Information on the processing of personal data

The legislation in force, with particular reference to Regulation 2016/679/EU of 27 April 2016 on the protection of natural persons with regard to the processing of personal data, as well as on the free movement of such data (General Data Protection Regulation, hereinafter “GDPR”) and Legislative Decree no. 196 of 30 June 2003, as amended (hereinafter, “Privacy Code“) guarantees that the processing of personal data is carried out in compliance with the rights, fundamental freedoms, as well as the dignity of natural persons, with particular reference to confidentiality, personal identity and the right to protection of personal data, ensuring that the data are processed lawfully and fairly.

In light of the above, ASDM S.r.l., with registered office in Corso Alessandro Tassoni, 31/A – 10143 – Turin (TO), in its capacity as data controller (hereinafter also referred to as the “Data Controller” or “Company“), provides you with the following information regarding the processing of Personal Data and Special Categories of Personal Data, as defined below, collected through our https://www.toget4u.com/ website, including the reserved area and its subdomains (hereinafter, the “Site“), for the performance of the services offered by and/or to users of the Site (hereinafter, the “Services“) and, more generally, all the activities described in this Policy.

The Policy may be modified, supplemented or updated periodically, also in consideration of any changes in the applicable legislation or provisions of the Guarantor for the protection of personal data and/or the European Data Protection Board. Substantial changes and updates to the Policy will be brought to the attention of the data subjects as soon as they are adopted, by updating the link to the Privacy Policy in the footer of the Site and email communications. We therefore invite interested parties to consult this Policy regularly to know the latest updated version, so as to be always informed about the methods of collection and processing of their personal data. In the event of changes that significantly affect the rights of the registered user, the latter will be informed by e-mail and the communication will be made with reasonable notice.

1. WHAT PERSONAL DATA ABOUT YOU MAY BE PROCESSED

For the purposes of this policy, “Personal Data” or “Data” (possibly including Special Categories of data, as defined below and within the limits of what is clarified below) are to be understood as all information concerning your person, suitable for identifying you directly and/or indirectly, better described below:

• contact data, such as name, surname, address, city, telephone numbers, e-mail addresses and any other data you voluntarily provide to register on the Website (hereinafter, “Contact Data“);
• personal data, such as date of birth, gender, tax code / VAT number (hereinafter, “Personal Data“);
• data of the Services, i.e. information relating to the Services offered by you and/or requested from other users of the Site, such as the characteristics of the Services, their amounts, the geographical area of reference, any participation in promotions, the level of satisfaction with the Services themselves (hereinafter, “Service Data“);
• Skills data, such as qualifications, any specialization courses / certifications, previous experience, foreign languages and any other information required and/or necessary for the provision of the Services, including particular characteristics, including technical ones (hereinafter, the “Skills Data“);
• payment data, such as the credit/debit card and/or debit card number (limited to the data necessary to identify/track the transaction, by obscuring part of the number itself), the IBAN, including data relating to the means of payment and the related circuits used, the number and the unique billing code, the applicable tax regime (hereinafter, “Payment Data“);
• data relating to your interactions with the Company’s social profiles, within the limits and in compliance with the privacy preferences that you have set on these social networks (hereinafter, “Social Data“);
• data on the ways in which you use the Site (which pages visited, your choices regarding cookies, technical data relating to the connection, including IP addresses or domain names of the computers used to connect to the Site, the URI addresses of the resources requested, the time of the request, the method used to submit the request to the server, the size of the file obtained in response, the numerical code indicating the status of the response given by the server, etc.), including the information collected through cookies, the information of which can be consulted at the following address Cookie Policy (hereinafter, “Usage Data“);
• in the event of your specific consent, data processed to evaluate certain personal aspects concerning you, in particular to offer a personalized experience in the use of the Site’s features, through the processing, analysis, comparison, combination and/or any other processing of your Contact Data, Master Data, Service Data, Skill Data, Payment Data, Usage Data (hereinafter, “Profiling Data“);
• data relating to your image, where provided by you voluntarily, and in any case in such a way as not to allow your identification exclusively through the image itself (hereinafter, “Data relating to the Image“).

