exercise of the rights of the data subject

Who is the interested party? You? Find out your rights.

The data subject is the natural person to whom the data refers.

Data protection information

Exercise of the rights of the data subject

Version of 16 October 2023 - MOD.INF.ESE.23-01

Introduction

Archiva Group, a brand owned by Archiva S.r.l. that brings together Archiva S.r.l. and Maxwell Consulting S.r.l., hereby informs you about the processing of your personal data carried out in order to process requests for the exercise of rights made through the website www.archivagroup.com. (hereinafter, "website").

Archiva S.r.l. and Maxwell Consulting S.r.l., with registered offices in via Spagna 24, 37069, Villafranca di Verona (VR), with reference to the personal data processed through the pages of the site for the purpose of instructing requests to exercise rights, take on the role of Data Controllers. They also take on the role of Data Processors pursuant to Article 28 of Regulation (EU) 2016/679 when they process personal data, collected through the site to process requests to exercise rights, on behalf of the other Archivagroup companies.

This information is provided pursuant to Article 13 of Regulation (EU) 2016/679.

Purposes of the processing and legal bases

The purposes of the processing of personal data provided directly by users by filling in the form for exercising the data subject's rights are set out below:

  1.  for purposes related to the instruction of the request to exercise rights formulated by the data subject;
    Legal basis for processing: fulfilment of a legal obligation (ART.6.1.C GDPR).
  2. to assert and/or defend the rights of the Controller in extrajudicial, judicial proceedings, litigation management, settlements, arbitrations;
    Legal basis of the processing: pursuit of the legitimate interest of the Data Controller (ART. 6.1.F GDPR).

Nature and modalities of processing

All Personal Data processing activities will be carried out in compliance with the European Regulation 2016/679, the provisions of the Privacy Code, Legislative Decree 196/2003, as amended by Legislative Decree 101/2018 and/or subsequent additions, and based on the principles of correctness, lawfulness and transparency, protecting confidentiality and fundamental rights and freedoms.

The provision of personal data is mandatory for the achievement of the purposes listed above. Therefore, failure to provide such data, in part or inexactly, may make it objectively impossible for the Data Controller to instruct and regularly conduct the activity concerning the request made by the data subject. Personal Data will be processed in form but also on paper, with logics strictly related to the aforementioned purposes.

Personal Data will be processed at the Data Controller's registered office and operational headquarters in Villafranca di Verona and will not be transferred to countries within the European Union for the purposes specified in this statement.

Categories of persons to whom personal data may be disclosed

The personal data provided by the Data Subject may be brought to the attention of employees or collaborators of the Data Controllers, for activities related to the completion of the preliminary investigation following the request to exercise rights, adequately instructed.

We inform you that personal data may be communicated, within the limits strictly pertinent to the above-mentioned purposes, to the subjects essentially included in the following categories and whose complete list may be requested from the Data Controllers for the processing within their competence, at the following addresses

Law firms, consultancy companies for consulting activities in their respective areas of expertise.

IT infrastructure maintenance companies, software suppliers and manufacturers, cloud service providers for any data restoration.

Certification bodies and accreditation bodies for verification activities in order to obtain and/or maintain the certifications acquired by Archiva Srl, Maxwell Consulting S.r.l.

Control bodies or authorities for verifications and controls in compliance with legal obligations, as well as in the event of the submission of complaints.

Duration of data processing and storage

The personal data processed will be kept for the time necessary to fulfil the purposes indicated in points 1 and 2 of the section "Purposes of the processing and legal bases", safeguarding the right of defence of the Data Controller.  At the end of the investigation, the personal data of the Data Subject will be kept in a register specifically dedicated to requests to exercise rights. After 10 years have elapsed from the end of the preliminary investigation, the personal data will be destroyed or rendered anonymous, in compliance with the technical procedures of deletion and backup.

Data protection officer (dpo)

Archiva S.r.l., on a voluntary basis, has appointed a Data Protection Officer who may be contacted by e-mail This email address is being protected from spambots. You need JavaScript enabled to view it..

Rights of the interested party

At any time, the data subject may exercise his/her rights vis-à-vis the Data Controllers in accordance with Articles 15 to 21 of the GDPR, the provisions of which are recalled in full.

The data subject shall have the right to request from the Data Controllers, for the processing operations falling within the competence of each of them and at any time, access to his/her personal data, to rectify or erase them or to object to their processing; he/she shall also have the right to request the restriction of processing, as well as to obtain, in a structured, commonly used and machine-readable format, the data concerning him/her. Furthermore, the data subject will be able, at any time, to withdraw consent for processing based on this legal basis without prejudice to the lawfulness of the processing, based on consent, carried out before the revocation.

Finally, the data subject may lodge a complaint with the competent Supervisory Authority in the event that he/she considers that his/her rights have been violated, in violation of the principles of the GDPR, according to the modalities indicated on the website of the Garante, accessible at www.garanteprivacy.it.

The aforementioned rights may be exercised by filling in the form available on the website www.archivagroup.com.

Amendments to the information notice

This information notice may be subject to updates in compliance with national and European regulatory provisions as well as by virtue of operational choices made by the Data Controllers.

Unless otherwise specified, this information notice shall continue to apply to personal data processed to date.