EXSTO Italia S.r.l. a Socio Unico
Legal address: Via Remigia 20-24-26, 40068 San Lazzaro di Savena (BO), Italy.
VAT: IT03337710044
Contact e-mail: privacy.italia@exsto.com
ph: (0039)051-6255095
- What is the life cycle of personal data?
Personal data being processed, purposes and conditions of lawfulness of the processing
The life cycle of personal data describes the moment in which the employer as Data Controller begins to process personal data, what the purposes and methods of processing are and the retention period.
What personal data do we process?
- Personal data
- Data relating to the employment relationship (contractual position, social security data, salary…)
- Tax and banking data
- Special data art. 9 GDPR (data relating to health situation and trade union membership).
Why do we process them (purpose and legal basis)?
The processing is based on the need to execute the employment relationship and comply with the legislation on safety at work, collective bargaining, the fulfillment of social security obligations as well as the payment of the salary.
What happens if we cannot process the data?
Failure to provide personal data will make it impossible to perform the work and any ancillary services thereof.
How long do we treat them?
Your data will be processed for the entire duration of the employment relationship.
Cases in which the processing may last longer than the contractual relationship:
– 10 years: the personal data necessary for the need for proof and documentation for fiscal/tax and accounting purposes or for other legal obligations will be kept for ten years;
– Until the conclusion of any judgments or alternative means of resolving disputes or disputes in the event of conflict with the worker.
- How are personal data processed?
The processing of your data will be carried out using paper and IT tools, in compliance with all the technical and organizational measures prepared by the data controller to guarantee the security and confidentiality of the information.
The worker’s personal data will not be used to monitor work activity but solely to guarantee the safety of workers and company assets, as well as the correctness of work performance, for example by regulating access via badges and attendance control software.
The worker has access to the internet and the company email service via devices made available by the employer. Internet browsing is not monitored and/or controlled.
- Who processes personal data?
Your data are processed by specially trained internal parties authorized to process them, who will in any case be bound to professional secrecy and maximum confidentiality regarding the same.
Your data are processed by consultants and service providers of the data controller (e.g. employment consultancy company, doctor responsible for safety…), all appointed as data controllers. These subjects process personal data in compliance with the regulations on the protection of personal data and under the control of the data controller.
The personal data provided are known to the System Administrator only for the needs of maintenance and control of the security of the IT systems.
- Who will be able to know the personal data?
Your data may be communicated to third parties, exclusively for technical and operational needs strictly connected to the purposes set out above and in particular to the following categories of subjects:
from/to public authorities and administrations for purposes related to the fulfillment of legal obligations;
from/to public and private social security bodies to which the transfer of your data is necessary for the performance of our company’s activities in relation to the fulfillment, on our part, of the contractual/commercial obligations towards you;
from/to banks, financial institutions or other subjects to whom the transfer of your data is necessary for the performance of our company’s activities in relation to the fulfillment, on our part, of the contractual obligations towards you.
from/to subjects whose right to access personal data is recognized by law or secondary or community legislation.
from/to subjects to whom the communication of personal data is necessary or is in any case functional to the fulfillment of existing contractual obligations;
- What are my privacy rights and who should I contact?
In relation to the aforementioned treatments, the interested party can exercise all the rights referred to in articles 12-22 of the European Regulation no. 679/2016.
The data subject has the right to ask the Data Controller:
Access to your personal data:
The interested party can obtain confirmation that personal data concerning him or her is being processed by obtaining more information on the processing and a copy of the personal data.
Rectification of personal data
The interested party may request the rectification of their personal data
The deletion of personal data
The interested party may obtain the deletion of personal data in the cases referred to in the art. 17 GDPR.
The limitation of the processing concerning him
The interested party may request that the processing be limited by opposing the cancellation as necessary for the exercise or defense of a right in court.
Opposition to the processing of personal data
The interested party cannot object to the processing of personal data as the processing is based on the contract.
With reference to personal data processed using automated methods, the right to data portability.
The interested party has the right to receive or request to transfer personal data to another owner in a commonly used structured format.
The interested party can request further information or exercise their rights by contacting the contact point of the Data Controller: email: info.italia@exsto.com tel: 051-6255095
The interested party has the right to lodge a complaint with the Guarantor for the protection of personal data.
For more information on the right to lodge a complaint you can visit the following web page:
If you want to report anything or to request clarifications, please, contact us via email: privacy.italia@exsto.com
