PRIVACY NOTICE PURSUANT TO ARTICLE 13 OF THE GDPR
Pursuant to Article 13 of the General Data Protection Regulation (GDPR 2016/679), the Client (hereinafter referred to as the "data subject") is hereby informed that:
Data Controller and other designated parties
The Data Controller is Il Ponte - Casa D'aste S.r.l., with its registered office in Milan, Via Pontaccio No. 12, represented by its Managing Director, Ms. Rossella Novarini, e-mail: direzione.generale@ponteonline.com. For the purpose of exercising the rights of the data subject, you may contact Ms. Francesca Conte, e-mail: francesca.conte@ponteonline.com.
The appointed Data Protection Officer (DPO) is Programmastudio Spa, represented by Mr. Pasquale Iannone.
Tel. +39 02 2829389, e-mail: privacy@programmastudio.it.
Processing activities and legal basis
The personal data, freely provided by the Client to the Company in connection with its business activities under the relevant contractual arrangements, shall be processed lawfully, fairly and in accordance with the GDPR for the following purposes:
performance of the consignment agreement and/or registration to participate in scheduled auctions;
compliance with the applicable anti-money laundering legislation (Italian Legislative Decree No. 231/2007, as amended).
The provision of the above-mentioned data is mandatory in order for the Data Controller to perform the services entrusted to it. Failure to provide the requested data will prevent the Data Controller from fulfilling its contractual obligations due to reasons attributable to the Client.
Personal data, such as the e-mail address, voluntarily provided by the Client to the Company on the basis of the Client's explicit consent, shall be processed lawfully and fairly, in accordance with the GDPR, for the purpose of sending information, updates and news regarding upcoming auctions and/or future events.
For this processing activity, the Company shall collect the data subject's consent by electronic and/or paper-based means.
Images may be recorded through a video surveillance system, as indicated by the relevant notices displayed on the premises, on the basis of the Data Controller's legitimate interest, namely to ensure the safety of individuals and the protection of the Company's assets.
Processing methods and data retention
The processed data (which may consist of personal identification data) are kept accurate, complete, relevant and not excessive in relation to the purposes of the processing described above.
Such data shall be processed in compliance with the required standards of security and confidentiality through the following methods: collection of data directly from the data subject, recording and storage for the specified, explicit and legitimate purposes. The data will be processed both in paper format and by electronic and automated means.
Personal data shall be processed by the Data Controller as well as by employees and collaborators who have been duly authorized to carry out such processing.
The data may be disclosed, in addition to the public authorities receiving the communications/declarations relating to this contractual relationship, to supervisory and inspection authorities where required in connection with audits and compliance checks concerning the fulfilment of legal obligations.
The data covered by this Privacy Notice may also be disclosed to professionals and/or collaborators engaged by the Data Controller for the performance of the services entrusted to it and for the same purposes. Such data shall not be disseminated beyond the limits specified herein, unless otherwise authorized in writing by the data subject.
The Data Controller does not intend to transfer the data covered by this Privacy Notice to a third country or to an international organization. Please note that external backup services are also provided by an Italian company, which is likewise subject to the applicable data protection legislation, through servers located within Italy.
No automated decision-making process is carried out.
Finally, the data subject is informed that the Data Controller has implemented a wide range of security measures to protect personal data against the risk of loss, misuse or alteration.
Data retention period
The data covered by this Privacy Notice shall be retained as follows:
- for 10 years (ten years) from the termination of the contractual relationship, for processing activities based on contractual obligations;
- for 5 years from the withdrawal of consent, for processing activities based on consent;
- for no longer than 72 hours, with regard to images recorded through the video surveillance system.
Rights of the data subject
The data subject has the right:
to obtain confirmation from the Data Controller as to whether or not personal data concerning him or her are being processed, even if not yet recorded, and to receive such data in an intelligible form. The data subject also has the right to access personal data, request that such data be updated or completed, rectified or erased, anonymized or blocked where processed in breach of the applicable legislation, request restriction of processing or object to the processing, as well as the right to data portability. The data subject also has the right to obtain information regarding the origin of the personal data, the purposes and methods of processing, and the logic applied where processing is carried out by electronic means;
to object, in whole or in part, to the processing of personal data for the purposes of direct marketing, advertising materials, direct sales, market research or commercial communications;
to withdraw consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal, and to lodge a complaint with a supervisory authority.