(Articles 13 et seq. European Regulation 679/2016)
Dear Data Subject,
Renthub S.R.L. is a company specialized in the field of Information Technology.
With this document (hereinafter, the “Notice”), we wish to renew our commitment to ensuring that the processing of personal data collected through this website (hereinafter, the “Website”), carried out by any means, whether automated or manual, is performed in full compliance with the safeguards and rights recognized by Regulation (EU) 2016/679 (hereinafter, “GDPR” or “Regulation”) and the other applicable provisions regarding the protection of personal data.
The term personal data refers to the definition set out in Article 4, point 1) of the Regulation, namely “any information relating to an identified or identifiable natural person; an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person” (hereinafter, “Personal Data”).
The Regulation requires that, before processing Personal Data —understood according to the definition set out in Article 4, point 2) of the Regulation as “any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction” (hereinafter, the “Processing”)—, the person to whom such Personal Data belongs be informed of the reasons why such data is requested and how it will be used.
To this end, this Notice —drawn up based on the principle of transparency and all the elements required by Article 13 et seq. of the Regulation— is intended to provide you, in a simple and intuitive manner, with all useful and necessary information so that you may provide your Personal Data knowingly and in an informed way, and at any time request and obtain clarifications and/or corrections.
The company that will process your Personal Data for the main purpose referred to in Section B of this Notice and which, therefore, will act as data controller within the meaning of Article 4, point 7) of the Regulation, namely “the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data”, is:
Renthub S.R.L. (hereinafter, the “Controller”), with registered office at Via Bagutta, 13, VAT No. 11911070966, 20121 - Milan (MI) (hereinafter, the “Office”).
Your personal data are collected and processed by the Controller for purposes strictly connected to the use of the Website and its information services. In addition, your personal data may also be used in different processing operations (storage, archiving, processing, etc.) always in terms compatible with such purposes. In particular, your personal data may be processed for the following purposes:
a) responding to requests;
b) enabling the provision of the services you requested;
c) complying with legal obligations;
d) sending promotional and direct marketing communications, including newsletters and market research.
The legal basis for the processing of personal data for the purposes referred to in points a), b) and c) is Article 6(1)(b) and (c) of the GDPR, since the processing is necessary to respond to the data subject’s requests, to provide the requested services, and is also necessary to comply with a legal obligation incumbent on the Controller. Providing personal data for these purposes is optional, but failure to do so would make it impossible to activate the services provided by the Website and to respond to requests.
The legal basis for the processing of personal data for the purpose referred to in point d) is Article 6(1)(f) of the GDPR. The Controller may carry out such activity based on its legitimate interest, regardless of your consent and until you object or restrict (pursuant to Section G, letter d) of this Notice) such Processing, as better specified in Recital 47 of the Regulation, which considers “the processing of personal data for direct marketing purposes may be regarded as carried out for a legitimate interest.” This is also subject to the Controller’s assessment of the possible prevalence of your interests, rights and fundamental freedoms that require the protection of Personal Data over its legitimate interest in sending direct marketing communications.
The contact methods used for direct marketing activities may be both automated and traditional. In any case, and as further specified in Section G, you may withdraw your consent, even partially, for example by consenting only to traditional contact methods.
As regards contact methods involving the use of your telephone numbers, please note that the Controller’s direct marketing activities will be carried out after checking your possible registration in the Public Opt-Out Register, as established under and for the purposes of Presidential Decree 7 September 2010, no. 178, as amended.
The Personal Data required to pursue the above purposes will be those indicated in the contact form, such as, by way of example: name, surname, e-mail address, telephone numbers.
Your Personal Data may be disclosed to specific entities considered recipients of such Personal Data.
Indeed, Article 4, point 9) of the Regulation defines a recipient of Personal Data as “a natural or legal person, public authority, agency or another body, to which the personal data are disclosed, whether a third party or not” (hereinafter, the “Recipients”).
In this respect, in order to properly carry out all the Processing activities necessary to achieve the purposes of this Notice, the following Recipients may process your Personal Data:
third parties that carry out part of the Processing and/or related and instrumental activities on behalf of the Controller. These subjects have been appointed data processors, meaning under Article 4, point 8) of the Regulation “a natural or legal person, public authority, agency or other body which processes Personal Data on behalf of the Controller” (hereinafter, the “Processor”);
individuals, employees and/or collaborators of the Controller, to whom specific and/or multiple Processing activities of your Personal Data have been assigned. These individuals have been given specific instructions regarding the security and proper use of Personal Data and are defined, under Article 4, point 10) of the Regulation, as “persons who, under the direct authority of the Controller or Processor, are authorised to process Personal Data” (hereinafter, the “Authorised Persons”).
