(pursuant to Article 13 of EU Regulation 2016/679 – “GDPR”)

Giuseppe Lemessi, in his capacity as Data Controller (hereinafter, the “Data Controller”), will process the personal data provided (“Personal Data”) in accordance with this Privacy Policy and in compliance with Regulation (EU) 2016/679 of 27 April 2016, known as the General Data Protection Regulation (hereinafter, the “GDPR” or the “Regulation”), as well as Italian Legislative Decree No. 196/2003, as amended by Legislative Decree No. 101/2018, containing the “Personal Data Protection Code” (collectively, the “Applicable Data Protection Legislation”).

Scope of this document

This page contains our privacy policy (“Privacy Policy”) and explains how we use and protect users’ personal information. For the purposes of this Privacy Policy, the processing of Personal Data includes any operation or set of operations performed on Personal Data, whether or not by automated means, in accordance with the Applicable Data Protection Legislation. Please note that Personal Data may be processed manually and/or with the use of electronic or digital tools.

Types of Data and Purposes of Processing

We collect and process the Personal Data of users who choose to register on our website and for our services (including events, updates and Committee projects), as well as the Personal Data of those who participate in the Committee’s projects.

Personal Data will be used for:

i) to provide information on topics of interest relating to the activities of the Committee, including initiatives, events, meetings, press releases and consultations; ii) to provide information of public interest and/or updates on the activities and programmes of the Committee (purposes i) and ii), individually and collectively, hereinafter referred to as the “keeping in contact” purposes); iii) to manage users’ participation in working groups, committees or other projects of the Committee (the “projects” purpose); iv) to manage initiatives, prepare reports and positions in the interest of the Committee and carry out any other use permitted under the Applicable Data Protection Legislation (the “Association initiatives” purpose). Purposes i) to iv) are collectively referred to as the “Purposes”.

The Data Controller may temporarily process the following information relating to a user:

first and last name;
• email address;
• telephone number;
• property details;
• any other information voluntarily provided by the user and/or collected from publicly available sources.

We will never share users’ Personal Data with third parties intending to use such data for direct marketing purposes, unless the user has been expressly informed and has given specific prior consent.

Legal Basis for Processing

The Data Controller will process Personal Data on the following legal bases:

• For the “keeping in contact” purposes, the legal basis is the handling of the user’s request or consent, where expressly required.
• For the “projects” purpose, the legal basis is the performance and management of the working group, Committee or other project that the user has joined or requested to participate in.
• For the “Association initiatives” purpose, the legal basis is the performance of the Committee’s activities joined by the user and/or the carrying out of specific Committee activities in any applicable form.

We will not use Personal Data for purposes other than those described in this Privacy Policy, unless prior consent has been obtained and appropriate information has been provided in accordance with the Applicable Data Protection Legislation.

Recipients of Personal Data and Third Parties

For the purposes set out in this Privacy Policy, Personal Data may be shared with:

a) officers and/or partners of the Committee authorised to process Personal Data;
b) service providers acting as Data Processors, and any other party carrying out activities on behalf of the Data Controller and/or engaged by the Data Controller in the performance of the Purposes, in accordance with the requirements of the Applicable Data Protection Legislation (“Third Parties”).

The Data Controller will process Personal Data only in countries within the European Economic Area and will not transfer such Personal Data to countries outside the European Economic Area, unless the data subject has provided prior written consent or other appropriate safeguards are in place, including: a) the adoption of the European Commission’s Standard Contractual Clauses; b) the existence of adequacy decisions adopted by the European Commission in relation to the countries receiving the transferred Data.

Data Retention Period

Personal Data will be processed for the period necessary to fulfil the purposes set out in this Privacy Policy and will be retained in accordance with the principles of proportionality and necessity. Unless specific requirements apply, for the “keeping in contact” and “projects” purposes, the Data Controller will retain Personal Data for a period of 24 months from, respectively, the first contact with the Association and participation in the relevant projects. Data may be retained for a longer period where expressly consented to or requested, or deleted earlier in the event that consent is withdrawn.

Rights of the Data Subject

Pursuant to Articles 15–21 of the GDPR, with regard to the Personal Data processed, the user has the right to:

• obtain confirmation from the Data Controller as to whether or not Personal Data concerning the user is being processed, as well as the right to access such data and obtain a copy in an intelligible form;
• request information regarding the methods, purposes and means of processing, including the logic applied in the event of automated processing;
• obtain information and identification details concerning the Data Controller and the Data Processors;
• obtain the updating, rectification or completion of their Personal Data;
• obtain the restriction, erasure, anonymisation or blocking of their Personal Data;
• object, on legitimate grounds, to the processing of their Personal Data;
• withdraw consent to the processing of Personal Data freely and at any time;
• receive their Personal Data in a structured, commonly used and machine-readable format, including for the purpose of transmitting such data to another Data Controller (right to data portability);
• lodge a complaint with the Italian Data Protection Authority.

Without prejudice to the right to lodge a complaint with the Italian Data Protection Authority, users may exercise their rights by sending an email to associazione@thedammusocircle.it or by ordinary mail to the address of the Data Controller.