SECTION III

What Happens if the Data Subject Fails to Provide the Personal Data Identified as Necessary for the Execution of the Requested Service?

The collection and processing of personal data are necessary to perform the requested services and/or to provide the requested Product.
If the Data Subject fails to provide the personal data expressly indicated as required in the order form or registration form, the Data Controller will not be able to carry out the processing operations related to the management of the requested services and/or the relevant contract and related Services/Products, nor to fulfill the obligations arising therefrom.

What Happens if the Data Subject Does Not Consent to the Processing of Personal Data for Commercial Promotion Activities Related to Services/Products Different from Those Purchased?

If the Data Subject does not consent to the processing of personal data for such purposes, said processing will not be carried out for those specific purposes, without affecting the provision of the requested services, nor those for which consent has already been given, if required.

If the Data Subject has given consent and subsequently withdraws it or objects to the processing of personal data for commercial promotion activities, their data will no longer be processed for such purposes, without any adverse consequences or effects on the Data Subject or on the provision of the requested services.

How We Process the Data Subject’s Personal Data

The Data Controller adopts appropriate security measures to preserve the confidentiality, integrity, and availability of the Data Subject’s personal data and requires third-party providers and Data Processors to implement equivalent security measures.

Where We Process Personal Data

The Data Subject’s personal data are stored in paper, electronic, and digital archives located in countries where the GDPR applies (EU member states).

How Long Are the Data Subject’s Personal Data Retained?

(Art. 13, paragraph 2, letter a, GDPR)

Unless the Data Subject expressly requests their removal, personal data will be retained for as long as necessary to fulfill the legitimate purposes for which they were collected.

In particular, such data will be stored for the entire duration of the Data Subject’s registration and, in any case, no longer than twelve (12) months of inactivity, meaning that within this period no Services have been associated or Products purchased using the same registration data.

Furthermore, personal data will, in any case, be retained to fulfill legal obligations (e.g., tax and accounting obligations) that continue to apply even after the termination of the contract (Art. 2220 of the Italian Civil Code). For these purposes, the Data Controller will retain only the data necessary to meet such obligations.

Cases in which the rights arising from the contract and/or the registration must be asserted in court are excluded from this rule; in such circumstances, the personal data of the Data Subject—limited to what is strictly necessary for these purposes—will be processed for as long as required to pursue them.

What Are the Rights of the Data Subject?

The Data Subject has the right to obtain from the Data Controller the following:

(Art. 13, paragraph 2, letter e, GDPR)

(Art. 32 GDPR)

(Articles 15–20 GDPR)

A) confirmation as to whether or not personal data concerning the Data Subject are being processed, and, where that is the case, access to the personal data and the following information:

the purposes of the processing;
the categories of personal data concerned;
the recipients or categories of recipients to whom the personal data have been or will be disclosed, in particular if recipients are located in third countries or international organizations;
where possible, the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period;
the existence of the right to request from the Data Controller rectification or erasure of personal data, or restriction of processing concerning the Data Subject, or to object to such processing;
the right to lodge a complaint with a supervisory authority;
where the personal data are not collected from the Data Subject, any available information as to their source;
the existence of automated decision-making, including profiling, and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the Data Subject;
where applicable, adequate safeguards provided by the third country (non-EU) or international organization to protect the data in case of transfer.

B) the right to obtain a copy of the personal data undergoing processing, provided that such right does not adversely affect the rights and freedoms of others. In the event of additional copies requested by the Data Subject, the Data Controller may charge a reasonable fee based on administrative costs.

C) the right to obtain from the Data Controller, without undue delay, the rectification of inaccurate personal data concerning the Data Subject.

D) the right to obtain from the Data Controller the erasure of personal data concerning the Data Subject without undue delay, where one of the grounds set out in Article 17 of the GDPR applies — for example, where the data are no longer necessary in relation to the purposes for which they were collected or otherwise processed, or where the processing is unlawful — and provided that the legal conditions for erasure are met; in any case, the processing shall not be justified by another equally legitimate reason.

E) the right to obtain from the Data Controller the restriction of processing in the cases provided for by Article 18 of the GDPR — for example, where the accuracy of the personal data is contested by the Data Subject, for a period enabling the Data Controller to verify the accuracy of the data. The Data Subject shall also be informed, within a reasonable time, when the suspension period has expired or the reason for the restriction no longer applies, and thus the restriction itself has been lifted.

F) the right to obtain from the Data Controller communication of the recipients to whom any rectification, erasure, or restriction of processing has been notified, unless this proves impossible or involves a disproportionate effort.

G) the right to receive the personal data concerning the Data Subject, in a structured, commonly used, and machine-readable format, and the right to transmit those data to another Data Controller without hindrance from the original Data Controller, in the cases provided for by Article 20 of the GDPR, as well as the right to have the personal data transmitted directly from one Data Controller to another, where technically feasible.

For any further information, or to exercise the above-mentioned rights, please contact the Data Controller at privacy@spazioingegneria.com.
To ensure that the rights listed above are exercised by the Data Subject and not by unauthorized third parties, the Data Controller may request additional information necessary to verify the identity of the applicant.