Privacy Notice on the Processing of Personal Data – Articles 13 and 14 of EU Regulation 2016/679 (GDPR)

​

The above-mentioned regulations govern the protection of personal data and impose a number of obligations on those who process information relating to other individuals. Among these obligations is the requirement to provide data subjects with adequate information regarding the use of their personal data, so that any consent given is freely expressed and unambiguous.

​

OLITRANS S.R.L. protects the privacy of visitors to its website https://olitrans.org/ by adopting appropriate measures to safeguard personal data in compliance with applicable laws and regulations.

This Privacy Notice applies exclusively to the website https://olitrans.org/ and not to any other websites that may be accessed through links contained therein.

​

In accordance with the above provisions, we provide the following information:

a) Data Controller

OLITRANS S.R.L.

Via Donegani 2
57123 Livorno
Italy

Email: amministrazione@olitrans.org

Certified Email (PEC): olitrans@pec.it

​

b) Purpose and Legal Basis of Processing

Personal data voluntarily provided by users will be processed to enable the Data Controller to respond to requests and/or perform services requested by the user.

The legal basis for processing is the necessity to perform a contract to which the data subject is a party or to take pre-contractual measures at the request of the data subject (Art. 6(1)(b) GDPR).

Personal data may also be processed where necessary to comply with legal obligations to which the Data Controller is subject (Art. 6(1)(c) GDPR).

​

c) Processing Methods

Personal data will be processed both electronically and in paper form by authorized personnel who have been properly trained and informed of their obligations under applicable data protection laws.

Appropriate security measures are implemented to ensure confidentiality and to prevent unauthorized access, disclosure, alteration, or destruction of personal data.

​

d) Data Retention Period

Personal data will be retained only for as long as necessary to fulfill the purposes for which it was collected, including compliance with legal, tax, accounting, and contractual obligations, payment processing, warranty management, and the protection of legal rights.

When personal data is no longer necessary for these purposes and no legal grounds for retention remain, it will be deleted.

Personal data will also be deleted following withdrawal of consent, where consent constitutes the legal basis for processing.

Retention periods may vary according to applicable tax regulations and other national or European legislation. Certain data may remain necessary throughout the duration of the relationship with the data subject. Where it is unclear whether such relationship has definitively ended or is merely suspended, the data may continue to be retained.

After a reasonable period, personal data will be deleted, as it may no longer be accurate or up to date should the relationship resume.

​

e) Rights of the Data Subject

The data subject has the right to request from the Data Controller:

• Access to personal data (Art. 15 GDPR);

• Rectification or updating of inaccurate personal data (Art. 16 GDPR);

• Erasure of personal data (“right to be forgotten”) where applicable (Art. 17 GDPR);

• Restriction of processing under the circumstances provided by law (Art. 18 GDPR);

• Data portability, allowing transfer of personal data to another controller without undue burden or cost (Art. 20 GDPR);

• Objection to processing based on legitimate grounds (Art. 21 GDPR);

• Withdrawal of consent at any time, without affecting the lawfulness of processing carried out before such withdrawal (Art. 7(3) GDPR);

• Lodging a complaint with the Italian Data Protection Authority (Garante per la Protezione dei Dati Personali) in accordance with the procedures available at www.garanteprivacy.it.

​

f) Disclosure of Data Outside the Data Controller’s Organization

Personal data will not be disclosed to the public and will not be transferred to third countries or international organizations.

Data may be processed by authorized internal personnel (employees and collaborators) and/or external service providers acting on behalf of the Data Controller. An updated list of such parties may be requested from the Data Controller.

The exercise of the rights listed above is free of charge and is not subject to any specific formal requirements.

Data subjects may exercise their rights at any time by sending a registered letter or certified email (PEC) to the contact details of the Data Controller.

​

For the purposes of this Notice, “personal data” means any information relating to an identified or identifiable natural person (“data subject”). An identifiable natural person is one who can be identified, directly or indirectly, particularly by reference to an identifier such as a name, identification number, location data, online identifier, or one or more factors specific to their physical, physiological, genetic, mental, economic, cultural, or social identity.

​

“Processing” means any operation or set of operations performed on personal data, whether by automated means or otherwise, including collection, recording, organization, structuring, storage, adaptation, alteration, retrieval, consultation, use, disclosure by transmission, dissemination, alignment, combination, restriction, erasure, or destruction.