This privacy notice is provided in accordance with and for the purposes of Article 13 of EU Regulation 2016/679 of April 27, 2016 (“GDPR”) and in compliance with local regulations on processing of personal data (hereinafter, jointly, “Privacy Laws”) by NEAT s.r.l.
NEAT intends to provide users (“User(s)”) who contact NEAT to request information through the contact forms available on the website www.design4rail.it or www.neat.it (the “Website”) with some information about their personal data, voluntarily provided through the contact form, and on the consequent processing of the same by NEAT.
The processing of data by the NEAT will be based on the principles of correctness, lawfulness, relevance, transparency and will be carried out while protecting the confidentiality and rights of the Users, in compliance with the Privacy Laws.
1. Data controller
The data controller of the personal data provided through the contact form on the Website is the NEAT company.
2. Types of data processed and categories of data subjects
The following personal data may be processed for the purposes indicated in the subsequent paragraph:
– personal identification data (name, surname, company);
– contact details (e-mail address, phone number);
– other information included in the message.
The personal data belong to the following categories of data subjects: Users who contact NEAT to request information through the contact forms available on the Website.
3. Purposes of the data processing and related legal basis
Users’ personal data will be processed by NEAT for the following purposes:
a) to reply to Users’ requests that may be received by NEAT through the contacts form of the Website. The legal basis of this processing activity is Article 6 paragraph 1, letter (b) of the GDPR, i.e., to execute pre-contractual and/or contractual measures;
a) to send communications and/or updates on NEAT’s activities, invitations to events, initiatives, webinars, promotional communications by e-mail. The legal basis of this processing activity is Article 6 paragraph 1, letter (a) of the GDPR, i.e. the User’s consent.
The processing of the Users’ personal data will be carried out only to the extent strictly necessary to achieve the above-mentioned purposes and, in any case, in compliance with the Privacy Laws.
The provision of personal data by User for the purpose specified in point a) is not mandatory, but it is essential and indispensable for the management of the User’s request by NEAT; hence, any refusal to provide the data may result in the impossibility for NEAT to respond to the User’s requests and for User to obtain the information requested.
The provision of personal data by User for the purpose mentioned in point b) is optional. Any refusal to provide the data will not prejudice in any way the possibility for User to obtain the information requested.
4. Data processing methods
The processing of personal data is carried out using manual, computerized, and telematic tools, solely for the purposes for which they were collected and, in any case, in a manner that ensures their security and confidentiality. The databases are kept in secure environments, access to which is controlled and in compliance with applicable legal provisions.
5. Categories of subjects to whom the data may be disclosed
The personal data provided will be processed by employees and collaborators of NEAT duly authorized, based on the roles and job duties performed by each of them, and/or by third parties duly appointed as data processors. These subjects are authorized to process the personal data within the limits of their competencies and in accordance with the instructions provided to them by the Controller.
6. Data Retention
NEAT will store the personal data for a period not exceeding the fulfilment of the purposes for which they were collected. Specifically:
a) with reference to purpose a) (i.e. reply to the User’s request), the personal data will be processed only for the time necessary to handle the User’s request;
b) with reference to purpose b) (i.e. for marketing purpose), the personal data will be processed for 24 months from the User’s consent.
7. Transfer of data abroad
Within the purposes described in this privacy notice, the data provided by the User will not be processed by companies, bodies or international organizations with headquarters in countries located outside the territory of the European Economic Area (EEA).
8. Rights of data subjects
NEAT informs Users that, in relation to the aforementioned processing activities, they have the rights provided for in Articles 15 and following of the GDPR. In particular, User has the right to:
1. access their personal data: in particular, the data subject has the the right to obtain confirmation from the Controller as to whether or not personal data concerning them is being processed and, if so, to access the personal data and obtain further information about their origin, the categories of data processed, the purposes of the processing, the methods of processing, the recipients of data, the data retention period, transfers of data if any, etc.;
2. obtain the rectification of inaccurate personal data without undue delay, as well as the completion of incomplete personal data by providing a supplementary statement;
3. obtain the erasure of personal data without undue delay in cases where:
a)the personal data is no longer necessary for the purposes of the processing;
b)the consent on which the processing is based has been withdrawn and there is no other legal ground for the processing;
c)the personal data has been unlawfully processed;
d)the personal data must be erased to comply with a legal obligation;
4. obtain the restriction of processing in cases where the accuracy of the personal data is contested (for a period necessary for the data controller to verify the accuracy of such data), the processing is unlawful, and/or the data subject has objected to the processing;
5. where applicable, object at any time to the processing of personal data based on the legitimate interests pursued by the Controller;
6. receive the personal data, in a structured, commonly used, and machine-readable format, and transmit these data to another data controller, where the processing is based on consent or a contract and is carried out by automated means (the right to data portability);
7. where applicable, withdraw consent at any time, if the processing of personal data is based on this legal basis, without affecting the lawfulness of the processing carried out prior to the withdrawal.
8. lodge a complaint with a supervisory authority: without prejudice to any other administrative or judicial remedy, the data subject who considers that the processing of their personal data violates the Privacy Laws has the right to lodge a complaint with the supervisory authority of the member state where they reside or work, or where the alleged violation occurred.
If the data subject wishes to obtain further information regarding the processing of their personal data or exercise the aforementioned rights, they can submit a written request to NEAT to the email address info@neat.it