Information about the processing of personal data

According to Article 13 of the EU General Data Protection Regulation 2016/679 ("GDPR" or "Regulation"), and in general in accordance with the principle of transparency foreseen in the same Regulation, we provide the following information regarding the processing of personal data.

1. DATA CONTROLLER
The data controller (i.e. the person who determines the purpose and means of processing of personal data) is Fondazione Edmund Mach di San Michele all’Adige, based in Via E. Mach, 1 38010 S. Michele all'Adige (TN), VAT code 02038410227, telephone 0461615301, e-mail direzione.generale@fmach.it, PEC direzione.generale@pec.iasma.it.
For contacts specifically relating to the protection of personal data, including the exercise of the rights referred to in the following paragraph 9, we indicate in particular the e-mail address privacy@fmach to which you may address any requests.

2. CONTACT DETAILS OF THE DATA PROTECTION OFFICER
We inform you that the data controller has designated the person responsible for the protection of personal data under Art. 37 of the Regulation (Data Protection Officer – "DPO"), which is contactable through the following channels: address Via E. Mach, 1 38010 S. Michele all’Adige (TN), e-mail dpo@fmach.it.

3. PURPOSE OF PROCESSING
The processing of your personal data is carried out in the context of your working relationship with the data controller and is aimed at the fulfilment of this relationship. In particular, the processing will have the following purposes:

1. Manage your presence in the structures of the Foundation and all related obligations, for a statistical evaluation of the attendees and for the verification of compliance with national and European regulations (eg numerical limits of trainees at the same time present at the place of training, visa permit, etc.);
2. Complete the attendance procedure, with relative communications to proposing or sending parties and mandatory communications (eg UNILAV communications, social security bodies, etc.);
3. Allow the experience to be carried out at the Foundation, with access to the facilities, laboratories, camps, outlying offices and the company canteen;
4. Processing, settlement and payment of salary or “participation indemnity” (indennità di partecipazione) if foreseen in the attendance at Fondazione, emoluments, payables and related accounting;
5. Fulfilment of obligations arising out of laws, contracts, pension regulations and also supplementary and complementary assistance, regulations about hygiene and safety at work and in the field of taxation, etc.;
6. Protection of legal claims.

4. TYPES OF PROCESSED DATA
The following data categories may be processed for the requirements related to the management of the attendance in Fondazione:

1. Personal and general data, address and other contact details, tax code and any other necessary information also in relation to your social security and contributory status;
2. Data suitable for the acquisition of knowledge, skills, abilities and competencies in the training and professional fields;
3. Data capable of detecting the state of health, collected in connection with certifications of illness, accident, maternity, occupational illness, exposure to risk factors, belonging to protected categories, ability to carry out certain tasks, health monitoring under the workplace safety rules.
4. Data capable of detecting political opinions or union and associative memberships, deriving from the use of permits or leave of absence recognized by laws or contracts, activities or union assignments, exercise of public functions, management of deductions o counts for the payment of associative or trade union or political dues, destination of sums to parties, associations, foundations, etc.;
5. Data capable of detecting religious or philosophical beliefs or membership to organizations of a religious or philosophical nature, such as the use of permits and holidays having such a character, the destination of sums or shares of income to those organizations, etc.;
6. Data of a judicial nature, in particular cases that will be indicated to you in case of processing of such data, in order to guarantee, among other things, the respect and to prevent the offences mentioned in D. Lgs. No. 231/2001.dati di natura giudiziaria, in casi particolari che Le verranno indicati in caso di trattamento degli stessi, al fine di garantire tra l’altro il rispetto e di prevenire i reati di cui al D.lgs. n. 231/2001.

