1. DATA CONTROLLER

The data controller, i.e. the entity responsible for decisions regarding the purposes, methods and security of personal data, is Ciancaleoni S.r.l. VAT IT 00261620546, with registered office at via della Meccanica 2/4 – 06038 – Spello (PG), Tel. 0742/301626 email: info@ciancaleoni.com, represented by its legal representative pro tempore.

 

2. JOINT CONTROLLERS – THIRD PARTY ASSIGNMENTS

In cases of joint controllership, the Controller ensures that compliance with the following principles is guaranteed through a joint controllership agreement. When personal data processing activities are outsourced to third parties, the Controller ensures that compliance with the following principles is guaranteed through a service contract.

 

3. ORGANIZATION

The Controller organizes the resources and processing of personal data in such a way that they meet the requirements set out by the GDPR and national sector regulations. Specifically:

3. 1. internally 

1. The privacy organization reflects the operational structure, with responsibilities consistent with operational tasks, powers, and the related authority.
2. Individuals assigned tasks and responsibilities of significance (taking into account the volume and categories of personal data, and the risks to the rights and freedoms of data subjects) are selected, identified, and entrusted based on objective criteria that define the organization’s needs in terms of knowledge, skills, and experience. In the absence of formal qualifications, the requirements and evaluation criteria are predefined.
3. Those processing data act under the direct authority of the Controller or a designated representative. The staff is duly trained and informed through a continuous training program that addresses the different needs related to their roles.
4. The Controller directs and supervises all those who process personal data on its behalf.

3. 2. externally

1. External entities entrusted with personal data processing activities are selected, identified, and engaged based on a proactive, transparent process that ensures an objective choice; the supplier must possess the necessary skills and expertise required by the organization; and the supplier must provide sufficient guarantees to implement adequate technical and organizational measures so that the processing complies with the GDPR and ensures the protection of the data subject’s rights.
2. All relationships with third parties processing data on behalf of the Controller are formalized in writing. The related contract meets the minimum requirements set out in Article 28 of the GDPR.
3. The Controller directs and supervises all those to whom processing activities are delegated.

4. STAKEHOLDERS
   1. The Controller processes the personal data of the following categories of individuals:

– employees

– freelancers

– users

– suppliers

4. 2. Categories of indirectly concerned subjects:

– relatives of employees or users

– creditors of employees

– parties involved in legal disputes with employees

4. 3. Interested Institutions / Entities

– trade unions

4. 4. others

 

5. PRIVACY CULTURE

For Ciancaleoni S.r.l., protecting personal data is not only a legal obligation but also a preferential requirement and a competitive asset. In line with the accountability perspective required by the GDPR, Ciancaleoni S.r.l. approaches the compliance of its personal data processing activities with a risk-based methodology. Respect for the rights, freedoms, and data of individuals is a non-negotiable ethical imperative that guides all its activities.

 

6. LAWFULNESS

Ciancaleoni S.r.l. processes personal data only on one of the legal bases provided by Article 6 of the GDPR (consent, fulfillment of contractual obligations, protection of the vital interests of the data subject or third parties, compliance with legal obligations, public interest or exercise of public authority, legitimate interest of the Controller or third parties to whom the data is disclosed).

 

Ciancaleoni S.r.l. processes special categories of personal data (i.e. data that can reveal racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, as well as genetic data, biometric data intended to uniquely identify an individual, or data concerning health, sex life, or sexual orientation) only when one of the conditions provided by Article 9.2 of the GDPR is met.

 

Ciancaleoni S.r.l. processes personal data relating to criminal convictions and offenses or related security measures only on one of the legal bases provided by Article 6.1 of the GDPR, and solely under the control of the public authority or, where processing is authorized by Union or Member State law, which provides appropriate safeguards for the rights and freedoms of the data subjects.

 

7. FAIRNESS

Ciancaleoni S.r.l. processes personal data exclusively for specific, explicit, and legitimate purposes, without resorting to unfair practices or deception, and strictly adheres to the limits set by the legal bases justifying such processing.

 

8. TRANSPARENCY

Ciancaleoni S.r.l. adopts appropriate measures to provide data subjects with all the information required by Articles 13 and 14 and the communications required by Articles 15 to 22 and Article 34, in a concise, transparent, intelligible, and easily accessible form, using clear and simple language. In particular, for each processing activity, Ciancaleoni S.r.l. informs the data subject of the methods by which personal data are collected, used, consulted, or otherwise processed, as well as the extent to which the data are or will be processed. All information and communications relating to the processing of such personal data must be easily accessible and understandable.

 

9. PURPOSE LIMITATION

Ciancaleoni S.r.l. processes personal data for specific, explicit, and legitimate purposes, ensuring that the processing is not incompatible with these purposes.

 

10. DATA MINIMIZATION

Ciancaleoni S.r.l. processes only the personal data that is adequate, relevant, and limited to what is necessary for the purposes for which it is processed.

 

11. ACCURACY

Ciancaleoni S.r.l. ensures that personal data are accurate and, where necessary, kept up-to-date; taking all reasonable measures to promptly delete or correct any inaccuracies in relation to the purposes for which they are processed.

 

12. STORAGE LIMITATION

Ciancaleoni S.r.l. retains personal data in a form that allows identification of the data subjects for no longer than necessary to achieve the purposes for which the data are processed.

 

13. INTEGRITY AND CONFIDENTIALITY

Ciancaleoni S.r.l. processes personal data in a manner that ensures adequate security through appropriate technical and organizational measures, protecting against unauthorized or unlawful processing, and against accidental loss, destruction, or damage.

 

14. DATA PROTECTION BY DESIGN AND BY DEFAULT

Ciancaleoni S.r.l. adopts a methodological approach to every project, whereby data protection is assessed from the design phase. For any project, whether structural or conceptual, data protection must be considered from the outset and solutions must be implemented to ensure the protection of personal data.

 

Ciancaleoni S.r.l. implements appropriate technical and organizational measures to ensure that, by default, only the personal data necessary for each specific processing purpose is processed; specifically, these measures aim to ensure that data is processed according to the defined purposes.

 

15. MANDATORY

Failure to comply with the principles outlined in this document, as well as any directives, instructions, requests, or orders issued by Ciancaleoni S.r.l. regarding the protection of personal data and compliance with current regulations, constitutes a serious breach.

 

16. REVISIONS

This document is prepared by the Controller, who is responsible for its updates and dissemination.