|
Personal data processing policy
Introduction
As Data Subject (Website User or Visitor), Legislative Decree no. 196/2003 ("Data Protection Code" - hereinafter referred to as " Code ") and the EU code and regulation 2016/679 (henceforth “ GDPR ”, for conciseness), provide for the protection of your Personal Data processing. In accordance with the provisions of the Code, the GDPR and the relevant legislation, your data will be processed according to the principles of correctness, lawfulness and transparency by respecting your rights, fundamental freedoms and dignity, in particular with regard to privacy, personal identity and your right to Personal Data protection.This disclosure is provided in accordance with article 13 of the Code as well as with articles 13 and 14 of the GDPR and is subject to updates published on the website www.smsalias.com . It is therefore advisable to check this disclosure regularly and to refer to the most up-to-date version.
Definitions
For the purposes of this information:
a) Data Bank, shall mean any set of Personal Data, divided into one or more units located in one or more Digitel Mobile S.r.l. websites and its subsidiaries and affiliates;
b) Customer, shall mean any natural or legal person, public administration, body, association or other agency that has signed a contract for the provision of messaging services by means of SMS and/or e-mail messaging services with Digitel Mobile S.r.l.;
c) Communication, shall mean the disclosure of Personal Data to one or more identified subjects other than the Data Subject, the representative of the Controller in the territory of the State, the Processor and the Persons in Charge, in any form, including by making available or searching such data;
d) Consent, any freely given specific, informed and explicit indication on the part of the individual in question, with which this individual Privacy Policy demonstrates their own consent, via a declaration or unequivocal positive action, that the Personal Data regarding him/her may be subject to Handling;
e) Traffic Data, shall mean any data processed for the purpose of the conveyance of a communication on an electronic communications network or for the billing thereof
f) Personal Data, shall mean any information relating to natural persons that are or can be identified, even indirectly, by reference to any other information including a personal identification number;
g) Person in Charge, shall mean the natural person that has been authorised by the Data Controller or Processor to carry out processing operations;
h) Data Subject, shall mean any natural person that is the subject of the Personal Data;
i) Pseudonymisation, the Handling of Personal Data in such a way that this data cannot be attributed to a specific individual without the use of additional information, on the condition that such additional information is stored separately and subject to technical and organisational measures aimed to guarantee that Personal Data cannot be attributed to an identified or identifiable physical person;
j) Processor, shall mean any natural or legal person, public administration, body, association or other agency that processes Personal Data on the controller’s behalf;
k) Controller, shall mean any natural or legal person, public administration, body, association or other entity that is competent, also jointly with another Data Controller, to determine purposes and methods of the processing of Personal Data and the relevant means, including security matters;
l) Processing, shall mean any operation, or set of operations, carried out with or without the help of electronic or automated means, concerning the collection, recording, organisation, keeping, interrogation, elaboration, modification, selection, retrieval, comparison, utilisation, interconnection, blocking, communication, dissemination, erasure and destruction of data, whether the latter are contained in a data bank or not;
m) User, shall mean a natural person using a publicly available electronic communications service for private or business purposes, without necessarily being a contracting party to such service.
Data Controller
The Data Processing Controller is Digitel Mobile S.r.l., with registered office in Via Filippo Brunelleschi n.29, 65124 Pescara, Company and VAT Number no. 03020690131, except as provided in the relevant information given to the Data Subject regarding SMS messaging services and e-mail messaging services, in respect of which Digitel Mobile S.r.l. may designate one or more Data Processors, pursuant to Section 29 of the Code and to article 28 of GDPR.
Consent to Handling
With the signing of the Services Contract, the individual gives their own consent to the Handling of their Personal Data in the ways and for the purposes described in this disclosure. In accordance with article 7 of the GDPR, the individual has the right to revoke their consent at any time via a simple communication sent to the address privacy@digitelmobile.com
The revocation of consent does not affect the lawfulness of Handling based on consent prior to this revocation. In the case of revocation of Consent, the Data of the individual will be deleted.
The location of the Handling of data and its transfer
The Handling of Personal Data connected to web services takes place at the headquarters of Digitel Mobile S.r.l. and of those of linked and monitored companies, and is managed solely by the person responsible for the Handling.
The Handling and preservation of Data takes place on servers located within the European Union, including those of third party companies which are tasked and duly appointed as Responsible for Handling. Currently, the servers are located in Italy. Data is not transferred outside of the European Union. The incumbent reserves the authority to modify the location of the servers, including outside the European Union, guaranteeing, in such cases, that the transfer will take place in compliance with all applicable laws, and with the relative guarantees stipulated by article 46 of the GDPR.
