;
  • the data subject has objected to processing, pending verification of whether the legitimate grounds of the data controller override those of the data subject.
  1. Right to lodge a complaint with the Data Protection Authority, following the procedures and instructions published on the official website of the Authority garanteprivacy.it.
  2. Right to data portability of the data subject, i.e., the right to receive in a structured, commonly used, and machine-readable format the personal data concerning them provided to a data controller and possibly to transmit them to another data controller, where the processing is based on consent or a contract and is carried out by automated means. Where technically feasible, the data subject has the right to obtain the direct transmission of data from one data controller to another.
  3. Right to object at any time to the processing of personal data, including profiling, particularly if:
  • the processing is based on the legitimate interest of the controller, subject to the specification of the reasons for the objection;
  • the personal data is processed for direct marketing purposes.
  1. Right not to be subject to a decision based solely on automated processing, including profiling, except where the decision: is necessary for entering into, or performance of, a contract between the data subject and a data controller, is authorized by Union or Member State law to which the data controller is subject, or is based on the explicit consent of the data subject.

The exercise of rights is not subject to any formality and is free of charge.

DATA CONTROLLER

The Data Controller is Olmi Residence located at Viale Giuseppe Pietri, 944 – 57034 Marina di Campo (LI), IT049003C2YQR24E8U, email info@olmiresidence.com

METHODS OF EXERCISING RIGHTS

The data subject may exercise their rights at any time by sending:

  • a registered letter with return receipt to Olmi Residence Viale Giuseppe Pietri, 944 – 57034 Marina di Campo (LI)
  • email to info@olmiresidence.com

Information Register now

PREAMBLE

Pursuant to Article 13 of Regulation (EU) 2016/679, Olmi Residence located at Viale Giuseppe Pietri, 944 – 57034 Marina di Campo (LI), IT049003C2YQR24E8U, email info@olmiresidence.com, as Data Controller, informs users of the processing of personal data resulting from the completion of the Register Now section.

DATA CONTROLLER

The Data Controller is Olmi Residence located at Viale Giuseppe Pietri, 944 – 57034 Marina di Campo (LI), IT049003C2YQR24E8U, email info@olmiresidence.com

DATA SUBJECTS

Internet service users interested in contacting the Data Controller and registering in the Register Now section.

DATA PROCESSED

The data processed includes identifying data such as name, surname, and company, and contact data such as personal email. The data collected is only what is strictly necessary to fulfill the request, respecting the principle of data minimization as set out in Article 5 of the European Regulation.

The data provided will be processed by the controller to contact the user as requested by the data controller.

PURPOSE OF PROCESSING

The personal data entered in the registration form, sent by the user’s choice and voluntarily, will be used to respond to requests submitted by the user for registration to events organized by Olmi Residence. The IT systems of this process are configured to ensure the confidentiality and integrity of the information.

NATURE OF PROVISION AND LEGAL BASIS OF PROCESSING

The provision of data is optional. The legal basis for processing is found in Article 6 letter a) of Reg. EU 679/2016, i.e., in the freely given and revocable consent at any time.

METHODS OF PROCESSING

The processing of data is carried out through IT procedures or otherwise by telematic means and paper supports by subjects, internal or external, specifically appointed and authorized and committed to confidentiality. The data is processed and stored with tools suitable to ensure its security, integrity, and confidentiality by adopting adequate security measures as required by law.

RETENTION PERIODS

The data will be retained until the consent is withdrawn by the data subject and, in any case, for a maximum period of 24 months.

COMMUNICATION, DISSEMINATION, TRANSFER

The data collected will not be disseminated, sold, or exchanged with third parties without the express consent of the data subject, except for any communications to authorized third parties – committed to confidentiality or, if appointed, data processors under Article 28 of Regulation (EU) 2016/679. The complete and updated list of data processors is available, upon request, through the methods indicated in this information. Data may be communicated to competent authorities, according to legal terms.

Personal data may be transferred to foreign countries within the European Union or outside the EU and transmitted to private companies and institutional bodies for purposes related to the requested services and for territorial competence needs. Data is sent for cross-border processing, according to the principles of necessity, limited to strictly necessary information. Data transfer occurs exclusively under the following conditions:

– Countries covered by adequacy decisions under Article 45 GDPR 679/16 EU;

– in the absence of adequacy decisions, processing, with reference to Article 46 GDPR 678/16 EU, occurs after an agreement with the data recipient in compliance with binding corporate rules in accordance with Article 47; standard data protection clauses adopted by the Commission according to the examination procedure referred to in Article 93, paragraph 2;

– in the absence of adequate safeguards, the Data Controller, pursuant to Article 49 GDPR 679/16 EU, if the transfer is necessary to fulfill contractual and/or legal obligations, communicates the data by providing all technical-organizational security measures such as, where possible, data minimization, pseudonymization, verification of the recipient’s reliability.

