According to Regulation (EU) 2016/679 (hereinafter “GDPR”), this page describes the processing methods of personal data. This notice is provided pursuant to Art. 13 GDPR and applies solely to this website, not to any other third-party sites accessible via links, for which no responsibility is assumed.
Personal Data Subject to Processing
Personal data: any information relating to an identified or identifiable natural person (“data subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to their physical, physiological, genetic, mental, economic, cultural or social identity (C26, C27, C30 GDPR).
Data Controller
Pursuant to Art. 4 and 24 of Regulation (EU) 2016/679, the Data Controller is ATLANTE SRL, with registered office at Via 2 Giugno 1946 n.8, 40033 Casalecchio di Reno (BO), represented by the legal representative pro tempore.
Purposes and Lawfulness of Processing
| PURPOSE OF PROCESSING | LEGAL BASIS | DATA RETENTION PERIOD | DATA PROVISION | |
| A) | Website browsing
Activities strictly related to the website’s operation and to the provision of the browsing service on the platform. The data necessary for using web services will also be processed to: • obtain statistical information about the use of services (most visited pages, number of visitors per hour/day, geographical areas of origin, etc.); • verify the correct operation of the services provided. | Legitimate interest | Data subject’s rights
Art. 6(f) and Recital 47 GDPR: processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party. | For the duration of the browsing session and up to a maximum of 7 additional days (unless required for investigation by judicial authorities). | Necessary to enable browsing. |
| B) | Contact or information request submitted via phone or dedicated form. | Contract – Pre-contractual measures
Art. 6(b) and Recital 44 GDPR: processing is necessary for the performance of a contract to which the data subject is party or to take steps at the data subject’s request prior to entering into a contract. | 1 year | Mandatory. Failure to provide data will make it impossible to receive a response to requests. |
| C) | Unsolicited job application through the “Work with us” section. | Contract
Art. 6(b) GDPR: processing is necessary for the performance of a contract to which the data subject is party or to take steps at the data subject’s request prior to entering into a contract. | 2 years | Mandatory. Essential to establish or manage a contractual relationship. Failure to provide data will prevent the Controller from proceeding. |
| D) | Direct marketing for sending promotional or commercial communications, newsletters or surveys via automated means (email).
No personal data will be disclosed to third parties. For a complete list of group companies and partners, you can write to privacy@atlantesrl.it. | Consent of the data subject
Art. 6(a) and Recitals 42, 43 GDPR: the data subject has given consent to the processing of their personal data for one or more specific purposes. | Until consent is withdrawn (opt-out). | Optional, but necessary to receive the newsletter. Without consent, the Controller will not be able to send marketing communications. |
| E) | Non-automated profiling
Personal data may be included in company databases/CRM systems to perform analyses and create homogeneous groups of users based on specific business characteristics, in order to manage services and send targeted promotional communications more effectively. | Consent of the data subject
Art. 6(a) and Recitals 42, 43 GDPR. | Until consent is withdrawn (opt-out) and in any case for no more than 12 months. | Optional. Failure to provide necessary data will prevent analysis and targeted communication. |
Recipients or Categories of Recipients of the Data
Personal data will be communicated, depending on the purposes outlined above, to entities acting as independent Data Controllers or as Data Processors (Art. 28 GDPR), and to natural persons (Art. 29 GDPR) acting under the authority of the Controller and Processors, in accordance with specific instructions. Data may be shared with the following categories of recipients:
- Entities based in Italy providing website and communication network services, including email, hosting, and platform management;
- Entities based in Italy with which the Controller has agreements, subject to consent where required;
- Entities responsible for direct marketing activities, subject to consent;
- Entities responsible for recruitment activities in relation to the “Work with us” section;
- Competent authorities for compliance with legal obligations and/or requests from public bodies.
The list of Data Processors is available upon request at: privacy@atlantesrl.it
Transfer of Data to Third Countries and/or International Organisations
Personal data will not be transferred outside the European Economic Area (EEA). In particular, data will be stored in Europe for website hosting, management, development and maintenance services. All third parties involved are based in Europe.
Automated Processing
Personal data will be processed using traditional manual, electronic, and automated means. No fully automated decision-making processes are carried out.
Any profiling activities, if explicitly consented to, will involve human intervention to analyse the data subject’s habits and preferences in order to improve the Controller’s commercial offerings and services (non-automated profiling).
Data Subject Rights
Data subjects may exercise their rights under Articles 15–22 GDPR by contacting the Data Controller at the above-mentioned email address. These include the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), and restriction of processing (Art. 18). The Controller shall notify each recipient to whom personal data have been disclosed of any rectification or erasure or restriction of processing (Art. 19).
Where applicable, the data subject also has the right to data portability (Art. 20) and the right to object (Art. 21) at any time to processing based on legitimate interest. Where processing is based on consent, the data subject may withdraw consent at any time without affecting the lawfulness of processing prior to withdrawal.
To stop receiving direct marketing communications or to withdraw consent for profiling, please contact the Data Controller at: privacy@atlantesrl.it
If you believe that your data have been processed unlawfully, you have the right to lodge a complaint with the Supervisory Authority (www.garanteprivacy.it) or to take appropriate legal action.
Date of last update: 19 September 2019
The Controller reserves the right to modify, update or remove parts of this notice.
ATLANTE SRL