Privacy Policy on the Processing of Personal Data

Summary
Art. 1. Identity and contact details of FAM s.r.l. as Data Controller
Art. 2. Processing of data for general marketing purposes
Art. 3. Processing of data for assistance and customer care purposes
Art. 4. Processing of data for administrative, accounting, and tax purposes
Art. 5. Processing of data for the assessment, exercise, or defense of a right
Art. 6. Categories of subjects to whom FAM s.r.l. communicates the user’s personal data (recipients)
Art. 7. Transfer to third countries
Art. 8. Right to object
Art. 9. Right of access
Art. 10. Right to rectification
Art. 11. Right to erasure
Art. 12. Right to restriction of processing
Art. 13. Right to data portability
Art. 14. Response times and methods in the event of exercising the rights of the data subject
Art. 15. Right to lodge a complaint with a supervisory authority

Art. 1. Identity and contact details of FAM s.r.l. as data controller
FAM s.r.l. (“FAM”) is the data controller of the personal data of users as described in this policy, which concerns the data collected from the website www.famsrl.eu for the purposes indicated therein.
The identifying details and contact information of FAM are as follows:

FAM, located at Via G. Ferraris n. 63, Arezzo, 50021,
Email: uce@famsrl.eu
Phone: +39 0575590733.

Art. 2. Processing of data for general marketing purposes
With the user’s express consent, FAM will process the user’s personal data to send informational and promotional communications via email, including newsletters, related to its own and/or third-party products and/or services.
The legal basis for this processing is the user’s express consent (art. 6.1.a) of the Regulation).
The user may revoke their consent at any time and/or oppose the processing of their data for marketing purposes by contacting FAM using the details indicated in art. 1.
Providing data for general marketing purposes is optional: there is no legal or contractual obligation for the user to provide such data for this purpose and/or to consent to the processing of their personal data for this purpose.
Failure to consent to the processing of data for marketing purposes will prevent the user from receiving advertising material related to products and/or services from FAM and/or third parties, as well as from FAM sending newsletters to the user.
For general marketing purposes, FAM will process the user’s data until the consent is revoked and/or the right to object is exercised, and in any case, no later than 24 months from the data collection, reserving the right, before the expiration of this term, to ask the user for renewal of consent and/or update of data.

Art. 3. Processing of data for assistance and customer care purposes
FAM will process users’ data for general assistance and customer care activities, thus responding to requests for information from users or responding to complaints, reports, disputes, as well as allowing the user, if desired, to leave a review.
The legal basis for this processing is the execution of pre-contractual measures taken at the request of the data subject (art. 6.1.b, last paragraph, of the Regulation) or, depending on the case, the legitimate interest of FAM (art. 6.1.f of the Regulation).
It is a legitimate interest of FAM to respond to requests for information and/or reviews and/or reports and/or disputes and/or complaints from users of the Site. This legitimate interest of FAM also coincides with the legitimate interest of the users of the Site making the requests and/or reports and/or disputes and/or complaints in question, and thus, in the context of the relationship with FAM, it can be reasonably expected that their personal data will be used by FAM to provide feedback to them.
The legitimate interest of FAM as identified can thus be deemed to prevail over the fundamental rights and freedoms of the data subject, also in light of these reasonable expectations and the existing relationship between the data subject and FAM, as well as considering the nature of the data processed and the coinciding interest of the data subjects themselves.
In any case, the user has the right to object, at any time, for reasons related to their personal situation, to the processing of their personal data concerning them for the purpose in question (i.e., assistance and customer care).

Art. 4. Processing of data for administrative, accounting, and tax purposes
FAM will process the user’s data for the execution of administrative and/or accounting and/or tax obligations related to the provision of services and/or the purchase of products offered on the Site.
The legal basis for this processing is the fulfillment of legal obligations to which FAM is subject (art. 6.1.c of the Regulation).
Providing data for this purpose is mandatory, as their processing is necessary to allow FAM to comply with the legal obligations imposed on it. Failure to provide data for this purpose will result in the user being unable to take advantage of the services of the Site.
For this purpose, FAM will process the user’s data until the expiration of the legal terms provided for the completion of each administrative, accounting, and tax obligation and/or for the retention periods established by law for the retention of related documentation.

