INFORMATION NOTICE UNDER ART. 13 OF REGULATION (EU) 2016/679

The Controller of personal data
Pursuant to Art. 13 of Regulation (EU) 2016/679 (GDPR), Unitransports s.r.l, Via Zurigo, 28/2 – 20147 Milan, is the Controller of your personal data. The Controller informs you that data supplied by yourself with respect to existing legal relationships (user/data subject) will be processed in accordance with the aforesaid regulation. Data processing will be lawful and in accordance with the principles set out in Art. 5 of Regulation (EU) 2016/679. Further communications may be given later on, even orally.

No Data Protection Officer has been appointed.

The updated list of processors and persons authorised to process data is kept at the registered office of the Organisation.

Processed data
Art. 4 of Regulation (EU) 2016/679 defines "personal data" as any information relating to an identified or identifiable natural person («data subject»); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person. “Processing” means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction. Specifically, these data are supplied spontaneously by yourself to execute existing legal relationships with the Controller:

Data concerning natural persons: name and surname of natural persons, details such as their residence, postcode, town, province, telephone, email, etc.;
Data concerning names of Freelance Professionals/Companies/businesses: data relating to financial and commercial activities; name, fiscal domicile or other identifiers (company name, address of registered office, address of operating office, telephone/fax numbers, email address, tax code or VAT no.).

On top of this there are browsing data, computer systems and software procedures that ensure the operation of this website, which might acquire your personal data in the course of their ordinary operations and whose transmission is implied in the use of Internet communication protocols. In any case, this information is not collected to be associated to identified subjects; however, by reason of its very nature, it might allow for the identification of users through processing operations and associations with data held by third parties. This category of data includes IP addresses or domain names of computers used by users connecting to the website, URIs (Uniform Resource Identifier) of the resources requested, the time of the request, the method used to submit the request to the server, the size of the file obtained in response, the numerical code indicating the status of the response given by the server (successful, error, etc.) and other parameters relating to the user’s operating system and IT environment. These data are used solely to obtain statistical and anonymous information on website usage and to check its regular operation, and are cancelled immediately after being processed. Personal data may be used to establish liability in case of potential cybercrimes damaging the website or pursuant to requests made by the relevant authorities.

Purposes of data processing
Subject to your specific consent, your personal data are processed for the following purposes:

to manage existing and/or future legal relationships;
to fulfil obligations deriving from the said legal relationships;
to ensure the organisational management of any legal relationship, whether existing or being defined;
to fulfil all regulatory, accounting and/or tax obligations;
to protect contractual rights;
for purposes that are functional to statistical analyses;
to promote marketing activities and commercial communications by email or phone, regarding the services supplied by the Controller, also through its partners.

Duration of data processing
Your personal data, where processed for purposes 1, 2, 3, 4, 5 and 6, will be stored for the time necessary to provide the services offered by the Controller and for up to 10 (ten) years. After this period of time, your data will be erased. Data processed for administrative and accounting purposes will be stored, in accordance with statutory obligations, for no more than 10 (ten) years. Data supplied for the purposes listed under point 7 will be processed for no more than 2 (two) years and, with regard only to customers, such period may be extended only in case of a contractual renewal. Your consent to data processing may be withdrawn at any time.

Nature of data supply
Your consent to data processing is required for purposes 1 - 6, i.e. to fulfil statutory obligations relating to a relationship and for any other purpose connected to statutory obligations, regulations and EU laws; your refusal to supply your data will prevent the Controller from fulfilling these obligations and thus from supplying the services and/or performances requested by yourself. Communications will be sent for the purposes referred to in point 7 by email or mail. The data subject may exercise at any time the rights granted by Art. 7(3) and Arts. 15 et seq. of Regulation (EU) 2016/679, i.e. s/he may ask for these communications to cease, also asking for these communications to be sent solely by using other contact methods, if any. The supply of your data and your consent to data processing for the purposes set out in point 7 are completely optional. Your refusal to supply your personal data for the aforesaid purposes will prevent us from engaging in activities relating to: the sending of newsletters by mail/email concerning the promotion of institutional activities.

Method of data processing
Personal data will be processed and stored solely for the purposes indicated above, using both paper and computer supports and will be entered in relevant data banks and processed with tools that can ensure their integrity, safety and confidentiality, in accordance with Regulation (EU) 2016/679. All appropriate technical and organisational measures will be taken to ensure a level of data protection that is in accordance with Regulation (EU) 2016/679. Access to data will be allowed only to persons authorised in writing to process personal data. Data may be communicated and/or collected also to/from third parties (e.g. when data are acquired from processing centres or other Companies). The same will be appropriately designated as Data Processors and will be involved in fulfilling the obligations required by the existing legal relationship and specific statutory obligations.

