Privacy Policy Notice pursuant to articles 13 and 14 of the European Regulation on the protection of personal data 2016/679

This notice describes the management methods of the ARISTEA website with reference to the processing of personal data of users who consult it and those who interact with the web services accessible electronically from the reference internet address, corresponding to the official page of ARISTEA S.p.A. This notice is provided only for the reference website and not for other websites that may be consulted by the user through links.

Definitions

For easy understanding of this Regulation, some of the definitions contained in article 4 of EU Regulation 2016/679 are provided:

“personal data”: any information relating to an identified or identifiable natural person. An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;

“processing”: any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;

“controller”: the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data;

“processor”: a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller;

“recipient”: a natural or legal person, public authority, agency or another body, to which the personal data are disclosed, whether a third party or not (however, public authorities which may receive personal data in the framework of a particular inquiry in accordance with Union or Member State law shall not be regarded as recipients);

“supervisory authority”: an independent public authority pursuant to article 51 GDPR;

“profiling”: any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyze or predict aspects concerning that natural person’s performance at work, economic situation, health, personal preferences, interests, reliability, behavior, location or movements;

“pseudonymisation”: the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organizational measures to ensure that the personal data are not attributed to an identified or identifiable natural person;

“consent of the data subject”: any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her;

“personal data breach”: a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, personal data transmitted, stored or otherwise processed.

Data Controller and Data Protection Officer

Data Controller: ARISTEA S.p.A. (VAT No. 04925910632), with registered office at Viale Spagna (Industrial Zone) – 84091 Battipaglia (SA) Italy in the person of its legal representative

Types of data processed

The computer systems and software procedures responsible for the operation of this website acquire, during their normal operation, the following personal data whose transmission is implicit in the use of Internet communication protocols:

• IP addresses;
• the type of browser used;
• the operating system;
• the domain name;
• the addresses of websites from which access was made;

information about pages visited by users within the site, access time, time spent on individual pages, internal path analysis and other parameters relating to the user’s operating system and IT environment;

• the addresses in URI (Uniform Resource Identifier) notation of the requested resources;

method used in submitting the request to the server and the size of the file obtained in response, the numerical code indicating the status of the response given by the server (success, error, etc.) and other parameters relating to the user’s operating system and IT environment;

This information is not collected to be associated with identified data subjects, but by its very nature could, through processing and associations with data held by third parties, allow users to be identified. The optional, explicit and voluntary sending of electronic mail to the addresses indicated on this site entails the subsequent acquisition of the sender’s address, necessary to respond to requests, as well as any other personal data included in the message.

Cookies

Please refer to the cookies policy available at the following link

Purpose and legal basis of processing

Navigation data is processed for our legitimate interest in ensuring the security of the sites, controlling their proper functioning and obtaining statistics regarding their use (art. 6, para. 1, lett. f) of the GDPR). To provide commercial information about products requested through the contact form on the site.

Methods of data processing

The personal data collected will be processed through the use of computer systems and stored both on computer media and on paper media, according to the principles of correctness, fairness and transparency provided by the applicable regulations on the protection of personal data and protecting confidentiality and rights through the adoption of appropriate technical and organizational measures to ensure an adequate level of security proportionate to the risk.

Personal data is processed for the time strictly necessary to achieve the purposes for which it was collected. Specific security measures are observed to prevent data loss, illicit or incorrect use and unauthorized access.

The data provided is not subject to profiling activities except in anonymous mode and only for data necessary for site maintenance and to improve the user’s browsing experience.

Recipients of Personal Data

The data will be processed exclusively by competent and duly appointed subjects for the performance of services necessary for proper management of the relationship, with guarantee of protection of the data subject’s rights. In particular, the data may be communicated to third parties duly appointed by public and/or private subjects in compliance with legal obligations.

Personal data may also be communicated by the Controller to persons authorized by the Controller to process the data. No data from the web service is disseminated.

Place of processing

The processing connected to the web services of this site takes place at the registered office of Tre ti srl and is handled only by personnel specifically assigned to this purpose, or by any external managers of maintenance operations, appropriately designated.

No data from the web service is communicated or disseminated. Personal data provided by users who submit requests for sending informational material is used solely for the purpose of performing the requested service or provision and will never be communicated to third parties unless specifically requested.

Transfer of Personal Data

The data controller does not transfer nor intends to transfer personal data to recipients in third countries or to international organizations

Rights of the data subject

At any time, the data subject may exercise, in relation to the data processing described, the rights provided by the applicable regulations on the protection of personal data, including the right to:

• receive confirmation of the existence of personal data and access to their content (access rights);
• update, modify and/or correct personal data (right of rectification);
• request deletion or limitation of processing of data processed in violation of law including those for which retention is not necessary in relation to the purposes for which the data was collected or otherwise processed (right to erasure and right to restriction);
• object to processing based on legitimate interest (right to object);
• withdraw consent, without prejudice to the lawfulness of processing based on consent given before withdrawal;
• lodge a complaint with the supervisory authority in case of violation of the regulations on the protection of personal data;
• receive a copy of the data in electronic format concerning the personnel selection service and request that such data be transmitted to another data controller (right to data portability).