The Data processed by the Company will not, as a rule, concern personal beliefs, racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, information relating to health or sex life or sexual orientation (hereinafter “Special Categories of Data“) and/or data relating to any criminal convictions and/or offences you may have committed. as shown in criminal record certificates and/or other appropriate documents (hereinafter referred to as “Criminal Conviction and Offence Data“). In the event that it is necessary to process Special Categories of Data and/or Data relating to Criminal Convictions and Offences, the Company undertakes to process such data in accordance with the applicable legislation.

2. FOR WHAT PURPOSES MAY YOUR PERSONAL DATA BE USED AND ON WHAT BASIS OF LAWFULNESS

The Data will be processed for the following purposes:

a. Access to the Site and possible account registration.

Your Personal Data, Contact Data and Usage Data will be processed by the Company to allow you to access the Site, complete any registration procedure, as well as to allow you to manage your personal account , in particular to modify such data, as well as – where provided – Skill Data, Payment Data, Image Data, as well as to display the list of Services offered and/or requested, as well as to allow you to access the pages and functions reserved for registered users only.

Prerequisite for processing: execution of pre-contractual/contractual measures (art. 6, par. I, lett. b), GDPR). The provision of Personal Data and Contact Data for this purpose is optional in the event of simple access to the Site for consultation (so-called “Cookie Policy”). “guest”), without registering; in the event of registration, the provision of Personal Data, Contact Data and Payment Data is mandatory, since in the event of failure to provide the same, it will not be possible to complete the registration, nor allow you to access the pages of the Site and the functions reserved for registered users, nor perform the economic services implied by the provision of the Services. For the rest, the provision of Usage Data for this purpose is mandatory, as it is intrinsically connected with access to the Site itself (and the nature and quality of the Usage Data depends on your choices regarding cookies, as better described in the Cookie Policy. Finally, the provision of Skill Data and Image Data for this purpose is optional, but failing this we may not have sufficient information to verify your suitability for the provision of Services and/or to identify you, where necessary for the provision of the Services themselves.

b. Use of Site Features.

Your Master Data, Contact Data, Service Data, Usage Data and Payment Data will be processed by the Company to allow you to use the features of the Site and, in particular, to allow you to provide/request Services to other users of the Site and execute the related contracts. In addition, if required by the specific object of the Services, in order to provide the Services, the Company may also request to process Skill Data and/or Image Data.

Finally, in the event of consent given pursuant to point 2.e below, the Company will process the Profiling Data to offer a personalized experience in the use of the Site’s features.

Prerequisite for processing: execution of pre-contractual/contractual measures (art. 6, par. I, lett. b), GDPR). The provision of Personal Data, Contact Data, Service Data and Payment Data is mandatory, since failure to provide them will not allow you to use the relevant functions of the Site. For the rest, the provision of Usage Data for this purpose is mandatory, as it is intrinsically connected with access to the Site itself (and the nature and quality of the Usage Data depends on your choices regarding cookies, as better described in the Cookie Policy. The provision of Skill Data and Image Data is optional, but failing this we may not have sufficient information to verify your suitability for the provision of Services and/or to identify you, where necessary for the provision of the Services. Finally, the provision of Profiling Data is also optional, however in the absence of this it will not be possible for the Company to offer a personalized experience in the use of the functions of the Site.

c. Support in the Management of the Site and/or Services.

Your Personal Data, Contact Data, Service Data, Payment Data will be processed by the Company for all purposes related to the management of the Site and/or Services, such as receiving any reports and/or requests for information and/or support relating to the functions of the Site and/or Services, the management of related payments, the sending of any other communication relating to the Services and/or the use of the functions of the Site, including the notification of the possible need to complete the compilation of your user profile for the provision of one or more Services.

Prerequisite for processing: execution of pre-contractual/contractual measures (art. 6, par. I, lett. b), GDPR). In this case, you are not required to provide new and specific data, since the Company will pursue this additional purpose, where necessary, processing data already collected for the pursuit of other purposes, deemed compatible with this (also due to the context in which such data were collected, the relationship between you and the Company, the nature of the data themselves and the adequate guarantees for their processing, as well as the link between the above purposes and this additional purpose).

d. Profiling activities.

Subject to your specific and express consent, the Company may use your Personal Data, Contact Data, Service Data, Skill Data and Payment Data for profiling purposes, including, but not limited to, processing Profiling Data and/or data relating to your choices, habits and preferences, the geographical area of reference, the functions of the Site used, the Services requested/provided, the relative amounts, the frequency of use to carry out market studies and statistical analyses and/or for the creation of profiles (individual and/or aggregated), to customize your experience in using the functions of the Site, as described in point 2.b above.

