INFORMATION NOTICE ON THE PROCESSING OF PERSONAL DATA PURSUANT TO ART. 13 OF REGULATION (EU) 2016/679 (GDPR)
Pursuant to and for the purposes of the applicable legislation, including Regulation (EU) 2016/679 “General Data Protection Regulation” (“GDPR”), Legislative Decree no. 196/2003 (“Privacy Code”), as well as any other applicable provisions on the protection of personal data (the “Privacy Legislation”), Inquaero S.r.l., as data controller, informs you that it will process the data communicated by the user or otherwise obtained through the use of the website https://www.inquaero.com (the “Site”) with the methods and for the purposes described below in this notice (the “Notice”).
The terms of this Notice apply exclusively to the Site and not to other websites owned by the Controller or owned by third parties that the user may access through the links possibly contained in the Site. Should the user access another website, it is recommended to read the information regarding the processing of personal data applicable to that website.
By browsing the Site, the user acknowledges having read and understood the content of this Notice.
1. Contact details of the Data Controller
The Data Controller is Inquaero S.r.l. (hereinafter also the “Controller” or “Company”) with registered office at Via Benigno Crespi 24, Milan (MI). You may contact the Data Controller by email at the address privacy@inquaero.com or by ordinary mail at the address indicated above.
2. Types of personal data processed through the Site
The Controller processes the following types of personal data of users who browse and interact with the web services of the Site, in particular:
- Browsing data
The computer systems and software procedures used to operate the Site acquire, in the course of their normal operation, certain personal data whose transmission is implicit in the use of internet communication protocols or is used to improve the quality of the service offered. These are information that are not collected to be associated with identified data subjects, but which by their very nature could, through processing and associations, allow users to be identified.
This category of data includes IP addresses or domain names of the computers used by users connecting to the Site, addresses in URI (Uniform Resource Identifier) notation of the requested resources, the time of the request, the method used to submit the request to the server, the size of the file obtained in response, the numerical code indicating the status of the response given by the server (successful, error, etc.) and other parameters relating to the user’s operating system and IT environment.
These data are used for the purpose of obtaining anonymous statistical information on the use of the Site and to check the correct functioning of the IT systems. The data could also be used to ascertain responsibility in the event of hypothetical computer crimes or in the event of damage to the Company or to third parties.
- Data voluntarily provided by the data subject
Users are not required to provide personal data to visit the Site. However, contacts between users and the Company, through the completion of contact forms, in the “Contacts” section, the sending of emails, messages or any type of communication to the addresses indicated on the Site, entail the consequent acquisition of common personal data, such as by way of example name, surname, email, as well as any other personal data that the user will provide spontaneously by interacting with the Company through the Site.
Therefore, should the user wish to avoid the processing of their data by the Company, they are invited not to forward any request or, at the very least, to provide as little personal data as possible.
3. Purposes and legal basis of the processing
Personal data may be collected and processed for the following purposes:
| Purpose of the processing | Legal basis of the processing | Nature of the provision |
|---|---|---|
| a) to allow users to use the web services of the Site; | Article 6, paragraph 1, letter b) of the GDPR: performance of a contract to which the data subject is party or of pre-contractual measures taken at the request of the data subject; | The provision of personal data is necessary and does not require your consent. Any refusal to provide the data may result in the impossibility for the Company to comply with the requested service, to fulfil legal obligations and to handle and respond to your requests. Providing data to manage requests for information is not a legal or contractual requirement; however, the provision of data is necessary to respond to your request. |
| b) to manage the user’s requests for information; | Article 6, paragraph 1, letter b) of the GDPR: performance of a contract to which the data subject is party or of pre-contractual measures taken at the request of the data subject; | |
| c) to prevent the commission of unlawful acts through the Site; | Article 6, paragraph 1, letter f) of the GDPR: pursuit of a legitimate interest of the Controller; | |
| d) to protect the rights of the Company, in the event of any legal disputes; | Article 6, paragraph 1, letter f) of the GDPR: pursuit of a legitimate interest of the Controller; | |
| e) to fulfil the legal obligations to which the Company is subject. | Article 6, paragraph 1, letter c) of the GDPR: fulfilment of legal obligations to which the Controller is subject. |
Should the Controller intend to use the collected personal data for any other purpose incompatible with the purposes for which they were originally collected or authorised, the Controller will inform the user in advance, and the latter may also deny or revoke their consent.
