INFORMATION NOTICE TO DATA SUBJECTS ON THE PROCESSING OF PERSONAL DATA - WEBSITE

Date of the drafting of this document: September 2018
 

This Information notice to data subjects (hereinafter the “Information Notice”) is issued pursuant to sect. 13 of the EU Regulation 679/2016 (General Data Protection Regulation – hereinafter the “GDPR”) and deals with personal data processing within the international architecture contest “Grand Prix Casalgrande Padano” (hereinafter the“Grand Prix”) 

THE DATA CONTROLLER
The data controller – i.e. the entity who determines the purposes and the means of processing – is Casalgrande Padana S.p.A., with registered office at Casalgrande (RE), c.a.p. 42013, Via Statale 467, 73 (ITALY), P. IVA 01270230350, C.F. 01622500369 (hereafter the “Data Controller”). If you have any questions or requests, or if you require clarifications regarding the processing of your personal data, you may contact the Data Controller in the following ways:

- by sending an e-mail to privacy@casalgrandepadana.it;
- by writing to: Via Statale 467, 73 42013 - Casalgrande (RE)
- by telephone: +39 0522 9901.

DATA SUBJECTS AND CATEGORIES OF DATA PROCESSED
Personal data means, as per sect. 4 of GDPR, “any information relating to an identified or identifiable natural person”.

Thus, the natural persons affected by the processing activity are the participants in the Grand Prix (hereinafter the "Data Subject/s").

On the legal basis specified hereinafter, the Data Controller will process the following personal data, provided by the data subject on a voluntary basis:
- identification information (such as, including and not limited to, name and surname, date of birth, taxpayer code, residence address);
- contact information (such as, including and not limited to, email address and telephone number);
- any other data and information suitable to identify the Data Subject. 

The processing of the personal data described above is necessary to grant the participation in the Grand Prix (with the exception of the processing due to registration in the newsletter provided by the Data Controller); therefore, the decision of not submitting your personal data will prevent the Data Controller from granting the participation in the Grand Prix. Anyway, processing of data for the purposes of registering for the newsletter is not necessary for participating in the Grand Prix, and it is optional: missed provision of data to register for the newsletter will not affect Data Subject’s participation in the Grand Prix. 
 

Should the Data Subject need more detailed information on the evaluation carried out by the Data Controller on the balancing between legitimate interests pursued and the interests, rights and freedom of the data subjects, he/she may contact the Data Subject at the contact details above.

CATEGORIES OF RECIPIENTS OF THE PERSONAL DATA 
To fulfil the purposes stated above and carry out the processing activities described above, the Data Subjects’ personal data may also be processed by third parties, other than the Data Controller: such entities can either process personal data on behalf of the Data Controller (therefore, acting as "data processors"), or as autonomous data controllers. 

In particular, Your personal data will be processed by the following subjects or categories of subjects:
– third parties involved in organization, management and development of the Grand Prix such as, members of a jury, advertising agencies, typographies, shippers, consultants, etc.; 
– administrative, judicial or law enforcement authorities, as required by the law, with reference to obligations of communication of personal data or other legal fulfilments;

If the Data Subject wishes to know the identity of all the parties to whom your personal data are disclosed, he/she can contact the Data Controller at the contact information given above. 

TRANSFER OF PERSONAL DATA OUTSIDE THE EUROPEAN ECONOMIC AREA 
The Data Controller will transfer your personal data outside the European Economic Area only toward countries that ensure an adequate level of protection for the data subjects' personal data, based on an adequacy decision by European Commission, or as a result of the adoption of appropriate or suitable safeguards, anyway in full compliance with the GDPR. 
These transfers take place in exceptional cases, for example when it is necessary to transfer a message from the data subjects' communication to an agent in a third country. 
The Data Controller will provide the Data Subjects, at their request, with detailed information on how personal data are transferred, on the appropriate or suitable safeguards adopted and on the means by which it is possible to obtain a copy of the transferred data or where they have been made available.
In any other case, the personal data are processed by the Data Controller at its offices or by recipients located within the EU.

