DATA PROTECTION AND PRIVACY STATEMENT

GDA S.R.L.
Via Martiri di Civitella, 36
52100 Arezzo, Italy

The controller for the purposes of data protection law is:

DONATO GALASSO | GLSDNT59B07L439H

as Data Controller of the processing of personal data pursuant to articles 4 and 28 of Legislative Decree no. 196/2003 and EU Regulation 2016/679 informs you, pursuant to art. 13 of the Code and the Regulation, which will process[1] your personal data manually and/ or with the support of information technology tools for the purposes indicated below.
Purpose of processing, legal basis and any third party data destination.

When you visit our site, your personal data will be treated for purposes related to the management of ordinary business relationships and, precisely, for the compilation of personal data lists, the book-keeping of suppliers/clients, invoicing, communications by both paper and computer means, and the management of the creditor to meet all the obligations under the regulations in force. Your data may be processed for internal statistical and market research purposes.

Your data may also be communicated to third parties, for technical and operational needs strictly related to the purposes stated above and in particular to the following categories:

Institutions, professionals, companies or other bodies that we entrust with the processing related to the fulfilment of administrative, accounting and management obligations related to the ordinary performance of our economic activity, including for credit recovery purposes;
public authorities and administrations for the purposes related to the fulfilment of legal obligations;
Banks, financial bodies or other persons to whom the transfer of said data is necessary for the performance of our company in relation to the acquittal, on our part, of the contractual obligations assumed towards You;
installation, servicing and maintenance services providers of computer and information systems and of all the services functionally connected and necessary for the performance of the duties covered by the Contract.
Failure to provide personal data will make it impossible for us to start contracts evolution and other related obligations, as well as to properly manage mutual business/work relations.

We inform you that we may send you commercial and/or promotional communications relating to products and services similar to those subjected to the contractual relationship, with the exception of Your disapproval.

Further data processing purposes

With your specific and distinct consent, your personal data may also be processed for each of the following purposes:

-sending via e-mail, post, SMS, telephone, commercial and/or promotional communications or advertising material on products or services provided by our business or for surveys regarding services quality satisfaction.

– profiling[2], in particular for the creation of your business profile and/or for the analysis of your preferences, habits or consumer choices, also through the crossing of such personal data with other information collected through profiling cookies accepted by You.

Your consent on each and every above stated purposes, is optional and will have no interference and/or consequences over the aforementioned purposes related to the basic business relationship.

Both your provision of data and your consent may be freely expressed, but your refusal will make it impossible for us, to implement contracts and other related obligations, and to manage correctly mutual business/working relationships.

Duration of data storage

Your personal data will be kept for the time strictly necessary to fulfil the purposes described above and to fulfil the obligations provided by law (will be anyway indicated in the various specific information).

Rights of the affected parties

Pursuant to art.7 of the Privacy Code and pursuant to articles 13, paragraph 2, and art.15 to 22 of the Regulation, we inform you that with regard to the processing of your personal data you may exercise the following rights:

Art. 15 Right of access of the data subject; The data subject shall have the right to obtain from the data controller, confirmation as to whether or not personal data concerning him or her are being processed;
Art. 16 Right to rectification: The data subject shall have the right to obtain from the controller the rectification of inaccurate personal data concerning him without undue delay;
Art.17 Right to erasure («right to be forgotten»): the data subject shall have the right to obtain from the controller the erasure of personal data concerning him without undue delay and the controller shall be obliged to delete the personal data without undue delay;
Art.18 Right to restriction of processing where one of the following applies:
– the accuracy of the personal data is contested by the data subject, for a period enabling the controller to verify the accuracy of the personal data;

-the processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of their use instead;

-the controller no longer needs the personal data for the purposes of the processing, but they are required by the data subject for the establishment, exercise or defence of legal claims;

-the data subject has objected to processing data pending the verification whether the legitimate grounds of the controller override those of the data subject.

Art 19 The controller shall communicate any rectification or erasure of personal data or restriction of data processing carried out, to each recipient to whom the personal data have been disclosed. The controller shall inform the data subject about those recipients if the data subject requests it.
Art.20 Right to data portability: The data subject shall have the right to receive the personal data concerning him or her, which he or she has provided to a controller, in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller without impediment from the controller to which the personal data have been provided;
Art.21 Right to object: The data subject shall have the right to object, on grounds relating to his or her particular situation, at any time to processing of personal data concerning him or her which is based on point (e) or (f) of Article 6(1) of EU Regulation 679-2016, including profiling, particularly when:

-The processing shall take place on the basis of the legitimate interest of the controller, subject to clarification of the grounds for opposition;

-Personal data are processed for direct marketing purposes.

8. Art.22 Automated individual decision-making, including profiling. The data subject shall have the right not to be subject to a decision based solely on automated data processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her personally.

[2] (Profiling is intended as “any form of automated processing of personal data consisting of the use of such data to evaluate certain personal aspects relating to a genuine person, in particular to analyse or foresee aspects relating to the professional performance, economic situation, health, personal preferences, interests, reliability, behaviour, location or travel of that natural person” (art.4 of EU Regulation 2016/679).

If the controller has made personal data public and is obliged to delete them, must inform the other controllers who process personal data, of the request to delete any link, copy, or reproduction of its data.
It should be noted, however, that if the processing of data was generated by the need to comply with legal provisions for the exercise of business/financial, the cancellation can only take place at the end of the period provided for by the aforementioned legal provisions for the retention of administrative/accounting documents.

Right to lodge a complaint with the Guarantor for the protection of personal data, following the procedures and suggestions published on the official website of the Authority https://www.garanteprivacy.it/home_en .

Right to revoke consent at any time; obviously with any consequence resulting from the impossibility of being able to comply with legal or contractual provisions if the data processing is established by these provisions.
The exercise of rights is not subject to any form of obligation and it’s free.

Procedure for the exercise of rights
The interested party may at any time exercise the rights by sending:

A registered letter to: see details below;

An e-mail to the following address;

GDA s.r.l. Via martiri di Civitella, 36 -52100- AREZZO

Tel. 0575353922

[1] By processing of personal data, we intend any operation or set of operations, carried out with or without the aid of automated processes and applied to personal data or sets of personal data, such as collection, registration, organisation, grouping, conservation, adaptation or modification, extraction, consultation, use, communication by transmission, publication or any other form of provision, comparison or interconnection, limitation, cancellation or destruction.