Privacy Policy on the Processing of Personal Data
Pursuant to Article 13 and 14 of European Regulation No. 2016/679, relating to the protection of natural persons with regard to the processing of personal data, as well as to the free movement of such data under current Italian legislation.

Dear Interested,
-
Pursuant to art. 13 of Legislative Decree 196/2003 (hereinafter "Privacy Code") and art. 13 and 14 of EU Regulation no. 2016/679 (hereinafter "GDPR 2016/679"), containing provisions for the protection of persons and other subjects with regard to the processing of personal data, we wish to inform you that the personal data provided by you will be processed in compliance with the aforementioned legislation and the confidentiality obligations to which the RESTART 38 STUDIO DI INGEGNERIA is bound. This information on the processing of personal data is provided by Dr. Simone Re, as Data Controller (hereinafter also "Data Controller" or "Restart 38 studio di ingegneria").

'Processing of personal data' means, within the meaning of Art.4 § 1, N.2, GDPR any operation or set of operations, carried out with or without the aid of automated processes and applied to personal data or sets of personal data, even if not recorded in a database, such as collection, recording, organisation, structuring, storage, processing, selection, blocking, adaptation or modification, extraction, consultation, use, communication by transmission, dissemination or any other form of making available, comparison or interconnection, limitation, erasure or destruction.

“Dear interested” refers to the person to whom the personal data relate.

According to the legislation indicated, this treatment will be based on the principles of lawfulness, fairness and transparency and protection of your privacy and your rights, according to the principles contained in Article 5 of the GDPR 2016/679.

Data controller (art.13, co.1, lit.a.GDPR):

The Data Controller is Restart 38 studio di ingegneria (C.F. and VAT IT02463890182), in the person of the legal representative pro tempore Dr. Simone Re.
The data you provide will be processed and stored at the registered office in Pavia (PV), Via Gramsci n. 35.
The holder can be contacted at +39 339 145 12 61 or at info@restart38.com.
The data may be processed by representatives, collaborators or external subjects, previously authorised, who operate on behalf of the Data Controller.
A Personal Data Protection Officer (DPO) has not been appointed.

Data Controller:

The Data Processor is Dr. Letizia Beriozza, domiciled at the registered office of Restart 38 studio di ingegneria, in Pavia (PV), Via Gramsci 35, tel: +39 3391451261, e-mail: info@restart38.com.

Origin and type of data processed:

Restart38 Engineering Studio will process the personal data collected during the conclusion of the professional assignment and during the execution of the assignment. The data may be collected directly from you or from third parties (including public databases).
By way of example, the following types of personal data will be processed:

• Name, surname, date and place of birth, tax code and VAT number;

• Telephone number and e-mail address;

• Bank details and financial situation;

• Identification document.

All personal data will be processed by Dr. Simone Re exclusively for the purposes and within the limits set out in the following points.

Confidentiality clause:

It is agreed that any data or information of which the Data Controller becomes aware and the activity carried out by him is of a confidential nature and implies, therefore, the obligation of confidentiality.

Obligation of loyalty and secrecy:

The employment relationship between the Data Controller and your person will be subject to an obligation of secrecy and loyalty pursuant to Article 2105 of the C.C. to which you must scrupulously adhere.
Failure to comply with this obligation will result in the termination of the employment relationship for good cause.
You undertake to adhere to the strictest confidentiality about the data and news that will come to your attention, even occasionally, during the consulting, collaboration, supply or work relationship and undertakes not to disclose and not to use such data and news for purposes other than those for which you become aware of them.
The information, data and confidential knowledge may not be copied or reproduced in whole or in part other than for operational needs strictly related to the performance of the activities of the Data Controller.

All documentation of any nature, in original or in copy, technical or administrative, of the Owner or in any case concerning you, provided to you or of which you yourself should come into possession in any capacity in the course of the relationship of advice, collaboration, supply or work, must be considered the exclusive property of the Owner and must be returned to the latter at the time of any termination of the employment relationship or at the time in which the Owner himself deems it appropriate.
In any case, the documentation in question, which must be attributed a character of extreme confidentiality, cannot be disclosed by you in the absence of express authorisation and must be kept by you, as a depositary with an obligation of custody, until the moment of return at the legal or administrative headquarters of the Owner.

