Farel Costruzioni srl - REGISTERED OFFICE: via Principale 81 - 20856 Correzzana (MB) VAT: 07629900965
OPERATIONAL HEADQUARTERS: via del Commercio, 10/12 - 20851 Lissone (MB)
Terms and conditions
EU REGULATION 679/2016 concerning the protection of natural persons with regard to the processing of personal data, as well as the free movement of such data
Farel Costruzioni Srl processes data in compliance with the provisions of European Regulation 679/16 concerning the protection of natural persons with regard to the processing of personal data, as well as the free movement of such data.
Pursuant to Articles 13 and 14 of the aforementioned regulation, the following information is provided regarding the identification data of the data controller and the data processor in relation to the processing of personal data concerning contracts and the provision of services.
The Data Controller is Farel Costruzioni Srl
The Data Protection Officer (DPO) is Mr./Ms. TITOLARE
Type of data processed
The data provided and processed by Farel Costruzioni Srl are: Administrative, Accounting, Banking, Financial, Personal data, Tax, Social security and employment data.
Purpose of processing
We inform you that personal data, provided directly by the data subject and/or collected through the completion of forms available on websites managed by Farel Costruzioni Srl, are processed for purposes related to the provision of the service covered by the contract
Methods of processing and access to data
The data collected through the signing of standard contracts in analog format are processed both in paper form and with IT and telematic tools and may be processed in aggregate form for statistical purposes and for verifying the quality standards of assistance and maintenance services, in which case the processing of identifying data is excluded.
The data collected through the completion of online forms are processed electronically and through management information systems.
The data is accessible exclusively by authorized personnel, who are adequately trained and informed about their duties and the activities permitted to them regarding the collected data, who operate on behalf of Farel Costruzioni Srl and who are recipients of instructions and tasks assigned by the data controller, by means of a letter of appointment. The data controller will process the data for the purposes indicated above, pursuing its own legitimate interests which do not override the interests or rights and freedoms of the data subject.
Scope of communication and possible dissemination
Customer and client data may be communicated to public administrations or entities providing a public service when submitting applications to participate in procedures for the selection of contractors, for the purpose of awarding contracts or concessions for the supply of goods or services, as provided for by public procurement regulations, for technical qualification purposes.
The data relating to the contract and the service activity may be communicated to business consultants for administrative and accounting purposes and to legal professionals for any dispute management.
The data, with the exception of those of a sensitive or judicial nature, may be communicated to those (private individuals or public administration), even outside the European Union, who, in their legitimate interest and making use of a right expressly granted to them by the specific legislation in force on the subject, request verification of the identity of the holder of the service provided by Farel Attrezzature Srl for investigative purposes or in any case for the protection of their own legitimate interest.
The data may also be communicated or made accessible to companies controlled by and/or affiliated with Farel Costruzioni Srl, to other parties responsible for the maintenance of IT systems, as well as to parties involved in specific phases of processing, as data processors of Farel Costruzioni Srl, whose names can be verified upon request by the interested parties.
The data may also be communicated to police authorities or the judicial authority for the purpose of investigating or suppressing crimes committed by users of telematic services, where necessary.
The data is not subject to disclosure, except for data of businesses and companies for commercial reference purposes.
The data may be processed in order to identify certain characteristics of specific types of recipients, with the aim of directing communication and advertising activities targeted to the interests of those recipients.
Personal data retention
Farel Costruzioni Srl will retain the data of the data subjects in a form that allows their identification for a period of time not exceeding the achievement of the purposes for which the data were collected; therefore, they will be kept until the existence of the current contractual relationship. The data strictly necessary for tax and accounting obligations, once the purpose for which they were collected no longer exists, will be kept for a period of 10 years as required by the relevant regulations.
The data subject has the right to request, at any time, the modification of the arrangements governed by this paragraph through the exercise of the rights referred to in the following paragraph.
