Information for the processing of personal data
Pursuant to Articles 13 and 14 of the Regulation (EU) 2016/679 (also referred to hereinafter as the “GDPR”), in relation to personal data processed by the Controller, we communicate as follows:
The Controller is:
INNOVA S.r.l.
via 1 Maggio, 8 – 38089 Storo (TN)
VAT number 01827470228
Tel 0465670104
E-mail info@innovaenergie.com
CATEGORIES OF DATA
E-mail address
Name and Surname
PURPOSES OF THE PROCESSING
Access and use of APP for remote management of purchased equipment
Technical assistance
LEGAL BASIS
Performance of a contract
The Controller has adopted adequate security measures in order to preserve the confidentiality, integrity and availability of the data subject's personal data and imposes similar security measures on third party suppliers and data processors. There is no automated decision-making process based on your data, including profiling. The personal data are processed using IT tools, with logic strictly related to the purposes of the processing.
If the Controller intends to further process your personal data for a purpose other than that for which they were collected, before proceeding with such further processing, he will provide you with all the relevant information, requesting your consent if necessary.
The provision of personal data is necessary for the above-mentioned purposes and the refusal implies the impossibility to access and use the APP.
Your personal data will not be disseminated and may be processed exclusively by authorized subjects or external data processors expressly appointed by the Data Controller and for the purposes indicated in the previous point 1.
The Controller does not transfer the Data to non-EU countries or to international organisation.
The data are kept for the time stricly necessary for the pursuit of the purposes indicated in the previous point 1, after which they will be permanently deleted or, alternatively, anonymized.
Pursuant to EU Regulation 2016/679 Articles 15 and following and of the current legislation, the interested party may exercise the following rights, according to the methods and within the limits established by the current legislation:
Article 15
Right of access by the data subject
Description
The data subject shall have the right to obtain from the controller confirmation as to whether or not personal data concerning him or her are being processed and, where that is the case, access to the personal data and the following information:
a) the purposes of the processing;
b) the categories of personal data concerned;
c) the recipients or categories of recipients to whom the personal data have been or will be disclosed, in particular if they are recipients in third countries or international organisations;
d) where possible, the envisaged period for which the personal data will be stored or, if this is not possible, the criteria used to determine that period;
e) the existence of the right to request from the controller rectification or erasure of personal data or restriction of processing of personal data concerning the data subject or to object to such processing;
f) the right to lodge a complaint with a supervisory authority;
g) where the data are not collected from the data subject, all available information as to their source;
h) the existence of an automated decision-making process, including profiling as referred to in Article 22(1) and (4), and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject.
Where personal data are transferred to a third country or international organisation, the data subject shall have the right to be informed of the appropriate safeguards pursuant to Article 46 relating to the transfer.
The controller shall provide a copy of the personal data undergoing processing. For any further copies requested by the data subject, the controller may charge a reasonable fee based on administrative costs. Where the data subject makes the request by electronic means, and unless otherwise requested by the data subject, the information shall be provided in a commonly used electronic form.
Conditions
The right to obtain a copy of one's personal data must not affect the rights and freedoms of others.
How to exercise it
The data subject can exercise the right by sending a request to the e-mail address info@innovaenergie.com.
In order to be able to provide a positive response to the request, it is necessary to provide the information necessary for the identification of the data subject.
Before providing an answer, the Controller may need to identify the data subject, as the right can only be exercised by the data subject or by his/her delegate.
Article 16
Right to rectification
Description
The data subject shall have the right to obtain from the controller without under delay the rectification of inaccurate personal data concerning him/her. Taking into account the purposes of the processing, the data subject shall have the right to have incomplete personal data completed, including by means of providing a supplementary statement.
Conditions
Processing of inaccurate and/or incomplete data.
How to exercise it
The data subject can exercise the right by sending a request to the e-mail address info@innovaenergie.com.
In order to be able to provide a positive response to the request, it is necessary to provide the information necessary for the identification of the data subject.
Before providing an answer, the Controller may need to identify the data subject, as the right can only be exercised by the data subject or by his/her delegate.
Article 17
Right to erasure («right to be forgotten»)
Description
The data subject shall have the right to obtain from the controller the erasure of personal data concerning him/her without undue delay and the controller shall have the obligation to erase personal data without undue delay.
Where the controller has made the personal data public and is obliged pursuant to paragraph 1 to erase the personal data, the controller, taking account of available technology and the cost of implementation, shall take reasonable steps, including technical measures, to inform the controllers which are processing the personal data that the data subject has requested the erasure by such controllers of any links to, or copy or replication of, those personal data.
Conditions
The right can be exercised where one of the following grounds applies:
a) the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;
b) the data subject withdraws consent on which the processing is based according to point (a) of Article 6(1), or point (a) of Article 9(2), and where there is no other legal basis for the processing;
c) the data subject objects to the processing pursuant to Article 21(1) and there are no overriding legitimate basis for the processing, or the data subject objects to the processing pursuant to Article 21(2);
d) the personal data have been unlawfully processed;
e) the personal data have to be erased for compliance with a legal obligation in Union or Member State law to which the controller is subject;
f) the personal data have been collected in relation to the offer of information society services as referred to in Article 8(1)
(Where Article 6(1)(a) applies, with regard to the direct offer of information society services to minors, the processing of the minor's personal data is lawful if the minor is at least 16 years old. Where the minor is under the age of 16, this processing is lawful only if and to the extent that such consent is given or authorised by the holder of parental responsibility. Member States may establish by law a lower age for these purposes provided that it is not less than age of 13 years).