RIGHTS OF DATA SUBJECTS

At any time, data subjects have the right to access their personal data, request its rectification, update, and deletion. It is also possible to object to processing and request its restriction.

These requests can be addressed to Olmi Residence located at Viale Giuseppe Pietri, 944 – 57034 Marina di Campo (LI), IT049003C2YQR24E8U, email info@olmiresidence.com. Furthermore, if it is believed that the processing has been carried out in violation of personal data protection regulations, the right to lodge a complaint with the Data Protection Authority, Piazza Venezia, 11 – 00187 – Rome, is recognized.

CONSENT DECLARATION FOR EVENT REGISTRATION

The undersigned declares their specific consent for the processing of personal data entered, which may be processed by Olmi Residence, as Data Controller, through registration for organized events.

Procedure for managing requests to exercise data subjects’ rights

PREAMBLE

PURPOSE

The purpose of this procedure is to define the tasks, responsibilities, and operational methods to be adopted when a request is submitted to the Data Controller by data subjects to exercise their rights regarding the processing of personal data, carried out by or on behalf of Olmi Residence.

The procedure applies:

  • to all workers of Olmi Residence, whether employees or collaborators;
  • to requests relating to all categories of data, whether common or special;
  • to requests from any data subject, regardless of category (such as employees/collaborators, subjects under video surveillance, users/visitors of the website).

LEGAL REFERENCES

  • Legislative Decree no. 196/2003 and subsequent amendments and integrations (Privacy Code);
  • Regulation (EU) 2016/679 (GDPR).

ACRONYMS AND DEFINITIONS USED

GDPR Regulation EU 2016/679 (General Data Protection Regulation).
Code D.lgs. 196/2003 Code regarding the protection of personal data as amended by D.lgs. 101/2018.
Data Protection Authority Garante per la protezione dei dati personali.
Data Controller Olmi Residence
Data Processor External subject processing personal data on behalf of the Controller (art. 28 of the GDPR).
Contact Person Internal subject appointed for managing requests to exercise rights regarding personal data protection.
Personal Data Any information relating to an identified or identifiable natural person (data subject); a natural person is considered identifiable if they can be identified, directly or indirectly, with particular reference to an identifier such as a name, identification number, location data, an online identifier, or one or more factors specific to their physical, physiological, genetic, mental, economic, cultural, or social identity.
Processing Any operation or set of operations performed on personal data or sets of personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
Data Subject The identified or identifiable natural person to whom the personal data relates.

RIGHTS OF DATA SUBJECTS

Data subjects may exercise, pursuant to Articles 15 et seq. of the GDPR, with reference to their personal data held by Olmi Residence, the following rights:

Art. 15 – Right of Access

Recitals 63, 64

The data subject has the right to obtain, at any time, from the Data Controller, confirmation as to whether or not personal data concerning them is being processed to allow them to verify the lawfulness of the processing. The data subject has the right to request access to the following information: the purposes of the processing; the categories of personal data concerned; the recipients or categories of recipients to whom the personal data has been or will be disclosed, in particular, if recipients in third countries or international organizations; where possible, the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period; the existence of the right of the data subject to request from the data controller rectification or erasure of personal data or restriction of processing of personal data concerning them or to object to such processing; the right to lodge a complaint with a supervisory authority; where the data is not collected from the data subject, any available information as to their source; the existence of automated decision-making, including profiling, referred to in Article 22(1) and (4), and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject.

The right of access allows the data subject to also request a copy of their personal data undergoing processing.

The data controller should take all reasonable measures to verify the identity of the data subject requesting access.
Art. 16 – Right to Rectification

Recital 65

 The data subject has the right to obtain from the data controller the rectification of inaccurate personal data concerning them without undue delay. The data subject may exercise this right even when the data is incomplete, by providing a supplementary statement.
Art. 17 – Right to Erasure

(“right to be forgotten”)

Recitals 65, 66, 67, 68, 69, 70

 The data subject has the right to obtain from the data controller the erasure of personal data concerning them without undue delay in the following cases: a) the personal data is no longer necessary in relation to the purposes for which it was collected or otherwise processed; b) the data subject withdraws consent on which the processing is based; c) the data subject objects to the processing and there are no overriding legitimate grounds for the processing, or objects to the processing of their data for direct marketing purposes, including profiling to the extent that it is related to such direct marketing; d) the personal data has been unlawfully processed; e) the personal data must be erased to comply with a legal obligation in Union or Member State law to which the data controller is subject; f) the personal data has been collected in relation to the offer of information society services to minors.

