Informativa ex artt. 13 GDPR
Pursuant to Regulation (EU) 2016/679 (hereinafter referred to as the "Regulation"), Var Group S.p.A. and Leapfrog Srl (hereinafter also referred to as the "Joint Controllers" or "Parties") wish to inform the users (hereinafter referred to as “Users or Data Subjects”) of the purposes and methods of the processing of personal data collected in connection with requests for information (hereinafter referred to as the "Call to Back") that come from the www.rippleorganization.vargroup.com website (hereinafter referred to as the "Website").
1 Data processed
The Parties intend to proceed with the processing of personal data of Users who use Call to Back such as personal data, contact data (e-mail address and telephone number) and role and organization to which they belong.
2 Purpose, legal basis and data retention
The personal data processed by the Parties are directly provided by the Data Subject by filling in the Call to Back form in order to request information on the project related to the Ripple Organization organizational model. In this case, the processing is based on the fulfillment of pre-contractual measures pursuant to art. 6, paragraph 1, letter b), of the GDPR. In addition, the Parties may carry out marketing and commercial promotion activities towards the Data Subject based on the provision of a specific, free and optional consent that may be withdrawn at any time pursuant to art. 6, par. 1, letter a), of the GDPR.
The Parties may also process the Data Subject's personal data for internal reporting and statistical analysis purposes of contact lists, based on their legitimate interest pursuant to art. 6, par. 1, letter f) of the GDPR, of the GDPR. The Parties may also contact the User following the first Call to Back step to propose again services and/or initiatives related to or similar to Ripple Organization based on their legitimate interest pursuant to art. 6, par. 1, letter f) of the GDPR.
In relation to the purposes set out above, personal data will be processed and stored for the time strictly necessary for the pursuit of the same purposes, in accordance with the principles applicable to the processing of personal data pursuant to art. 5 GDPR, as well as in compliance with the rights of the Data Subject.
Consequently, the Parties:
For the purposes of managing the contacts of Users who contact the Joint Controllers, the Parties will process personal data for 6 (six) months following the User's request for information. In addition, for the same retention period, the Parties may process personal data for the purpose of reporting and statistical analysis on the contact lists of Users who have requested information. In addition, the Parties may contact the User again during the same period to propose services and/or initiatives related to or similar to Ripple Organization. At the end of the 6 (six) months, the Parties will proceed to permanently delete and/or anonymise the data.
For marketing and commercial promotion purposes for a period no longer than 24 months from collection, unless consent is withdrawn. Near the deadline indicated above, the Parties may send a request for renewal of consent; in the event of new consent, the relevant consent will be considered valid for the following 24 months. It should be noted that the Data Subject may withdrawn, at any time, the consents already given to the processing of personal data; the withdrawal of consent does not affect the lawfulness of the processing carried out before the withdrawal itself. The withdrawal can be exercised through the form accessible through the communications received at your e-mail address or by writing to the following e-mail address: digitallaw&dataprotection@vargroup.it.
3 Data recipients
The data will be processed by the internal resources of the Parties as authorized to process the data. If it is necessary to carry out a transfer of data outside the EEA, the Parties will take care to notify the Data Subject and will adopt one of the safeguards indicated in Chapter V of the Regulation.
4 Rights of the Data Subject
The Data Subjects may exercise the rights of access to personal data pursuant to art. 15 of the EU Regulation and the rights provided for by art. 16, 17, 18, 20 and 21 of the Regulation regarding the rectification, erasure, limitation of the processing of personal data, data portability, where applicable and the opposition to the processing of personal data, in the manner established by art. 12 of the Regulation and within the limits established by art. 2-undecies Italian decree 196 of 30 June 2003, as amended. The rights can be exercised by writing to the following address: digitallaw&dataprotection@vargroup.it.
5 Right to lodge a complaint
Data subjects have the right to lodge a complaint with the Data Protection Authority. Below are the coordinates:
Piazza Venezia n. 11 - 00187 Roma
Centralino telefonico: (+39) 06.69677.1
E-mail: protocollo@gpdp.it
6 Data Protection Officer
The Data Protection Officer can be contacted at the following e-mail address: dpo@sesa.it.