DATA CONTROLLER

FAI Service S. Coop., with registered office in Viale Cassala, 57 – 20143 Milano (MI), Italy, Tax No. 08422730153 and VAT No. 02654640040 (hereinafter referred to as the “Controller”).

Contacts:

● e-mail privacy@lumesia.com

● y mail at the administrative headquarters in Via Renzo Gandolfo, 1 – 12100 Madonna dell’Olmo (CN), Italy.

This notice applies to the www.faiservice.com website, to which the following web pages relate:

• www.lumesia.com

• www.lumesia.it

• doc.faiservice.it

• www.faiserviceutility.it

• faiservice.it

• faiservice.eu

• faiservice.es

• faiservice.net

(all the above-mentioned web pages are jointly referred to as the “Website”).

Type of Processed Data

Purposes of the Processing

Legal Basis

Nature of Data Provision

Data Retention Period

Biographical data (name of the data subject), contact data (email address) and any other data provided in the message sent (collected through the forms available at https://www.faiservice.com/contatti/ and https://www.lumesia.com/contatti/ or sent via email to info@faiservice.com and info@lumesia.com)

Biographical data (name of the data subject – entered in the “representative” field -, tax no.), contact data (address, email address, telephone and fax numbers), company name and VAT no., and other data, if any, provided in the message sent or entered in the “notes” field (collected through the form for sending information requests or suggestions available at http://www.faiserviceutility.it/utility/contatti_raggruppamento.asp?s=1 or by sending an email to utility@faiservice.com)

To reply to contact requests, related to the services of the Data Controller and/or its business partners and/or its subsidiary and/or associated companies.

Performance of pre-contractual obligations to which the Data Subject is a party (art. 6, para. 1, letter b) of the GDPR).

Required to follow up the request.

If Data are not provided, the Data Controller will not be able to reply to the request.

The Data Controller will delete the Personal Data processed for this purpose within 1 year from the date of request processing closure.

Browsing data automatically collected by the Website: access and browsing data.

By accessing the Website, the IT systems and software procedures used for running the Website acquire, during their normal operation, access and navigation data whose transmission is implicit in the use of Internet communication protocols (for example: information on the browser used by the User, IP addresses, URI/URL notation addresses of the pages visited, date, time and duration of each visit, the method used to submit the request to the server, the size of the file received in response, the numerical code indicating the status of the response given by the server, as well as other parameters related to the User operating system and IT environment – the “Navigation Data”).

The Website also uses IT techniques for direct acquisition of the user personal identification data consisting of “strings of code”, i.e. “cookies”.

To allow browsing on the Website and using cookies.

The pursuit of legitimate interests of the Data Controller or third parties, provided that the interests or the fundamental rights and freedoms of the data subject requiring the protection of personal data do not prevail, taking into account the reasonable expectations of the data subject based on his/her relationship with the Data Controller (art. 6, para. 1, letter f) of the GDPR).

With regard to cookies, except for technical cookies, the legal basis for processing is the explicit consent of the data subject (art. 6, para. 1, letter a) of the GDPR).

With the exception what specified above for browsing data (which are necessary in order to allow the Website browsing), the provision of Data is discretionary.

In particular, disabling technical cookies will not allow to browse the Website, whereas disabling the other cookies will not affect your browsing.

The data will be retained for the entire duration of the browsing session.

For more information on the cookies used by the Website and their retention periods, refer to the cookie policy at the following link https://www.faiservice.com/privacy/

Biographical data and contact data

Allow sending promotional material related to the Controller and its activities, products and services, as well as invitations to events organised by it (so-called direct marketing).

The explicit consent of the data subject (art. 6, para. 1, letter a) of the GDPR).

Discretionary.

If data are not provided, there will be no detrimental consequences for Data Subject, but the Controller will not be able to send him/her promotional material.

Data will be retained for 24 months from the date of provision, unless the Data Subject withdraws his/her consent; in this case, data will be deleted immediately.

Biographical data and contact data

Sharing of data with other companies belonging to the same group as the Controller and commercial partners in the transport services sector (such as, by way of example, insurance companies, motorway service or fuel providers) for the purpose of sending commercial communications.

