This information notice, provided pursuant to art. 13 of the EU Regulation 2016/679 (the “Regulation“), concerns the privacy policies adopted by ZNR notai (hereinafter also “ZNR“) for the management of the document sharing platform (the “Platform“) and is meant for registered users of the Platform (“Users“). Personal data contained in the documents available through the Platform are processed in execution of the mandate conferred by the data subjects in the terms and for the purposes described in the general privacy policy available on the website znr.it.
- Data Controller
Data controller is ZNR notai (the “Controller”), with registered office in Milano, Via Pietro Metastasio, 5, 20123.
- Personal Data
The Users’ data processed in the context of the services offered through the Platform are:
- the personal data necessary for the creation of an account on the Platform (first and last name, email address, company/professional firm of affiliation);
- the User’s authentication data (login credentials); and
- data relating to the use of the Platform by Users (access logs, file downloads).
No data is collected unless it is relevant and strictly necessary for the pursuit of the purposes indicated below and is not collected any data belonging to the special categories of data referred to in Article 9(1) of the Regulation.
- Purposes of data processing
The personal data referred to in point 2 above are processed for the following purposes:
- to authorize access to the Platform (creation of an account);
- to ensure the correct functioning of the Platform;
- to communicate updates on the status of the file;
- to share and transmit the documentation relating to an operation;
- to provide the User with a historical archive of the documentation;
- to ensure the security of the data present on the Platform;
- send communications regarding the activities of ZNR.
- Legal basis of the processing
The legal basis that authorizes the processing of personal data:
(i) for the purposes mentioned in letters a) to e) of point 3 above, is Art. 6(1)(b) of the Regulation (“…processing is necessary for the performance of a contract to which the data subject is party”) as the processing of the User’s data is necessary to allow the User to use the Platform in accordance with the Terms and Conditions of Use of the Platform accepted at the time of registration;
(ii) for the purpose described in letter f) of point 3 above, is Art. 6(1)(c) of the Regulation (“…necessary for compliance with a legal obligation to which the controller is subject”) since the processing is necessary to ensure the correct use of the Platform and the security of the data in accordance with the provisions of Art. 32 of the Regulations;
(iii) for the purpose described in letter g) of point 3 above, it is art. 130, paragraph 4, of Legislative Decree 196/2003 which provides that the data controller may use the email address to send communications relating to services that are similar to those offered to the data subject, unless the User refuses such use.
- Recipients
The data related to the creation and use of the account by the Users are shared with the subjects delegated by the Controller to carry out the activities related to the maintenance, security and accessibility of the Platform and in general with the suppliers of services used by the Controller to achieve the purposes referred to in point 3 (e.g. electronic communication systems, data processors). These subjects, duly appointed as data processors pursuant to art. 28 of the Regulation, are contractually bound to respect the privacy regulations and the instructions given by the Controller. The data contained in the documentation made available through the Platform are shared, under the conditions and Terms of use of the document sharing platform, with the Users authorized to access the documentation related to a specific transaction.
The data may also be communicated to subjects, entities or authorities to whom it is mandatory to communicate personal data under the provisions of the law or orders by the authorities.
- Retention Period
In order to achieve the purpose set out in letter (e) of point 3 (and consequently for the purposes set out in letters (a), (c) and (d) of point 3 above), data will be stored for a period of 10 years from the closing of the last transaction accessed by the User. With specific reference to the purpose referred to in point 3 letter (b) above, the data will be retained for a period of 12 hours from the end of the session by the User; with reference to the purpose referred to in point 3 letter (f) above, the data (including the User’s download statistics) will be retained for a period of six months from the User’s registration. The data processed for the purposes referred to in paragraph 3 letter (g) above will be retained until the User requests to cease such processing.
- Rights of the data subject
The User has the right to obtain confirmation of the existence of processing of his/her data, to request access to his/her data, to know what kind of data has been collected, to request the correction or the erasure of the data in the cases provided for by art. 17 of the Regulation, the transformation into an anonymous form or the suspension or limitation of the processing of data concerning him/her, as well as to obtain in a structured format, commonly used and readable by automatic device, his/her data, in the cases provided for by art. 20 of the Regulation. The User has the right to object to the processing for the purpose described in paragraph 3 letter. g) above at any time, without any formality, by sending an email to privacy@znr.it
In any case, the user has the right to lodge a complaint to the Italian Data Protection Authority pursuant to art. 77 of the Regulation if he/she believes that the processing of his/her data is contrary to the privacy legislation in force.
- Contacts
The Controller can be reached at any time at the above address or at the e-mail address privacy@znr.it for the purposes of the exercise of the rights referred to in paragraph 8 or for any questions concerning the processing of personal data of Users described herein.