DISCLOSURE PURSUANT THE REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL
Last update: June 2020
The Data Controller does not fall within the cases provided for by Art. 37 c. 1, for this reason no Data Protection Officer (DPO) has been appointed.
CATEGORIES OF PERSONAL DATA PROCESSED
ARTISAN DNA may process the following categories of users’ data:
Personal data : any information relating to an individual, identified or identifiable, even indirectly, by reference to any other information including a personal identification number; identification data, personal data that allow direct identification (such as but not limited to name, VAT number, address, email address, phone number, etc, see art. 4, par. 1, no. 1 GDPR).
Navigation data: The personal data acquired by computer systems and software procedures used to operate this website or the platform during their normal operation, whose transmission is implicit in the communication protocols of the Internet. This information is not collected to be associated with identified people; however, by their nature through processing and association with data held by third parties they may allow to identify users.
This category of data includes IP addresses or domain names of computers used by users connecting to the site, URI (Uniform Resource Identifier) of requested resources, time of request, the method used to submit the request to the server, the file size obtained in response, the numerical code indicating the status of response from the server (successful, error, etc.) and other parameters regarding the operating system and computer environment. These data are used only to obtain anonymous statistical information about the website (most visited pages, number of daily visitors, geographical areas of origin, etc.) and to check its correct functioning and is deleted immediately after processing.
System logs: For needs related to operation and maintenance, this platform and any third-party services may collect system logs, which are files that record interaction between computer systems – including navigation information – and which may also contain personal data, such as IP Address.
Navigation data aimed at profiling: supplied indirectly by the user through the use of the services, or obtained and analysed following the user’s consent provided with the use of the website or the services;
‘processing’ means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;
‘data subject’ means an identified or identifiable natural person (“you”).
PURPOSES OF THE PROCESSING
The data and cookies transmitted by you will be processed by ARTISAN DNA exclusively with the methods and procedures necessary to provide you with the requested or subscribed services (contractual purposes), to fulfil a legal obligation, or to satisfy a legitimate interest of the holder, and for the additional purposes for which you have given your consent. E.g., your data will be used by ARTISAN DNA to allow your registration on the site and to take advantage of all the services offered through the website and the platform.
(Direct marketing purposes) The processing of personal data for direct marketing purposes is regarded as carried out for a legitimate interest. The data can be used to send to you by email newsletters, promotional material or inform you of activities and services, carry out statistical analyses on anonymous basis, market surveys on anonymous basis, and sending commercial information to you about ARTISAN DNA’s products and promotional initiatives, similar to those you have previously chosen. We inform you that you can refuse or object to this purpose at any time as described below.
We inform you that some activities could be carried out through suppliers, specifically appointed Data Processors, also residing outside the European Union.
MODALITIES OF THE PROCESSING
The processing of your personal data is carried out using the modalities described in art. 4, no. 2 and in accordance with art. 32 of the GDPR. through automatic or manual methods.
LEGAL BASIS OF THE PROCESSING
Your personal data may be processed, pursuant to art. 6 letters a), b), c) and f) GDPR, for the following purposes:
RECIPIENTS OF THE DATA
In pursuance of artt. 28 and 29 of the GDPR, your personal data will not be disclosed, but may be communicated where necessary for the provision of the service to employees and collaborators of the Data Controller in Italy and abroad without involving the data transfer outside Europe, or to other subjects appointed, if necessary, as Data Processors by ARTISAN DNA for technical or organizational tasks. Data may be communicated also to third-party companies or other subjects providing assistance and advice as external data processors.
The updated list of Data Processors can always be requested to the Data Controller.
Furthermore, your data may be communicated to competent authorities to execute the relevant laws and/or regulations, on request or when the communication is mandatory by law for the fulfilment of the mentioned purposes.
DATA RETENTION PERIOD
ARTISAN DNA, in compliance with the principles of lawfulness, purpose limitation and data minimization, pursuant to art. 5 of the GDPR, keeps your data for the duration of your consent, the contract, or that other retention period as required by law (e.g. accounting requirements).
Your personal data will be processed by ARTISAN DNA within the European Union territory.
RIGHTS OF DATA SUBJECTS
Pursuant to the GDPR, you can exercise some rights towards the Data Controller, such as obtaining from the Data Controller the cancellation of your data (right to be forgotten), the limitation, updating, rectification, portability, or right to oppose to the treatment of your personal data. More in detail, you can exercise the following rights (as set forth by articles 15, 16, 17, 18, 19, 20, 21, 22 of the GDPR):
Furthermore, at any time, you may revoke the consent on which the treatment carried out is based. The withdrawal of your consent does not affect the lawfulness of the processing that took place on the basis of the consent given before the revocation.
MORE INFORMATION ABOUT THE EXERCISE OF YOUR RIGHTS
Any request for information or clarification about your rights and their execution can be addressed to the Data Processor by sending:
CHANGES TO INFORMATION