DISCLOSURE WITH RESPECT TO NATURAL PERSONS PURSUANT TO ARTICLES 13 AND 14 OF REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL OF APRIL 27, 2016 (HEREINAFTER THE “DISCLOSURE”)

1. DATA CONTROLLER

The Data Controller is Fondazione Cassa di Risparmio di Cuneo, having its registered office in Via Roma, 17 – 12100 Cuneo (CN), C.F. 96031120049 whose data can also be found on the website on its Home Page and/or other web pages.

The Data Protection Officer (DPO) is attorney Luisa Di Giacomo, who can be contacted at the e-mail address dpo@fondazionecrc.it., with an office in Turin, Corso Vittorio Emanuele II No. 76.

 

2. PERSONAL DATA BEING PROCESSED

The Personal Data collected by the Site are as follows:

1. Navigation data

The Site’s computer systems collect certain Personal Data, the transmission of which is implicit in the use of Internet communication protocols. This information is not collected in order to be associated with you, but by its very nature could, through processing and association with data held by third parties, allow you to be identified. Among these are the IP addresses or domain names of the devices used to connect you to the Site, the URI (Uniform Resource Identifier) notation addresses of the resources requested, the time of the request, the method used to submit the request to the server, the size of the file obtained in response, the numerical code indicating the status of the response given by the server (successful, error, etc.) and other parameters relating to your operating system and computer environment.

These data are used in order to obtain anonymous statistical information on the use of the Site and to check its correct functioning; to allow – given the architecture of the systems used – the correct provision of the various functions you requested, for security reasons and to ascertain responsibility in the event of hypothetical computer crimes to the detriment of the Site or third parties and are deleted after 7 days; in any case, these data are kept by the Site Owner for the period strictly necessary and in any case in accordance with the relevant regulations in force.

1. Data provided voluntarily

Through the Site you may have the opportunity to voluntarily provide Personal Data, such as your first and last name and e-mail address to subscribe to the newsletter service or to contact the Controller through the “Contact Us” form or similar. You are free to provide or not to provide your Personal Data, but failure to do so may in specific cases result in the impossibility of obtaining the requested service. Should you leave your e-mail to subscribe to the newsletter service, you can unsubscribe at any time, using the appropriate link you will find under each communication.

1. Cookies and related technologies

The Owner collects Personal Data through cookies. More information about the use of cookies and related technologies are. available here.

 

 

3. PURPOSE, LEGAL BASIS AND MANDATORY OR OPTIONAL NATURE OF PROCESSING

The Personal Data you provide through the Site will be processed by the Data Controller for the following purposes:

1. a) response to a request from the interested party, purposes inherent to the execution of a contract to which you are a party or the execution of pre-contractual measures taken at your request (e.g.: request for contact through the Contact form or e-mail, registration to the newsletter service); in this case the conferment is optional, but in case of its absence it will not be possible to answer your question or provide you with the requested service; we specify that the data inherent to your company are not considered Personal Data under the current legislation and therefore do not fall within the scope of this information.
2. (b) purposes of statistical research/analysis on aggregated or anonymous data, thus with no possibility of user identification, aimed at measuring the operation of the Site, measuring traffic and evaluating usability and interest;
3. (c) purposes related to the fulfillment of a legal obligation to which the Controller is subject;
4. (d) purposes necessary to establish, exercise or defend a right in a court of law or whenever judicial authorities exercise their judicial functions;

The legal basis for the processing of Personal Data for the purposes under (a) is the provision of a service or response to a request from the data subject, and therefore consent is not required under Applicable Law.

The purpose under (b) does not involve the processing of Personal Data, while the purposes under (c) and (d) represent legitimate processing of Personal Data under the Applicable Legislation because, once Personal Data is provided, the processing is necessary to fulfill a legal obligation to which the Data Controller is subject.

 

4. MODE OF TREATMENT.

In relation to the aforementioned purposes, the processing is carried out using manual, computerized and telematic tools with logics strictly related to the aforementioned purposes and, in any case, in such a way as to guarantee the security and confidentiality of the data themselves and with the commitment on your part to promptly notify us of any corrections, modifications and updates. Said processing may be carried out on behalf of the Data Controller for the purposes and in the manner described above and in compliance with appropriate criteria to ensure security and confidentiality, by companies, studies, entities and external collaborators appointed as Data Processors and only with regard to the processing carried out by them.

None of your personal data at the Data Controller falls under the definition of “Special Categories of Data” of Article 9 of the EU Regulation 2016/679. Should such data be transmitted to us, in the absence of your explicit written consent we will delete it immediately.

 

5. RECIPIENTS TO WHOM YOUR DATA MAY BE DISCLOSED

Your Personal Data may be shared, for the purposes specified in Section 3, with:

1. parties necessary for the provision of the services offered by the Site, including but not limited to the webmaster agency, the system for sending e-mail and analyzing the operation of the Site, or the newsletter management system, who typically act as external data controllers appointed by the Data Controller;
2. persons authorized by the Controller to process Personal Data who have committed to confidentiality or have an appropriate legal duty of confidentiality; (e.g., employees and contractors of the Controller); (a. and b. are collectively “Recipients”);
3. Jurisdictional authorities in the exercise of their functions when required by Applicable Regulations.

