PRIVACY NOTICE PURSUANT TO ARTICLE 13 OF EU REGULATION 2016/679

This privacy policy is based upon Articles 13 and 14 of EU Regulation 2016/679.

Users who register for conferences and/or any other service provided by the data controller must authorise the personal data processing in accordance with art. 6 of the regulation.

Personal data controller

QOL-ONE Association, Via Torrente Carrò e Quattrone, 8C, Pellaro – Reggio Calabria 

Controller’s email address: amministrazione.qolone@gmail.com

Data Protection Officer (DPO)

Pietro Caridi: privacy@qol-one.org

Types of data collected

The types of personal data collected by QOL-ONE are: first name, surname, residential address, tax code, VAT number, telephone number, email, place and date of birth, education, profession, medical register reference number, body of affiliation and type of contract. Personal data are voluntarily provided by the user, but consent to processing is mandatory.

Unless otherwise specified, all requested data are mandatory. If the user refuses to provide them, we may be unable to provide the service. In cases where the application indicates certain data as optional, users are free to refrain from communicating such data, without this having any consequence on the availability of the service or its operation.

Method and place for the processing of the collected data

Method of data processing

The controller adopts all the appropriate security measures to prevent unauthorised access, disclosure, modification or destruction of personal data.

The processing is carried out using computer and/or telematic instruments, with organisational methods and logics strictly related to the purposes indicated. In some cases, in addition to the controller, other subjects involved in the organisation (administrative staff) or external subjects (such as third party technical service providers, postal couriers, conference organisers, IT companies, communication agencies) may have access to the data, and can be appointed as data processors by the controller, if needed. An updated list of data processors can always be requested from the controller.

Place of data processing

The data are processed at the controller’s operational headquarters and in any other place where the parties involved in the processing are located. For further information, please contact the controller.

The user’s personal data may be transferred to a country other than the one where the user is located. For further information on the location of the processing, the user may refer to the section on personal data processing details.

In case of higher protection, the user is entitled to obtain information about the legal basis for the transfer of data outside the European Union or to an international organisation under public international law or consisting of two or more countries, such as the UN, as well as about the security measures taken by the controller to protect the data.

Should one of the transfers just described take place, the user may refer to the respective sections of this document or request information from the controller by contacting him at the abovementioned contact details.

Legal basis of the processing

The legal basis of the processing is the consent of the user.

The controller can process the user’s personal data if one of the following conditions is met:

• the user has given consent for one or more specific purposes. Note that, in some jurisdictions, the controller may be authorised to process personal data without the user’s consent or another of the legal bases specified below, until the user objects (‘opts-out’) to such processing. However, this does not apply if the processing of personal data is governed by the European legislation on the protection of personal data;
• the processing is necessary for the performance of a contract with the user and/or the performance of pre-contractual measures;
• the processing is necessary for the performance of a legal obligation to which the controller is subject;
• the processing is necessary for the performance of a task carried out in the public interest or in the exercise of public powers assigned to the controller;
• the processing is necessary for pursuing the legitimate interest of the controller or third parties.

However, it is always possible to ask the controller to clarify the actual legal basis of each processing, and in particular to specify whether the processing is based on law, required by a contract or necessary to formalise a contract.

Storage period

Data are processed and stored for the time required by the purposes for which they were collected.

Therefore:

• personal data collected for purposes related to the performance of a contract between the controller and the user will be retained until the performance of such contract is completed;
• personal data collected for purposes related to the legitimate interest of the controller will be retained until such interest is satisfied. The user may obtain further information regarding the legitimate interest pursued by the controller in the relevant sections of this document or by contacting the controller.

When the processing is based on the user’s consent, the data controller may keep the personal data longer, until such consent is revoked. Moreover, the controller may be obliged to keep the personal data for a longer period in compliance with a legal obligation or by order of an authority.

