Privacy policy

Privacy notice concerning the processing of personal data pursuant to Article 13 of “Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, repealing Directive 95/46/EC” (“GDPR”).

The Data Controller, HRM SRL, wishes to inform you of the purposes and methods used to process any personal data relating to natural persons pursuant to the GDPR that may be processed by the Data Controller, as well as the associated rights concerning such processing.
Purposes of processing and nature of the main data processed.
The Data Controller processes the personal data of natural persons exclusively for the following purposes:

1. Contractual purposes relating to the establishment and management of the contractual relationship;
2. Administrative purposes relating to the management of administrative matters associated with the existing contractual relationship;
3. For commercial communication and marketing purposes, including through the use of newsletters;
4. For security purposes and to protect company assets;
5. Cooperation with public authorities, particularly health authorities.

Personal data (surname and first name, telephone numbers, email address, tax details and bank details) are collected for the purpose of organising and managing the contractual relationship and, only with your express consent, for commercial communication and marketing purposes.

Main methods of data processing

The Data Controller limits the collection and processing of personal data to what is strictly necessary for the purposes pursued.
Data may be processed in paper form, electronically and through the use of video surveillance systems.
Following a risk assessment and, where applicable, an assessment of the impact on the protection of personal data associated with a failure to meet the confidentiality, availability and integrity objectives for the information processed, the Data Controller plans and implements the necessary technical and organisational measures to minimise those risks. This also serves to ensure the resilience of the processing carried out as part of the broader requirement to ensure the continuity of the services provided.
Legal basis for processing
The processing of personal data for contractual and administrative purposes is necessary to establish and manage the contractual relationship and to comply with the related legal obligations.
Refusal to consent to processing means that it will not be possible to establish and maintain the contractual relationship and, consequently, to provide the service.

The processing of personal data for commercial communications and marketing purposes is optional and requires your consent. Refusal to provide consent will not affect the provision of the service.

Communication or disclosure of processed data

The Data Controller does not disclose or communicate your personal data to third parties for purposes other than those set out above.
The data is not processed in countries outside the EU.
Processing by third parties
For the purposes listed above, the Data Controller may engage third parties to assist with the processing of your data, including, for example:

1. Administrative service providers, such as accountants;
2. Providers of technical support services for IT systems;
3. Affiliated companies.

In this case, the Data Controller ensures that these parties may process your personal data solely to carry out the activities within their remit that are strictly related to the purposes defined above, and in compliance with appropriate technical and organisational data protection measures.
The data may be accessed by authorised personnel.
The data is not disseminated or disclosed to third parties except where specifically required by law and, if requested, may be disclosed to public authorities.
The data is not transferred abroad, and no automated decision-making is carried out.

Privacy notice and exercise of the data subject’s rights

Il Titolare del trattamento, desidera informarla dei diritti che il GDPR le conferisce, in qualità di soggetto interessato al trattamento.

Tali diritti sono riportati nell’Art. 13 del GDPR e riguardano:

1. il diritto dell’interessato di chiedere al titolare del trattamento l’accesso ai dati personali;
2. il diritto dell’interessato di chiedere al titolare la rettifica o la cancellazione degli stessi o la limitazione del trattamento;
3. il diritto dell’interessato di opporsi al loro trattamento;
4. il diritto dell’interessato alla portabilità dei dati;
5. il diritto dell’interessato di proporre reclamo a un’autorità di controllo.

Periodo di conservazione dei dati personali e criteri di riferimento

Il Titolare conserva i dati personali trattati con riferimento ai seguenti criteri:

1. rispetto dei requisiti applicabili alla durata del rapporto contrattuale in essere;
2. rispetto di requisiti amministrativi e fiscali come da normativa applicabile.

È fatta salva la conservazione per un periodo superiore in relazione a richieste della pubblica autorità.
È fatta salva la conservazione dei dati personali, anche particolari, per un periodo superiore, nei limiti del termine di prescrizione dei diritti, in relazione ad esigenze connesse all’esercizio del diritto di difesa in caso di controversie.

Titolare del Trattamento

Titolare del Trattamento dei suoi dati personali è HRM SRL, con sede legale in Milano, Piazza Santo Stefano, 6.

Per ogni richiesta di informazioni in merito ai trattamenti svolti sui suoi dati personali nonché per l’esercizio dei suoi diritti riportati all’art. 13 del GDPR può far riferimento al seguente indirizzo di posta elettronica: privacy@hrmgroup.it oppure può rivolgersi al Responsabile della protezione dei dati che è contattabile al seguente indirizzo di posta elettronica certificata: daniela.madera@pec.it, oppure agli indirizzi email: daniela.madera@milano.pecavvocati.it o privacy@goaps.it.
HRM SRL