DISCLOSURE ON PERSONAL DATA PROCESSING

Purposes of the processing
Personal data is collected and processed in order to:

1. draw up contracts for the products/services supplied;
2. fulfil the pre-contractual, contractual and tax requirements arising from interactions with you;
3. exercise the data controller’s rights, such as the right to defence in court;
4. manage commercial and marketing communications related to similar products and services supplied and customer satisfaction surveys;

and will be processed in compliance with the principles of correctness, lawfulness, transparency and protection of your privacy and rights. Your personal data will be processed for the entire duration of our business relationship and also thereafter in order to comply with all legal requirements.

Manner of processing
Data processing for the purposes set out above may be either automated (electronic or digital) or non-automated (paper-based) and in compliance with the privacy and security rules established by the law and related regulations and internal protocols.

Location of processing
The data are currently processed and stored at our operating facilities. They are also processed, on behalf of Ac Rolcar, by professionals and/or companies appointed to carry out technical, development, management and administrative/accounting activities. The mandatory or optional nature of data provision and the possible consequences of failure to provide such data. The provision of data is mandatory in all cases required by legal and contractual obligations. Accordingly, failure to provide such data, in whole or in part, may result in Ac Rolcar being unable to execute the contract or properly fulfil all requirements connected to the relationship.

Data disclosures
The following categories of people may become aware of your data during processing:

• the controller’s employees and consultants appointed as processors and/or internal managers in charge of data processing and/or system administrators;
• third party companies or other parties to which the data controller has outsourced activities;
• without the need to provide express consent, pursuant to article 6b)/c) of the GDPR, the controller may communicate your data to supervisory authorities, judicial authorities and those parties to which disclosure is mandatory to fulfil the related obligations. These parties shall process the data in their role as independent data controllers;
• professionals or companies specialised in commercial communications related to similar products and services offered and customer satisfaction surveys;
• professionals or companies specialised in the management of on-site visits to our premises such to comply with occupational safety and related legislation;
• professionals or companies specialised in the management of CCTV systems.

Cross-border data transfer
To comply with the pre-contractual, contractual and tax requirements arising from our interactions with you, your personal data may be communicated to parties (customers and suppliers in order to fulfil contractual obligations) in third party EU and non-EU countries. Should it be necessary, Ac Rolcar shall have the option of moving your data to servers in third party EU and non-EU countries.

Data storage times
The data provided will be held in our archives according to the following time parameters:

• to draw up contracts for the products/services supplied, to fulfil the pre-contractual, contractual and tax requirements arising from our interactions with you and to exercise the controller’s rights, such as the right to defence in court. For instance, ten years for administrative, accounting, contractual and labour law activities and for the management of any disputes, as per the provisions of article 2220 of the Italian Civil Code, except in the case of any delays in the payment of fees which would justify its extension;
• ten years from the end of the contract for the management of commercial communications related to similar products and services supplied and customer satisfaction surveys.

Rights of the data subject
The data subject may exercise the following rights in relation to their personal data:

• Right of access (art. 15): the data subject shall have the right to obtain from the controller confirmation as to whether or not personal data concerning him or her are being processed and, where that is the case, access to the personal data;
• Right to rectification (art. 16): the data subject shall have the right to obtain from the controller without undue delay the rectification of inaccurate personal data concerning him or her. Taking into account the purposes of the processing, the data subject shall have the right to have incomplete personal data completed, including by means of providing a supplementary statement;
• Right to erasure (‘right to be forgotten’) (art. 17): The data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay and the controller shall have the obligation to erase personal data without undue delay where one of the following grounds applies: the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed; the data subject withdraws consent where the processing is based on point (a) of Article 6(1), or point (a) of Article 9(2), and where there is no other legal ground for the processing; the data subject objects to the processing pursuant to Article 21(1) (‘Right to object’) and there are no overriding legitimate grounds for the processing, or the data subject objects to the processing pursuant to Article 21(2); the personal data have been unlawfully processed; the personal data have to be erased for compliance with a legal obligation in Union or Member State law to which the controller is subject;
• the right to lodge a complaint with the Data Processing Authority at: garante@gpdp.it or at the certified email: protocollo@pec.gpdp.it

How data subjects can exercise their rights
Data subjects may exercise their rights at any time by sending:

• Data subjects may exercise their rights at any time by sending: – a registered letter with return receipt to AC ROLCAR S.r.l. – Operating offices located at Via Emilia 12, 10099 – San Mauro Torinese (TO) and Via Giovanni Battista Valente 62/I, 16044 – Cicagna (GE).
• a certified email to ACROLCAR@LEGALMAIL.IT

Data controller, manager and processors
The data controller is AC ROLCAR S.r.l., VAT no. 07694710018 with registered office in Corso Germano Sommeiller 32, 10128 – Turin (TO), and operating offices in Via Emilia 12, 10099 – San Mauro Torinese (TO) and Via Giovanni Battista Valente 62/I, 16044 – Cicagna (GE).