Privacy

Document reproduced from the official Abitare 2000 website, to which the information refers.

DETAILED NOTICE UNDER ARTICLES 12, 13 AND, WHERE APPLICABLE, 14 OF THE GDPR — REGULATION (EU) 2016/679 ON THE PROTECTION OF NATURAL PERSONS WITH REGARD TO THE PROCESSING OF PERSONAL DATA (HEREAFTER THE GDPR)

The controller provides the following notice under Articles 12, 13 and, where applicable, 14 of the GDPR regarding personal data supplied by the Customer/data subject when completing and signing a Contract to purchase the controller's products or services, voluntarily submitting personal data to this website (particularly through forms), or simply browsing it.

1. Controller and contact details
The controller is ABITARE 2000 DI FRANCO IACOMINO, based at VIA VARIANTE 7 BIS 117 NOLA (NA) 80035, VAT number 00113191217, telephone 0818238031, email info@abitare2mila.it, website https://www.abitare2mila.it (hereafter the Website).

2. Principles applicable to processing
In accordance with the GDPR, the controller continually seeks to ensure that personal data are:

1. processed lawfully, fairly and transparently;
2. collected for specified, explicit and legitimate purposes and not subsequently processed incompatibly with those purposes;
3. adequate, relevant and limited to what is necessary for the purposes of processing;
4. accurate and, where necessary, up to date;
5. kept no longer than necessary to achieve the purposes for which they are processed;
6. processed securely using appropriate technical and organisational measures;
7. where based on consent, processed following a freely made decision by the Customer/data subject, based on a request clearly distinguishable from other matters, in an understandable, accessible form using clear and plain language.

The controller adopts appropriate technical and organisational measures to protect personal data by design and ensure that, by default, only the data necessary for each specific purpose are processed.
The controller collects and carefully considers suggestions, comments and opinions sent by the Customer/data subject to the contact details above, to implement a dynamic privacy management system that effectively protects people with regard to their data.
This notice may change as relevant legislation and the controller's technical and organisational measures develop. Customers/data subjects are therefore asked to visit this section periodically to read updates and the notice currently in force.

3. How personal data are processed
Personal data are processed manually and electronically, using methods closely related to the purposes below and in a way that ensures their security and confidentiality.

4. Purposes of personal data processing

(4a) Purposes for which processing is necessary
Personal data supplied by the Customer/data subject are primarily processed to perform the Contract, manage credit and, more generally, manage the relationship arising from the Contract.
Providing data in the Contract or subsequently during the contractual relationship for these purposes is mandatory. Failure to provide data, or providing incomplete or inaccurate data, prevents the Contract from being concluded and/or performed and prevents the Customer/data subject from using the controller's products/services, potentially exposing them to liability for breach of contract.
Personal data may also be processed where necessary to comply with a legal obligation on the controller, protect the vital interests of the Customer/data subject or another person, perform a task in the public interest or exercise official authority vested in the controller, or pursue the legitimate interests of the controller or third parties, provided the Customer/data subject's interests or fundamental rights and freedoms do not override them. Providing data is also mandatory in these cases, and failure to provide data or providing incomplete or inaccurate data may expose the Customer/data subject to liability and penalties under the applicable legal system.

(4b) Additional purposes following specific, express consent
In addition to the purposes above, supplied/acquired personal data may, with the Customer/data subject's consent expressed by selecting the 'Give consent' box in the Contract or on the Website (or other social or web applications of the controller), be processed for market research and commercial or promotional communications by telephone (including the supplied mobile number) and automated contact systems (email, SMS, MMS, fax, etc.) regarding the products/services of the controller or companies in any Group to which it belongs.
Consent for the purposes in (4b) is optional. If refused, data will be processed only for the purposes in (4a), subject to the provisions below on legitimate interests of the controller or third parties.

5. Categories of personal data processed
The controller primarily processes identification and contact data (first name, surname, addresses, types and numbers of identification documents, telephone numbers, email addresses, tax/billing data and other relevant information) and, where commercial transactions occur, financial data (banking data, particularly account identifiers, credit card numbers and other information connected with those transactions).
Processing for contractual purposes or with express consent does not generally concern special categories of personal data, known as sensitive data (revealing racial or ethnic origin, political opinions, religious beliefs, health or sexual orientation, etc.), genetic or biometric data, or data relating to criminal convictions and offences.
However, in performing contractual obligations, the controller may need to retain and/or process sensitive, genetic, biometric or criminal-offence data belonging to the Customer/data subject or third parties, for which the Customer/data subject acts as controller. In that case processing takes place under the terms, conditions and limits of the appointment of the controller as processor by the Customer/data subject.
As controller of the Website, and potentially as processor appointed by the Customer/data subject as described above, the controller also processes browsing data. The systems and software operating websites acquire certain personal data in their normal operation, whose transmission is implicit in internet protocols. These are not collected to be associated with identified individuals, but by their nature may enable identification. They include geolocation data, IP addresses, browser type, operating system, domain names and websites from which users enter or leave, pages visited, access times, time spent on pages, internal navigation paths and other system or environment parameters. Processing and combining such information, including with data held by third parties, can identify users.
The Website may also use session cookies (not stored on the data subject's computer and deleted when the browser closes), persistent cookies, or other tracking systems to transmit personal information.