Types of Data Processed
Browsing data
During their ordinary course of operation, the IT systems and software procedures required to run the website www.smsalias.com acquire certain Personal Data, whose transmission is implicit in the use of Internet communication protocols. This information is not collected to be associated with identified Data Subjects but, by its very nature, it could enable identification of the users through the processing and matching of data held by third parties. This data category includes IP addresses or domain names of computers used by the users who visit the site, of the requested resources, the time of the request, the method used to submit the request to the server, the size of the file received in reply, the numerical code indicating the status of the reply from the server (done, error, etc.) and other parameters related to the operating system and the IT environment of the user. These data are only used to obtain anonymous statistical information on the use of the website and to control its correct functioning and are immediately deleted after processing. The data may be used to ascertain responsibility in the event of any potential computer crimes against the site. In any case, the data are kept by Digitel Mobile S.r.l. for the time strictly necessary and in any case pursuant to current relevant norms and regulations.
Data provided voluntarily by users
The voluntary, optional and explicit dispatching of Data to Digitel Mobile S.r.l. by the User (e.g. when registering in the Digitel Mobile S.r.l. Data Bank or entering their Data by filling in specific forms, also in order to verify the ability to access the services provided by the company, and sending e-mail to the addresses provided on the website) entails the subsequent acquisition of the sender's address and the provided data, for which the User gives explicit consent to their Processing.
Data collected through the www.smsalias.com website
The use of the www.smsalias.com website for the transmission of SMS/MMS and e-mail communications allows you to detect the opening of a message, from which IP address or by what type of browser the email was opened, and other technical details. The collection of such data is functional to the use of the service offered by Digitel Mobile S.r.l. and forms an integral part of the message delivery system features. In registering for the Client Area of the site www.smsalias.com, the User permits Digitel Mobiles S.r.l. to handle their Personal Data, including – but not limited to – their name, surname, telephone number and email address, with the sole aim of completing and managing the process of creating, registering and using the functionalities of the Client Area.
For the disbursement of services connected to the Client Area, Digitel Mobile S.r.l. could acquire other types of data including data relating to credit cards.
Personal Data collected through filling in forms on the www.smsalias.com website - also in the case of free trial use of SMS/MMS and e-mail services – are collected and processed for the following purposes:
a) carrying out the relationship with the Customer in accordance with the contract;
b) management of the administration and fulfilment of legal obligations (e.g. accounting, tax), or to comply with the requests of the Judicial Authority;
Data provided voluntarily by users for marketing purposes
If the User has also consented to the Processing of Personal Data to receive advertising and promotional communications about Digitel Mobile S.r.l. services, enjoy discounts, gifts and exclusive offers, pursuant to Section 13 of the Code, it is stated that:
a) Processing is based on the principles of correctness, lawfulness and transparency and pursues the following aims:
i. conclude, manage and carry out the request made by the Data
Subject to subscribe to Digitel Mobile S.r.l.'s newsletter and mailing list in order to receive commercial and/or promotional and/or advertising communications about the services of Digitel Mobile S.r.l. via e-mail or SMS;
ii. organise, manage and execute the request for registration also through the communication of the Data to third party suppliers or to subsidiaries and/or affiliates;
iii. to comply with legal obligations or other obligations required by the competent authorities;
b) The collected data are used by Digitel Mobile S.r.l. to manage the newsletter and mailing list subscription request and will be made known to third parties for the protection of rights and fulfilment of obligations under the law or regulations and upon request by the competent authorities.
To interrupt the transmission and for deletion from the newsletter and mailing list, the Data Subject can at any time undertake the cancellation procedure from the service following the instructions contained in the communications received.
Methods, purposes and duration of Handling
The Data gathered by Digitel Mobiles S.r.l. is:
A. handled via automated electronic, informatic and telematic tools, or via manual elaborations with rationales related to the purposes for which Data is
gathered;
B. handled legally, correctly and transparently with regards to the individual;
C. gathered for defined, explicit and legitimate purposes, and subsequently handled in a way that is not incompatible with such purposes;
D. adequate, pertinent and limited to that which is necessary for the purposes for which data is gathered;
E. exact and, if necessary, updated;
F. preserved in such a way as to permit the identification of the individual concerned only for the time that is strictly necessary for carrying out the aims for which the data was gathered;
G. handled in such a way as to guarantee adequate security of personal data, including protection – via adequate technical and organisational measures – against the handling of data that is not authorised or legal and against loss, destruction or accidental damage.
