Privacy Policy

Privacy policy

This page contains the Privacy Policy for this website, which is intended to provide information regarding the processing of personal data of users who interact with this website and utilise its services, as well as to provide the information required under Articles 13 and 14 of EU Regulation 2016/679.

This privacy notice applies solely to this website and not to any other websites that may be accessed by the user via links provided on this site's web pages.

Regulation (EU) 2016/679 on the protection of personal data (hereinafter, the "Regulation") establishes rules relating to the protection of natural persons with regard to the processing of personal data, as well as rules relating to the free movement of such data, and protects the fundamental rights and freedoms of natural persons, with particular reference to the right to the protection of personal data.

Art. 4(1) of the Regulation provides that "Personal Data" means any information relating to an identified or identifiable natural person (hereinafter, the "Data Subject").

"Processing" means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction (Art. 4(2) of the Regulation).

Data Controller

Confindustria Lombardia

via Pantano 9 - 20122 Milan (MI)

tel: 0258370800

fax: 0258370741

email: segreteria@confindustria.lombardia.it

The Data Controller has appointed a Data Protection Officer (hereinafter “DPO”), who can be contacted at the following address: dpo@confindustria.lombardia.it.

Purpose of processing and legal basis

The processing of data of natural persons (such as name, surname, email, and generally all contact details) for which Confindustria Lombardia (hereinafter the "Association") is the data controller is carried out for the following purposes and related legal bases:

  • to respond to requests sent by the user via email and/or forms on the site; the legal basis for the listed processing activities is Art. 6(1)(b) of EU Regulation 2016/679 for the fulfilment of requests submitted by the user;
  • to periodically send, via remote communication technologies (telephone, mobile phone, SMS, email, fax, post, etc.), informative newsletters regarding the institutional activities of the Association; the legal basis for the listed processing activities is Art. 6(1)(b) of EU Regulation 2016/679 for the fulfilment of the newsletter subscription request submitted by the user;
  • to process requests for registration for events organised by the Data Controller and/or by entities within the Confindustria system; the legal basis for the listed processing activities is Art. 6(1)(b) of EU Regulation 2016/679 for the fulfilment of requests submitted by the user;
  • to perform obligations provided for by laws, regulations, or EU legislation, as well as to comply with measures issued by public Authorities empowered to do so or by supervisory and control bodies to which the Association is subject; the legal basis for this type of processing is Art. 6(1)(c);
  • to enable and facilitate site navigation, as well as to ensure an adequate level of security, integrity, and availability; the legal basis for this type of processing is the legitimate interest of the Data Controller as provided for by Art. 6(1)(f);
  • analysis of statistical data on aggregated or anonymous data, for the purpose of monitoring the proper functioning of the Site, traffic, usability, and interest; the legal basis for this type of processing is the legitimate interest of the Data Controller as provided for by Art. 6(1)(f);
  • to establish, exercise, or defend legal claims; the legal basis for this type of processing is the legitimate interest of the Data Controller as provided for by Art. 6(1)(f);
  • to fulfil obligations provided for by law, regulations, EU legislation, or by an order of an Authority; the legal basis for this type of processing is the legitimate interest of the Data Controller as provided for by Art. 6(1)(c).

Data types

The data necessary for the pursuit of the purposes set out above will be collected and processed:

  • identification data
  • contact details
  • data relating to the membership relationship and/or requests sent by the data subject

Methods of processing

In accordance with the provisions of Article 5 of the Regulation, the personal data subject to processing will be:

  • processed lawfully, fairly, and in a transparent manner in relation to the data subject;
  • collected and recorded for specified, explicit, and legitimate purposes, and subsequently processed in a manner compatible with those purposes;
  • adequate, relevant, and limited to what is necessary in relation to the purposes for which they are processed;
  • accurate and, where necessary, kept up to date;
  • processed in a manner that ensures an appropriate level of security;
  • stored in a form that allows for the identification of the data subject for a period of time not exceeding that necessary for the purposes for which they are processed.

