Privacy policy

INFORMATION PURSUANT TO ART. 13 OF EU REGULATION NO. 2016/679

A.C.S. S.r.l., (tax ID and VAT no.: 01275340352) (hereinafter “A.C.S.”), through its pro tempore legal representative, headquartered in Cadelbosco di Sopra (Reggio Emilia), Via Brodolini, 1, as the Data Controller for the purposes of Articles 4(7) and 24 of Regulation (EU) No. 2016/679 (“GDPR”), informs you that pursuant to Article 13 GDPR your personal data, as described in Article 1 below, will be processed by the Data Controller for the purposes described in Article 3 below.

This disclosure – to be understood as provided only for the website www.acs.re.it (hereinafter, “Website”) – is inspired, in particular, by the following documents: Recommendation no. 2/2001 of the Article 29 WP (below, “Article 29 WP”, now EDPB); Opinion no. 3/2010 of the Article 29 WP; Opinion no. 6/2014 of the Article 29 WP; Guidelines no. 260/2018 of the Article 29 WP; Guidelines no. 5/2020 of the EDPB.

The Data Controller invites you to carefully read this disclosure before providing any personal data: indeed, this document contains all necessary information concerning the protection and safeguarding of personal data, in compliance with the relative EU and domestic regulations (including second-level).

 

1. Category of data processed.

1.1. The Data Controller will process your personal data pursuant to Article 4(1) GDPR which you have voluntarily provided through the different functions present on the Website (e.g., newsletter and/or work with us form), including “browsing” data (indeed, the Website’s IT systems may collect certain personal data the transmission of which is implicit in the use of internet communication protocols; this is information which is not collected to be associated with you, but, due to its nature, could make it possible to identify you, through processing and associations with data held by third parties: e.g., IP addresses, domain names of the devices used to connected to the Website; URI addresses).

Moreover, when strictly required for the pursuit of the purposes pursuant to Article 3.4.(d) below, the Data Controller will also process your special categories of personal data pursuant to Article 9(1) GDPR.

 

2. Contact details.

2.1. The Data Controller may be contacted at the following address: info@acs.re.it

 

3. Purposes and legal basis for the data processing.

3.1. In accordance with Article 6(1)(b) and (c) GDPR, your personal data will be processed by the Data Controller for the following purposes:

1. Proper execution of a precontractual measure adopted at the request of the data subject (e.g., request for contact or more information submitted through the Website), including the associated legal obligations.

In compliance with Article 13(2)(e) GDPR, the Data Controller specifies that any failure to provide personal data will make it impossible to fully and properly achieve the processing purposes laid out in Article 3.1.

3.2. In accordance with Article 6(1)(f) GDPR, your personal data will be processed by the Data Controller for the following purpose:

1. Statistical analyses (in anonymous and aggregate form) concerning the use of and interaction with the Website.

3.3. In accordance with Article 6(1)(a) GDPR, your personal data will be processed by the Data Controller for the following purpose:

1. Marketing activities (e.g., commercial, advertising and/or promotional communications; market research), to be carried out with traditional and/or automated means.

In compliance with Article 13(2)(c) GDPR, the Data Controller informs you of the right to revoke any consent provided for the purposes described in Article 3.3. at any time, without this event in any case jeopardising the lawfulness of processing carried out based on the consent provided prior to this revocation.

3.4. In accordance with Articles 6(1)(b) and 9(2)(g) GDPR and in compliance with Article 2 sexies(2)(dd) of the amended Italian Legislative Decree no. 196/2003 (Privacy Code), your personal data and, when necessary, your special categories of personal data, will be processed by the Data Controller for the following purpose:

1. Personnel search, assessment and selection activities.

In compliance with Article 13(2)(e) GDPR, the Data Controller specifies that any failure to provide personal data and, when necessary, your special categories of personal data, will make it impossible to fully achieve the processing purpose laid out in Article 3.4.

 

4. Recipients.

4.1. In compliance with Article 13(1)(e) GDPR, the Data Controller specifies that your data may be disclosed pursuant to Article 2 ter(4)(a) of the amended Italian Legislative Decree no. 196/2003 (Privacy Code), when appropriate, to one or more recipients pursuant to Article 4(9) GDPR (which belong, in general, to the following categories: parties authorised by the Data Controller (e.g., employees or similar); head hunting, marketing IT, analysis and cloud computing companies; various types of advisors; public entities) for the proper achievement of the purposes described in Article 3.