Paragraph 3 of Article 17 lists the limitations to the exercise of the right, which are based on the legal basis underlying the processing and thus justify both the retention of data and further processing. The Controller may therefore reject the request for erasure if the processing is based on:

– the exercise of the right to freedom of expression and information;

– compliance with a legal obligation, for the performance of a task carried out in the public interest or in the exercise of official authority;

– reasons of public interest in the area of public health;

– purposes of archiving in the public interest, scientific or historical research purposes, or statistical purposes, to the extent that the erasure is likely to render impossible or seriously impair the achievement of the objectives of that processing;

– the establishment, exercise, or defense of legal claims.
Art. 18 Right to Restriction of Processing

Recital 67

The data subject has the right to request the restriction of processing where one of the following applies: a) the data subject contests the accuracy of the personal data, for a period enabling the data controller to verify the accuracy of the personal data; b) the processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of its use instead; c) the data controller no longer needs the personal data for the purposes of the processing, but they are required by the data subject for the establishment, exercise, or defense of legal claims; d) the data subject has objected to processing pursuant to Article 21(1), pending the verification whether the legitimate grounds of the data controller override those of the data subject.

Paragraph 2 provides that, in certain cases, despite the limitation of processing being ordered, personal data may exceptionally be processed in cases of: consent of the data subject; assertion of rights in court; protection of the rights of another person; significant public interest.

Recital 67 illustrates some practical ways to implement the right to restriction; this could be ensured by:

– temporarily transferring selected data to another processing system (so they are not available for normal processing activities);

– making selected personal data inaccessible to users (where processing is configured this way);

– temporarily removing published data from a website.

– in automated archives, the restriction of personal data processing should generally be ensured through technical devices so that personal data are not subject to further processing and can no longer be modified (unless the data subject requests their deletion).
Art. 20 – Right to data portability

Recital 57, 68

The data subject has the right to receive personal data concerning them, which they have provided to a data controller, in a structured, commonly used, and machine-readable format, and has the right to transmit those data to another data controller without hindrance from the controller to whom the data were provided, where: a) the processing is based on consent; b) the processing is carried out by automated means. This right does not apply to non-automated processing (paper archives or registers). However, this right must not infringe the rights and freedoms of others.
Art. 21 – Right to object

Recital 69, 70

 The data subject has the right to object at any time, on grounds relating to their particular situation, to the processing of personal data concerning them, where the processing is necessary for:

– the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;

– the pursuit of the legitimate interest of the controller, provided that such interests are not overridden by the data subject’s fundamental rights and freedoms;

– purposes of scientific or historical research or statistical purposes.

It is therefore up to the controller to demonstrate that the legal basis for the processing overrides the interests or fundamental rights and freedoms of the data subject.

Recital 70 specifies that where personal data are processed for direct marketing purposes, the data subject should have the right to object to such processing at any time and free of charge, including profiling to the extent that it is related to such direct marketing. This right should be explicitly brought to the attention of the data subject and presented clearly and separately from any other information.

Art. 22 – Right not to be subject to a decision based solely on automated processing, including profiling

Recital 71, 72

The data subject has the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning them or similarly significantly affects them. This right does not apply when the automated decision:

– is necessary for entering into, or the performance of, a contract between the data subject and the data controller;

– is authorized by Union or Member State law to which the controller is subject;

– is based on the data subject’s explicit consent.

Explicit exclusion is made for such decisions concerning special categories of data governed by Art. 9 of Regulation EU 679/2016, except where:

– the data subject has given explicit consent to the processing of those personal data for one or more specified purposes;

– the processing is necessary for reasons of substantial public interest, on the basis of Union or Member State law, which shall be proportionate to the aim pursued, respect the essence of the right to data protection, and provide for suitable and specific measures to safeguard the fundamental rights and interests of the data subject.

ROLES AND RESPONSIBILITIES

The procedure applies to all employees and collaborators of Olmi Residence as well as to Data Processors appointed pursuant to Art. 28 of the GDPR. Compliance with this procedure is mandatory and requires the prompt and active involvement of the individuals mentioned.

They are therefore required to provide the Data Controller with maximum cooperation to comply with the current legislation on personal data protection.

STAGES OF THE PROCEDURE

SUBMISSION AND RECEIPT OF THE REQUEST

The request to exercise rights can be submitted directly to the Data Controller or intercepted by third parties who, acting as Data Processors, are in direct contact with the data subjects.

Requests can be exercised using the specific form “Model for the exercise of rights regarding personal data protection” (see 01P_PR-14.1-00 Model Exercise Rights Data Subjects), published in the appropriate section of the institutional website, to be sent by email to the indicated address. The request must be accompanied by a copy of the applicant’s identity document (unless the application is digitally signed by the applicant) to be considered valid. The request is always subject to registration to assign it a receipt date useful for calculating deadlines.