The explicit consent of the data subject (art. 6, para. 1, letter a) of the GDPR).

Discretionary.

If data are not provided, there will be no detrimental consequences for Data Subject, but third parties identified by the Controller will not be able to send the Data Subject promotional material concerning these third parties.

Data will be retained for 24 months from the date of provision, unless the Data Subject withdraws his/her consent; in this case, data will be deleted immediately.

In addition, and without prejudice to the above, the Data Controller undertakes to base the processing of Personal Data on the principles of minimisation, reviewing – on an annual basis – if it is necessary to retain them for a period of time not longer than that required by the purposes for which data have been collected and processed.

The Data Subject may withdraw his/her consent at any time, without prejudice to the lawfulness of the processing carried out up to that moment by the Controller pursuant to such legal basis.

The Data Controller may retain Personal Data to comply with the law or to exercise or defend any right or claim in legal proceedings. When the purposes for which Personal Data were collected and processed have been achieved, the Controller will implement appropriate measures to anonymise them, so that the Data Subject cannot be identified.

PERSONAL DATA RECIPIENTS/CATEGORIES OF RECIPIENTS

Data will be processed by employees of the Data Controller duly authorised to process the Data according to the instructions and after taking suitable measures to protect the Data in relation to all the purposes described above.

The following entities may become aware of Personal Data in connection with the processing purposes provided for in this privacy policy and may process Personal Data both as independent data controllers and as data processors, duly appointed by the Data Controller:

• entities that perform activities necessary to achieve the above-mentioned purposes, i.e. companies that provide IT infrastructures and IT support and consulting services, companies that provide data analysis and development services, as well as IT consultants (also natural persons), law firms, accountants and auditors;

• commercial partners and/or subsidiaries and/or associated companies of the Controller, such as third parties offering services accepted by the Controller, if the data are shared for the sole purpose of replying to the request for information of the Data Subject;

• third parties such as companies belonging to the group of the Controller and commercial partners in the transport services sector (such as, by way of example, insurance companies, motorway service or fuel providers) which will send the Data Subject promotional communications, where the Data Subject has given his/her consent also to receive promotional material from third parties, regardless of any request made by the Data Subject.

TRANSFER OF PERSONAL DATA TO A NON-EU COUNTRY

Personal data are retained at the Data Controller’s premises and will not be transferred to non-EU countries.

The Data Controller undertakes to transfer personal data to third countries, if necessary:

• ensuring that the country to which the personal data will be sent guarantees an adequate level of protection, as provided for in Article 45 of the GDPR; or

• complying with the standard contractual clauses approved by the European Commission for the transfer of personal information outside the EEA (these clauses are set out in Article 46(2) of the GDPR).

DATA PROCESSING METHODS

Data will be processed in compliance with the principles of fairness, lawfulness and transparency, through manual and automated methods and using paper and electronic means, in any case within the limits of the purposes of data processing set out in this notice and, in any case, always guaranteeing the security and confidentiality of your Data.

RIGHTS OF DATA SUBJECTS

You are entitled to exercise the following rights under the conditions and within the limits set out in Articles 12-22 of the GDPR by sending an email to privacy@lumesia.com

• Right of access (Article 15 of the GDPR);

• Right to rectification of inaccurate personal data and to have incomplete personal data completed (Article 16 of the GDPR);

• Right to erasure of personal data (Article 17 of the GDPR);

• Right to restriction of processing (Article 18 of the GDPR);

• Right to object to the processing pursuant to Article 6(1), letters (e) or (f), of the GDPR, including profiling (Article 21 of the GDPR);

• Right to lodge a complaint with a supervisory authority (Article 77 of the GDPR).

If the Data Subject considers that the processing of personal data carried out by the Controller infringes the Regulation (EU) 2016/679, he/she has the right to lodge a complaint with a Supervisory Authority, in particular in the Member State of his or her habitual residence, place of work or place of the alleged infringement of the Regulation (in Italy the Garante Privacy https://www.garanteprivacy.it/), including the possibility of a judicial remedy

Data di aggiornamento: 16.12.2021