Where required by law or to prevent or repress the commission of a crime, your Personal Data may be disclosed to public entities or the judicial authority, without such entities being considered Recipients. Indeed, pursuant to Article 4, point 9) of the Regulation, “public authorities which may receive personal data in the framework of a particular inquiry in accordance with Union or Member State law shall not be regarded as Recipients.”
One of the principles applicable to the Processing of your Personal Data concerns the limitation of the retention period, governed by Article 5(1)(e) of the Regulation: “personal data shall be kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed; personal data may be stored for longer periods insofar as the personal data will be processed solely for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1), subject to implementation of the appropriate technical and organisational measures required by this Regulation in order to safeguard the rights and freedoms of the data subject.”
In light of this principle, your Personal Data will be processed by the Controller only as long as is strictly necessary to achieve the purposes referred to in Section B of this Notice.
In particular:
for the purposes referred to in Section B, points a), b) and c), your Personal Data, without prejudice to legal obligations, will be processed for the minimum necessary period, namely 3 months from the contact request, as indicated in Recital 39 of the Regulation;
for the purposes referred to in Section B, point d), the Controller may lawfully process your Personal Data for one year.
As provided by the Regulation, if you have given your consent to the Processing of your Personal Data for one or more purposes for which it was requested, you may withdraw it at any time, in whole and/or in part, without prejudice to the lawfulness of the Processing based on consent before its withdrawal.
The procedures for withdrawing consent are simple and intuitive: you only need to contact the Controller using the contact details provided in this Notice and specifically in Section G, letter g).
As provided by Article 15 of the Regulation, you may access your Personal Data, request their rectification and updating if incomplete or inaccurate, request their deletion if their collection occurred in violation of a law or regulation, as well as object to Processing for legitimate and specific reasons.
In particular, you have the following rights:
a. Right of access: to obtain confirmation of whether or not your Personal Data are being processed and, if so, access to such data and related information (purposes, categories of data, recipients, retention period, existence of rights, source of data, existence of automated decision-making, etc.).
b. Right to rectification: to obtain the rectification of inaccurate Personal Data or the completion of incomplete Personal Data.
c. Right to erasure (“right to be forgotten”): to obtain the deletion of your Personal Data without undue delay when one of the grounds set out in Article 17(1) of the Regulation applies (e.g. data no longer necessary, withdrawal of consent, objection to processing, unlawful processing, need to comply with a legal obligation). Exceptions apply under Article 17(3) (e.g. freedom of expression, legal obligations, public interest, research, defence of legal claims).
d. Right to restriction of processing: to obtain restriction in the cases provided for in Article 18 of the Regulation (e.g. contesting accuracy, unlawful processing but objecting to erasure, need for retention for legal claims, pending verification of an objection).
e. Right to data portability: to receive all your Personal Data in a structured, commonly used and machine-readable format, or to request their transmission to another controller.
f. Right to object: to object at any time to the processing of your Personal Data for direct marketing purposes, including profiling to the extent that it is related to such direct marketing.
g. Right to lodge a complaint with a supervisory authority: to file a complaint with the competent Data Protection Authority if you believe that the Processing of your Personal Data carried out by the Controller violates the Regulation, without prejudice to your right to seek redress before any other administrative or judicial authority.
To exercise all the above rights, you simply need to contact the Controller as follows:
by sending an e-mail to info@renthubsoftware.com
by sending a registered letter to the registered office of Renthub S.R.L.
Your Personal Data will be processed by the Controller within the territory of the European Union.
Should it become necessary, for technical and/or operational reasons, to rely on parties located outside the European Union, we hereby inform you that such parties will be appointed Processors under Article 28 of the Regulation, and the transfer of your Personal Data to such parties, limited to the performance of specific Processing activities, will be regulated in accordance with Chapter V of the Regulation.
All necessary safeguards will be adopted to ensure the fullest protection of your Personal Data, based on:
(a) adequacy decisions for the third countries concerned issued by the European Commission;
(b) appropriate safeguards provided by the third party recipient under Article 46 of the Regulation;
(c) adoption of binding corporate rules;
(d) use of standard contractual clauses approved by the European Commission.
In any case, you may request further details from the Controller if your Personal Data have been processed outside the European Union, including evidence of the specific safeguards adopted.
