POLICY PURSUANT TO ART. 13 GDPR

JOINT DATA CONTROLLERS

Pursuant to Article 26 of EU Regulation 2016/679 (hereinafter for brevity GDPR) is the data controller:
Over Spa Via Pergolesi 5, 20124 – Milan Italy

as Data Controller of the personal data of its customers, suppliers and users of the site, informs you that the personal data you provide will be processed in the following ways and in compliance with the principles established by the GDPR.

1. Purpose and legal basis of the Processing
Personal data will be processed in order to:

• 1.1. conclude contracts with the Data Controller and manage the related relationships in the pre-contractual, contractual, tax and accounting phases; (the legal basis of the aforementioned processing is the fulfilment both of contractual obligations and of legal obligations to which the Data Controller is subject).
• 1.2. direct marketing activities towards customers already acquired for the purpose of the direct sale of products and/or services of the Data Controller (sending newsletters, information activities, market research, advertising communications); (the legal basis of the aforementioned processing is legitimate interest).
• 1.3. direct marketing activities towards new customers; (the legal basis of the aforementioned processing is consent).

2. Methods of processing and data retention period
The data processing shall be carried out by means of the operations indicated in Article 4 no. 2 of the GDPR in manual form, through IT and telematic tools. The data will be recorded, processed and stored in our paper and electronic archives.
The data will be processed by persons authorised to process it.
For the activities referred to in Article 1.1., personal data will be kept until the processing of the same is no longer necessary for the purpose for which they were collected and, in any case, no later than 10 years from the termination of the contractual relationship.
For the activities referred to in Articles 1.2. and 1.3., personal data will be kept until the processing of the same is no longer necessary for the purpose for which they were collected and, in any case, no later than 2 years from the termination of the contractual relationship (from their acquisition).

3. Recipients of data processing
The data may be made accessible to employees and/or collaborators of the Data Controller in their capacity as authorised data processors.
The data may be communicated for the obligations imposed by the legislation or for a correct execution of the contractual relationship for example to social security, welfare and insurance institutions, trade associations, tax and labour offices, other companies of the group, professional law firms, commercial, tax, auditing, banks and credit institutions.
The data will not be disclosed to unknown parties.

4. Nature of the provision
The communication of data is mandatory for the purposes referred to in Article 1.1.; therefore any refusal to provide such data or incorrect communication implies the objective impossibility for the writer to manage pre-contractual and contractual relationships.
The communication of data for the purposes referred to in Articles 1.2. and 1.3. is optional; you can therefore decide not to provide any data or to exercise, even subsequently, the right of opposition pursuant to Article 21 of the GDPR.
In this case, your personal data will no longer be subject to direct marketing (and therefore you will no longer receive newsletters, advertising communications, etc.) but you will still be entitled to the services referred to in Article 1.1.

5. Rights of the data subject
In your capacity as data subject, you can exercise the rights referred to in Article 15 GDPR and more specifically the following rights:

• I. to obtain confirmation of the existence or otherwise of personal data concerning you and, in this case, obtain access to the data;
• II. to obtain access to the following information: a) purposes of the processing; b) categories of personal data in question; c) recipients or categories of recipients to whom the personal data have been or will be communicated; d) when possible, the expected period of retention of the personal data or, if not possible, the criteria used to determine that period; e) the existence of the right of the data subject to ask the data controller for the rectification or deletion of the personal data or the limitation of the processing of personal data concerning him or her or to oppose their processing; f) the right to lodge a complaint with a supervisory authority; g) if the data are not collected from the data subject, all the information available on their origin; h) the existence of an automated decision-making process, including the profiling referred to in Article 22, paragraphs 1 and 4, at least in such cases, significant information on the logic used, as well as the importance and expected consequences of such processing for the data subject;
• III. to be informed of the existence of adequate guarantees pursuant to Article 46 relating to the transfer in the case of transfer of personal data to a third country or an international organisation;
• IV. where applicable, the data subject can exercise the rights referred to in Articles 16 to 21 of the GDPR (right to rectification, right to deletion “right to be forgotten”, right to restriction of processing, right to data portability, right to object);
• V. the data subject may also: a) revoke the consent at any time without prejudice to the lawfulness of the treatment based on the consent given before the revocation; b) receive timely communication of the possible violation of your personal data within the limits of what is indicated in Article 34; c) propose a complaint to the Italian data protection authority.

6. Methods of exercising rights
The data subject may exercise their rights towards and against each joint data controller.
In order to exercise their rights, the data subject may contact the following data controller: Over Spa Via Pergolesi 5, 20124 – Milan Italy, by sending a written communication to the company’s headquarters, or by sending an email to [email protected]