PRIVACY POLICY

PURSUANT TO REGULATION (EU) 2016/679 (“GDPR”) ARTICLES 13 AND 14
AND SUBSEQUENT NATIONAL ADAPTATION STANDARDS

This document (“Disclosure“) is intended to provide you with guidance regarding the processing of information, as specified below, that will be provided by you or otherwise available at our facility and that will be processed by us and/or other identified parties for the purposes set forth below. The Notice, in particular, is made pursuant to EU Regulation no. 679/2016 (“GDPR“) and subsequent national compliance regulations (together with the GDPR hereinafter “Applicable Legislation“).

The data controller, pursuant to Articles 4 and 24 of Reg. EU 2016/679, is ATLAS TRE – Via Statale Sud, 43 64028 Silvi Teramo Italy, VAT No. 02127980676 , Tel. 333 47 39 269, andreab.atlastre@gmail.com, in the person of the legal representative pro-tempore (hereinafter “Owner“).

2. Contact details of the Data Protection Officer (so-called “DPO-DPO”).
The Data Controller does not carry out activities that require the appointment of a Data Protection Officer.

3. Purpose and legal basis for processing
The Personal Data collected will be processed for the purposes and under the legal bases below:

*Purpose*	*Legal basis for processing*
point 3(a): for the management of your contractual relationship or to execute pre-contractual measures (such as, for example, request for information or request for quotation). In this case, you are free to provide your Personal Data, including special data; however, failure to do so will not allow you to establish the aforementioned relationship and fulfill your request.	processing is necessary in connection with the performance of a contract to which you are a party
Point 3(b): subject to your specific consent, to send you. *(i)* promotional communications related to the Owner and (ii) communications relating to events organized by the Controller (hereinafter “ *marketing purposes* “)	your consent

4. Categories of personal data processed (according to art.14)
Within the limits of the purposes and methods described in this Notice, information that can be considered as “Personal Data” may be processed, which includes your personal details, contact information (such as, for example, cell phone number, e-mail address, etc.).

5. Recipients and categories of recipients
Personal data will not be disseminated, i.e., will not be disclosed to unspecified parties. Instead, they may be subject to communication to well-defined parties, in full compliance with legal requirements, for purposes strictly related to those previously indicated. Any access to your personal data is limited to individuals authorized by the Data Controller. The communication to the identified recipients, only if involved and functional, is related to the achievement of the purposes mentioned in point 3 above, so the personal data collected and processed may be:

Used anonymously for statistical purposes;
made available to the Owner’s employees, in their capacity as Data Processors or persons authorized to process personal data;
disclosed to third parties, natural or legal, public administrations, professionals, law enforcement agencies, government agencies, regulatory bodies, courts or other public authorities authorized by law;
disclosed to business partners, only in case of prior and express consent of the User;
if necessary, transferred to another Data Controller in accordance with the GDPR, including with regard to the right to data portability.

Information may, in addition, be disclosed whenever communication may be necessary to comply with requests from the Judicial or Public Security Authorities. The data collected will not be disseminated under any circumstances.

The list of Personal Data Processors is available at the office of the Data Controller.

6. Transfer of data abroad
Data will not be transferred outside the European Union.

7. Period of data retention (criteria for determination).
Below is a table that contains indications of retention times (i.e., criteria for determination) of Personal Data:

*Purpose*	*Storage times*
Item 3(a): contract management	For the duration of the relationship and 10 years thereafter (ordinary statute of limitations).
item 3(b): marketing purposes	2 years after collection, subject to the data subject’s ability to change and/or revoke their wishes at any time (changes with the GDPR’s “accountability” principle)

8. Methods of data processing
The processing of Personal Data will be carried out by manual, computerized or telematic means, suitable to guarantee their security and confidentiality and will be performed by personnel duly trained in compliance with the Applicable Regulations. There is no automated decision making.

In addition to the cases when it is necessary to contact you for needs related to the management of your position, where you consent to the processing of your data for the purposes set forth in Section 3(b), you may be contacted by e-mail, newsletter, text message, or through any equivalent electronic means, or by paper mail or operator call to any of the contact details provided. If you prefer to be contacted only at one or some of these addresses, you may make an express request by using the form available in the Privacy section of the web page www.atlastre.com/Modulo exercise rights.pdf

9. Rights to which you are entitled
We inform you that you may exercise the rights recognized by the Applicable Regulations including, but not limited to:

to have access to their Personal Data and know their origin, the purposes and aims of the processing, the data of the subjects to whom they are communicated, the period of data retention or the useful criteria for determining it (art.15);
To request rectification (art.16);
deletion (“oblivion”), if no longer necessary, incomplete, erroneous or collected in violation of the law (art.17);
To request that the processing be limited to a part of the information about you (art.18);
to the extent technically feasible, to receive in a structured format or to transmit to you or to third parties indicated by you information about you (so-called “portability”) or information that has been voluntarily provided by you (art.20);
to object to their processing based on legitimate interest (Art. 21);
as well as to revoke their consent at any time, in case it forms the basis of the processing (revocation of consent however does not affect the lawfulness of the processing based on the consent carried out before the revocation).

The aforementioned rights may be exercised by means of a written request addressed without formality to the Holder [ovvero ai/al DPO] at the contacts indicated in points 1 and 2.

Holder shall do so without delay and, in any case, no later than one month after receipt of the request. The deadline may be extended by two months if necessary, taking into account the complexity and number of requests received by the Holder. In such cases, the Holder will, within one month of receiving your request, inform you and make you aware of the reasons for the extension.

You are reminded that where the response to your requests has not been satisfactory in your view, you may address and file a complaint with the Data Protection Authority(http://www.garanteprivacy.it/) in the manner provided for in the Applicable Regulations.

Revised May 2018