For any processing of personal data carried out through cookies, reference is made to the dedicated Cookie Policy.
Should the Controller intend to process the user’s personal data through cookies or similar tracking tools, it will inform the user, collecting their consent where necessary.
4. Methods of the processing
Within the organisational structure of the Company, personal data will be processed by persons authorised to process them who act under the authority of the Data Controller, duly instructed by the Controller itself, mainly with electronic systems in compliance with the principles applicable to the processing of personal data pursuant to art. 5 of the GDPR.
5. Criteria used to determine the retention periods of personal data
Your data will be kept for the period necessary to fulfil legal obligations.
The retention period of the data depends on the purposes for which they are processed and may therefore vary. The criteria used to determine the applicable retention period are the following: the retention of the personal data covered by this Notice will take place for the time necessary (i) to manage the contractual relationship with the user, (ii) to manage complaints or specific requests of the user, (iii) to assert rights in court, and (iv) for the period provided for by applicable laws.
6. Communication, disclosure and transfer of personal data
Personal data will not be disclosed and may be communicated to the competent Authorities or to public or private entities for the fulfilment of obligations provided for by law.
The collected personal data may be processed by third-party providers, as data processors in relation to the services performed on behalf of the Company on the basis of specific contractual agreements, possibly for occasional maintenance operations and as far as necessary to perform services under specific requests.
Your personal data will not be transferred outside the European Union and/or the European Economic Area (“EEA”).
The complete list of such subjects or categories of subjects is available at the Controller’s registered office and can be requested by sending a communication to the contact details indicated in paragraph 1 of this Notice.
7. Rights of the data subject
Within the limits provided for under art. 2-undecies of the Privacy Code, you have the right to exercise at any time the rights recognised by arts. 15 to 22 and 77 of the GDPR, as briefly summarised below:
- Right of access: you may request information regarding the processing we carry out on your data or confirmation that the Controller processes your personal data. In such case, you may ask us to provide a copy of your data and to verify which data we hold.
- Right of rectification: you have the right to ask us to rectify your personal data in the event they are not correct, including the right to request the completion of incomplete personal data.
- Right to erasure: you have the right to ask us to delete the data (or part of them) you have provided, including those whose retention is no longer necessary in relation to the purposes for which the data were collected or otherwise processed.
- Right to restriction of processing: you may ask us to restrict the processing of your personal data should the legal conditions apply.
- Right to object: you may object to the processing of your personal data, without prejudice to the existence of a prevailing legitimate reason for the continuation of such processing.
- Right to data portability: you may obtain from the Company, in a structured, commonly used and machine-readable format, the personal data you have communicated to us, in order to transmit them to another entity. This right applies where the Company processes such data through automated means, on the basis of consent or for the purpose of providing services.
- Withdrawal of consent: where the processing is based on consent, you may withdraw it at any time, without prejudice to the lawfulness of the processing carried out before such withdrawal.
- Right not to be subject to automated decision-making: you may request not to be subject to processing based solely on automated decision-making, including profiling, which produces legal effects concerning you or similarly significantly affects you. This right cannot be exercised where: i) the processing is necessary for the conclusion of a contract between you and the Controller; ii) the processing is authorised by law; iii) the processing is based on your consent.
- - Right to lodge a complaint with the Supervisory Authority: without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with the competent Supervisory Authority where you consider that the processing carried out violates the current legislation on the protection of personal data.
Without prejudice to the procedures provided for by the Italian Data Protection Authority to promote any complaint, for all other rights you may send a request to the Controller through the contact details indicated in paragraph 1 of this Notice.