Information on the processing of personal data

Pursuant to Articles 13 and 14 of the European Regulation 2016/679 (GDPR)

1. Background

This information describes the processing of personal data carried out through the website https://stage-imed-website.posytron.it and is provided in accordance with the provisions of the rules on the protection of personal data – Regulation (EU) 2016/679 (hereinafter “GDPR”), Legislative Decree 196/2003, as updated by Legislative Decree 101/2018 (or “Code for the Protection of Personal Data”) and the relevant measures of the Authority for the Protection of Personal Data.

If you have any questions regarding this privacy policy or Movibell’s use of your personal data, cookies, and other similar technologies, you can contact our Data Protection Officer (so-called DPO) by email at [email protected]

2. Data controller

The data controller, i.e. the entity that determines the purposes and means of the processing of personal data, is Movibell Srl – P. IVA 08580240961

The Data Controller can be contacted by forwarding an e-mail to [email protected] or by sending a communication by traditional mail to the address of the Data Controller’s registered office, taking care to specify the reason for the request.

3. Personal data being processed, purposes, legal bases and retention periods

3.1.1. Dati di navigazione: natura del conferimento

The computer systems and software procedures used to operate the site acquire, during their normal operation, some personal data whose transmission is implicit in the use of Internet communication protocols. This is information that is not collected to be associated with identified interested parties, but which, by its very nature, could, through processing and association with data held by third parties, allow users to be identified. This category of data includes the IP addresses or domain names of the computers used by users connecting to the Site, the URI(Uniform Resource Identifier) notation addresses of the requested resources, the time of the request, the method used to submit the request to the server, the size of the file obtained in response, the numerical code indicating the status of the response given by the server (successful, error, etc.) and other parameters relating to the user’s operating system and computer environment (such as, for example, the name and type of device connecting to the Platform). The provision of such data is not mandatory, at the moment that the User decides not to provide such data he/she will not navigate on the Site and will not be able to access the functionalities made available by it.

3.1.2. Dati di navigazione: finalità di trattamento

– This data is used in order to obtain anonymous statistical information on the use of the Site, to check its correct functioning, to improve the quality of the services offered and to optimize the functionality of the Site.

– Such data are processed to the extent strictly necessary and proportionate to ensure the security of the networks and the information passing through them.

3.1.3. Dati di navigazione: base giuridica

Art. 6 (1) (f) GDPR – Legitimate interest of the data controller in maintaining the security of the Site and that it is not used in ways that infringe the rights of others or as a conduit for the commission of unlawful acts or possible fraud (see Recital 47 of the GDPR).

3.1.4. Dati di navigazione: periodo di conservazione

The personal data referred to in this section shall be retained for up to 12 months after collection, unless the data subject objects, which may be exercised at any time in the manner set forth in the “Rights of the Data Subject” section of this notice

3.2.1. Newsletter e altre comunicazioni per promuovere prodotti e servizi: natura del conferimento

Within the site there are sections where the User can report his/her e-mail address in order to submit a request to subscribe to the promotional newsletter related to the services offered by the Company. This section collects the following types of data:

– E-mail address.

– Name/Company

– Phone number

The provision of data in this area is optional in nature. If the User decides not to provide such data, it will not be possible to forward the request for subscription to the newsletter/communication, which will therefore be unable to give appropriate course to such request of the User.

3.2.2. Newsletter e altre comunicazioni per promuovere prodotti e servizi: finalità di trattamento

Subscription to Movibell’s newsletter related to services offered by the Society.

3.2.3. Newsletter e altre comunicazioni per promuovere prodotti e servizi: base giuridica

Pursuant to Art. 6 (1) (a) GDPR, it is the consent of the User expressed through the inclusion within the specific box of the e-mail address. This consent is revocable at any time, without affecting the lawfulness of the processing carried out prior to the revocation, by following the instructions given within the section “Rights of the data subject”

3.2.4. Newsletter e altre comunicazioni per promuovere prodotti e servizi: periodo di conservazione

Until the User’s express consent is revoked.

3.3.1. Area Contatti: natura del conferimento

The website hosts a contact area through which the User can proceed to submit a contact request to the Company or proceed to make specific requests for assistance.

This section collects the following types of data:

– First and last name;

– email address;

– telephone number;

– company name

– Free field for entering message text.

