Pursuant to Article 13 of EU Regulation 2016/679 of 27/04/2016, hereinafter referred to as GDPR (General Data Protection Regulation), EXACT LAB S.r.l., with registered office and operations in Via Crispi, 56 – 34142 Trieste, Italy, as the data controller, hereby informs you of the following:
Data controller
The data controller is EXACT LAB S.r.l., with registered office and place of business at Via Crispi, 56 – 34142 Trieste.
Purpose of processing
- conclusion and execution of the contract and all activities related thereto, such as, by way of example, invoicing, credit protection, administrative, management, organizational, and functional services for the execution of the contract;
- compliance with obligations under the law, regulations, applicable legislation, and other provisions issued by authorities vested with legal powers and by supervisory and control bodies.
Mandatory or optional nature of data provision and consequences of refusal to provide personal data
The data requested for the purposes referred to in points a) and b) above must be provided in order to comply with legal obligations and/or to conclude and execute the contractual relationship and provide the requested services. Therefore, your refusal, even partial, to provide such data would make it impossible for the Supplier to establish and manage the relationship and provide the requested service.
Data processing methods
Personal data is processed using the methods indicated in Article 4(2) of the GDPR, for the purposes indicated above, both on paper and electronically, using electronic or automated tools, in compliance with current legislation, particularly with regard to confidentiality and security, and in accordance with the principles of fairness, lawfulness, transparency, and protection of the customer’s rights.
The processing is carried out directly by the data controller’s organization, its managers, and/or agents.
Communication and Dissemination
Your personal data may be disclosed, within the limits strictly relevant to the obligations, tasks, and purposes mentioned above and in compliance with current legislation, to the following categories of subjects:
- parties to whom such communication must be made in order to fulfill or enforce specific obligations under laws, regulations, and/or EU legislation;
- companies belonging to the Data Controller’s Group or parent, subsidiary, or affiliated companies pursuant to Art. 2359 of the Italian Civil Code, which act as data controllers or for administrative and accounting purposes (purposes related to the performance of internal organizational, administrative, financial, and accounting activities, in particular, functional to the fulfillment of contractual and pre-contractual obligations);
- External natural and/or legal persons who provide services instrumental to the Data Controller’s activities for the purposes referred to in point 1 above (e.g., call centers, suppliers, consultants, companies, organizations, professional firms). These entities will act as data processors.
Personal data retention period
Personal data will be retained for the entire duration of the contract stipulated with the Data Controller. After this period, the data will be retained for the duration of the legally required retention periods for administrative documents, after which they will be deleted.
Data transfer
Personal data is stored on servers located within the European Union. It is understood that the Data Controller, if necessary, will have the right to relocate the servers outside the EU. In this case, the Data Controller hereby ensures that the transfer of data outside the EU will take place in accordance with applicable legal provisions, subject to the stipulation of the standard contractual clauses provided by the European Commission.
Rights of the interested party
- obtain confirmation of the existence or otherwise of personal data concerning you, even if not yet recorded, and their communication in an intelligible form;
- get the indication:
- of the origin of personal data;
- of the purposes and methods of processing;
- of the logic applied in case of processing carried out with the aid of electronic instruments
- of the identifying information of the owner, managers, and the designated representative pursuant to art. 5, paragraph 2 of the Privacy Code and art. 3, paragraph 1, of the GDPR;
- of the subjects or categories of subjects to whom the personal data may be communicated or who may become aware of them in their capacity as designated representative in the territory of the State, managers or persons in charge;
- obtain:
- the updating, rectification or, when relevant, integration of the data;
- the deletion, transformation into anonymous form or blocking of data processed in violation of the law, including data whose retention is not necessary in relation to the purposes for which the data were collected or subsequently processed;
- certification that the operations referred to in letters a) and b) have been brought to the attention, including with regard to their content, of those to whom the data were communicated, except in the case in which such fulfillment proves impossible or involves the use of means manifestly disproportionate to the right protected;
- to object, in whole or in part:
- for legitimate reasons, to the processing of personal data concerning you, even if pertinent to the purpose of the collection.