Art. 5. Processing of data for the assessment, exercise, or defense of a right
FAM will process the user’s data for the assessment, exercise, or defense of a right in all competent venues.
The legal basis for this processing is the legitimate interest of FAM (art. 6.1.f of the Regulation).
It is indeed a legitimate interest of FAM to pursue legal remedies to ensure the enforcement of its contractual rights or to demonstrate compliance with obligations arising from the contract with the data subject or imposed on FAM by law. This legitimate interest is grounded in the constitutionally protected right to defense. It can therefore be deemed to prevail over the fundamental rights and freedoms of the data subject, also in light of their reasonable expectations.
In any case, the user has the right to object, at any time, for reasons related to their personal situation, to the processing of their personal data concerning them for the purpose in question (i.e., defense of a right/justice purposes).

The user can exercise this right by contacting FAM using the details indicated in art. 1 of this privacy policy.

Art. 6. Categories of subjects to whom FAM communicates the user’s personal data (recipients)
The personal data provided by the user may be communicated by FAM to the categories of recipients indicated below.
The subjects to whom FAM communicates the data act as data processors designated by FAM through a specific contract (“Data Processors”) or as individuals designated to process personal data under the direct authority of FAM (“Designates”), or, in the case of third parties utilized by the Data Processor, as “Sub-Processors,” pursuant to art. 28.4 of the Regulation.
The personal data of users may be communicated by FAM to the following categories of recipients:

• Companies, consultants, or professionals possibly appointed for the installation, maintenance, updating, and, in general, management of the hardware and software of the Site (including the platform), including cloud computing service providers, and to third parties they utilize;
• Companies tasked by FAM with sending commercial communications;
• All those subjects, including public authorities, who have access to the data based on regulatory or administrative provisions;
• All public and/or private subjects, natural and/or legal persons (legal, administrative, and tax consulting firms), where communication is necessary or functional to the proper fulfillment of contractual obligations undertaken in relation to the products and services offered on the Site, as well as legal obligations or in the case of assessment, exercise, or defense of a right.

Art. 7. Transfer to third countries
Personal data are not transferred to countries outside the European Union.

Art. 8. Right to object
The data subject has the right to object at any time, for reasons related to their particular situation, to the processing of their personal data concerning them carried out for purposes based on the legitimate interest of the data controller.
In the event that the data are processed for direct marketing or profiling purposes, the data subject also has the right to object at any time to the processing of their personal data concerning them carried out for such purposes.
In the case of exercising the right to object, FAM refrains from further processing the personal data, unless it demonstrates the existence of compelling legitimate grounds for proceeding with the processing that prevail over the interests, rights, and freedoms of the data subject or for the assessment, exercise, or defense of a right in judicial proceedings.
If the data subject objects to processing for direct marketing or profiling purposes, their personal data are no longer processed for such purposes.

Art. 9. Right of access
The data subject has the right to obtain from FAM confirmation as to whether or not personal data concerning them are being processed and, in such a case, to obtain access to personal data and the following information:

• The purposes of the processing;
• The categories of personal data in question;
• The recipients or categories of recipients to whom the personal data have been or will be disclosed, particularly if recipients in third countries or international organizations;
• When possible, the expected retention period for the personal data or, if not possible, the criteria used to determine that period;
• The existence of the right of the data subject to request the data controller rectification or erasure of personal data or restriction of processing personal data concerning them or to object to such processing;
• The right to lodge a complaint with a supervisory authority;
• If the data are not collected from the data subject, all available information as to their source;
• The existence of automated decision-making processes, including profiling, that produce legal effects concerning the data subject or significantly affect them, and at least in such cases, meaningful information about the logic involved, as well as the significance and anticipated consequences of such processing for the data subject.