Processing will be carried out using manual, IT, and telematic tools with organisational and processing logic strictly related to the purposes themselves, and in any case in such a way as to ensure the security, integrity, and confidentiality of the data through technical and organisational measures appropriate to the level of risk arising from the processing.

Nature of the provision of data and consequences of a refusal to respond

Apart from what is specified for navigation data, users/visitors are free to provide their personal data. The provision of data is in some cases necessary, as any refusal to provide it could result in the failure to conclude or properly fulfil the contract to which the data subject is a party and/or the failure to comply with the legal obligations to which the Data Controller is subject.

The provision of data for processing that requires consent is optional; failure to provide such data will not prevent the use of the services offered by the Data Controller. Even in the event of consent, the data subject shall have the right to withdraw it at any time.

Entities or categories of entities to whom data may be disclosed

Personal data will be processed by authorised personnel within the Data Controller's organisation. Data may also be disclosed to data processors appointed by the Data Controller (a complete list of external processors is available from the Data Controller), who are responsible for managing the purposes set out above.

Furthermore, data may be disclosed to independent data controllers such as (by way of example and not limited to) Confindustria, the Confindustria system, and partners of projects in which the Association is involved for institutional, statistical, and informational purposes, as well as to third parties to whom Confindustria Lombardia entrusts activities functional to the services provided.

Data retention

In general, Personal Data will be stored for the time strictly necessary to pursue the purposes for which it was collected and processed, including the retention period required by applicable legislation and, in any case, for a maximum period of 10 years from the termination of the relationship with the Controller and for a maximum period of 2 years for purposes where your consent is required, without prejudice to any need for the Controller to defend their rights in court.

Transfer of data abroad

For the purposes indicated above, Personal Data will be processed within the European Economic Area (EEA). Should it be transferred to Third Countries, in the absence of an adequacy decision by the European Commission, the requirements provided for by the applicable legislation regarding the transfer of Personal Data to third countries will be respected, such as the Standard Contractual Clauses provided by the European Commission.

Rights of the data subject

Arts. 15 et seq. of EU Regulation 2016/679 grant data subjects the exercise of specific rights.

Art. 15 recognises the right of data subjects to access their personal data and to obtain a copy thereof. The right to obtain a copy of the data must not adversely affect the rights and freedoms of others.

With an access request, the data subject has the right to obtain confirmation from the Controller as to whether or not their personal data is being processed and to know the purposes and categories of data processed, the third parties to whom the data is disclosed, and whether the data is transferred to a non-European country with adequate safeguards. The data subject also has the right to know the retention period of their personal data in relation to the aforementioned purposes.

With regard to their personal data, the data subject has the right to request the rectification of inaccurate data and the completion of incomplete data, erasure (right to be forgotten) under the conditions indicated in Art. 17 of EU Regulation 2016/679, and to object to or restrict processing.

Rights may be exercised by sending a request to the Data Controller at the addresses indicated above, without any specific formality.

Before providing a response, the controller may need to identify the data subject by requesting a copy of their identity document.

A written response will be provided without undue delay and, in any case, no later than one month from receipt of the request.

Should the data subject believe that the processing of their personal data violates the provisions of EU Regulation 2016/679, they have the right to lodge a complaint with the Data Protection Authority based in Rome, pursuant to Art. 77 of the Regulation itself, as well as to take legal action.

Browsing policy

Anonymous browsing data

The IT systems and software procedures used to operate this website acquire, during their normal operation, certain personal data whose transmission is implicit in the use of Internet communication protocols.

This information is not collected to be associated with identified data subjects, but by its very nature could, through processing and association with data held by third parties, allow users to be identified.

This category of data includes IP addresses or domain names of the computers used by users who connect to the site, URI (Uniform Resource Identifier) notation addresses of the requested resources, the time of the request, the method used to submit the request to the server, the size of the file obtained in response, the numerical code indicating the status of the response given by the server (successful, error, etc.) and other parameters relating to the user's operating system and IT environment.

This data is used solely for the purpose of obtaining anonymous statistical information on the use of the site and to check its correct functioning. The data may also be used to ascertain liability in the event of hypothetical cybercrimes against the site.

Version 1.1

Updated xx/05/2021