Subjects to whom personal data may be communicated:

Your personal data may be communicated to:

1. Staff and suppliers of the Company;

2. Advisers and accountants or other lawyers who provide functional services for the purposes set out above;

3. Banking and insurance institutions providing functional services for the purposes indicated above;

4. Subjects who process data in fulfilment of specific legal obligations;

5. Judicial or administrative authorities, for the fulfilment of legal obligations.

Purposes of the processing (art.13, co.1 GDPR):

The personal data you provide will be processed for the following purposes:

• FOR THE EXECUTION OF THE CONTRACT: the data will be processed by the Data Controller for the correct and complete management and execution of the assignment received, as well as to use the services provided by external consultants, to execute a service or order received or to carry out activities direct or indirect to those of the responsibility of the data controller, as well as in order to send information to collaborators, in order to fulfil the requests of the user or end customer;

• FOR THE FULFILMENT OF LEGAL OBLIGATIONS: the data will be processed by the Data Controller in order to fulfil the obligations imposed on the Professional and provided for by current legislation, also in the tax and accounting field;

• FOR A LEGITIMATE INTEREST OF THE OWNER: the data may be processed by the Data Controller on the basis of a legitimate interest:

  • In the event of breach of contract, the data may be used by the Professional for the purpose of recovering his claim;

  • Safeguarding your life or physical safety and any other person;

  • Implementation of all necessary security measures to prevent the risk of destruction, loss, dissemination, alteration, theft, undue access and any other unauthorised activity involving personal data;

  • Sending communications and newsletters for the purpose of correct information and free economic initiative, in accordance with and in full adherence to the ethical rules in force.

Personal data may be processed by means of both paper and computerised files (including portable devices) and processed in a manner strictly necessary to meet the purposes indicated above.

If Restart 38 studio di ingegneria intends to further process your personal data for a purpose other than that for which they were collected, prior to such further processing, it will provide you with information about this different purpose and any further relevant information.

Legal basis of the processing:

The Data Controller and the Data Processor process your personal data lawfully, where the processing is necessary for the execution of the professional assignment received, is based on the express consent, which is extended to the use of the internal application in use at RESTART 38 STUDIO DI INGEGNERIA and by all employees and / or internal and external collaborators.

Methods of processing (Art.32 GDPR):

In relation to all the purposes indicated above, the processing of data will take place in full respect of fundamental freedoms and in such a way as to guarantee the dignity, security and confidentiality of the interested party and may be carried out with computer and telematic and / or manual tools, by the Data Controller and its employees and / or internal and external collaborators, in compliance with the provisions of art. 32 of the GDPR 2016/679 and Annex B of Legislative Decree 196/2003 (Article 33-36 of the Code) regarding security measures, by specially appointed subjects and in compliance with the provisions of art. 29 GDPR 2016/ 679.

Restart 38 studio di ingegneria uses appropriate security measures and techniques, including organisational, in order to preserve the confidentiality, integrity and availability of your personal data and imposes similar security measures on third-party suppliers and Processors, in particular in order to reduce the risks of destruction or loss, even accidental, of data, unauthorised access, or processing not allowed or not in accordance with the purpose of collection. The data will be processed with logic strictly related to the purposes specified above, on the basis of the data held by the Data Controller and with the commitment, on the part of the interested party, to promptly communicate any corrections, additions and / or updates.

Retention period (Art. 13(2)(a) GDPR):

We would like to point out that, in compliance with the principles of lawfulness, limitation of purposes and minimisation of data, pursuant to art. 5 GDPR 2016/679, subject to your free and explicit consent expressed at the end of this information, your personal data will be kept for the time provided for by the applicable legislation, and in any case for a period of time not exceeding that necessary for the achievement of the purposes for which they are collected and processed. At the end of this period, the data will be deleted in whole or in part automatically (under applicable legislation) or made anonymous so as not to allow, even indirectly or by linking other databases, the identification of data subjects. In any case, if you decide to withdraw your consent or object to the processing, your data will be deleted within 30 days of the request.

