Data Controller

The data controller is

Cultural Association Committee of San Floriano
head office Piazza don G.B. Piemonte 1
33028 – Tolmezzo (Illegio).

The Data Controller can be contacted by
E-mail: amministrazione@illegio.it cert@pec.comitatosanfloriano.it,
to allow the interested party to exercise their rights.

Objectives of data processing

The personal data you provide will be processed for the purpose of sending out, by means of newsletters, commercial and/or promotional communications or advertising material on events organized by the Committee or for detecting the degree of satisfaction with their quality.

Refusal to provide your personal data will make it impossible for us to handle these communications correctly.

Legal basis

Personal data will be processed for the purpose of sending, via newsletter, commercial and/or promotional communications or publicity material on events organized by the Committee or for measuring the degree of satisfaction with their quality only with your express consent.

Transfer of data

The Data Controller does not transfer personal data to other countries or to international organizations.

However, it reserves the possibility of using cloud services; in which case, the service providers will be selected from among those who provide adequate guarantees, as provided for in Article 46 GDPR 679/16.

Data communication

Furthermore, your data may be disclosed to third parties, for technical and operational requirements strictly related to the purposes set out above and, in particular, to suppliers of installation services, assistance and maintenance of computer and telematic systems and equipment and of all services functionally connected and necessary for the performance of the services covered by the Contract.

Data storage

Your personal data, processed for the purposes of marketing and promoting the events organized by the Comitato di San Floriano, will be kept for five years without prejudice to the exercise of the rights mentioned below.

Data subjects’ rights

Pursuant to articles 13, paragraph 2, and from 15 to 21 of the Regulations, we inform you that in relation to the processing of your personal data you can exercise the following rights:

a. The right to obtain access to personal data and to the following information: confirmation as to whether or not personal data are being processed; the purposes of the processing; the categories of personal data; the recipients or categories of recipients to whom the personal data have been or will be disclosed; where the data are not collected from the data subject, all available information as to their source; the existence of an automated decision-making process, including profiling; a copy of the personal data undergoing processing.

b. Right of rectification and integration of personal data;

c. Right of data erasure (“right to be forgotten”) if one of the following grounds exists: the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed; the subject withdraws consent to the processing of the data and there is no other legal basis for the processing; data subject objects to the processing and there is no overriding legitimate ground for the processing; personal data have been processed unlawfully; personal data must be erased in order to comply with a legal obligation under Union or Member State law to which the data controller is subject. If the controller has made personal data public and is obliged to erase it, it must inform the other controllers processing the personal data of the request to erase any link, copy or reproduction of its data.

d. Right to restriction of processing where: the data subject contests the accuracy of the personal data, for the period necessary for the controller to verify the accuracy of the personal data; the processing is unlawful and the data subject objects to the erasure of the personal data and requests instead that their use be restricted; although the data controller no longer needs the personal data for the purposes of processing, the personal data are necessary for the establishment, exercise or defence of legal claims; the data subject has objected to the processing, pending verification as to whether the data controller’s legitimate reasons prevail over those of the data subject.

e. Right to file a complaint with the Authority for the Protection of Personal Data, following the procedures and indications published on the Authority’s official website www.garanteprivacy.it.

f. Right to data portability, namely the right to receive in a structured, commonly used and machine-readable format the personal data concerning him/her that have been provided to a data controller and, where applicable, to have them transmitted to another data controller, where the processing is based on consent or on a contract and is carried out by automated means. Where technically possible, the data subject shall have the right to obtain the direct transmission of data from one controller to another.

g. The right to object at any time to the processing of personal data, including profiling, in particular where: the processing is carried out on the basis of the legitimate interest of the data controller, subject to prior explanation of the reasons for the objection; personal data are processed for direct marketing purposes.

h. The right not to be subject to a decision based solely on automated processing, including profiling, except where the decision: is necessary for the conclusion or performance of a contract between the data subject and a data controller; is authorized by Union law or the law of the Member State to which the data controller is subject; or is based on the explicit consent of the data subject.

i. The right to revoke consent at any time; obviously with all consequences resulting from the impossibility of complying with legislative or contractual provisions if the processing is established by such provisions.

The exercise of rights is not subject to any formal constraints and is free of charge.