Specifically:
1. Personal Data
Digitel Mobile S.r.l. processes Personal Data based on the principles of correctness, lawfulness and transparency and has the following aims in compliance with article 6, letter b of the GDPR:
a) conclude, manage and carry out requests for contact or provision of services forwarded by the Data Subject;
b) organise, manage and carry out requests for contact and provision of services also by means of communication to third parties in general, including suppliers and/or collaborators and/or subsidiaries and/or affiliated companies for the provision of services and/or rights defence and/or fulfilment of obligations under the law or regulations and upon request by the competent authorities.
The Personal Data of the Data Subject may be used to request information, including by telephone, concerning the quality of the services offered, or relating to any cancellation, and with particular reference to the Traffic Data Processing for the purpose of marketing the services. Such Data may also be stored for periods longer, but in any case for the duration strictly necessary to attain the purposes for which they are kept. Personal Data processing shall be carried out automatically and/or manually, and for the time strictly necessary to achieve the purposes for which the data have been collected. Specific security measures are implemented to prevent data loss, misuse or incorrect use of data, and unauthorised access. In accordance with article 26 of the GDPR, taking into account the state of the art and costs of execution, and also the nature, environment of application, context and purposes of Handling, as well as the risks of varying probability and seriousness for the rights and liberties of physical persons resulting from the Handling, whether at the moment of determining the means of Handling or the act of handling itself, the Incumbent will put adequate technical and organisational measures into place, such as the pseudonymisation and encryption of personal data, aimed to efficiently implement the principles of protection of data, such as minimisation, and to integrate into the handling process all necessary guarantees to satisfy the conditions of the GDPR and to protect the rights of individuals.
2. Data related to SMS/MMS and e-mail service
The Customer or the User who enters or otherwise submits Third Party Data must ensure, assuming all responsibility, that he/she has previously provided the third parties with the information pursuant to Section 13 of the Code and to have acquired the required consent for data processing, pursuant to article 7 of the GDPR.
The data relating to the transmissions made by Digitel Mobile S.r.l. customers (telephone numbers of the recipients/users/e-mail addresses) and communicated to Digitel Mobile S.r.l. by the Customer will be stored in Digitel Mobile S.r.l.'s Data Bank with the purpose of addressing any critical issues regarding technical support, any abuses and for statistical purposes and in compliance with article 6 of the GDPR.
Data regarding the recipient/user's telephone numbers/email addresses and any data regarding the communications made by the customers will never be transferred to third parties. No commercial information, promotional notice or any kind of notice by Digitel Mobile S.r.l. will be sent to the recipient/users' telephone numbers/e-mail addresses.
Data traffic are retained by Digitel Mobile S.r.l., in accordance with the explicit consent given by the Customer in the contract for the services provided by Digitel Mobile S.r.l. for a period not exceeding 24 months for the purpose of:
a) preventing and countering crimes;
b) documentation in the event of a billing dispute or for requesting payment also in court;
c) the marketing of electronic communication services or the provision of value-added services;
d) internal organisation and statistical surveys, as well as to meet any requests for delivery and/or display of advanced data by authorised persons such as, for example, administrative, judicial or public security authorities.
The content of SMS/MMS and email messages is preserved by Digitel Mobile S.r.l., in compliance with the express Consent given with the contract by the Client who uses services provided by Digitel Mobile S.r.l., for a period of no more than 6 months for consultation by the Client, via access to the website www.smsalias.com and use of the correct login and password.
3. Optional Data Provision
Except for Navigation Data, the disclosure of Data by the Data Subject is optional, but any refusal may not allow Digitel Mobile S.r.l. to provide timely and correct handling of the contact request or provision of the service performed by the Data Subject.
