Data Protection Notice exercise of the rights of data subjects

Privacy Notice - Exercising the rights of the data subject

pursuant to Articles 13 and 14 of Regulation (EU) 2016/679

1. Introduction

Archiva Group, a brand owned by Archiva S.r.l. (a single-member company), which comprises the companies listed in Annex A to this notice, hereby informs you about the processing of your personal data carried out to handle requests to exercise your rights submitted via the website https://www.archivagroup.com (hereinafter, the "website" or "site").

Throughout this policy, Archiva Group may be referred to simply as "Archiva" or, where a specific provision relates solely to a single legal entity within Archiva Group, by the short name of the company to which that provision refers.

This site may include plugins, links to social networks or platforms for the distribution of audiovisual content. Interaction with these elements means that certain data may be transmitted to the provider of the plugin, social media platform or content platform, in order to enable the necessary use of the content available there. The privacy notices regarding the processing of personal data carried out by the aforementioned providers can be found on their respective websites.

2. Data Controller

With regard to personal data processed via the website or other information systems (CRM, HR management system, ERP), Archiva acts as the Data Controller, in accordance with Article 4(7) of Regulation (EU) 2016/679 (hereinafter the "GDPR").

However, in specific operational scenarios, Archiva may process personal data on behalf of other companies, or vice versa, acting as a Data Processor pursuant to Article 28 of the GDPR. Such cases include, for example, the provision of infrastructure services, the technical management of the website, or the hosting of online forms and platforms.

The roles between the companies of Archiva Group's data processing activities are formalised through internal joint-controller agreements or the appointment of a Data Processor, signed between the parties, which transparently regulate their respective responsibilities. The up-to-date list of processing operations for which a Data Processor role is envisaged may be requested from each company via the contact details provided below in this notice.

3. Purposes, legal basis and duration of processing

The processing of personal data serves the following possible purposes:

Categories of data processed	Purposes of processing	Type of data subject	Legal basis for processing	Duration of processing
General data: first name, surname, email address, telephone number, identity	a. for purposes related to the processing of a request by the data subject to exercise their rights; b. to assert and/or defend the Data Controller's rights in out-of-court and judicial proceedings, dispute resolution, settlements and arbitration	All	Article 6(1)(c): processing is necessary for compliance with a legal obligation to which the data controller is subject Article 6(1)(f): processing is necessary for the purposes of the legitimate interests pursued by the data controller or by a third party, provided that such interests are not overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular if the data subject is a child.	The personal data processed will be retained for as long as necessary to fulfil the purposes set out in points 1 and 2 of the section 'Purposes of processing and legal bases', whilst safeguarding the data controller's right of defence. Upon completion of the investigation, the data subject's personal data will be retained in a register specifically dedicated to requests to exercise rights. Once 10 years have elapsed since the closure of the investigation, the personal data will be destroyed or anonymised, in accordance with the technical procedures for deletion and backup.

4. Nature and methods of processing

Archiva Group declares that the processing of personal data carried out for the purposes indicated above will be conducted in compliance with the applicable national and supranational regulations governing 'personal data protection'. In accordance with the aforementioned laws, the processing carried out by Archiva Group will be based on the principles of fairness, lawfulness and transparency, safeguarding the rights and freedoms of data subjects.

The provision of personal data is mandatory for the purposes listed above. Therefore, failure to provide such data, or the provision of incomplete or inaccurate data, could result in the Data Controller being objectively unable to process and carry out the activities relating to the request made by the data subject in the normal course of business.

Personal data will be processed electronically or in paper form, using methods strictly related to the aforementioned purposes. This privacy notice does not apply to websites other than the one explicitly mentioned.

Data processing is carried out by adopting appropriate technical and organisational measures, in line with the principles of data protection by design and data protection by default. Archiva carries out periodic security checks and has obtained numerous third-party certifications, which can be viewed at https://www.archivagroup.com/it/archiva/sicurezza-e-privacy. Personal data is processed primarily at the Data Controller's premises and will not be transferred to countries outside the EU.

5. Categories of persons who may become aware of personal data

Personal data processed by Archiva Group may be disclosed to employees or contractors of the Data Controller, for processing within their respective areas of responsibility; these individuals, operating under the direct authority of the Data Controller and in compliance with specific security measures provided to them, will process personal data in accordance with data protection principles.

Personal data may also be disclosed to any Data Processors appointed pursuant to Article 28 of the GDPR who, acting under the direct authority of the Data Controller, will receive appropriate instructions. The same will apply to any Data Processors in relation to their employees or staff members.

Please also note that personal data may be disclosed to parties essentially falling within the following categories; a full list of these may be requested from the Data Controller via the contact details set out in Annex A to this notice:

• Companies or other entities carrying out outsourced activities on behalf of Archiva Group: for website management and/or development, support, communication, event organisation and management, providers of video-conferencing software solutions, and operators of electronic platforms for sending marketing campaigns and newsletters;
  
• Recruitment agencies: for activities falling within their remit;
  
• Certification and accreditation bodies: for verification activities aimed at obtaining and/or maintaining the certifications held by Archiva Group.

6. Data Protection Officer (DPO)

Archiva Group has appointed a Data Protection Officer who can be contacted by email at the following address: dpo.privacy@archivagroup.it.

The following is a non-exhaustive list of situations in which the DPO may be contacted and/or should be contacted:

• if you wish to exercise a right recognised by the European General Data Protection Regulation;
• if you wish to contest the rejection of a request to exercise a right, or if you consider that the response was unsatisfactory or was not provided within the specified timeframe;
• if you believe that your personal data has been breached during processing carried out by the Data Controller or the Data Processor;
• if you believe that the information provided to you is not sufficiently clear and transparent;
• if you consider it necessary to receive clarification or further details regarding the processing of your personal data (purposes, legal basis, retention periods, methods of processing, etc.);
• if you need information in order to lodge a complaint with the supervisory authority.

7. Rights of the data subject

The data subject may, at any time, exercise their rights vis-à-vis the Data Controller in accordance with Articles 15 to 21 of the GDPR, the full text of which is hereby incorporated by reference.

The data subject shall have the right to request from the Data Controller access to their personal data, the rectification or erasure of such data, or to object to their processing; they shall also have the right to request the restriction of processing, as well as to obtain, in a structured, commonly used and machine-readable format, the data concerning them.

Furthermore, the data subject may, at any time, withdraw their consent for processing operations based on that legal basis, without this affecting the lawfulness of any processing carried out on the basis of consent prior to the withdrawal.

Finally, the data subject may lodge a complaint with the competent supervisory authority if they consider that their rights have not been respected, in breach of the principles of the GDPR, in accordance with the procedures set out, for example, on the Data Protection Authority's website, accessible at www.garanteprivacy.it.

These rights may be exercised by completing the relevant form available on the website http://www.archivagroup.com or by sending a message to the certified email address privacy@pec.archivagroup.it (which can also be reached via standard email).

8. Changes to the privacy notice

This privacy notice may be subject to updates in accordance with national and European regulatory provisions, as well as by virtue of operational decisions made by the Data Controller. Unless otherwise specified, it will continue to apply to personal data processed up to that point. In the event of significant changes to the privacy notice, notification will be provided via a banner on the website or by direct email, where applicable.