The Internal Contact takes charge of the request and involves, as soon as possible, the Head of the organizational structure holding the data subject to processing or the Data Processor who has competence concerning the subject of the request.

From a subjective point of view, requests must refer to information relating to “natural persons” held by Olmi Residence. The data subject exercising a right must be identified to ensure the most accurate processing of requests.

EVALUATION OF THE REQUEST

The Data Controller evaluates the request submitted by the data subject to verify the validity of the application and take the necessary actions to fulfill the request. If reasonable doubts arise from the evaluation of the application regarding the identity of the natural person submitting the request, the Data Controller will promptly inform the data subject, who must prove their identity.

RETRIEVAL OF DATA AND EXECUTION OF OPERATIONS REQUESTED BY THE DATA SUBJECT

If the application is deemed valid, the Data Controller will identify the involved organizational structure and ensure the necessary involvement of the Designated Subjects and/or Data Processors holding the data subject to the application. Once the existence of the data contained in the application is verified, the requested operations will be carried out in accordance with Articles 15 to 22 of the GDPR (e.g., rectification, integration, deletion). If legal or regulatory provisions do not allow compliance with the application, appropriate reasons will be prepared, and feedback will be provided to the data subject.

FEEDBACK TO THE DATA SUBJECT

Pursuant to Art. 12, paragraph 3, of the GDPR, the Data Controller provides the data subject with information regarding the action taken concerning the request to exercise the rights recognized to them, without undue delay and, in any case, within one month of receiving the request, even if the response is negative. This period may be extended by two months, if necessary, taking into account the complexity and number of requests received.

In the event of an extension of the response period, the Data Controller is required to inform the data subject, within one month of receiving the request, of such extension and the reasons for the delay.

In the event of non-compliance with the data subject’s request, the Data Controller informs the data subject without delay, within one month of receiving the request, of the reasons for the non-compliance and the possibility of lodging a complaint with a supervisory authority and seeking judicial remedy. The response must be concise, transparent, intelligible, and drafted in clear and simple language.

The response method must consider the channel indicated by the data subject in the request.

If the exercise of the right to portability under Art. 20 of the GDPR is requested, the response must be provided by attaching the data in electronic format according to the standard explained in the “Guidelines on the right to data portability” – adopted by the Working Group under Art. 29 and available at www.garanteprivacy.it/regolamentoue/portabilita.

Pursuant to Art. 12, paragraph 2, of the GDPR, in the case of data processing carried out for a purpose that does not require, or no longer requires, the identification of the data subject, the Data Controller cannot refuse to fulfill the data subject’s request for the exercise of their rights, unless the Data Controller demonstrates that they are unable to identify the data subject. In this latter case, the rights can only be exercised when the data subject provides additional information enabling their identification.

COSTS FOR HANDLING REQUESTS

Operations concerning the management of requests aimed at exercising the rights recognized by the GDPR are carried out at no cost to the data subject. If the data subject’s requests are manifestly unfounded or excessive, particularly due to their repetitive nature, the Data Controller may charge a reasonable fee, taking into account the administrative costs incurred to manage the request, or refuse to comply with the request, as provided for in Art. 12, paragraph 5, of the GDPR.

The burden of demonstrating the manifestly unfounded or excessive nature of the request lies with the Data Controller.

STORAGE OF DOCUMENTATION

Documentation relating to requests to exercise rights by data subjects is retained by the Data Controller.

NOTIFICATION IN CASE OF RECTIFICATION, DELETION, OR RESTRICTION OF PROCESSING

Pursuant to Art. 19 of the GDPR, the Data Controller is responsible for communicating to each recipient to whom personal data have been disclosed any rectifications or deletions or restrictions of processing carried out in accordance with Articles 16, 17, paragraph 1, and 18 of the GDPR, unless this proves impossible or involves a disproportionate effort.

The communication to such recipients is made by the Data Controller within one month of the rectification and/or deletion of data or restriction of processing. The Data Controller must keep track of such operations in the Register of requests to exercise data subjects’ rights.

If the data subject has requested it, the Data Controller provides evidence of the recipients to whom personal data concerning them have been disclosed.

REGISTER OF REQUESTS TO EXERCISE DATA SUBJECTS’ RIGHTS

The Data Controller documents requests aimed at exercising the data subject’s rights by preparing an updated internal Register. The Register of requests to exercise data subjects’ rights (see 02P_PR-14.1-00 Register Requests Data Subjects’ Rights) must contain the following information:

  • progressive number;
  • date of receipt of the application;
  • assigned protocol number;
  • name of the applicant;
  • name of the data subject (if different from the applicant);
  • description of the request;
  • involved organizational structures or databases;
  • action taken regarding the request;
  • references of the feedback note to the data subject (date and protocol);
  • notes and comments.