The right to erasure does not apply to the extent that the processing is necessary:
a) for exercising the right of freedom of expression and information;
b) for compliance with a legal obligation which requires processing by Union or Member State law to which the controller is subject or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
c) for reasons of public interest in the area of public health in accordance with points (h) and (i) of Article 9(2) as well as Article 9(3);
d) for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) in so far as the right referred to in paragraph 1 is likely to render impossible or seriously impair the achievement of the objectives of that processing;
e) for the establishment, exercise or defence of legal claims.
How to exercise it
The data subject can exercise the right by sending a request to the e-mail address info@innovaenergie.com.
In order to be able to provide a positive response to the request, it is necessary to provide the information necessary for the identification of the data subject.
Before providing an answer, the Controller may need to identify the data subject, as the right can only be exercised by the data subject or by his/her delegate.
Article 18
Right to restriction of processing
Description
The data subject shall have the right to obtain from the controller the restriction of processing.
Where processing has been restricted under paragraph 1, such personal data shall, with the exception of storage, only be processed with the data subject's consent or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the Union or of a Member State.
A data subject who has obtained a restriction of processing pursuant to the paragraph 1 shall be informed by the controller before the restriction of processing is lifted.
Conditions
The right can be exercised where one of the following grounds applies:
a) the accuracy of the personal data is contested by the data subject, for a period enabling the controller to verify the accuracy of the personal data;
b) the processing is unlawful and the data subject objects to the erasure of the personal data and requests instead that their use be restricted;
c) the controller no longer needs the personal data for the purposes of the processing, but they are required by the data subject for the establishment, exercise or defence of legal claims;
d) tthe data subject has objected to processing pursuant to Article 21(1) pending the verification whether the legitimate grounds of the controller override those of the data subject.
How to exercise it
The data subject can exercise the right by sending a request to the e-mail address info@innovaenergie.com.
In order to be able to provide a positive response to the request, it is necessary to provide the information necessary for the identification of the data subject.
Before providing an answer, the Controller may need to identify the data subject, as the right can only be exercised by the data subject or by his/her delegate.
Article 19
Notification obligation regarding rectification or erasure of personal data or restriction of processing
Description
The controller shall communicate any rectification or erasure of personal data or restriction of processing carried out in accordance with Article 16, Article 17(1) and Article 18 to each recipient to whom the personal data have been disclosed, unless this proves impossible or involves disproportionate effort. The controller shall inform the data subject about those recipients if the data subject requests it.
How to exercise it
The data subject can exercise the right by sending a request to the e-mail address info@innovaenergie.com.
In order to be able to provide a positive response to the request, it is necessary to provide the information necessary for the identification of the data subject.
Before providing an answer, the Controller may need to identify the data subject, as the right can only be exercised by the data subject or by his/her delegate.
Article 20
Right to data portability
Description
The data subject shall have the right to receive the personal data concerning him/her, which he/she has provided to a controller, in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller without hindrance from the controller to which the personal data have been provided.
The exercise of the right referred to in paragraph 1 of this Article shall be without prejudice to Article 17 - Right to erasure ("right to be forgotten")
Conditions
The right can be exercised where one of the following grounds applies:
a) the processing is based on consent pursuant to point (a) of Article 6(1) or point (a) of Article 9(2) or on a contract pursuant to point (b) of Article 6(1)
b) processing is carried out by automated means
The exercise of the right referred to in paragraph 1 of this Article shall be without prejudice to Article 17. That right shall not apply to processing necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.
The right referred to in paragraph 1 shall not adversely affect the rights and freedoms of others.
How to exercise it
The data subject can exercise the right by sending a request to the e-mail address info@innovaenergie.com.
In order to be able to provide a positive response to the request, it is necessary to provide the information necessary for the identification of the data subject.
Before providing an answer, the Controller may need to identify the data subject, as the right can only be exercised by the data subject or by his/her delegate.
Article 21
Right to object
Description
The data subject shall have the right to object at any time to processing of personal data concerning him/her.
The controller shall no longer process the personal data unless the controller demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defence of legal claims.
Where personal data are processed for direct marketing purposes, the data subject shall have the right to object at any time to processing of personal data concerning him or her for such marketing, which includes profiling to the extent that it is related to such direct marketing.
Where the data subject objects to processing for direct marketing purposes, the personal data shall no longer be processed for such purposes.
Where personal data are processed for scientific or historical research purposes or statistical purposes pursuant to Article 89(1), the data subject, on grounds relating to his or her particular situation, shall have the right to object to processing of personal data concerning him or her, unless the processing is necessary for the performance of a task carried out for reasons of public interest.
Conditions
The right can be exercised where one of the following grounds applies:
- to reasons concerning his own personal situation,
- to processing of personal data concerning him/her which is based on point e) (processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller) or f) (processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child ) of Article 6(1), including profiling based on those provisions.
How to exercise it
The data subject can exercise the right by sending a request to the e-mail address info@innovaenergie.com.
In order to be able to provide a positive response to the request, it is necessary to provide the information necessary for the identification of the data subject.
In the context of the use of information society services and without prejudice to Directive 2002/58/EC, the data subject can exercise his right to object by automated means using specific techniques.
Before providing an answer, the Controller may need to identify the data subject, as the right can only be exercised by the data subject or by his/her delegate.
In general, for the exercise of rights, the data subject can contact the Controller by writing to the addresses listed above.
Before providing an answer, the Controller may need to identify the data subject, by requesting to provide a copy of his/her identity document.
Written feedback will be provided without undue delay and in any event within one month of receipt of the request. That period may be extended by two further months, where necessary, taking into account the complexity and number of the requests, as prescribed by the art. 12 (3) GDPR.