6. Sources of personal data
Personal data are collected directly from the Customer/data subject while they browse the Website (or other social or web applications of the controller), or through sales representatives when or after signing the Contract and during its performance, or from public sources.
As explained above, as an appointed processor fulfilling contractual obligations, the controller may retain and/or process third-party data, particularly browsing data and potentially sensitive, genetic, biometric or criminal-offence data for which the Customer/data subject acts as controller, acquired with those third parties' consent while they browse the Website or other relevant applications.

7. Legitimate interests
The legitimate interests of the controller or third parties can provide a lawful basis for processing where they are not overridden by the data subject's interests or fundamental rights and freedoms. Such interests may arise where there is a relevant, appropriate relationship, for example when the data subject is a customer. In particular, the controller has a legitimate interest in processing data for fraud prevention, direct marketing, movement of data within any business Group to which it belongs, or processing traffic data to ensure network and information security: the ability of a system to resist unexpected events or unlawful acts compromising availability, authenticity, integrity or confidentiality.

8. Circulation of personal data

(8a) Disclosure of personal data — categories of recipients
Besides employees and collaborators authorised to process data under appropriate written instructions ensuring confidentiality and security, third parties may perform activities for the purposes in (4a), fulfilling contractual or legal obligations. These include, without limitation, commercial/technical partners; banking and financial service providers; document storage companies; debt collectors; auditors and financial statement certifiers; rating companies; professional advisers; customer care providers; factoring, securitisation or other credit assignees; companies in any Group to which the controller belongs; business information providers; and IT service providers. They process data as independent controllers or as processors for specific operations covered by their contracts with the controller. Processors receive appropriate written instructions, particularly regarding minimum security measures, to ensure confidentiality and security.
Third parties may also perform activities for the purposes in (4b). These include, without limitation, commercial/technical partners, marketing service providers, advertising agencies and advisers on competitions and prize promotions. They process data as independent controllers or as processors for specific contracted operations. The controller gives processors appropriate written instructions, particularly regarding minimum security measures, to ensure confidentiality and security.
A periodically updated list of processors working with the controller is available on written request to the controller's registered office.
Personal data may also be disclosed on request to competent authorities to fulfil mandatory legal obligations.

(8b) Transfers of personal data to third countries
Personal data may be transferred abroad, within or outside the European Union. Transfers outside the EU take place on the basis of an adequacy decision, appropriate GDPR safeguards (particularly standard data protection clauses approved by the European Commission), or one or more GDPR derogations, particularly express consent, performance of the Customer/data subject's Contract, or performance of a contract concluded with another person for their benefit, including activities entrusted to that person to fulfil the Customer's Contract. On written request to the controller's registered office, the Customer/data subject may learn which safeguards or derogations justify transfers outside the EU. For any data-related request, including exercising GDPR rights, they may always contact the controller.

9. Criteria for determining retention periods
For the purposes in (4a), the retention period and potential processing coincide with the limitation period for legal, tax and other rights/duties arising from the Contract, generally ten years, unless events interrupting that limitation period extend it.
For the purposes in (4b), retention and potential processing end when the Customer/data subject withdraws consent or, if consent is not withdrawn, one year after all relationships between them and the controller have ended.

10. Rights of the Customer/data subject
The controller recognises and facilitates all GDPR rights, particularly access to and copies of personal data (Article 15), rectification (Article 16), erasure (Article 17), restriction of processing (Article 18), portability (Article 20, where applicable) and objection to processing (Articles 21 and 22 in the cases they cover, particularly marketing or automated decision-making, including profiling, with legal effects, where applicable).
Where processing is based on consent, the Customer/data subject may withdraw consent at any time without affecting the lawfulness of prior processing. They may unsubscribe through the Website or other applications, use the link at the bottom of commercial communications, or contact the controller using the details above.

The Customer/data subject also has the right to complain to Italy's data protection authority, the Garante per la Protezione dei Dati Personali, and to seek judicial remedies against its decisions or against the controller and/or a processor.

11. Security of systems and personal data
Considering current technology, implementation costs, the nature, scope, context and purposes of processing, and the likelihood and severity of risks to individuals' rights and freedoms, the controller adopts technical and organisational measures considered appropriate to the risk. These aim to ensure ongoing confidentiality, integrity, availability and resilience of systems and services (including encryption where necessary), timely restoration after physical or technical incidents, and regular testing and evaluation of security measures.
The assessment takes account particularly of the risks of accidental or unlawful destruction, loss, alteration, unauthorised disclosure of or access to personal data transmitted, stored or otherwise processed.
The controller seeks to ensure that anyone acting under its authority with access to personal data processes them only on the controller's instructions.
The Customer/data subject acknowledges and accepts that no security system guarantees absolute protection. Accordingly, the controller is not liable for unauthorised acts by third parties who gain access despite appropriate precautions.

12. Automated decision-making, including profiling
The controller may carry out automated processing, including profiling, for the purposes in (4b), to improve Website navigation or the usability of other applications and the purchasing experience, subject to the rights to object and withdraw consent described above.
Profiling means automated processing of personal data to assess aspects of an individual, particularly to analyse or predict personal preferences, interests or location, including creating profiles or groups sharing characteristics, interests or behaviour.
The controller does not carry out automated processing with legal or similarly significant effects on the Customer/data subject unless necessary to conclude or perform the Contract, authorised by law, or based on explicit consent. In every case the right to human intervention, to express one's views and to contest the decision is recognised.