FAM provides a copy of the personal data being processed. In the case of further copies requested by the data subject, FAM may charge a reasonable fee based on administrative costs. If the data subject requests the information by electronic means, and unless otherwise indicated by the data subject, the information is provided in a commonly used electronic format.

Art. 10. Right to rectification
The data subject has the right to obtain from FAM the rectification of personal data concerning them without undue delay. Taking into account the purposes of the processing, the data subject has the right to have incomplete personal data completed, including by providing a supplementary statement.

Art. 11. Right to erasure
The data subject has the right to obtain from FAM the erasure of personal data concerning them without undue delay, and FAM is obliged to erase without undue delay personal data if one of the following grounds applies:

• The personal data are no longer necessary for the purposes for which they were collected or otherwise processed;
• The data subject withdraws consent on which the processing is based, and where there is no other legal ground for the processing;
• The data subject objects to the processing based on the legitimate interest of the data controller for reasons related to their particular situation and there are no overriding legitimate grounds or objects to the processing of their personal data for direct marketing or profiling purposes;
• The personal data have been unlawfully processed;
• The personal data must be erased for compliance with a legal obligation in Union or Member State law to which the data controller is subject.

Art. 12. Right to restriction of processing
The data subject has the right to obtain from FAM restriction of processing when one of the following applies:

• The data subject contests the accuracy of the personal data for a period enabling FAM to verify the accuracy of such personal data;
• The processing is unlawful, and the data subject opposes the erasure of the personal data and requests instead the restriction of their use;
• Although FAM no longer needs them for the purposes of processing, the personal data are required by the data subject for the establishment, exercise, or defense of a right in legal proceedings;
• The data subject has objected to processing based on the legitimate interest of the data controller, for reasons related to their particular situation, pending verification regarding the overriding legitimate grounds of FAM over those of the data subject.

If processing is restricted, the personal data subject to restriction are processed, except for storage, only with the consent of the data subject or for the establishment, exercise, or defense of a right in legal proceedings or to protect the rights of another natural or legal person or for reasons of substantial public interest of the Union or a Member State.
The data subject who has obtained restriction of processing is informed by the data controller before such restriction is lifted.

Art. 13. Right to data portability
The data subject has the right to receive in a structured, commonly used, and machine-readable format the personal data concerning them provided to FAM and has the right to transmit such data to another data controller without hindrance from the data controller to whom they were provided, where:

• The processing is based on the consent of the data subject or on a contract;
• The processing is carried out by automated means.

In exercising their right to data portability, the data subject has the right to obtain the direct transmission of personal data from one data controller to another, where technically feasible.
Exercising the right to data portability does not affect the right to erasure.
The right to data portability shall not adversely affect the rights and freedoms of others.

Art. 14. Response times and methods in the event of exercising the rights of the data subject
FAM provides the data subject with information about the actions taken regarding a request to exercise the rights recognized by arts. 15 to 22 of the Regulation (i.e., right of access, right to rectification, right to erasure, right to restriction of processing, right to data portability, right to object) and this privacy policy (“Rights of the Data Subject”), without undue delay and, in any case, within one month of receiving the request. This period may be extended by two months if necessary, taking into account the complexity and number of requests. FAM informs the data subject of such extension and the reasons for the delay within one month of receiving the request. If the data subject submits the request by electronic means, the information is provided, where possible, by electronic means, unless otherwise indicated by the data subject.

Art. 15. Right to lodge a complaint with a supervisory authority
Without prejudice to any other administrative or judicial remedy, the data subject who believes that the processing concerning them violates the Regulation has the right to lodge a complaint with a supervisory authority, in particular in the Member State where they habitually reside, work, or in the place where the alleged violation occurred. The supervisory authority to which the complaint has been lodged informs the complainant of the status or outcome of the complaint, including the possibility of judicial remedy.