Social platforms
The website offers ports of access to so-called social network services and platforms. Unitransports S.r.l. advises users to be cautious with regard to the circulation of personal information on thematic channels via “comments” or “public posts” when using these platforms. The conditions of use and the Privacy policies that apply to each of these means of social communication, published on their websites, regulate the information supplied. Unitransports S.r.l. carries out no control over the use of personal information communicated in any public forum, comment area, wall, so that the user is exclusively accountable for any disclosure.

Cookies
Pursuant to the Italian Data Protection Authority’s Measure no. 229 of 8 May 2014, there are two macro-categories of cookies: “Technical cookies" and "Profiling cookies”.

Technical cookies
Technical cookies are used for the sole purpose of carrying out the transmission of a communication on an electronic communications network, or insofar as this is strictly necessary to the provider of an information society service that has been explicitly requested by the subscriber or user to provide said service. They are not used for other purposes and are usually installed directly by the website owner. They may be classified as follows: (i) browsing or session cookies, which ensure the normal website browsing and use (enabling, for example, purchase or the authentication to access restricted areas of the website); (ii) analytics cookies, similar to technical cookies when used directly by the website manager to collect aggregate information on the number of users and how they visit the website; (iii) functionality cookies, which enable users to browse the website based on a set of selected criteria (for example the language and the products selected for purchase) in order to improve the service provided. The installation of these cookies requires the user’s prior consent, without prejudice to the obligation to provide the information listed in Art. 13 of Regulation (EU) 2016/679.

Profiling cookies
Profiling cookies are aimed at creating user profiles and are used to send advertising messages in line with the preferences shown by the user while browsing online. Since these devices can particularly intrude upon users’ privacy, the user must be adequately informed of the use of such cookies and thus express his/her valid consent.
Every domain, or portion thereof, visited with the user’s browser can set cookies. Since a typical Internet page, for instance that of an online newspaper, contains objects that originate from many different domains and each of them can set cookies, hundreds of cookies may be stored on your browser. These cookies are designed to record and sometimes also trace information on usage experience, going from one page to the other whilst maintaining the user’s authentication, as well as to save the user’s previously entered preferences (username, password, etc.), and to trace the user’s tastes and preferences, allowing for the management of any targeted marketing actions. Any limit to their use certainly produces effects on the user’s website consultation. Their block or removal from the browser’s cache might prevent the user from fully receiving the services offered by the web application.

Communication to third parties and/or disclosure of data
For the purposes set out in points 1 to 7, your data may be communicated to external subjects, duly designated in writing, where this is required to fulfil a statutory obligation or to fulfil obligations deriving from a contract you are a party to, as well as to meet your specific requests prior to contract conclusion.

The recipients of the data subject’s data can be divided also into the following categories:

Supervisory authorities, judicial authorities, entities, professionals, companies, public administrations or other structures engaged in data processing connected with the fulfilment of administrative, accounting and management obligations related to the ordinary pursuit of the Controller’s business (statutory obligations);
banks, financial institutions, freelance professionals, professional firms and consultants to whom data communication is necessary to pursue the Controller’s business and, in particular, to fulfil its contractual obligations toward the data subject (contractual obligations);

The data collected will not be disseminated in any way.

Intention to transfer data abroad
Your data will be transferred solely in Italy and within the European Union.

Rights granted by Regulation (EU) 2016/679
The data subject may exercise at any time the rights granted by Art. 7(3) and Arts. 15 et seq. of Regulation (EU) 2016/679:

right of access to personal data;
right to obtain the rectification or erasure of the same or the restriction of processing;
right to object to data processing;
right to data portability;
right to withdraw his/her consent, where envisaged (the withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal);
right to lodge a complaint with the supervisory authority (Italian Data Protection Authority).

Contact details of the Controller
To exercise the aforesaid rights, the data subject may send an email to the Controller at the address privacy@unitransports.it
The Controller of personal data is Unitransports s.r.l, Via Zurigo, 28/2 – 20147 Milan. The list of external Processors will be kept up to date and will be sent to the data subject upon request.
The data subject declares s/he has been informed of the rights granted by Art. 7(3) and Arts. 15 et seq. Further information on personal data processing may be communicated, also orally, at the time of data collection.