DATA PROTECTION NOTICE
(Article 13 of EU Regulation 2016/679)
In accordance with Article 13 of Regulation (EU) 2016/679 (Regulation (EU) 2016/679 – also “GDPR”), the following information is provided regarding the processing of personal data in connection with
1. Controller of the data processing
GEOPARC Bletterbach Lerch 40, I-39040 Aldein Phone number: 0471 886 946 E-mail address: info@bletterbach.info
2. Data Protection Officer (DPO)
The contact details of the Data Protection Officer (DPO) are as follows:
Compliance Consulting GmbH E-mail address: dpo@com-co.it
3. Data processed
The controller processes the following categories of data:
– General personal data of the parent pursuant to Art. 4 No. 1 of Regulation (EU) 2016/679, namely: first and last name; images and audiovisual recordings.
– General personal data of the minor pursuant to Art. 4 No. 1 of Regulation (EU) 2016/679, namely: first and last name; images and audiovisual recordings.
4. Purpose and legal basis of the processing
The personal data collected are processed for the purposes of communication, promotion and dissemination of the activities, initiatives and projects of the controller.
In particular, based on the choice expressly made by the data subject, the images and/or videos may be used and published through the following channels:
– the controller’s website; – social media profiles and pages managed by the controller; – printed informational and promotional materials such as brochures, flyers, posters and similar materials; – books, publications and other editorial products in printed or digital form.
The legal basis for the processing is Art. 6(1)(a) GDPR: the data subject has given their consent to the processing of their personal data for the purposes stated above. Providing the data is voluntary, but is a necessary condition for pursuing the stated purposes.
5. Processing methods
Personal data are processed with or without the aid of IT systems. The controller ensures the logical and physical security, as well as the confidentiality, of the processed data through appropriate technical and organizational measures.
6. Data retention
The personal data collected for the stated purposes are processed and stored for the period necessary to achieve those purposes, and in any case until the data subject withdraws their consent.
The images and/or videos are stored and used for a period of no more than 15 years from their collection, and in any case not longer than necessary to achieve the purposes for which consent was given.
If the images and/or videos are used as part of promotional materials relating to a specific initiative or event, they will be stored and used only for the duration of that initiative or event and its promotion.
The data subject may withdraw their consent at any time. In the event of withdrawal:
a) content published on digital channels over which the controller has direct influence, such as its own website, will be removed within a reasonable period, and in any case within 30 days of receipt of the withdrawal;
b) printed materials already produced in which the images were used, such as flyers, brochures or other promotional materials, may continue to be used until existing printed copies are exhausted. In the event of any subsequent reprints, the images of the data subject will no longer be used.
7. Recipients of the data
Personal data are accessible to:
– employees of the controller who are authorized to process data; – business partners and/or service providers who carry out outsourced activities on behalf of the controller, acting as processors, by performing activities related, supporting or supplementary to those of the controller. The list of processors is available at the contact details indicated in point 1 of this privacy notice.
The controller may also disclose the user’s data to public authorities or third parties (e.g. law enforcement authorities), but solely for the fulfilment of legal obligations. Data are not published or disseminated where this is prohibited by law.
8. Data transfer
No data transfers outside the EU or to international organizations are planned.
9. Rights of the data subject
Pursuant to Articles 15-21 of the GDPR, the user has the right to:
– Right of access (Art. 15 GDPR): to obtain confirmation as to whether or not personal data concerning them are being processed, and, where that is the case, to obtain information in particular on the purposes of the processing, the categories of personal data processed, the storage period, and the recipients to whom the data may be disclosed.
– Right to rectification (Art. 16 GDPR): to obtain, without undue delay, the rectification of inaccurate personal data concerning them, as well as the completion of incomplete personal data.
– Right to erasure (Art. 17 GDPR): to obtain, without undue delay, the erasure of personal data concerning them in the cases provided for by the Regulation.
– Right to restriction of processing (Art. 18 GDPR): to obtain restriction of processing by the controller in the cases provided for by the Regulation.
– Right to data portability (Art. 20 GDPR): to receive the personal data provided to the controller in a structured, commonly used and machine-readable format, and the right to have that data transmitted to another controller without hindrance, in the cases provided for by the Regulation.
– Right to object (Art. 21 GDPR): to object to the processing of personal data concerning them, unless the controller demonstrates compelling legitimate grounds for the processing.
The above rights, as well as the withdrawal of consent given, may be exercised by simply submitting a request to the controller or to the Data Protection Officer (DPO) at the contact details indicated in point 1.
Furthermore, the data subject has the right, pursuant to Art. 77 of the Regulation, to lodge a complaint with the competent supervisory authority (https://www.garanteprivacy.it/).
