Where applicable and within the limits of the GDPR, as a data subject, the user is granted the following rights over the Personal Data collected and processed by the Data Controller for the purposes set out in paragraph 4:
- pursuant to Article 15 GDPR, to obtain confirmation from the Data Controller that Personal Data is or is not being processed and if so, to obtain access to the following information: (i) the purposes of the processing; (ii) the categories of Personal Data concerned; (iii) the recipients or categories of recipients to whom the Personal Data have been or will be disclosed, particularly if they are recipients in third countries or international organisations; (iv) whenever possible, the expected retention period of the Personal Data or, if not possible, the criteria used to determine such period (v) the right to lodge a complaint with a supervisory authority; (vi) if the data is not collected from the user, all available information about its origins; (vii) the existence of automated decision-making, including profiling, as well as information about the logic used and the expected consequences of such processing;
- pursuant to Article 16 GDPR, to obtain the rectification of inaccurate Data concerning them or, taking into account the purposes of the processing, to complete missing Personal Data;
- pursuant to Article 17 GDPR, to obtain the deletion of Personal Data if any of the following reasons exist: (i) the Data is no longer necessary in relation to the purposes it was collected or otherwise processed for; (ii) the Data is being processed unlawfully; (iii) the user has withdrawn the consent under which the Data Controller had the right to process the Data and there is no other legal basis for the Data Controller to process the Data; (iv) the user has objected to the processing and there is no overriding legitimate reason; (v) the Personal Data must be deleted to fulfill a legal obligation. However, the Company has the right to disregard the request to exercise the aforementioned cancellation rights if this is necessary for (a) the exercise of a legal obligation or the performance of a task performed in the public interest; or (b) to defend its own right in court;
- pursuant to Article 18 GDPR, to obtain the restriction to the Personal Data processing when one of the following occurs: (i) in the event that the user has disputed the accuracy of the Personal Data concerning them for the time necessary for the Controller to verify the accuracy of such Personal Data; (ii) in the event of unlawful Personal Data processing, if the user objects to its deletion; (iii) where it is necessary for the establishment, exercise or defence of a right in a court of law; (iv) for the time necessary to verify whether the Data Controller's legitimate reasons prevail over the user's request to object to the processing;
- pursuant to Article 20 GDPR, to receive the Personal Data provided to the Company and processed by it on the basis of consent or contract with the user in a structured, commonly used and readable format, as well as the right to transmit such data to another Data Controller without hindrance;
- pursuant to Art. 21 GDPR, for reasons related to the user’s particular situation, to object to the Data processing carried out on the basis of the legitimate interest of the Data Controller.
- to revoke consent for the personal data processing with consent as the legal basis.
Without prejudice to any other administrative or judicial remedy, the user also has the right to lodge a complaint with the Data Protection Authority (www.garanteprivacy.it) where they believe there has been a violation of their rights regarding Personal Data protection.