Prerequisite for processing: consent of the data subject (art. 6, par. I, lett. a), GDPR). Failure to provide consent for profiling purposes does not have consequences on contractual relationships. Consent can be revoked at any time by means of the contacts indicated below, in section 7) of the Policy. In addition, you may – also in this case, at any time – modify or enrich your choices regarding consent in the appropriate area dedicated to your preferences regarding the processing of personal data, in the manner described in point 7 of this policy.

In this case, you are not required to provide new and specific data, since the Company will pursue this additional purpose, where necessary, processing data already collected for the pursuit of other purposes, deemed compatible with this (also due to the context in which such data were collected, the relationship between you and the Company, the nature of the data themselves and the adequate guarantees for their processing, as well as the link between the above purposes and this additional purpose).

e. Marketing activities.

Subject to your specific and express consent, your Contact Data may be processed by the Company for the purpose of sending promotional/advertising material, including products and/or services of partners of the Company itself, or for the performance of market research or commercial communication (including personalized, in which case we will also process your Profiling Data, in the case of consent given pursuant to point 2.d) above, through the use of e-mail, text messages and other bulk messaging tools, etc., including social network platforms.

Prerequisite for processing: consent of the data subject (art. 6, par. I, lett. a), GDPR). Failure to provide consent for marketing purposes, by the Company and/or third parties, does not have consequences on relations with the Company itself. Consent can be revoked at any time by means of the contacts indicated below, in section 7) of the Policy. In addition, you may – also in this case, at any time – modify or enrich your choices regarding consent in the appropriate area dedicated to your preferences regarding the processing of personal data and, in addition, exercise the right to object to the processing of data concerning you for direct marketing purposes, including profiling to the extent that it is related to such direct marketing, in the manner described in point 7 of this policy.

In this case, you are not required to provide new and specific data, since this additional purpose will be pursued by processing data already collected for the pursuit of other purposes, deemed compatible with this (also due to the context in which such data were collected, the relationship between you and the Company, the nature of the data themselves and the adequate guarantees for their processing, as well as the link between the above purposes and this additional purpose).

f. Purposes related to the need to protect the rights, including those of the data subject.

Your Data will be processed by the Company to protect its rights, including with respect to any requests, or to take legal action, including by making claims against you or third parties, as well as to be able to prove that it has provided feedback to any requests to exercise one or more rights of the data subject, described in detail below in point 7) of this policy.

Prerequisite for processing: legitimate interest of the Company in the protection of its rights (Article 6, paragraph I, letter f), GDPR). In this case, you are not required to provide new and specific data, since the Company will pursue this additional purpose, where necessary, processing data already collected for the pursuit of other purposes, deemed compatible with this (also due to the context in which such data were collected, the relationship between you and the Company, the nature of the data themselves and the adequate guarantees for their processing, as well as the link between the above purposes and this additional purpose).

g. Fulfilling legally binding requests to comply with legal obligations, regulations or measures/requests from competent authorities, including supervisory authorities.

Your Data may be processed to comply with a legal obligation and/or measures/requests from competent authorities, including supervisory authorities.

Prerequisite for processing: legal obligations, to which the Company is subject (art. 6, par. I, lett. c, GDPR). In this case, you are not required to provide new and specific data, since the Company will pursue this additional purpose, where necessary, processing data already collected for the pursuit of other purposes, deemed compatible with this (also due to the context in which such data were collected, the relationship between you and the Company, the nature of the data themselves and the adequate guarantees for their processing, as well as the link between the above purposes and this additional purpose).

h. Dissemination, advertising and promotional purposes.

The Data Controller will process the Personal Data, the Data relating to the Image and the Data relating to the Voice, only in the event of the signing by the Owner of a specific agreement/release (hereinafter, the “Release“), for the publication and/or dissemination in any form of audio/video content (e.g., on the Site, on printed paper – including internal brochures, brochures and magazines – and/or on any other means of dissemination, including social networks and/or similar platforms), for purposes of dissemination, advertising and promotion of its activities and for their archiving, including in search engines.

