Privacy Policy

UE 2016/679 REGULATION

 

La Neperia Group Srl (di seguito, “Neperia Group”), con sede legale in Viale Egeo, 151 – 00144 – Roma (RM), CF e P.IVA IT11676741009 (in seguito, “Titolare”), informa di essere Titolare del Trattamento ai sensi dell’art. 13 D.Lgs 30.6.2003 n. n. 196 (hereinafter, “Privacy Code”) and art. 12, 13 and 14 of EU Regulation no. 2016/679 (hereinafter, “GDPR”) as to the protection of individuals with regard to the processing of personal data collected on www.neperiagroup.com (hereinafter, the “Site”).

This document describes the purposes and methods of personal data processing by the users of the Site managed by Neperia Group (the document does not include the processing carried out on other websites that may be viewed by the user through links on the Site).

The purpose of this document is to inform about the criteria for the correct processing of personal data carried out on or through the Website, criteria that the user can find in detail in the information published – pursuant to art. 13 of the Regulation – in the various sections of the Website aimed at specifying the methods and purposes of the processing related to the provision of specific services and / or information of various kinds.

Personal data processing means any operation or group of operations, performed with or without the use of automated processes and applied to personal data or sets of personal data, even if not recorded in a database, such as collection, registration, organization, structuring, storage, processing, selection, blocking, adaptation or modification, extraction, consultation, use, communication by transmission, dissemination or any other form, comparison or interconnection, limitation, cancellation or destruction.

 

1. Identification details and contact information for data controller:

To contact Neperia Group Srl quickly and to communicate directly read the following details:

Neperia Group – Srl
Viale Egeo, 151 – 00144 – Rome (RM)
Fiscal code and VAT number IT11676741009
To contact quickly and communicate directly and effectively with Neperia Group, please use the following details, including the e-mail address, as follows:

Phone number +39 0635297614
E-mail privacy@neperiagroup.com PEC NEPERIAGROUPSRL@legalmail.it

The updated list of data processors is kept at the registered office of the Data Controller.

 

2. The Subject of the Processing

a. Data of navigation

The computer systems and software procedures used to operate the Site gather, during their normal operation, some personal data whose transmission is implicit in the use of Internet communication protocols.

The information are not collected to be associated with identified interested parties, but which, by their very nature, could allow users to be identified through processing and association with data held by third parties.

This category of data includes IP addresses or domain names of the computers used by users who connect to the Site, the addresses in the Uniform Resource Identifier (URI) notation of the requested resources, the time of the request, the method used to submit the request to the server, the size of the file obtained in response, the numerical code indicating the status of the response given by the server (success, error, etc.) and other parameters relating to the operating system and the user’s computer environment.

These data are used for the sole purpose of obtaining anonymous statistical information on the use of the site and to check its correct functioning and are deleted immediately after processing.

These data, necessary for the use of web services, are also processed to:

• obtain statistical information on the use of services (most visited pages, number of visitors per hour or day, geographical areas of origin, etc.);
• check the correct functioning of the services offered.

The navigation data do not persist for more than seven days and are deleted immediately after their aggregation (except for any need to establish criminal offenses by the judicial authorities).

b. Data provided by the user

The optional, explicit and voluntary sending of messages to the contact addresses, as well as the compilation and forwarding of the curriculum vitae submission form present on the Site, entail the acquisition of the sender’s contact details, necessary to reply, as well as all personal data included in communications and any related attachments.

Specific information will be published in the pages of the Site prepared for the provision of certain services.

c. Use of cookies or user tracking / monitoring systems

A cookie is a text file that resides on the user’s hard disk, where it was sent through the web page of our server. The user can at any time choose whether to enable or disable cookies by changing the settings of his browser. Usually the use of cookies makes it faster and easier the use of the website.

The so called session cookies used on the Site avoid the use of other technologies that could compromise the privacy of users’ browsing and do not allow the acquisition of personal identification data.

We do not use cookies to profile users, nor are other tracking methods used.

Instead, session cookies (non-persistent) are used strictly limited to what is necessary for the safe and efficient browsing of the Website. The storage of session cookies in the terminals or browsers is under the user control, where on the servers, at the end of the HTTP sessions, information about cookies remains recorded in the service logs, with storage times no longer than seven days like other browsing data.

There are third-party cookies: for details about them, please refer to the specific Cookie Policy.

For details on the management of cookies, including opt-out, please refer to the specific Cookie Policy in the “Policy” section.

 

3. Purpose and legal basis of the processing

Your personal data are processed:

1. A) without your express consent (Article 24 letter a), b), c) Privacy Code and art. 6 b), e) GDPR), for the following Service Purposes and with different means of communication (i.e. telephone, mobile phone, sms, e-mail, fax, PEC, paper mail):
   • reply to explicit and voluntary contact requests;
   • evaluation of CVs sent willingly and without any request by the Data Controller;
   • management of cookies (session and technical) as better shown in the specific Cookie Policy;
   • exercise the rights of the Controller, as for example the right to a legal defence.
2. B) Only upon your specific and clear consent (articles 23 and 130 of the Privacy Code and article 7 of the GDPR), for the following Marketing Purposes:
   • send via e-mail, mail and/or sms and/or telephone calls, newsletters, commercial communications and/or advertising material on products or services offered by the Controller and survey of the degree of satisfaction on the quality of services;
   • send via e-mail, mail and/or sms and/or telephone calls, commercial and/or promotional communications of third parties (for example, business partners, insurance companies, other companies of the Card Protection Plan Group). Please note that if you are already one of our customers, we may send you commercial communications relating to services and products of the Controller similar to those you have already enjoyed, except for your refusal (Article 130 paragraph 4 of the Privacy Code).