Movibell cannot carry out any kind of prior check in relation to the information entered within the fields that can be freely filled in by the User, and for this reason Users are requested not to enter information from which, even indirectly, data belonging to special categories referred to in Article 9 of the GDPR may be known. If such types of data are entered, Movibell will not take such information into account in the feedback formulated and will proceed to delete such data in a secure manner that does not allow its recovery. The provision of data in this area is optional in nature.

If the User decides not to provide such data, the User will not be able to forward contact requests to the Company, which will therefore find itself unable to provide appropriate feedback.

3.3.2. Area Contatti: finalità di trattamento

To provide feedback to contact requests submitted to the Company by Users via the form.

3.3.3. Area Contatti: base giuridica

Art. 6 (1) (b) GDPR – processing is necessary for the execution of pre-contractual measures taken at the request of the data subject.

3.3.4. Area contatti: periodo di conservazione dei dati

For only the time necessary to recontact the User who has requested it from Users and for a time frame that depends on the classification of the contact as user-business (company) or user-private (interested party), in order to handle in the correct manner any subsequent requests from the same User or for further information related to the same or similar issues.

4. Methods of processing personal data

The processing of personal data is carried out, using electronic and paper methods, by means of the operations of collection, recording, updating, organization, storage, consultation, processing, modification, selection, extraction, comparison, use, interconnection, blocking, deletion and destruction of personal data. Personal data are protected so as to minimize the risk of destruction, loss (including accidental loss), unauthorized access/use, or use incompatible with the original purpose of collection. This is achieved with the technical and organizational security measures implemented by the Data Controller.

5. Possible recipients or the possible categories of recipients of personal data

Data may only be accessed by authorized individuals who have been duly instructed (also with regard to compliance with security measures and confidentiality obligations) in accordance with Art. 29 et seq. GDPR (by way of example: staff of the commercial and administrative function).

The data may be further accessed, as autonomous data controllers or data processors pursuant to Art. 28 GDPR, companies that provide services selected by the User. In order to obtain an updated list of the subjects who may become aware of the personal data, it is possible to forward a communication by e-mail to [email protected] taking care to specify the reason for the request.

6. Dissemination and transfer of personal data to a third country or outside the‘Europe

Movibell guarantees that personal data will never be disseminated. The personal data being processed may also be transferred to third countries or sites outside the European Economic Area (EEA). In these cases, if it becomes necessary to transfer data to a third country located outside the European Economic Area, the Company guarantees that such a transfer will only take place in the presence of an adequacy decision from the European Commission or other appropriate guarantees provided by the Laws on the protection of personal data (such as the stipulation of standard contractual clauses with the entity that will receive the data and that must in any case guarantee that the user’s personal data is subject to the same level of protection guaranteed by the Company).

7. Rights of the‘data subject

The exercise of the rights set forth in this section is not subject to any formal constraints and is free of charge, except for manifestly unfounded or excessive requests, pursuant to Art. 12 (5) of the GDPR.

In relation to the processing described in this notice and in accordance with the GDPR, the User may exercise the following rights:

– Right of access to their personal data and to all information under Art. 15 of the GDPR,

– Right to rectification of one’s inaccurate personal data and supplementation of incomplete personal data,

– right to erasure of their data, except for those contained in records that must be mandatorily retained by the Company and unless there is an overriding legitimate reason for processing;

– Right to restriction of processing where one of the cases referred to in Art. 18 of the GDPR.

– Right to object to the processing of one’s personal data, subject to the provisions with regard to the necessity and obligatory nature of the processing for the purposes of establishing the relationship

– Right to revoke any consent given for non-mandatory data processing, without thereby affecting the lawfulness of the processing based on the consent given prior to revocation.

The Data Subject also has the right to lodge a complaint with the Data Protection Authority(www.garanteprivacy.it) or the Data Protection Authority of the EU State where the Data Subject normally resides or works, or of the place where the alleged breach occurred, in relation to processing that he or she considers to be non-compliant.

8. Ways of exercising the rights of the‘interested party

The User may at any time exercise the rights set forth in Section 7 above (Rights of the Data Subject), for all such requests, the User may contact the Controller by e-mail at [email protected]

9. Consense

This notice provides that the processing of personal data to provide the newsletter is carried out on the basis of the User’s consent. Such consent may be expressed by placing specific flags in special boxes at the bottom of the forms on the site through which Users’ personal data are collected.

Milan, September 22, 2023