We inform you that, for the establishment and execution of contractual relationships, our organization may come into possession of your data, acquired verbally, directly or through third parties, qualified as personal data by the European Regulation 2016/679 (GDPR) and by Legislative Decree 196/2003, as amended by Legislative Decree 101/2018. 101/2018.

According to the legislation indicated, this processing will be based on the principles of fairness, lawfulness, transparency and protection of your privacy and rights.

Nature of the data processed:  we process your personal data such as identifying information, tax information, contact information, and economic information necessary for the performance of contractual relationships, both existing and future, communicated by you in connection with the conclusion and performance of contracts, or by virtue of pre-contractual relations and negotiations. We do not possess any of your data that may be classified as special or of a judicial nature (Articles 9 and 10 of the GDPR).

The services of the Data Controller are not intended for minors under 18 years of age, and the Data Controller does not intentionally collect personal information relating to minors. Where the data subject is a minor, such processing is lawful only if and to the extent that such consent is given or authorized by the holder of parental responsibility for whom the identifying data and copy of the recognition documents are acquired. Otherwise, in the event that information about minors is inadvertently recorded or collected, the Data Controller will promptly delete it.

Purpose of the processing, duration and legal basis: Your data will be processed for the entire duration of the contractual relationship and even thereafter, without your express consent pursuant to Article 6 letters b and f of the GDPR, solely and exclusively for the following purposes: to fulfill pre-contractual, contractual and tax obligations; to fulfill obligations prescribed by law, regulation, community legislation or an order of the Authority; to exercise the rights of the Data Controller, for example, the right of defense in court.  The Data Controller will process personal data for the time necessary to fulfill the above purposes and in any case for no more than 10 years from the termination of the relationship.

Please note that if you are already a customer, we may send you commercial communications regarding services and products of the Data Controller similar to those you have already used, unless you object (Articles 130 Legislative Decree 196/2003 and 21 no. 2 GDPR).

Obligation or right to provide data: As for the data that we are obliged to know, in order to fulfill the obligations prescribed by law, your failure to provide such data would make it impossible to establish or continue the relationship, to the extent that such data is necessary for the execution of the same.

Scope of knowledge of your data: the following categories of subjects may become aware of your data, as controllers or subjects authorized to process, appointed by the company, the Data Controller: executives, administrators, and directors; internal secretarial offices; accounting and invoicing personnel; personnel in charge of marketing services; third parties (such as providers for the management and maintenance of the website, suppliers, credit institutions, professional studios, etc.) who carry out outsourcing activities on behalf of the Data Controller, as external controllers of the processing; Supervisory Bodies, Judicial Authorities, as well as all other subjects to whom communication is mandatory by law for the performance of the indicated purposes.

Communication and dissemination:  Your data will not be disclosed to unidentified third parties through their availability or consultation by us. Your data may be communicated by us, within the limits of their respective and specific competence, to public or private entities, including any subject for which we have an obligation (or recognized right according to laws or secondary or community regulations) or a need for communication, as well as to our consultants, to the extent necessary to carry out their assignment within our organization, subject to our letter of engagement imposing the duty of confidentiality and security.

Transfer of data to countries outside the European Union:  Personal Data may only be transferred abroad to non-European countries where necessary, whose level of data protection has been deemed adequate by the European Commission under Article 45 of the GDPR or after signing the standard contractual clauses adopted/approved by the European Commission under Article  46, 2 letters C) and d) or after adopting other safeguards under Articles  46 and 47 of the GDPR.

Your rights:  As the data subject, you have the rights under Article 15 of the GDPR, including the right to: i) obtain confirmation of the existence or non-existence of personal data concerning you, even if not yet registered, and their communication in an intelligible form; ii) obtain the indication of: a) the origin of personal data; b) the purposes and methods of processing; c) the logic applied in case of processing carried out with the aid of electronic tools; d) the identification details of the data controller, processors, and the designated representative under Article 3, paragraph 1, of the GDPR; e) the subjects or categories of subjects to whom personal data may be communicated or who may become aware of it as the designated representative in the territory of the State, processors or appointees; iii) obtain: a) updating, rectification, or integration of data; b) erasure, anonymization, or blocking of data processed unlawfully, including data that does not need to be stored in relation to the purposes for which the data was collected or subsequently processed; c) certification that the operations referred to in letters a) and b) have been notified, including their contents, to those to whom the data was communicated or disseminated, except where this proves impossible or involves a disproportionate effort compared to the protected right; iv) object, in whole or in part, a) legitimate reasons to the processing of personal data concerning you, even if pertinent to the purpose of collection; b) to the processing of personal data concerning you for the purpose of sending advertising or direct sales material or for carrying out market research or commercial communication through the use of automated call systems without the intervention of an operator, via email and/or through traditional marketing methods such as telephone and/or postal mail. Where applicable, you will also have the rights under Articles 16-21 of the GDPR (Right to rectification, right to be forgotten, right to restriction of processing, right to data portability, right to object), as well as the right to lodge a complaint with the supervisory authority. At any time, you may obtain confirmation of the existence or non-existence of personal data concerning you and the communication of such data and the purposes on which the processing is based.  In addition, you may obtain erasure, anonymization, or blocking of data processed unlawfully, as well as updating, rectification or, where there is an interest, the integration of data.  You may object, for legitimate reasons, to the processing itself. We kindly ask you to promptly notify the relevant office of the company of any possible changes to your personal data so that we can comply with the current legislation, which requires that the collected data be accurate and therefore up-to-date.

Data controller and processor:  The data controller is Think Srl with registered office at Via Carlo Maria Piazza, 2 – 21052 Busto Arsizio (VA).

The Data Processor, whom you can contact to exercise your rights and/or for any clarifications regarding the protection of personal data, can be reached at the email address:  matteothink@gmail.com

Think Srl Soluzioni Creative