VAM Investments Group S.p.a.
Management of privacy compliance
Management of privacy compliance
The controller processes data of suppliers acting as processors; of employees or collaborators acting as persons authorised to process data; and of any joint controllers, independent controllers or recipients of personal data. The processing takes place within a company privacy organisational model, in order to comply with personal data protection obligations (e.g. record-keeping and accountability, allocation of roles and responsibilities, drafting of contracts and authorisation letters, etc.). The processing may also concern the handling of requests from data subjects to exercise their rights, as well as the handling and documentation of any personal data breaches. The data are recorded in cloud-based software and managed with the help of an external consultant.
Why we process the data and on what legal basis
- Organising and maintaining the company's personal data protection system (accountability).Legal basis: Legal obligation (Art. 6(1)(c) GDPR)
- Managing privacy appointments, roles and responsibilities.Legal basis: Legal obligation (Art. 6(1)(c) GDPR)
- Managing contractual relationships with processors and other parties involved in the processing.Legal basis: Legal obligation (Art. 6(1)(c) GDPR)
- Handling requests from data subjects to exercise their rights.Legal basis: Legal obligation (Art. 6(1)(c) GDPR)
- Handling and documenting personal data breaches.Legal basis: Legal obligation (Art. 6(1)(c) GDPR)
Purposes 1, 2, 3, 4 and 5 are based on compliance with the obligations laid down by Regulation (EU) 2016/679, in particular Arts. 24, 28, 30, 33, 34 and 37-39 GDPR, pursuant to Art. 6(1)(c).
Categories of data subjects
- Authorised employees and collaborators
- Suppliers appointed as processors
- Joint controllers or independent controllers involved in the processing
- Data subjects exercising their rights
Data subjects requiring greater protection: Employees
Categories of personal data
- Identification data (e.g. first name, surname, role in the company)
- Contact data (e.g. work email, company contact details)
- Contractual data (e.g. processor appointments, authorisation letters)
- Data relating to requests to exercise rights (e.g. content of the request, attached documents)
Categories of recipients
- Supervisory authorities
- Clients (data of suppliers acting as processors may be disclosed to them)
Processors
- Avv. Massimo Bacci (Privacy consultancy)
- Microsoft Ireland Ltd. (Software services)
- Hostinger International Ltd (Web hosting / cloud hosting)
Transfers to third countries
Some personal data are transferred to countries outside the European Economic Area (EEA). Below you will find, for each transfer, the party involved, the destination country and the safeguard that makes it lawful:
- Microsoft Ireland Ltd. (Software services) — United States (safeguard: EU-US Data Privacy Framework)
Microsoft has obtained certification under the EU-US DPF, which is covered by an adequacy decision of the European Commission.
Retention period
The data are retained for the time needed to demonstrate compliance (accountability) and to handle any audits/claims: generally for the duration of the relationships with the parties involved and, thereafter, for 10 years or for an appropriate period depending on the risks and the limitation periods of rights, without prejudice to longer specific obligations (e.g. documented data breaches). Employees' data are deleted from the cloud software once their role as persons authorised to process data has ended.
Consequences of not providing the data
Providing the data is necessary to comply with privacy obligations and to manage roles, appointments, requests and incidents; without them it will not be possible to ensure compliance and to manage the obligations properly. Where certain activities are based on legitimate interest (e.g. organisation and storage in the cloud), you may object within the limits of Art. 21 GDPR, unless legitimate grounds or legal obligations prevail.