PROCESSING BY AUTOMATED INDIVIDUAL DECISION-MAKING
The Data Controller does not carry out any processing by automated individual decision-making (sect. 22 of GDPR)

DATA SUBJECTS' RIGHTS
The Data Subject has several individual rights, that can be exercised in any moment towards the Data Controller, by contacting it at the contact information above. The Data Controller will reply to Data Subjects’ requests without undue delay.

ACCESS
The Data Subjects have the right to request from the Data Controller the access to the personal data concerning them, as provided by sect. 15 GDPR, particularly requesting information on: 

– the purpose of the processing;
– the categories of the processed personal data;
– the recipients or categories of recipients to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organizations;
– where possible, the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period;
– the existence of the right to request from the Data Controller rectification or erasure of personal data or restriction of processing of personal data concerning the data subject or to object to such processing;
– the right to lodge a complaint with a supervisory authority;
– where the personal data are not collected from You, any available information as to their source;
– the existence of automated decision-making, including profiling, referred to in sect. 22(1) and 22(4) of GDPR and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for You

WITHDRAWAL OF CONSENT
Data Subjects have the right to withdraw their consent at any time, pursuant to sect. 7(3) of GDPR, without affecting the lawfulness of processing based on consent before its withdrawal, and thee lawfulness of processing under different legal basis.

RECTIFICATION 
Data Subjects have the right to request the rectification of the inaccurate personal data, or to have incomplete personal data completed, as provided by sect. 16 of GDPR. 

ERASURE (I.E. "RIGHT TO BE FORGOTTEN")
Data Subjects have the right to require to the Data Controller the cancellation of their personal data, as provided by sect. 17 of GDPR. The exercise of this right may not be granted (or may be granted only partially) should the data processing be necessary for compliance with a legal obligation to which the Data Controller is subject, or for the establishment, exercise or defense of legal claims, or for other events set forth by sect. 17(3) of GDPR.

RESTRICTION OF PROCESSING 
Data Subjects have the right to require to the Data Controller the restriction of processing where (a) the accuracy of the personal data is contested by them, (b) the processing is unlawful, and they oppose the erasure of their personal data; (c) the Data Controller no longer needs such personal data for the purposes of the processing, but they are required by Data Subjects for the establishment, exercise or defense of legal claims; and (d) Data Subjects have objected to processing. 

PORTABILITY
Data Subjects can obtain from the Data Controller the portability of their personal data processed on a consent or contractual basis and by automated means: in this case, they may receive the personal data concerning them, in a structured, commonly used and machine-readable format. Moreover, Data Subjects have the right to transmit those data to another data controller. 

OBJECT
Data Subjects have the right to object to the processing of their personal data as provided by sect. 21 of GDPR, unless the Data Controller demonstrates, in response to such a request, the existence of a compelling legitimate grounds for the processing which override theur interests, rights and freedoms or for the establishment, exercise or defense of legal claims. In the event of failure to answer, or negative or inaccurate or unsatisfactory answer to Data Subject’s request, he/she has the right to lodge a complaint to a supervisory authority. If Data Subject is a British citizen, habitually resides in UK or is professionally based in UK, or believes the alleged violation by the Data Controller has been carried out in UK, he/she may at any time contact the Information Commissioner’s Office – https://ico.org.uk/ – to obtain ad adequate protection of his/her rights. If Data Subject is citizen of another EU member State, habitually resides or is professionally based in another EU member State, believes the presumed violation by the Data Controller has been carried out in another EU member State, please consult the web page http://ec.europa.eu/justice/article-29/structure/data-protection-authorities/index_en.htm to have detailed information on competent supervisory authority.

MODIFICATIONS AND UPDATES TO THIS INFORMATION
If this Information Notice is modified or updated, the Data Controller will take all reasonable measures to inform Data Subject of such modifications (for example with appropriate communications - through banners or similar tools - on homepage of Grand Prix website www.grandprixcasalgrandepadana.com). Nonetheless, Data Subject are invited to check regularly the "Privacy" section of such website, where this Information Notice is displayed, and to consult the most recent version of it.