 

6. DATA TRANSFERS ABROAD

None of your personal data is transferred outside the European Union. The server on which this site is hosted is located within the European Union. The site communicates using secure protocol (https), so the data you enter is protected.

The Controller ensures that the electronic processing of your Personal Data by Recipients is done in compliance with Applicable Law.

Should transfers outside the European Economic Area occur, such transfers will be based alternatively on an adequacy decision or the Standard Model Clauses approved by the European Commission.

 

7. DATA RETENTION

In general, your Personal Data is kept for as long as your request for the services provided by you remains and, when it ends, for ten years thereafter. In the case of newsletter subscription, the data will be processed until you decide to unsubscribe: in this case, you will no longer receive communications from the Data Controller, but data retention, if processed for other purposes and with adequate legal basis, may remain for a period in any case not exceeding ten years. Personal Data may, also, be processed for a longer period, if an act interrupting and/or suspending the statute of limitations occurs that justifies the extension of data retention.

 

8. YOUR RIGHTS.

You may exercise your rights under the Regulations by sending an e-mail to info@fondazionecrc.it or by contacting the DPO at the contact details above, clearly indicating for which data you are requesting the exercise of your rights, listed below.

a. Right of access

You will be able to obtain confirmation from the Data Controller as to whether or not any processing of your Personal Data is taking place and, if so, to obtain access to the Personal Data and information required by Article 15 of the Regulations, including but not limited to the purposes of the processing and the categories of Personal Data processed.

If Personal Data is transferred to a third country or international organization, you have the right to be informed of the existence of adequate safeguards relating to the transfer.

If requested, the Controller may provide you with a copy of the Personal Data being processed. For any additional copies, the Controller may charge you a reasonable fee based on administrative costs. If the request in question is made by electronic means, and unless otherwise specified, the information will be provided to you by the Controller in a commonly used electronic format.

b. Right of rectification

You may obtain from the Controller the rectification of your Personal Data that is inaccurate as well as, taking into account the purposes of the processing, the integration of the same, if it is incomplete, by providing a supplementary statement.

c. Right to cancellation

You may obtain from the Data Controller the deletion of your Personal Data if any of the grounds set forth in Article 17 of the Regulations exist, including, but not limited to, if the Personal Data is no longer necessary in relation to the purposes for which it was collected or otherwise processed or if the consent on which the processing of your Personal Data is based has been withdrawn and there is no other legal basis for the processing.

Please note that the Data Controller may not delete your Personal Data if their processing is necessary, for example, to comply with a legal obligation, for reasons of public interest, or for the establishment, exercise or defense of a legal claim.

d. Right to limitation of processing

You may obtain the restriction of the processing of your Personal Data if one of the cases provided for in Article 18 of the Regulations occurs, including, for example, your dispute as to the accuracy of your Personal Data being processed or if your Personal Data is necessary for the establishment, exercise or defense of a right in a court of law, although the Data Controller no longer needs it for the purposes of processing.

e. Right to data portability

Where the processing of your Personal Data is based on consent or is necessary for the performance of a contract or pre-contractual measures and the processing is carried out by automated means, you may:

– Request to receive the Personal Data you provide in a structured, commonly used, machine-readable format (example: computer and/or tablet);

– Transmit your received Personal Data to another Data Controller without hindrance from the Data Controller.

You may also request that your Personal Data be transferred by the Controller directly to another data controller designated by you, if this is technically feasible for the Controller. In this case, it will be your responsibility to provide us with all the exact details of the new data controller to whom you intend to transfer your Personal Data and to provide us with appropriate written authorization.

f. Right of opposition

You may object at any time to the processing of your Personal Data if the processing is carried out for the performance of an activity in the public interest or in pursuit of a legitimate interest of the Data Controller (including profiling activity).

Should you decide to exercise the right of objection described here, the Controller will refrain from further processing your personal data, unless there are legitimate grounds for processing (grounds overriding the interests, rights and freedoms of the data subject), or the processing is necessary for the establishment, exercise or defense in court of a right.

g. Right to file a complaint with the Data Protection Authority

Without prejudice to your right of recourse in any other administrative or jurisdictional forum, if you believe that the processing of your Personal Data by the Data Controller occurs in violation of the Regulations and/or applicable legislation, you may lodge a complaint with the relevant Data Protection Authority (www.garanteprivacy.it).

 

9. CHANGES

This Privacy Policy is effective as of October 2024. The Owner reserves the right to change or simply update its content, in part or in full, including due to changes in Applicable Law. The Owner will inform you of such changes as soon as they are introduced and will be binding as soon as they are posted on the Site. The Data Controller therefore invites you to visit this section regularly to take cognizance of the most recent and up-to-date version of the Privacy Policy so that you are always up-to-date on the data collected and the Data Controller’s use of it.