To exercise these rights you may contact the Controller at any time, sending the request to the following email address: privacy@aristeaspa.com

Furthermore, the data subject may lodge a complaint with the supervisory authority, represented in Italy by the Guarantor for the Protection of Personal Data www.garanteprivacy.it.

Privacy notice regarding Artificial Intelligence

Notice on the processing of personal data (Privacy Code – Legislative Decree 196/2003 as amended by Legislative Decree 101/2018 – EU Regulation 679/2016 on the processing of personal data – Art. 13)

Aristea S.p.A. with registered office at Viale Spagna, 84091 Battipaglia SA, VAT No. 04925910632, in the person of its legal representative, as data controller (hereinafter “Controller”), informs you, pursuant to EU Regulation 679/2016 (“GDPR”) that your data will be processed according to principles of correctness, lawfulness, transparency, in compliance with the purposes and methods indicated below, collecting them to the necessary and exact extent for processing.

1. Premise

Within its business, the Controller, and through its company employees, may use AI systems to improve production levels and increase customer satisfaction.

During these detection activities, the company acquires images, data and other files such as videos or music that will then be used to pursue the purposes indicated above

2. Lawfulness, purpose, legal basis of processing and provision of data
   The acquired data will be processed – in compliance with the GDPR and section 4 of this notice – for the provision of services.

Within this purpose, the following objectives can also be identified which constitute or will constitute an integral part:

a) Enhancement of the capacity for detection and monitoring of data traffic on the corporate and commercial network.
c) Conducting tests on the artificial intelligence characteristics of the platform used in relation to the detection of characteristics set during the research phase.

The applicable legal basis for processing is the legitimate interest of the data controller (pursuant to art 6, par 1, lett. f) GDPR).

3. Data processed

The personal data acquired and processed by the Controller falls into the category of common data (images, photos, license plate numbers, commercial data…).

In this regard, recital 51 of the GDPR states that “[…] the processing of photographs should not systematically constitute processing of special categories of personal data, as they fall under the definition of biometric data only when they will be processed through a specific technical device that allows unique identification or authentication of a natural person […]”.
The EDPB (European Data Protection Board) has also expressed its opinion on this topic with Guidelines 3/2019 on the processing of personal data through video devices stating that “[…] video recordings of an individual cannot be considered biometric data per se under art. 9 GDPR if they have not been subjected to specific technical processing to contribute to the identification of that individual […].

4. Methods of processing, security measures and retention of personal data

Your personal data is subject to electronic processing. The company does not perform automated profiling processing of the personal data in its possession.

Your data will be processed using the best computer or telematic systems available on the market, using high security “standards” against accidental data loss by adopting “data breach” management procedures (i.e. violation of data management) as provided by current regulations. In compliance with articles 25 (“Data protection by design and by default”), 32 (“Security of processing”), 35 (“Data protection impact assessment”) and 36 (“Prior consultation”) of EU Regulation 679/2016, the Controller has adopted a programmatic document on the design of the service covered by this notice.

5. Access and communication of data

For the purposes referred to in the previous point 2, the Controller may communicate your personal data to different categories of recipients such as, for example, employees and collaborators of the Controller in their capacity as authorized and/or internal data processors and/or system administrators;

Your data will not be disseminated.

6. Data transfer abroad

Personal data is not stored on servers located within the European Union. It remains understood that the Controller, where necessary, will have the right to move servers also outside the EU. In this case, the Controller ensures from now that the transfer of data outside the EU will take place in compliance with the guarantees provided by the GDPR including adequacy decisions of the European Commission or contractual agreements for the protection of personal data (so-called “EU Standard Contractual Clauses”).

7. Rights of the data subject and methods of exercise

We inform you that, at any time and whenever the conditions exist, you may exercise your rights provided by articles 15 et seq. GDPR:

• obtain confirmation of the existence or not of personal data concerning you and their copy in intelligible form;
• obtain the updating, rectification or integration of your data;
• request the deletion of your data, within the terms permitted by regulations;
• object, in whole or in part, to the processing of personal data concerning you;
• limit processing, in case of violation, request for rectification or objection;
• request the portability of electronically processed data, provided on the basis of consent or contract;
• withdraw consent to the processing of your data, where provided.
• in relation to fully automated profiling, obtain human intervention from the Controller to express your opinion and contest the decision.

Should you deem it appropriate, you may lodge a complaint with the Guarantor Authority for the Protection of Personal Data.

The data subject may exercise these rights at any time by sending:

1. a registered letter with return receipt to the Controller’s address;
2. an email to privacy@aristeaspa.com