PRIVACY NOTICE
This privacy notice is provided in accordance with and for the purposes of Article 13 of EU Regulation 2016/679 of April 27, 2016 (“GDPR”) and in compliance with local regulations on processing of personal data (hereinafter, jointly, "Privacy Laws”) by Jakala S.p.A. Benefit Company, as better identified below, as data controller (hereinafter "Jakala" or "Controller”).
Jakala intends to provide users (“User(s)”) who browse the website www.jakala.com (the “Website”) and might contact Jakala through the contact forms available on the Website with some information about the processing of their personal data.
The processing of data by Jakala will be based on the principles of correctness, lawfulness, relevance, transparency and will be carried out while protecting the confidentiality and rights of the Users, in compliance with the Privacy Laws.
1. Data controller
The data controller of the personal data is the Jakala S.p.A. Benefit Company, with its registered office at Corso di Porta Romana 15, 20122 – Milan, Italy, fiscal code, VAT number and registration number with Companies Register of Milan 08462130967.
Controller notifies that, according to Article 37 of the GDPR, it has appointed a Data Protection Officer (DPO), namely Emanuela Astori. The DPO can be reach at the following e-mail address: privacy@jakala.com.
2. Types of data processed and categories of data subjects
The following personal data may be processed for the purposes indicated in the subsequent paragraph:
a) personal identification data (name, surname, company, region);
b) contact details (e-mail address);
c) other information included in the message;
d) browsing data.
The personal data belong to the following categories of data subjects: Users of the Website.
3. Purposes of the data processing and related legal basis
Users’ personal data will be processed by the Controller for the following purposes:
a) to reply to Users’ requests that may be received by the Controller through the contacts form of the Website. The legal basis of this processing activity is Article 6(1)(b) of the GDPR, i.e., to execute pre-contractual and/or contractual measures;
b) to send communications and/or updates on Jakala’s activities, invitations to events, initiatives, webinars, promotional communications by e-mail. The legal basis of this processing activity is Article 6(1)(a) of the GDPR, i.e. the User’s consent;
c) to allow registration for and the organization of events by Jakala or events for which Jakala is a partner or sponsor, as well as the consequent sending of organizational communications (such as participation reminders, information regarding the organization and attendance of the event itself) and/or materials related to the event (e.g., slides, presentations). The legal basis legitimizing this processing is Article 6(1)(b) of the GDPR, namely the execution of pre-contractual measures.
The processing of the Users’ personal data will be carried out only to the extent strictly necessary to achieve the above-mentioned purposes and, in any case, in compliance with the Privacy Laws.
The provision of personal data by User for the purpose specified in point a) and c) is voluntary, but it is essential and indispensable for the management of the User’s request or the registration for an event by Jakala; hence, any refusal to provide the data may result in the impossibility for Jakala to respond to the User’s requests and for User to obtain the information requested, or to manage the registration for one or more events.
The provision of personal data by User for the purpose mentioned in point b) is optional. Any refusal to provide the data will not prejudice in any way the possibility for User to obtain the information requested.
4. Data processing methods
The processing of personal data is carried out using manual, computerized, and telematic tools, solely for the purposes for which they were collected and, in any case, in a manner that ensures their security and confidentiality. The databases are kept in secure environments, access to which is controlled and in compliance with applicable legal provisions.
5. Categories of subjects to whom the data may be disclosed
The personal data provided will be processed by employees and collaborators of Jakala duly authorized, based on the roles and job duties performed by each of them, and/or by third parties duly appointed as data processors. These subjects are authorized to process the personal data within the limits of their competencies and in accordance with the instructions provided to them by the Controller.
In the context of the abovementioned purposes, the User’s personal data may be communicated to other companies belonging to the Jakala Group (i.e. controlled companies, parent companies, affiliates, or otherwise connected entities), to manage the Users’ requests in a more efficient way.
The complete list of data processors is available, upon request, at the Controller's headquarters.
6. Data Retention
The Controller will store the personal data for a period not exceeding the fulfilment of the purposes for which they were collected. Specifically:
a) with reference to purpose a) (i.e. reply to the User’s request), the personal data will be processed only for the time necessary to fulfill the User’s request, and in any case for a period not exceeding 12 months from the provision of the data, unless an extension is expressly granted by the same User;
b) with reference to purpose b) (i.e. for marketing purpose), the personal data will be processed for 24 months from the User’s consent, unless an extension is expressly granted by the User or the consent is withdrawn;
c) with reference to purpose c) (i.e. events registration and attendance), the personal data will be processed until the end of the event and for the period of 6 months after its conclusion.
7. Transfer of data abroad
Within the purposes described in this privacy notice, the data provided by the User may be processed by other companies belonging to the Jakala Group, companies, bodies or international organizations with headquarters in countries located outside the territory of the European Economic Area (EEA). The processing of such data takes place in maximum compliance with the confidentiality and security standards set out in the applicable personal data protection laws. Whenever the User's personal data is subject to international transfer outside the EEA, Jakala will adopt all suitable and necessary contractual measures to guarantee an adequate level of protection of personal data in accordance with what is indicated in this privacy notice on the processing of personal data.
8. Rights of data subjects
Jakala informs Users that, in relation to the aforementioned processing activities, they have the rights provided for in Articles 15 and following of the GDPR. In particular, User has the right to:
1. access their personal data: in particular, the data subject has the the right to obtain confirmation from the Controller as to whether or not personal data concerning them is being processed and, if so, to access the personal data and obtain further information about their origin, the categories of data processed, the purposes of the processing, the methods of processing, the recipients of data, the data retention period, transfers of data if any, etc.;
2. obtain the rectification of inaccurate personal data without undue delay, as well as the completion of incomplete personal data by providing a supplementary statement;
3. obtain the erasure of personal data without undue delay in cases where:
b) the consent on which the processing is based has been withdrawn and there is no other legal ground for the processing;
c) the personal data has been unlawfully processed;
d) the personal data must be erased to comply with a legal obligation;
4. obtain the restriction of processing in cases where the accuracy of the personal data is contested (for a period necessary for the data controller to verify the accuracy of such data), the processing is unlawful, and/or the data subject has objected to the processing;
5. where applicable, object at any time to the processing of personal data based on the legitimate interests pursued by the Controller;
6. receive the personal data, in a structured, commonly used, and machine-readable format, and transmit these data to another data controller, where the processing is based on consent or a contract and is carried out by automated means (the right to data portability);
7. where applicable, withdraw consent at any time, if the processing of personal data is based on this legal basis, without affecting the lawfulness of the processing carried out prior to the withdrawal.
8. lodge a complaint with a supervisory authority: without prejudice to any other administrative or judicial remedy, the data subject who considers that the processing of their personal data violates the Privacy Laws has the right to lodge a complaint with the supervisory authority of the member state where they reside or work, or where the alleged violation occurred.
If the data subject wishes to obtain further information regarding the processing of their personal data or exercise the aforementioned rights, they can submit a written request to the Controller or the DPO, with the subject line "Privacy - Exercise of Privacy Rights" to the email address privacy@jakala.com or by sending a letter with receipt of return to the address stated at Article 1 above.