The rights of the data subject
The data subject may exercise the rights referred to in Articles 15 to 22 of European Regulation 679/16:
Art 15 – Right of access by the data subject 1. The data subject has the right to obtain from the data controller confirmation as to whether or not personal data concerning him or her are being processed, and, if so, access to the personal data and the following information: a) the purposes of the processing; b) the categories of personal data concerned; c) the recipients or categories of recipients to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organizations; d) where possible, the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period; e) the existence of the right to request from the controller rectification or erasure of personal data or restriction of processing of personal data concerning the data subject or to object to such processing; f) the right to lodge a complaint with a supervisory authority; g) where the personal data are not collected from the data subject, any available information as to their source; h) the existence of automated decision-making, including profiling referred to in Article 22(1) and (4), and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject.
2. If personal data are transferred to a third country or to an international organization, the data subject has the right to be informed of the existence of appropriate safeguards pursuant to Article 46 relating to the transfer.
3. The data controller shall provide a copy of the personal data undergoing processing. For any further copies requested by the data subject, the data controller may charge a reasonable fee based on administrative costs. If the data subject makes the request by electronic means, and unless otherwise indicated by the data subject, the information shall be provided in a commonly used electronic format.
4. The right to obtain a copy referred to in paragraph 3 must not adversely affect the rights and freedoms of others.
Art 16 – Right to rectification - The data subject has the right to obtain from the data controller the rectification of inaccurate personal data concerning him or her without undue delay.
Taking into account the purposes of the processing, the data subject has the right to obtain the completion of incomplete personal data, also by providing a supplementary statement.
Art 17 – Right to erasure - The data subject has the right to obtain from the controller the erasure of personal data concerning him or her without undue delay and the controller has the obligation to erase personal data without undue delay where one of the following grounds applies: a) the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed; 4.5.2016 IT Official Journal of the European Union L 119/43 b) the data subject withdraws consent on which the processing is based according to Article 6(1)(a) or Article 9(2)(a), and where there is no other legal ground for the processing; c) the data subject objects to the processing pursuant to Article 21(1) and there are no overriding legitimate grounds for the processing, or the data subject objects to the processing pursuant to Article 21(2); d) the personal data have been unlawfully processed; e) the personal data have to be erased for compliance with a legal obligation in Union or Member State law to which the controller is subject; f) the personal data have been collected in relation to the offer of information society services referred to in Article 8(1). 2. Where the controller has made the personal data public and is obliged pursuant to paragraph 1 to erase them, the controller, taking account of available technology and the cost of implementation, shall take reasonable steps, including technical measures, to inform controllers which are processing the personal data that the data subject has requested the erasure by such controllers of any links to, or copy or replication of, those personal data. 3. Paragraphs 1 and 2 shall not apply to the extent that processing is necessary: a) for exercising the right of freedom of expression and information; b) for compliance with a legal obligation which requires processing by Union or Member State law to which the controller is subject or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller; c) for reasons of public interest in the area of public health in accordance with Article 9(2)(h) and (i) and Article 9(3); d) for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) in so far as the right referred to in paragraph 1 is likely to render impossible or seriously impair the achievement of the objectives of that processing; or e) for the establishment, exercise or defence of legal claims.
Art 18 – Right to restriction of processing - 1. The data subject has the right to obtain from the controller restriction of processing where one of the following applies: a) the data subject contests the accuracy of the personal data, for a period enabling the controller to verify the accuracy of the personal data; b) the processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of their use instead; c) although the controller no longer needs the personal data for the purposes of the processing, they are required by the data subject for the establishment, exercise or defense of legal claims; d) the data subject has objected to processing pursuant to Article 21(1) pending the verification whether the legitimate grounds of the controller override those of the data subject. 2. Where processing has been restricted under paragraph 1, such personal data shall, with the exception of storage, only be processed with the data subject’s consent or for the establishment, exercise or defense of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the Union or of a Member State. L 119/44 IT Official Journal of the European Union 4.5.2016 3. A data subject who has obtained restriction of processing pursuant to paragraph 1 shall be informed by the controller before the restriction is lifted.