Prerequisite for processing: execution of contractual measures, provided for in the Disclaimer (art. 6, par. I, lett. b), GDPR). The provision of Data is mandatory, as it is necessary for the stipulation and execution of the Release, and failure to provide the same will make it impossible to execute the Release itself.

3. FROM WHICH SOURCES MAY DATA BE COLLECTED AND HOW

The Data may be collected by the Data Controller directly from you, through the provision of the same by you.

In particular, the Company may collect Data through:

a. your use of the Website and/or the Social pages owned or available to the Company;

b. the performance of contracts relating to Services;

c. the Customer Support service, if it is used.

The Data may be updated and/or supplemented on the basis of publicly available information and/or collected from third parties, and/or directly from you.

4. HOW WE KEEP YOUR PERSONAL DATA SECURE AND FOR HOW LONG

The processing of your Data will be based on the principles of correctness, lawfulness and transparency and may also be carried out through automated methods .

The processing will in any case take place using tools suitable for guaranteeing confidentiality through the use of procedures suitable for avoiding the risk of loss, unauthorized access, unlawful use and dissemination, as well as the use of security measures appropriate to the risk. We limit access to your Data to only those who need to use it for relevant purposes.

We keep your Data only for the time strictly necessary to achieve the purposes for which they were collected or for any other related legitimate purpose. Therefore, if the Data is processed for two different purposes, we will retain such Data until the purpose with the longer term ceases; however, we will no longer process the Data for that purpose for which the retention period has expired. Data that is no longer required, or for which there is no longer a legal basis for its storage, is irreversibly anonymized (and thus can be stored) or securely destroyed.

Below are the storage times in relation to the different purposes listed above:

a. Access to the Site and possible account registration.

The data processed for the pursuit of this purpose will be stored for the period necessary for the finalization of the registration and for the entire duration of the same; subsequently, for a period of time not exceeding ten years from the date of the last service provided to the user or, in the event of inaction, ten years from the last access to the account, in accordance with the terms of the statute of limitations provided for by the Civil Code.

If you have limited yourself to accessing the Site, without registering, the Usage Data will be stored in pseudonymous form for six months, in line with the retention times provided for the logs relating to the accesses of the System Administrators, except for different retention periods indicated in the cookie policy (Cookie Policy).

b. Use of Site Features.

The data processed for the pursuit of this purpose will be stored for the entire period of use of the account functions and, subsequently, for a period of time not exceeding ten years from the date of the last service provided to the user or, in the event of inaction, ten years from the last access to the account, in accordance with the statute of limitations provided for by the Civil Code.

c. Management of the Site’s features.

The data processed for the pursuit of this purpose will be stored for a period of time not exceeding ten years from the date of the individual communications relating to reports and/or requests for information and/or support and/or complaints relating to specific payments, in line with the statute of limitations provided for by the Civil Code.

d. Profiling activities.

The data processed for the pursuit of this purpose will be stored for a period of time not exceeding one year from your last expression of will, without prejudice to your possibility of revocation in the manner provided for in point 7 of this policy.

e. Marketing activities.

The data processed for the pursuit of this purpose will be stored for two years from their registration, without prejudice to your possibility of revocation of consent and the right to exercise the right to object in the manner provided for in point 7 of this policy.

f. Purposes related to the need to protect the rights, including those of the data subject.

The data processed for the pursuit of this purpose will be stored for the entire duration of the relevant procedures, and in any case for the time deemed reasonably necessary by the Company for the protection of its rights, also in relation to the relevant statute of limitations.

With particular reference to the data stored to provide proof of feedback to the data subject, such Data will be stored for a period of ten years from the last request of the data subject, or from the last communication interrupting the statute of limitations, in line with the statute of limitations provided for by the Civil Code.

g. Fulfilment of legally binding requests to comply with legal obligations, regulations or relevant authority orders/requests.

The data processed for the pursuit of this purpose will be stored for the entire duration of the proceedings at the relevant competent authorities, in addition to the related limitation periods.

h. Dissemination, advertising and promotional purposes.

The Data processed for the pursuit of this purpose will be stored for a period of time not exceeding five years from the termination of the Release, in line with the prescribed times provided for by the Civil Code.

5. WHO WE MAY SHARE YOUR PERSONAL DATA WITH

The Data may be accessed by persons duly authorised and instructed by the Company.