Lastly, the Data Controller specifies that your data will not be subject to any dissemination pursuant to Article 2 ter(4)(b) of the Privacy Code, except, when strictly necessary (and limited solely to personal data), for the achievement of the processing purposes pursuant to Article 3.3.(c).

 

5. Retention period.

5.1. In compliance with Article 13(2)(a) GDPR, the Data Controller discloses the following: i) the retention period of your personal data, processed for the purposes pursuant to Article 3.1., will coincide with a term not to exceed the pursuit of the underlying purposes (identifiable, on an approximative basis, as 10 years, starting from the end of any precontractual measure), which may be extended to meet regulatory and/or legal obligations; ii) the retention period of your personal data, processed for the purposes pursuant to Article 3.3., will last until you decide to communicate your revocation pursuant to Article 17 GDPR of any consent provided previously without, as noted above, this event jeopardising the lawfulness of processing based on any consent provided previously; iii) the period of retention of your personal data and, when necessary, your special categories of personal data, processed for the purposes pursuant to Article 3.4., will coincide with a term not to exceed the pursuit of the underlying purposes (identifiable, on an approximative basis, as 1 year, starting from the end of the personnel search, assessment and selection activities).

 

6. Transfer.

6.1. Your data shall be retained within an archive belonging or in any event linked, also on an indirect basis, to the Data Controller, and located within the EEA.

 

7. Rights of the data subject.

7.1. In relation to your data, the Data Controller informs you that, in compliance with Guidelines no. 260/2018 of the Article 29 WP, you are entitled to exercise the following rights, possibly subject to the limitations set forth in Articles 2 undecies and 2 duodecies of the Privacy Code: right of access pursuant to Article 15 GDPR: right to obtain confirmation concerning whether processing of personal data regarding the relative data subject is under way, as well as the information pursuant to Article 15 GDPR (e.g., purpose of processing, retention period); right to rectification pursuant to Article 16 GDPR: right to correct, update or add to personal data; right to erasure pursuant to Article 17 GDPR: right to have the personal data deleted or destroyed or anonymised, when however the requirements listed in the same article are met; right to restriction of processing pursuant to Article 18 GDPR: right with a predominantly protective purpose, intended to restrict processing when the conditions governed by the same Article 18 are met; right to data portability pursuant to Article 20 GDPR: right to obtain the personal data provided to the Data Controller in a structured, commonly used and machine readable format (and, when requested, to transmit them directly to another Data Controller), when the specific conditions laid out in the same article are met (e.g., legal basis of consent and/or execution of a contract; personal data provided by the data subject); right to object pursuant to Article 21 GDPR: right to have specific personal data processing terminated on a permanent basis; right to lodge a complaint with the supervisory authority (i.e., the Italian Data Protection Authority) pursuant to Article 77 GDPR: right to lodge a complaint when it is deemed that the processing subject to analysis violates national and EU regulations on personal data protection.

7.2. In compliance with Article 12(1) GDPR, the Data Controller will provide you with the communications pursuant to Articles 15 to 22 and 34 GDPR in a concise, transparent, intelligible and easily accessible form in simple and clear language; such information will be provided in writing or by other means, possibly electronic, or, at the request of the data subject, verbally, provided that the identity of the data subject can be proven by other means.

7.3. In compliance with Article 12(3) GDPR, the Data Controller informs you that it will provide you with the information relating to the action taken with regard to a request pursuant to Articles 15 to 22 GDPR without unjustified delay and, in any event, at the latest within one month of receipt of the request; that period may be extended by 2 months, if necessary, taking into account the complexity and number of the requests (in this case, the Data Controller undertakes to inform the data subject of such extension and the reasons for the delay, within one month of receipt of the request).

7.4. You may at any time exercise the above rights (apart from the right pursuant to Article 77 GDPR) by using the contact details provided in Article 2.

 

Reggio Emilia, dated 2.3.2021 (date of most recent update).

 

A.C.S. S.r.l.

(represented by its pro tempore legal representative)