Art 19 – Right to obtain notification from the data controller in cases of rectification or erasure of personal data or restriction of processing - The data controller shall communicate to each recipient to whom the personal data have been disclosed any rectification or erasure or restriction of processing carried out in accordance with Article 16, Article 17, paragraph 1, and Article 18, unless this proves impossible or involves a disproportionate effort. The data controller shall inform the data subject about those recipients if the data subject requests it.
Art 20 – Right to portability - 1. The data subject has the right to receive the personal data concerning him or her, which he or she has provided to a data controller, in a structured, commonly used and machine-readable format and has the right to transmit those data to another data controller without hindrance from the controller to which the personal data have been provided, where: a) the processing is based on consent pursuant to Article 6(1)(a) or Article 9(2)(a), or on a contract pursuant to Article 6(1)(b); and b) the processing is carried out by automated means. 2. In exercising his or her rights regarding data portability pursuant to paragraph 1, the data subject has the right to have the personal data transmitted directly from one controller to another, where technically feasible. 3. The exercise of the right referred to in paragraph 1 of this Article shall be without prejudice to Article 17. That right shall not apply to processing necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. 4. The right referred to in paragraph 1 shall not adversely affect the rights and freedoms of others.
Art 21 – Right to object - The data subject has the right to object at any time, on grounds relating to his or her particular situation, to the processing of personal data concerning him or her pursuant to Article 6(1)(e) or (f), including profiling based on those provisions. The data controller shall refrain from further processing the personal data unless he or she demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defense of legal claims.
2. If personal data are processed for direct marketing purposes, the data subject has the right to object at any time to the processing of personal data concerning him or her for such purposes, including profiling to the extent that it is related to such direct marketing.
3. If the data subject objects to the processing for direct marketing purposes, personal data will no longer be processed for such purposes.
4.5.2016 EN Official Journal of the European Union L 119/45 4. The right referred to in paragraphs 1 and 2 is explicitly brought to the attention of the data subject and is presented clearly and separately from any other information at the latest at the time of the first communication with the data subject.
5. In the context of using information society services and without prejudice to Directive 2002/58/EC, the data subject may exercise their right to object by automated means using specific technical specifications. 6.
If personal data are processed for scientific or historical research purposes or for statistical purposes in accordance with Article 89, paragraph 1, the data subject, for reasons related to his or her particular situation, has the right to object to the processing of personal data concerning him or her, unless the processing is necessary for the performance of a task carried out in the public interest.
Art 22 – Right to refuse automated processing - The data subject has the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her.
2. Paragraph 1 does not apply in cases where the decision: a) is necessary for the conclusion or performance of a contract between the data subject and the data controller; b) is authorized by Union law or the law of the Member State to which the data controller is subject, which also specifies appropriate measures to protect the rights, freedoms, and legitimate interests of the data subject; c) is based on the explicit consent of the data subject. 3. In the cases referred to in paragraph 2, letters a) and c), the data controller shall implement appropriate measures to safeguard the rights, freedoms, and legitimate interests of the data subject, at least the right to obtain human intervention on the part of the data controller, to express their point of view, and to contest
the decision. 4. The decisions referred to in paragraph 2 are not based on the special categories of personal data referred to in Article 9, paragraph 1, unless Article 9, paragraph 2, letters a) or g) apply, and adequate measures are in place to protect the rights, freedoms and legitimate interests of the data subject.
In this sense, the data subject is allowed to access their own data for
- Verify its authenticity
- Modify them if they become inaccurate Also supplement them with an integrative declaration
- Request its deletion
- Limit its processing
- Object to processing
The data controller is required to respond without unjustified reason.
Data deletion
Farel Costruzioni Srl, in compliance with the corresponding right of access of the data subject, has established procedures by which data subjects can request the erasure without undue delay of their personal data or the restriction of the processing of their personal data for the following reasons:
- Because the data is no longer necessary for the purposes for which it was collected
- Because the data subject has withdrawn consent
- Because the data subject objects to the processing
- Because the data is processed unlawfully.
To exercise the rights provided for by Articles 15 to 22 of EU Regulation 679/16, the data subject must submit a specific written request addressed to: Farel Costruzioni Srl