Provision of data and consequences of any refusal:

The provision of your personal data is mandatory as it is strictly necessary for the purpose of carrying out the activities indicated above. Any refusal by the data subject to provide personal data will make it impossible to fulfil the activities within the purposes of the processing. With regard to personal data relating to the performance of the consulting, collaboration, supply or work relationship of which you are a party or relating to the fulfilment of a legal obligation (e.g. obligations related to the maintenance of accounting and tax records), failure to provide personal data prevents the termination of the contractual relationship.

Scope of communication and dissemination:

We also inform you that the data collected will never be disseminated, nor to any fully automated decision-making process, nor will it be communicated without your explicit consent. The personal data provided may be disseminated, if the communications are necessary for the purposes indicated above and for the transfer of data to public bodies, consultants, external collaborators, to all those who work in the same sector, as well as, in general, to all those subjects to whom the communication is necessary for the correct fulfilment of the same purposes mentioned above. Such data, by their very nature, could make it possible to identify users through processing and association with data held by third parties (e.g. accountant). This category of data includes for example:

• IP addresses and/or domain names of e-mails;

• The method used to submit the request to the server;

• The electronic submission of documentation;

• Electronic invoicing software;

• Parameters related to the user's operating system and computer environment.

This data is used for:

• The proper functioning of the service rendered;

• Ascertain liability in the event of computer offences;

• Provide for the tax and accounting obligations required by law.

Their dissemination cannot be predisposed to subjects other than those strictly indicated in this writing.

Transfer of personal data:

Your data could be transferred to non-EU countries due to the use of servers located outside the territory of the European Union (cloud storage). The controller ensures that the transfer of data outside the EU will take place in accordance with the applicable legal provisions and that the recipients of the data will be bound by protection and security obligations. On request, you can get more information from the Owner.

Special categories of personal data:

Pursuant to Articles 26 and 27 of Legislative Decree 196/2003 and Articles 9 and 10 of EU Regulation No. 2016/679, you may provide the controller with data that can be classified as "special categories of personal data" and that is, data that reveal "racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, as well as genetic data, biometric data intended to uniquely identify a natural person, data relating to the health or sex life or sexual orientation of the person". These categories of data may only be processed with your free and explicit consent, expressed in writing at the bottom of this information.

Existence of automated decision-making, including profiling:

The Data Controller does not use the data processing of an automated decision-making process, including profiling, which may produce legal effects for the person or that may significantly affect the person.

Security measures:

The Processing is carried out in a manner and with appropriate means to guarantee the security and confidentiality of the data, the Data Controller having adopted appropriate technical and organisational measures that guarantee, and allow to demonstrate that the processing is carried out in accordance with the relevant legislation.

Rights of the data subject:

At any time, you may exercise, pursuant to art. 7 of Legislative Decree 196/2003 and articles 15 to 22 of EU Regulation no. 2016/679, the right to:

1. Request confirmation of the existence or not of their personal data;

2. Obtain information on the purposes of the processing, the categories of personal data, the recipients or categories of recipients to whom the personal data have been or will be disclosed and, where possible, the retention period;

3. Obtain rectification and erasure of data;

4. Obtain the restriction of processing;

5. Obtain data portability, i.e. receive them from a controller, in a structured, commonly used and machine-readable format, and transmit them to another controller without hinderance;

6. Object to the processing at any time and also in the case of processing for direct marketing purposes;

7. Oppose an automated decision-making process relating to natural persons, including profiling;

8. Request from the controller access to and rectification or erasure of personal data or restriction of processing concerning him or to object to their processing, in addition to the right to data portability;

9. Withdraw consent at any time (except where the processing is necessary to fulfil a legal obligation to which the Data Controller is subject or for the performance of a task in the public interest or related to the exercise of public authority vested in the Data Controller) without prejudice to the lawfulness of the processing based on the consent given prior to the revocation;

10. Lodge a complaint with a supervisory authority.

You can exercise your rights at any time by sending:

• A written request by registered letter with return receipt to Restart 38 studio di ingegneria, at the postal address of the registered office, in Pavia (PV), Via Gramsci 35, Italy;

• By contacting the following telephone number: +39 339 145 12 61;

• By writing an email to info@restart38.com.

Changes and updates:

This information may be subject to changes imposed by changes to current legislation and technical and organisational developments to which the activity of the Data Controller may be subjected.

The Owner therefore reserves the right to make changes to the information, committing to timely communication and/or dissemination.