Privacy policy

INFORMATION NOTICE ON THE PROCESSING OF PERSONAL DATA (Regulation (EU) 2016/679 "GDPR")

Alderian Srl, Via A. Ferrarin 14 Cassola (VI), Tax Code and VAT No. 04416760249 (hereinafter, the "Controller"), in its capacity as data controller, informs you pursuant to Art. 13 of Legislative Decree 30.6.2003 no. 196 (hereinafter, the "Privacy Code") and Art. 13 of EU Regulation no. 2016/679 (hereinafter, the "GDPR") that your data will be processed in the following ways and for the following purposes:

• Subject of Processing The Controller processes personal identification data (for example: first name, last name, company name, address, phone number, email, banking and payment details), hereinafter "personal data" or "data", communicated by you when entering into contracts for the Controller's services.
• Purpose of processing Your personal data are processed:
• Without your explicit consent (Art. 24 letters a), b), c) Privacy Code and Art. 6 letters b), e) GDPR), for the following Service Purposes:
• To conclude contracts for the Controller's services;
• To fulfill pre-contractual, contractual, and tax obligations arising from existing relationships with you;
• To fulfill obligations set out by law, regulations, EU legislation, or orders from Authorities (for example, anti-money laundering obligations);
• To exercise the Controller's rights, such as the right of defense in court;
• Only with your specific and separate consent (Arts. 23 and 130 Privacy Code and Art. 7 GDPR), for the following Marketing Purposes:
• To send you newsletters, commercial communications, and/or advertising material about products or services offered by the Controller, and to assess satisfaction regarding service quality, by email, post, SMS, and/or telephone contact;
• To send you by email, post, SMS, and/or telephone contact commercial and/or promotional communications from third parties (for example, business partners).
• Please note that if you are already our customer, we may send you commercial communications related to services and products of the Controller similar to those you have already used, unless you object (Art. 130, paragraph 4 Privacy Code).
• Processing methods The processing of your personal data is carried out by means of the operations indicated in Art. 4 Privacy Code and Art. 4 no. 2 GDPR, namely: collection, recording, organization, storage, consultation, processing, modification, selection, extraction, comparison, use, interconnection, blocking, communication, deletion, and destruction of data. The Controller will process personal data for the time necessary to fulfill the purposes above and, in any case, for no longer than 10 years after termination of the relationship for Service Purposes and no longer than 2 years from data collection for Marketing Purposes.
• Access to data Your data may be made accessible for the purposes referred to in Art. 2.A) and 2.B):
• to employees and collaborators of the Controller, in their capacity as persons in charge and/or internal processors and/or system administrators;
• to third-party companies or other entities (for example: banks, professional firms, consultants, insurance companies for the provision of insurance services, etc.) that carry out outsourced activities on behalf of the Controller, in their capacity as external data processors.
• Data communication Without the need for explicit consent (pursuant to Art. 24 letters a), b), d) Privacy Code and Art. 6 letters b) and c) GDPR), the Controller may communicate your data for the purposes referred to in Art. 2.A) to supervisory bodies (such as IVASS), judicial authorities, insurance companies for the provision of insurance services, and to those entities to whom communication is mandatory by law for the fulfillment of the aforementioned purposes. These entities will process the data as independent data controllers. Your data will not be disclosed.
• Data transfer Personal data are stored on servers located in Italy, within the European Union. It is understood, however, that if necessary the Controller may move servers outside the EU. In such case, the Controller ensures that extra-EU data transfer will take place in compliance with applicable legal provisions, subject to the execution of the standard contractual clauses provided by the European Commission.
• Nature of data provision and consequences of refusal The provision of data for the purposes referred to in Art. 2.A) is mandatory. Without such data, we will not be able to guarantee the Services referred to in Art. 2.A). The provision of data for the purposes referred to in Art. 2.B) is optional. You may therefore choose not to provide any data or subsequently deny the possibility of processing data already provided: in this case, you will not receive newsletters, commercial communications, or advertising material related to the Services offered by the Controller. You will still be entitled to the Services referred to in Art. 2.A).
• Data subject rights As a data subject, you have the rights referred to in Art. 7 Privacy Code and Art. 15 GDPR, namely the right to:
• obtain confirmation as to whether or not personal data concerning you exist, even if not yet recorded, and their communication in intelligible form;
• obtain information on:
  a) the origin of personal data;
  b) the purposes and methods of processing;
  c) the logic applied in case of processing carried out with electronic tools; d) the identification details of the controller, processors, and the representative designated pursuant to Art. 5, paragraph 2 of the Privacy Code and Art. 3, paragraph 1 GDPR; e) the entities or categories of entities to whom personal data may be communicated or who may become aware of them as designated representative in the State territory, processors, or persons in charge;
• obtain:
  a) updating, rectification or, where interested, integration of data;
  b) deletion, anonymization, or blocking of data processed unlawfully, including data whose retention is not necessary in relation to the purposes for which data were collected or subsequently processed;
  c) certification that the operations referred to in letters a) and b) have been notified, including their contents, to those to whom the data were communicated or disclosed, except where this proves impossible or involves a means clearly disproportionate to the protected right;
• object, in whole or in part: a) for legitimate reasons, to the processing of personal data concerning you, even if relevant to the purpose of collection; b) to the processing of personal data concerning you for sending advertising material, direct sales, market research, or commercial communication, through automated calling systems without operator intervention by email and/or through traditional marketing methods by telephone and/or postal mail. Please note that the data subject's right to object, as set out in point b) above, for direct marketing through automated methods also extends to traditional methods, and in any case the data subject retains the right to exercise the right to object only in part. Therefore, the data subject may decide to receive only communications through traditional methods, only automated communications, or neither type of communication.
• Where applicable, you also have the rights referred to in Arts. 16-21 GDPR (right to rectification, right to erasure, right to restriction of processing, right to data portability, right to object), as well as the right to lodge a complaint with the Supervisory Authority.
• How to exercise rights You may exercise your rights at any time by sending:
• an email to info@alderian.com
• Controller, processors and persons in charge The data controller is Alderian Srl - VAT No. 04416760249. The updated list of processors and persons in charge of processing is kept at the Controller's registered office.