Information notice pursuant to Article 13 of the European Regulation (EU) 2016/679 and consent

Pursuant to Article 13 of the European Regulation (EU) 2016/679 (hereinafter the “GDPR”), and in relation to the personal data that the company will have access to as part of the handling of your request, we provide you with the following information:

Data Controller and Data Protection Officer

The Data Controller is MASS S.r.l. (P.IVA 01363800127) REA VA 117213 – certified email address (PEC): mass-srl.va@pec.it), represented by its Legal Representative and Sole Director, Bailetti Riccardo (hereinafter also referred to as “Mass”), with registered office at Via Trento 54/A, Fraz. Caidate, 21040 Sumirago (VA), Italy.
The Data Controller can be contacted via the certified email address indicated above.

Purpose of data processing

The processing of personal data is carried out for the proper and complete execution of the services provided. Your data will also be processed for the purpose of:

• complying with tax and accounting obligations;
• fulfilling legal obligations applicable to companies under current legislation.

Personal data may be processed both by paper-based and electronic archives (including portable devices), using methods strictly necessary to achieve the purposes described above.

Legal basis for processing

Mass lawfully processes personal data where the processing:

• is necessary for the performance of the services provided, of a contract to which the user is a party, or for the execution of pre-contractual measures;
• is necessary to comply with a legal obligation to which Mass is subject;
• is based on your explicit consent, such as for the specific sending of newsletters- informational material, etc., through completion of the relevant form.

Consequences of failure to provide personal data

Failure to provide personal data prevents the completion of the relationship between the company and the website user with regard to specific requests.
The user may, however, continue browsing the website.

Data retention

Personal data processed for the purposes described above will be retained for the duration of the requested service and, subsequently, for as long as Mass is subject to legal obligations of data retention for tax or other purposes established by law or regulation, and in any case no longer than five (5) years after the termination of the relationship.

Data disclosure

Your personal data may be disclosed to:

1. consultants and accountants;
2. entities processing data in compliance with specific legal obligations;
3. judicial or administrative authorities, in order to fulfil legal requirements.

Profiling and data dissemination

Your personal data are not subject to dissemination or to any fully automated decision-making process, including profiling.

Data subject rights

Among the rights granted to you under the GDPR are the following:

• to request from Mass access to your personal data and to information relating thereto; the rectification of inaccurate data or the completion of incomplete data; the erasure of your personal data (when one of the conditions set out in Article 17, paragraph 1 of the GDPR applies and subject to the exceptions provided for in paragraph 3 of the same article); the restriction of processing of your personal data (when one of the cases set out in Article 18, paragraph 1 of the GDPR applies);
• to request and obtain from Mass – in cases where the legal basis of processing is the contract or consent, and where processing is carried out by automated means – your personal data in a structured, commonly used and machine-readable format, also for the purpose of transmitting such data to another data controller (the so-called “right to the portability of personal data”);
• to object at any time to the processing of your personal data where specific situations concerning you so arise;
• to withdraw your consent at any time, limited to cases where processing is based on your consent for one or more specific purposes and concerns common personal data (for example, date and place of birth or place of residence) or special categories of data (for example, data revealing racial origin, political opinions, religious beliefs, health status or sexual life). Processing based on consent and carried out prior to its withdrawal remains lawful;

to lodge a complaint with a supervisory authority (Autorità Garante per la protezione dei dati personali – www.garanteprivacy.it).