Privacy Policy

Information on the processing of personal data

 

made pursuant to article 13 of EU Regulation 2016/679

We hereby inform you that, for the execution of relations with its customers, Orangedev S.r.l. collects, as data controller, the personal data referred to them, also acquired verbally, directly or through third parties pursuant to EU Regulation 2016/679 General Data Protection Regulation (hereinafter “GDPR”) and of Legislative Decree 196/03 “Personal data protection code” as amended by Legislative Decree 101/18.

The legislation in question first of all provides that whoever carries out personal data processing is required to inform the interested party on which data are processed and on the qualifying elements of the specific processing, which, in any case, must take place according to the principles of lawfulness, correctness and transparency, in the protection of your rights and your privacy. We therefore provide the following information.

OWNER OF THE TREATMENT AND RESPONSIBLE FOR DATA PROTECTION

The data of the data controller – Orangedev S.r.l. – are the following: C.F. and VAT number 06689280482, registered office in Via Panciatichi 40 – 50127 Florence, Tel: (+39) 055 0351846, E-mail: info@orangedev.it, PEC: orangedev@legalmail.it. You can contact the data protection officer, designated by the owner pursuant to art. 37 of the GDPR, by writing to your attention at the headquarters of the owner, or by e-mail at the address: dpo@orangedev.it.

PURPOSE OF THE TREATMENT AND LEGAL BASIS

The processing of your personal data is aimed at managing activities connected to the stipulation and execution of the contract with Orangedev S.r.l., such as, by way of example but not limited to: management of contracts, of orders and of shipments, management of invoicing, services to protection of consumers and users, credit protection, administrative, managerial, organizational and functional services for managing the contract. The processing of your personal data for these purposes is necessary for the execution of the contract of which you are a part, or of the pre-contractual measures adopted upon your own request also with reference to the free trial periods of Orangedev products and services S.r.l. made available to you by the data controller (Article 6, paragraph 1, letter b of the GDPR). Therefore, failure to provide data, as well as incorrect communication of the same, will make it impossible for the owner to guarantee the adequacy of the treatment.

The data may also be processed to fulfill any obligations established by laws and regulations, as well as by community legislation or by provisions dictated by public authorities. The legal basis of the processing will be the need to fulfill a legal obligation on the part of the owner, pursuant to art. 6, par. 1, lit. c) of the GDPR.

Furthermore, the processing may be necessary for the judicial and extrajudicial protection of the rights deriving from the contract: in this circumstance, the legal basis of the processing can be found in the pursuit of a legitimate interest of the owner, pursuant to art. 6, par. 1, lit. f) of the GDPR.

Finally, the personal data you provide may be processed to carry out marketing and promotional activities concerning the products and services provided by Orangedev S.r.l., as well as for commercial communications carried out both by automated means (e.g. text messages, e-mail) , both traditional (e.g. telephone, paper mail). In this specific case, the treatment will be bound to the explicit consent given by you, pursuant to art. 6, par. 1, lit. a) of the GDPR. In this case, you can freely express your consent according to the methods indicated by the owner: this choice is in fact entirely optional, and the consent given can be revoked at any time.

Pursuant to art. 22, par. 1 of EU Regulation 2016/679, in none of the cases described above will your personal data be subjected to decision-making processes based solely on automated processing, including profiling, as defined in art. 4, par. 4 of the aforementioned Regulation.

RECIPIENTS AND ANY CATEGORIES OF RECIPIENTS OF THE DATA

Without prejudice to communications made in fulfillment of legal obligations, all data collected and processed may be communicated exclusively for the purposes specified above to the following categories of recipients:

  • employees and collaborators of the owner in charge of customer management and related activities, expressly authorized and trained pursuant to art. 2-quaterdecies of Legislative Decree 196/03 and art. 29 of the GDPR who will receive explicit instructions from the owner about the methods of processing your data;
  • subjects third parties, identified as responsible pursuant to art. 28 of the GDPR, with which the controller has entered into specific agreements governing the processing of your data, also providing specific written instructions regarding the methods of data processing.

By way of example and not exhaustively, the latter category includes the consultants that the owner makes use of for the management of the obligations required by current legislation, as well as for the technical and administrative support necessary for the activities connected and instrumental to the correct execution of the stipulated contract. The complete and updated list of the recipients, or of the data processors identified pursuant to art. 28 of the GDPR, it can be consulted at the offices of the owner, or upon explicit and reasoned request to the owner.

