Consent to the processing of personal data

Pursuant to articles 13 and 14 of Regulation (EU) 2016/679 (General Data Protection Regulation, so-called “GDPR”), we inform you that your personal data provided to us will be subject, in compliance with the aforementioned legislation and in accordance with the confidentiality obligations that inspire the activity of CFA, of the processing as defined by Article 4 of Regulation (EU) 2016/679. In particular, we would like to inform you of the following:

Data relating to the Data Controller

The data controller is Alessandro Vannucci, Via Rubens 10 – 20148 Milan, email address: alessandrovannucci@yahoo.it

Purpose of the processing

In consideration of the activity carried out by Alessandro Vannucci, the collection and processing of your personal data (including name, surname, date of birth, residence address, email address, bank details, and any particular data) has as its purpose:

Processing for purposes related to the execution of the services deriving from the contractual relationship and the provision of the assistance and consultancy services indicated in the Contract.

The legal basis of the processing consists in the execution of the contract (Article 6, paragraph 1, let.b) of the Regulation).

Processing for purposes related to the management of the personal relationship with the Customer (planning of activities, telephone contacts, meetings, etc.).

The legal basis of the processing consists in the execution of the contract (Article 6, paragraph 1, let.b) of the Regulation).

Processing for purposes related to the fulfillment of legal obligations and, in particular, accounting and tax obligations.

The legal basis of the processing consists in the fulfillment of a legal obligation (Article 6, paragraph 1, let.c) of the Regulation).

Processing for purposes related to the management of any disputes

The legal basis of the processing consists in the pursuit of the legitimate interest of the Data Controller (Article 6, paragraph 1, letter f) of the Regulation).

Processing related to the detection of the degree of customer satisfaction and management of marketing activities by sending informative material in relation to services offered through the periodic newsletter.

The legal basis of the processing is consent (Article 6, paragraph 1, letter f) of the Regulation).

The personal data of the interested party will be processed by authorized personnel pursuant to Article 29 of Regulation (EU) 2016/679.

In order to fulfill the obligations of customer due diligence, which includes the identification of the beneficial owner, referred to in Legislative Decree 231/2007, the CFA may use public registers, lists, deeds or documents that can be known by anyone, containing information on customers and beneficial owners.

The processing of Data for these purposes will take place with computerized and manual methods, based on logical criteria compatible and functional to the purposes for which the data were collected, in compliance with the rules of confidentiality and security required by law and internal regulations. Some Data will also be processed on behalf of the CFA by third parties, bodies or professionals who, as outsourced Data Processors, perform specific processing services or activities complementary to those of the CFA. The Data referring to the Data Subject are, or have been, provided to the CFA by the same Data Subject and may be, or have been, also collected from public registers or lists.

Particular data (sensitive data)

With regard to the processing of any data related to health (but not clinical documentation), it can only take place with the express consent of the interested party.

Mandatory or optional nature of the provision of Data

The provision of personal data for the purposes referred to in letters a) and b) is optional but the refusal to provide them makes it impossible for the owner to establish the contract and execute the services. The provision of data is mandatory for the purposes referred to in letter c) and failure to provide it may give rise to a violation of the law (with possible consequences for the interested party) or a breach of contract by the interested party (to which contractual or civil remedies regarding non-fulfillment may be obtained). The provision of data is optional for the purposes referred to in letter e) and the refusal to provide them will not affect in any way the establishment of the contract or the execution of the requested services. We remind you right now that any withdrawal of consent to the processing of data will not affect the lawfulness of the processing based on the consent given before the revocation.

Retention Period

The Data will be kept in full for the entire period of execution of the contract; subsequently, the Data will be kept for a period of ten years in order to comply with legal obligations and, among these, the obligations referred to in art. 2220 of the Civil Code. Any further storage of Data or part of the Data may be arranged to assert or defend their rights in any possible place and in particular in the judicial offices.

Communication to third parties and dissemination

The achievement of the aforementioned purposes may also take place by means of transmission and communication of data to third parties, with this meaning such third parties authorized to the related processing of the data, as they are in charge of carrying out or providing specific services strictly functional to the execution of the contractual relationship, such as:

banks and credit institutions, in relation to certain payment methods;

companies and professionals used by the owner;

companies and professionals that the Customer uses, for particular services rendered and always at the request of the Customer.

The names and addresses of these subjects are available at the request of the interested parties.

Dissemination and Transfer of Data to Countries Outside the European Union

The personal data of the interested party will not be disseminated, having to be understood by dissemination the giving knowledge of the personal data of the interested party to indeterminate subjects.

Personal data will not be transferred to countries located outside the European Union.

Rights of the interested party

With regard to your personal data, we inform you that you can exercise the rights provided for in articles 15 to 22 of Regulation (EU) 2016/679:

Access to the following information:

purpose of the processing,

categories of personal data in question,

recipients or categories of recipients to whom such personal data have been or will be communicated, in particular if recipients of third countries or international organizations,

existence of the right of the interested party to ask the data controller to rectify or delete personal data or limit the processing of personal data concerning him or to oppose their processing;

Rectification, by which I mean:

correction of inaccurate personal data concerning him without justified delay,

integration of incomplete personal data, including by providing a supplementary statement;

deletion of data concerning you without undue delay, if:

the data are no longer necessary with respect to the purposes for which they were collected or otherwise processed,

a withdrawal of consent is formulated and there is no other legal basis for the processing,

you object to the processing and there is no overriding legitimate reason to proceed with the processing,

the personal data have been processed unlawfully,

personal data must be deleted to comply with a legal obligation,

personal data have been collected in relation to the offer of services of the CFA of information;

restriction of processing:

if you contest the accuracy of the personal data, for the period necessary for the data controller to verify the accuracy of such personal data

when the processing is unlawful and the data subject opposes the erasure of the personal data and requests instead that their use be restricted,

when the personal data are necessary for the data subject to ascertain, exercise or defend a right in court, although the data controller no longer needs it for the purposes of the processing,

if you object to the processing by virtue of the right to object;

Receive notification in case of correction or cancellation of personal data or limitation of processing;

Data portability, i.e. the right to receive personal data concerning you in a structured, commonly used and machine-readable format and you have the right to transmit such data to another data controller, if:

the processing is based on the express consent of the interested party for one or more specific purposes or takes place on the basis of a contract signed with the interested party and

the processing is carried out by automated means;

Opposition at any time, for reasons related to your particular situation, to the processing of personal data concerning you.

Right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or which significantly affects him or similarly significantly affects his person.

To exercise the above rights, you can contact the Data Controller, by sending a registered letter with return receipt to the address indicated or an email to the address alessandrovannucci@yahoo.it.

You have the right to lodge a complaint with a supervisory authority if you believe that the Data has been processed in violation of the GDPR