At the end of the storage period the personal data will be deleted. Therefore, at the end of this period, the right of access and the right to erasure, rectification and data portability can no longer be exercised.

Purpose of the collected data processing

The user’s data are collected to enable the data controller to provide its services, as well as for the following purposes: contact management and messaging, contacting the user, statistics, conference registration.

To obtain further detailed information on the purposes of the processing and which personal data are relevant for each purpose, the user may refer to the relevant sections of this document.

User rights

Users may exercise certain rights with respect to the data processed by the controller.

In case of higher protection, the user may exercise all the rights listed below. In any other case, the user may contact the controller to find out which rights apply in his/her case and how to exercise them.

In particular, the user has the right to:

• revoke consent at any time. The user may revoke the previously expressed consent to the processing of his or her personal data;
• object to the data processing. The user may object to the processing of his or her data when the processing is done on a legal basis other than consent. Further details on the right to object are set out in the section below;
• access to data. The user has the right to obtain information on the data processed by the controller and on certain aspects of the processing, and to receive a copy of the data processed;
• verify and request rectification. The user may verify the correctness of his or her data and request that they be updated or rectified;
• obtain the restriction of data processing. When certain conditions are met, the user may request the restriction of the processing of his/her data. In this case, the data controller will not process the data for any purpose other than their storage;
• obtain the deletion or removal of personal data. When certain conditions are met, the user may request the deletion of his/her data by the data controller;
• receive his or her data or have them transferred to another data controller. The user has the right to receive his or her personal data in a structured, commonly used and machine-readable format and, where technically feasible, to have them transferred without hindrance to another data controller. This provision is applicable when the data are processed by automated means and the processing is based on the user’s consent, on a contract to which the user is a party, or on contractual measures related thereto;
• lodge a complaint. The user may lodge a complaint with the competent data protection supervisory authority or take legal action.

More details on the right to object

When personal data are processed in the public interest, in the exercise of public powers assigned to the controller or in pursuit of a legitimate interest of the controller, users have the right to object to the processing for reasons related to their particular situation.

Users are reminded that if their data are processed for direct marketing purposes, they may object to the processing without giving any reason. To find out whether the controller processes their data for direct marketing purposes, users may refer to the relevant sections of this document.

How to exercise user rights

To exercise their rights, users may address a request to the controller’s contact details indicated in this document. Requests are filed free of charge and processed by the controller as soon as possible, in any case within one month.

Applicability of the higher level of protection

While most of the provisions of this document apply to all users, some are expressly subject to the applicability of a higher level of protection to personal data processing.

Said level of protection is always guaranteed when the processing:

• is carried out by a data controller established in the EU; or
• concerns personal data of users located in the EU and is functional to the offering of goods or services either for payment or for free to such users; or
• concerns personal data of users located in the EU and allows the controller to monitor the behaviour of such users, providing that such behaviour takes place within the EU.

More about the processing

Legal defence

The user’s personal data may be used by the data controller in legal proceedings or in the preparatory phases of such proceedings in case of misuse of this application or related services by the user.

The user declares that he/she is aware that the data controller may be obliged to disclose the data by order of public authorities.

Specific information

If requested by the user, in addition to the information contained in this privacy policy, this application may provide him/her with additional and contextual information regarding specific services, or the collection and processing of personal data.

System logs and maintenance

For operation and maintenance purposes, this application and any third party services used by it may collect system logs, i.e. files that record interactions and that may also contain personal data such as the user IP address.

Information not contained in this policy

More information concerning the personal data processing may be requested at any time from the data controller via the contact details we provided above.

Changes to this privacy policy

The data controller reserves the right to make changes to this privacy policy at any time by informing the users on this page and, if possible, on this application, and also, if technically and legally feasible, by sending a notification to users through one of the contact details held. Users are therefore invited to visit this page regularly and check the date it was last modified, shown at the bottom of the page.

Should said changes affect processing whose legal basis is consent, the data controller will collect the user’s consent again, if necessary.