Under no circumstances will your personal data be disclosed.

PERIOD OF STORAGE AND TRANSFER OF DATA

Your personal data will be stored on company or third-party servers located within the European Union, for the time strictly necessary to achieve the purposes for which they were collected, and subsequently according to the pro tempore applicable legislation. In the event of a judicial dispute, the data will be processed for the entire duration of the same, until the terms for the appeal actions have expired. The owner undertakes to inform the interested party, should the eventuality of a change of destination of the personal data being processed occur.

The owner does not transfer personal data to third countries or international organizations, reserving the possibility of using cloud services, selecting the suppliers of these services among those who will provide adequate guarantees as required by art. 46 of EU Regulation 2016/679.

SOFTWARE-AS-A-SERVICE

As regards the delivery of its software in SaaS mode, Orangedev S.r.l. is configured as data controller pursuant to article 28 of EU Regulation 2016/679, as well as system administrator on the basis of the provision of the Guarantor Authority for the protection of personal data of 27 November 2008 “Measures and precautions prescribed to data controllers carried out with electronic tools in relation to the attributions of the functions of system administrator”, as amended by the provision of June 25, 2009.

RIGHTS OF THE INTERESTED PARTY

As subjects interested in the treatment, you can exercise, except to evaluate and verify its applicability first, the rights referred to in articles 15 to 21 of EU Regulation 2016/679. In particular, pursuant to these articles, the interested party can exercise:

  • the right of access (art. 15): the right to obtain confirmation from the data controller as to whether or not personal data concerning him is being processed and, if so, to obtain access to personal data;
  • the right to rectification or integration (Article 16): the right to obtain from the data controller the rectification and/or integration of inaccurate or incomplete personal data concerning him, without unjustified delay;
  • the right to cancellation (“right to be forgotten”, art. 17): the right to obtain from the data controller the cancellation of personal data concerning him, without unjustified delay;
  • the right to limitation of treatment (art. 18): the right to obtain limitation of treatment from the data controller. This right applies when one of the following hypotheses occurs:
    – the interested party disputes the accuracy of the personal data, and the limitation takes place for the period necessary for the data controller to verify the accuracy of such personal data;
    – the processing is unlawful and the interested party opposes the cancellation of personal data, asking instead that their use be limited;
    – although the data controller no longer needs it for processing purposes, personal data are necessary for the data subject to ascertain, exercise or defend a right in court;
    – the interested party has opposed the processing pursuant to article 21, paragraph 1, pending verification of the possible prevalence of the legitimate reasons of the data controller with respect to those of the interested party;
  • the right to receive notification, in the event of rectification or cancellation of personal data or in the event of limitation of processing (art. 19);
  • the right to data portability (art. 20): the right of the data subject to receive, in a structured format, commonly used and readable by an automatic device, the personal data concerning him/her provided to the data controller, as well as the right to transmit such data to another data controller without impediments by the data controller to whom it previously provided them. This right applies if:
    – the treatment is based on consent pursuant to art. 6, par. 1, lit. a), or of the art. 9, par. 2, lit. a), or on a contract pursuant to art. 6, par. 1, lit. b); and
    – the processing is carried out by automated means.
  • the right to object (art. 21): the right to object at any time, for reasons connected with your particular situation, to the processing of your personal data pursuant to art. 6, par. 1, letters e) or f), including profiling on the basis of these provisions. In this case, the data controller refrains from further processing the personal data, unless he demonstrates the existence of binding legitimate reasons for proceeding with the processing which prevail over the interests, rights and freedoms of the data subject or for ascertaining , the exercise or defense of a right in court;
  • the right not to be subjected to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or which significantly affects his person (art. 22).

You may exercise the above rights at any time by contacting the data controller and his data protection officer at the addresses indicated in this statement.

Finally, pursuant to art. 77 of the GDPR and without prejudice to any other administrative or judicial appeal, if you believe that the processing that concerns you violates the same Regulation, you have the right to lodge a complaint with the Guarantor Authority for the protection of personal data according to the methods described on the institutional website www.gpdp.it.