INFORMATION ON THE PROCESSING OF PERSONAL DATA
StudioProgress S.n.c.

Pursuant to (EU) Regulation 2016/679 (hereafter "Regulation") this document describes the principles of lawfulness, fairness, transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity and confidentiality applied by Studio Progress S.n.c. when processing personal data.

Specific safety measures are observed in order to safeguard personal data against loss, unlawful or unfair use and unauthorized access.  

DATA CONTROLLER

The data controller is Studio Progress S.n.c. (C.F. 02154470179), a Company with headquarters in  25121 Brescia (BS) Via Carlo Cattaneo n. 51, certified email address: studioprogress@legalmail.it(the “Controller”).

CATEGORIES OF THE PERSONAL DATA PROCESSED, PROCESSING PURPOSES AND BASIC PRINCIPLES

As a general rule, our customers’ personal data as well as third parties’ data supplied by our customers (collectively referred to as personal data) are processed at the Controller’s headquarters for the following purposes:

1. compliance with statutory obligations, obligations provided for by specific regulations, obligations established by the Community legislation and directives issued by Public Authorities as well as Supervision and  Control Bodies (legal basis for processing the relevant data: statutory obligation)
2. goods sales management and service provision management (such as, for example, the registration and participation to conferences, including hotel bookings and/or the management of transport services), execution and management of contracts, including preliminary agreements and/or after-sale support (legal basis for processing the relevant data: execution of the contract or pre-contractual measures);
3. asserting one’s rights in various contexts, including fraud, debt recovery or controversies (legal basis for processing the relevant data: legitimate interest);
4. internal statistical analyses in aggregate form (legal basis for processing the relevant data: legitimate interest)
5. distribution of promotional and/or information and/or communication material via e-mail, traditional mail and telephone (legal basis for processing the relevant data: consent).

The intentional, explicit and voluntary transmission of messages to contact addresses involves the acquisition of the relevant contact data required to provide a response and the processing of personal data for the above purposes.

Customers are free to supply personal data in order to request information and/or documents and/or other communications.   

A contractual relationship shall only be established if the personal data mentioned under point 2 is  provided. 

HANDLING AND STORAGE

Personal data shall be processed using IT tools and paper based documents and stored as follows:

a)     for the purposes mentioned under point 5 until the consent is withdrawn;

b)     as far as the other types of processing mentioned in the list are concerned, the storage time  shall be suitable for the purposes of the data collection, that is to say it shall be observed by the  Controller over the whole duration of the contract and thereafter, as established by the law or by specific regulations concerning tax or other purposes.    

RECIPIENTS OF THE DATA

The personal data collected shall be processed by the Controller’s personnel and/or collaborators who shall

observe the instructions received concerning the purposes and the processing modalities.   

In addition, personal data shall be communicated to the entities the Controller avails himself/herself of to achieve the purposes described in detail above, such as, for example: 

• companies dealing with the technical coordination of IT systems and the relevant support and maintenance;
• in general, companies and/or third parties (including professionals) supporting the Controller in the fulfilment of his/her contractual obligations.  

An updated list of the people responsible and authorized to process personal data is kept at the Controller’s legal headquarters.  

Personal data will not be circulated in any way.  

RIGHTS OF THE DATA SUBJECT

The data subject shall have the following rights:

right of access: the data subject shall have the right to obtain confirmation as to whether or not personal data concerning him or her are being processed and, where that is the case, access to personal data and obtain a copy of the same

right to rectification: the data subject shall have the right to obtain the rectification of inaccurate personal data concerning him or her and to have incomplete personal data completed without undue delay 

right to erasure (right to be forgotten):the data subject shall have the right to obtain the erasure of personal data concerning him or her from the controller without undue delay.  

right to restriction of processing: the data subject shall have the right to obtain restriction of processing pursuant to art. 18 of the Regulation

right to data portability: the data subject shall have the right to receive the personal data concerning him or her, which he or she has provided to the controller,  in a structured, commonly used and machine-readable format as well as  the right to transmit it to another controller without hindrance, where the processing is based on consent and is carried out by automated means. The data subject shall also have the right to have his/her personal data transmitted directly to another controller, where technically feasible   

right to object: the data subject shall have the right to object to the processing of his/her data at any time on grounds relating to his or her particular situation, legitimate interest, the execution of public services or the exercise of public authority, including profiling, unless the Controller has legitimate reasons to continue to process the personal data of the data subject and these reasons override the interests, rights and freedom of the data subject  or unless the Controller needs to establish, exercise or defend legal claims. 

Where personal data is processed for direct marketing purposes, the data subject shall have the right to object to the processing of his/her personal data for such marketing at any time. Profiling shall be considered included, to the extent it is related to such direct marketing 

right of withdrawal: the data subject shall have the right to withdraw his/her consent at any time. The withdrawal of the consent shall not impair the legitimacy of the data processing based on consent before the withdrawal

right to complain:  the data subject shall have the right to file a complaint with thePersonal DataSupervisory Authority located in  Piazza di Montecitorio 121, 00186, Rome (RM).

Privacy Policy updated on 25th May 2018