Digitel Mobile S.r.l.'s appointment as a Processor for the Data Controller Customer
In cases where, as Data Processing Controller of the final SMS and/or e-mail recipients, the Customer appoints Digitel Mobile S.r.l. External Data Processor of SMS and/or e-mail end-users/recipients – without prejudice to the Customer's responsibility regarding the use of SMS and/or e-mail end-users/recipients and the content of the communications - in its capacity as External Processor, Digitel Mobile S.r.l. declares being aware of its obligations pursuant to Legislative Decree 196/2003, and on behalf of GDPR it commits to:
a) handle Data only under the documented instruction of the person responsible for Handling Data;
b) preserve the rules of the Code and of the GDPR, especially the rules regarding security measures as stipulated in article 32 of the GDPR, committing to adopt technical and organisational, physical and logical measures to guarantee a level of security that is adequate to the risk, with the aims of minimising the risk of destruction or loss, whether intentional or accidental, of Data, or unauthorised access or Handling that is not permitted and that does not comply with the purposes indicated below;
c) observe the provisions of the Data Protection Authority;
d) to process the Data sent by the Controller for the sole purpose of carrying out the functions required by the contract and for the required time;
e) to identify, amongst its collaborators, and designating them in writing, the Persons in Charge of processing, who operate under the direct authority of the Processor;
f) provide periodic basic training to the Persons in Charge in matters relating to Data Processing;
g) observe and ensure its Persons in Charge observe secrecy concerning the Personal Data they will come to know as they implement the contract and not to disclose or communicate Data, information or documentation acquired under the contract itself to third parties;
h) monitor the work of their Persons in Charge;
i) collaborate actively and promptly with the person responsible for data handling in order to satisfy the obligations of the person responsible for data handling in responding to requests for the exercising of the rights of the individual concerned, according to the terms and conditions stipulated by regulations;
j) in the event that the Processor is required to use the services of subcontractors to carry out the contract, the Processor undertakes to sign a written agreement with the subcontractors that they will comply with the terms and conditions of the contract and the obligations set out in this notice.
k) under selection of the person responsible for data handling, to delete or return all Personal Data after the services rendered in relation to the Handling have been terminated and to delete existing copies, except for the preservation of data for aims that are permitted by Law;
l) to make available to the person responsible for the handling of data all the information required to demonstrate compliance to legal obligations;
m) to allow and contribute to revision activities, including inspections, carried out by the person responsible for data handling or by someone else who is charged with this responsibility;
n) to immediately inform the person responsible for data handling if, in his/her opinion, an instruction violates the GDPR or other regulations, whether national or EU, relating to the protection of Data.
Security of information
All information collected on the www.smsalias.com website is stored and maintained in secure facilities that restrict access only to authorised personnel.
The www.smsalias.com website is regularly checked for any security breaches and to ensure that the information collected is safe from unauthorised viewing.
Digitel Mobile S.r.l. complies with the security measures prescribed by applicable laws and regulations and all appropriate measures according to the most advanced criteria to ensure and secure the confidentiality of Users' Personal Data and to minimise the dangers of unauthorised access, removal, loss or damage to Users' Personal Data as much as possible.
Data Subject's Rights
The Data Subject has the rights as enunciated by Section 7 of the Code and by Chapter III of the GDPR. In particular, a Data Subject shall have the right to:
1. obtain confirmation as to whether or not Personal Data concerning him or her exist, regardless of their being already recorded, and communication of such data in intelligible form;
2. to be informed:
a) of the source of the Personal Data;
b) of the purposes and methods of the processing;
c) of the logic applied to the processing, if the latter is carried out with the help of electronic means;
d) of the identification data concerning the Data Controller, Data Processors and the designated representative;
e) of the entities or categories of entity to whom or which the Personal Data may be communicated and who or which may get to know said data in their capacity as designated representative(s) in the State’s territory, Data Processor(s) or person(s) in charge of the processing.
f) the expected period of preservation of their personal data or, if this is not possible, the criteria used to determine this period;
g) all the information available and its origin, if such Data is not gathered from the individual;
3. obtain the adjustment, addition or deletion (right to anonymity) of Personal Data or limitation of the Handling of Personal Data regarding him/her:
4. obtain the portability of Data;
5. object, in whole or in part:
a) on legitimate grounds, to the processing of Personal Data concerning him/her, even though they are relevant to the purpose of the collection;
b) to the processing of Personal Data concerning him/her, where it is carried out for the purpose of sending advertising materials or direct selling or else to carry out market or commercial communication surveys.
6. lodge a complaint to a Monitoring Authority.
Minors
If the individual concerned is younger than 18 years of age, Handling is only legal if and to the extent that consent is given or authorised by the person holding parental responsibility, for whom identifying data and a copy of documents of recognition must be acquired.
Information
Information and requests regarding privacy concerns, including the Data Subject’s Rights, may be directed to Digitel Mobile S.r.l. by email at
privacy@digitelmobile.com
|
|