The categories of personal data being processed are represented by common personal data, specified above.

 

4. Processing methods

Your personal data are processed according to the operations specified in art. 4 of Privacy Code and art. 4 n. 2) of GDPR and in particular: collection, registration, organization, storage, consultation, processing, modification, selection, extraction, comparison, use, interconnection, blocking, communication, deletion and destruction of data. Your personal data are subject to both paper and electronic and/or automated processing.

 

5. Access to data

Your data may be accessible for the purposes referred to in art. 3.A) and 3.B):

• to employees and colleagues of the Controller in Italy, as persons in charge and/or internal officers of the processing and/or system administrators;
• to third-party companies or other subjects (as an indication, banks, professional firms, consultants, insurance companies for the provision of insurance services, etc.) that carry out outsourced activities on behalf of the Controller as Independent External Processing Controllers or as External Processing Officers.

 

6. Data communication

Without the need for clear consent (pursuant to Article 24 letter a), b), d) Privacy Code and art. 6 lett. b) and c) GDPR), the Data Controller may communicate your data for the purposes referred to in art. 3.A) to Public Bodies and Supervisory Bodies, Judicial Authorities, to insurance companies for the provision of insurance services, as well as to those subjects to whom the communication is mandatory by law for the accomplishment of said purposes, including the performance of contracts for the services of the Controller. These subjects will process the data as independent external data controllers or external data officers, where the conditions are met. Your information will not be disseminated.

 

7. Data transfer

Personal data are stored on servers located at the headquarters within the European Union and on servers owned by Cloud Services providers, who will process the data as independent data controllers or external data processing officers, where the conditions are met. In any case, it is understood that the Data Controller, if necessary, will have the right to move the servers even outside the EU. In this case, the Data Controller hereby ensures that the transfer of data to non-EU countries, will take place in accordance with the applicable legal provisions, pursuant to the standard contractual clauses provided by the European Commission.

 

8. Nature of data provision and consequences of refusal to respond

The provision of data for the purposes referred to in art. 3.A) is mandatory. Without, we cannot guarantee the services of the art. 3.A). The provision of data for the purposes referred to in art. 3.B) ) is optional. ou can therefore decide not to give any data or to deny subsequently the possibility of processing data already provided: in this case, you will not receive newsletters, commercial communications and advertising material concerning the Services offered by the Data Controller. However, you will continue to be entitled to the Services referred to in art. 3.A).

 

9. Rights of the person concerned

As the concerned party, you have the rights set forth in art. 7 of the Privacy Code and art. 15 GDPR and precisely the rights of:

1. obtain confirmation of the existence or not of your personal data, even if not yet registered, and their communication in an intelligible form;
2. obtain information about:
   1. the origin of personal data;
   2. b) the aims and methods of processing;
   3. c) the logic applied when processing is carried out by electronic means;
   4. d) the identification details of the controller, of the officers and of the designated representative pursuant to art. 5, paragraph 2 of the Privacy Code and art. 3, paragraph 1, GDPR;
   5. e) the persons or the categories of persons whom the personal data may be communicated to or who can learn about them as appointed representative within the State, or as officers;
3. obtain:
   1. a) the updating, amendment or, when of interest, integration of data;
   2. b) the cancellation, transformation into anonymous form or blocking of data processed unlawfully, including data whose retention is unnecessary for the purposes for which the data were collected or subsequently processed;
   3. c) the declaration that the operations referred to in letters a) and b) have been brought to the attention, also with regard to their content, of those whom the data have been communicated or disseminated to, except in the case in which this fulfilment proves impossible o involves a use of means manifestly disproportionate to the protected right;
4. object, in whole or in part to:
   1. a) the processing of your personal data for licit reasons, even if pertinent to the purpose of the collection;
   2. b) the processing of your personal data to send advertising or direct sales material or for carrying out market research or commercial communication, through the use of automated call systems without an operator by e-mail and/or through traditional marketing methods by telephone and/or paper mail. Please note that the right to oppose by the interested party, set out in the above point b), for direct marketing purposes through automated methods, includes the traditional ones and that in any case the data subject can exercise the right to object even only partially. Therefore, the interested party can decide to receive only communications using traditional methods or only automated communications or none of the two types.

Where applicable, he also has the rights referred to in Articles 16-21 GDPR (Right of rectification, right to be forgotten, right of limitation of treatment, right to data portability, right of opposition), as well as the right of complaint to the Guarantor Authority.

 

10. How to exercise your rights

You can exercise your rights in any moment, by sending:

• the specific form that can be downloaded at the following link: Request for rights_Form – v.3.5
• a registered mail with return receipt to the Data Processing Officer, at the headquarters of the Controller, in Viale Egeo, 151 – 00144 – Rome (RM) – Italy;
• an e-mail to the address: privacy@neperiagroup.com

 

11. Restrictions

The rights of the interested party, referred to in point 9, may be subject to restrictions as per art.23 GDPR to safeguard, among others, national security; the defence; public safety and other specific cases envisaged.

 

12. Length of data processing and storage

The Data Controller will process personal data for the time necessary to fulfil the aforementioned purposes and in any case for no more than 10 years from the termination of the Service Purposes and no later than 2 years from the data collection for Marketing Purposes. Exceptions are the CV data, which will be destroyed immediately if they do not respond to any positions that the Controller was looking for. In the case of a favourable feedback, instead, a specific data processing policy will be sent immediately to consent for.