In particular, for the performance of some of the Data processing activities, the Company may communicate the same to the following categories of external subjects, who will process such Data as independent data controllers or as data processors, duly designated by the Company in accordance with current legislation (depending on the role they play in relation to the processing):

• consultants and external providers such as cloud service providers, IT providers or hosting providers;
• professional firms, especially where necessary for the protection of the Company’s rights;
• other users of the Site, where necessary to perform the Services and related contracts;
• banks and credit institutions;
• payment intermediaries;
• insurance companies;
• police forces, and other public administrations, in fulfillment of obligations provided for by laws, regulations or applicable legislation.

In any case, your Data will never be transferred to third parties for the pursuit of marketing purposes. Any access to your Data is limited to those persons who need to know it in order to fulfil their professional responsibilities, by means of a letter of authorisation.

You may contact the Company in the manner provided in the “Contacts” paragraph if you wish to request to be able to view the list of data processors and other subjects to whom we communicate the Data.

6. INTERNATIONAL TRANSFERS

We may need to transfer your Data to countries outside the European Economic Area (EEA) (hereinafter the “Third Countries“) whose Data protection laws may have different standards than those of the EEA. In the latter case, the Company will ensure that all of its Data accessible outside the EEA is treated with appropriate safeguards.

In this case, the Company will provide adequate guarantees and safeguards for such cross-border transfers, in accordance with the provisions of the legislation on the protection of personal data; these include the use of Standard Contractual Clauses approved by the European Commission, Codes of Conduct and/or Binding Corporate Rules. Such clauses impose similar data protection obligations directly on the recipient, unless it is permitted by applicable data protection law to transfer the data without such formalities.

Some Third Countries, identified in the appropriate list available on the European Commission’s website, have been deemed adequate by the European Commission itself, as they provide protection similar to that of EEA data protection law, and therefore no additional legal safeguards are required for these countries.

Currently, for specific needs related to the data processing described in this policy, the Company also makes use of suppliers, included in the categories of subjects referred to in point 5., located in third countries that do not belong to the European Economic Area. In particular, the Company may need to transfer your Data:

• in the United States, especially with regard to processing involving Microsoft and/or Google, under the conditions set out in the Adequacy Decision of 10 July 2023 as amended, pursuant to art. 45 GDPR;

Without prejudice to the above, if a transfer to other Third Countries is necessary, the Company will take care to specify in advance the Third Country of destination as well as the specific instrument adopted for the transfer of Data to that Country.

7. YOUR DATA PROTECTION RIGHTS AND YOUR RIGHT TO LODGE A COMPLAINT WITH A SUPERVISORY AUTHORITY

You have the right to ask the Company, in compliance with the conditions set out in the GDPR:

• access to the Data concerning you, as well as their correction;
• the deletion of Data;
• the limitation of processing;
• within the limits of the Data processed for contractual purposes and/or on the basis of your consent, and processed by automated means, the receipt of such Data in a structured, commonly used and machine-readable format (portability) and/or the transmission of the same to another data controller (so-called “data controller”). “portability“);
• the withdrawal of your consent, in the event that the processing is based on consent, without prejudice to the lawfulness of the processing based on consent before the withdrawal.

To exercise your rights, you may contact the Company at the following address: [Company’s privacy email ].

Right to object: You have the right to object at any time, for reasons related to your particular situation, to the processing of Data by the Company for the pursuit of its legitimate interest, for the purposes referred to above under 2.f. The request for opposition must be addressed to the following address: [Company’s privacy e-mail ].

The exercise of the rights of the data subject is subject to certain exceptions, in particular aimed at safeguarding the public interest (e.g. the prevention or identification of crimes) and/or the protection of the rights of the Company. In the event that you exercise any of the aforementioned rights, it will be the responsibility of the Company to verify that you are entitled to exercise it and you will be acknowledged, as a rule, within one month.

The Company will take strict consideration of any complaints or reports about how we process your personal data and will make every effort to respond to your requests. In addition, you may forward complaints or reports to the competent Supervisory Authority, i.e. the Guarantor for the protection of personal data (using the references available on the www.gpdp.it website), or refer the appropriate courts.

8. CONTACT

The contact details of the Company, as data controller, are as follows: info@toget4u.com.