5. LEGAL BASIS FOR PROCESSING AND TRANSFER OBLIGATION
Given that all the purposes of the processing are related to the establishment and then to the conduct of the working relationship, although there is no obligation to give data in the pre-contractual phase, the failure to give the data will result in the impossibility to proceed with the recruitment and therefore the establishment of the working relationship. Once the contract has been concluded, the conferral of the further necessary data is compulsory for all that is required by the legal and contractual obligations and, therefore, any refusal to supply them in whole or in part, besides being able to give rise to the impossibility for the company to execute the contract, could still configure contractual failure by the customer and a breach of regulatory obligations from you. The non-conferral of data connected to your rights (for example in relation to the title to benefit from certain permits) may result in the impossibility of enjoying such rights.
The legitimacy to the processing of the data derives therefore from the fact that it is necessary for the execution of the working contract of which you are part (or, in pre-contractual phase, for pre-contractual measures in the context of the selection and recruitment process) and for fulfilling the associated legal obligations. It is also noted that, for the treatment of particular categories of personal data (for example, as far as the employment relationship is concerned, those relating to health or union membership), there is no ban on the processing when this is necessary to fulfil specific obligations and exercise the specific rights of the data controller or of the person concerned in matters of labour law, social security and social protection (think of communications to social and welfare institutions, health monitoring), while still in the presence of appropriate guarantees for the fundamental rights and interests of the person concerned.

6. PROCESSING WAYS AND DURATION
Processing will be carried out:

• Through the use of manual and automated systems;
• by entities or categories of authorized people in order to fulfil their duties,
• with the use of appropriate measures to ensure the confidentiality of data and to avoid access to them by unauthorised third parties.

The retention of the data following the termination of the employment relationship will take place for a period not exceeding that required to fulfil the obligations or tasks referred to in point 3, and in any case to pursue the specific purposes indicated therein, with cancellation of the data attributable to the specific purposes that are no longer pursued.

7. DATA COMMUNICATION
Without prejudice to the communications carried out in fulfilment of statutory and contractual obligations, all data collected and processed may be communicated, exclusively for the purposes specified above, to:

• The company that provides the software for the management of the employment relationship (including the processing of payrolls);
• The tax consultancy which, in its turn, may, limited to technical requirements, have the aforementioned data treated by the company that provides the software to it;
• Competent doctor;
• Insurance and welfare institutions;
• Financial administration;
• Funds or private pension and assistance institutions;
• Insurance companies;
• Credit institutions;
• Trade union organisations to which you have given specific mandate;
• Business organisations of which the company is a member;
• Training bodies
• Law firms and labor consultants.

Personal data is not subject to dissemination.

8. LOCATION OF DATA PROCESSING
The activity is carried out on the territory of the European Union.

9. RIGHTS OF THE INTERESTED PARTY
We remind you that Chapter III of the GDPR gives you the exercise of the following rights:

• a) Access to personal data (you will therefore have the right to have free information about the personal data held by the controller and about the related processing, and to obtain a copy in an accessible format);
• b) Rectification of data (we will provide, on your recommendation, the correction or integration of your data – which are not an expression of evaluative elements – incorrect or inaccurate, even if they have become so, because they have not been updated);
• c) Withdrawal of consent (if processing takes place on the basis of your consent, you may withdraw the consent at any time, without affecting the lawfulness of processing provided before the withdrawal.
• d) Erasure (right to be forgotten) (for example, data are no longer needed with regard to the purposes for which they were collected or processed; they have been illegally treated; they must be deleted in order to fulfil a legal obligation; you have withdrawn the consent and there is no other legal basis for processing them; you object to processing;
• e) Right to restrict processing (in certain cases – objecting the accuracy of the data, during the time required for verification; objecting the lawfulness of processing with opposition to the erasure; need of use for your rights of defence, while they are no longer useful for processing; if there is objection to processing, while the necessary verifications are carried out- the data will be stored in such a way in order to be able to be restored, but, in the meantime, they are not available to the controller except in relation to the validity of your restriction request);
• f) Right to object to processing in full or in part for legitimate reasons (in certain circumstances you may however object to processing of your data, in particular, if your personal data is processed for direct marketing purposes, you have the right to object to processing at any time, including profiling to the extent that it is connected to such direct marketing. If personal data are processed for the purposes of scientific or historical research or for statistical purposes, for reasons related to your particular situation, you have the right to object to processing, unless processing is necessary for the execution of a public interest task);
• g) Data portability (if processing is based on consent or on a contract and is carried out by automated means, on request, you will receive your personal data in a structured format, in common use and readable by an automatic device, and you may transmit them to another controller, unimpeded by the controller which has provided them and, if technically feasible, you can obtain that such transmission is made directly by the latter).
• h) Complaint to the supervisory authority (Garante per la protezione dei dati personali – Garante Privacy).