Privacy policy pursuant to Legislative Decree 196/2003 and European Regulation 2016/679 (GDPR) for the processing of personal data

1. Preface

Marco Letizi, hereinafter referred to as the Data Controller, provides information on the use and processing of personal data provided by the Data Subject or otherwise acquired through interaction with the pages of the website www.esgcompliance.it, in compliance with the provisions of the legislation on the protection of personal data.

2. Data Controller

If you have any questions regarding our privacy policy, please contact us at marcoletizi@esgcompliance.it.

3. Type of data processed

The personal data collected from the website, either independently or through third parties, includes: name, surname, email address, telephone number, address, tax code, and VAT number. Personal data may be freely provided by the data subject or, in the case of technical necessity, collected automatically during use of the website. Personal data may be freely provided by the Data Subject or, in case of technical necessity, collected automatically during use of the website. If the data is considered optional, the Data Subject is free to refrain from providing such data, without this having any consequence on the availability of the service or its operation. Any use of cookies or other tracking tools by the website or by the owners of third-party services used by the website, unless otherwise specified, is for the purpose of providing the service requested by the data subject, in addition to the further purposes described in this document and in the Cookie Policy. The Data Subject assumes responsibility for the personal data shared through the website, releasing the Data Controller from any liability to third parties. It is possible to visit the website anonymously.

4. Legal basis

The Data Controller processes personal data relating to the Data Subject if one of the following conditions applies:
• the Data Subject has given consent for one or more specific purposes;
• processing is necessary for the performance of a contract with the Data Subject and/or for the implementation of pre-contractual measures;
• processing is necessary to comply with a legal obligation to which the Data Controller is subject;
• processing is necessary for the performance of a task carried out in the public interest by the Data Controller;
• processing is necessary for the purposes of the legitimate interests pursued by the Data Controller or by a third party.

5. Purpose of Processing 

The Data Subject's data is collected to allow the Data Controller to provide its services, and also for the following purposes: collection of website statistics (e.g., Google Analytics), contact with the Data Subject (contact forms, newsletter service, and/or quote request), display of content from external platforms (e.g., social networks).

Website statistics
The services contained in this section allow the Data Controller to monitor and analyze traffic data and are used to track the behavior of the Data Subject. Google Analytics is a web analytics service provided by Google Inc. (“Google”). It uses the personal data collected for the purpose of tracking and examining the use of this website, compiling reports and sharing them with other services developed by Google, contextualizing and personalizing the ads of its advertising network.

Contact form / Request a quote / Newsletter
By filling in the contact forms on the website with their personal data, the data subject consents to their use in order to receive a response to requests for information, quotes, or any other nature indicated in the form header. By consenting to registration, the mailing list, or the newsletter, the email address of the interested party is automatically added to a list of contacts to whom emails containing information, including commercial and promotional information, about this website may be sent.

External platforms' content
These services allow (directly from the pages of the site) to interact with social networks or other external platforms,
to view content hosted on external platforms and to interact with them. The interactions and information acquired by
questo sito sono, in ogni caso, soggette alle impostazioni privacy dell’Interessato relative ad ogni social network. Nell’ipotesi in cui sia
installato un servizio di interazione con i social network, è possibile che, anche nel caso in cui gli utenti non utilizzino il servizio, lo stesso raccolga dati di traffico relativi alle pagine in cui è installato.

6. Processing methods and retention period

The data is processed electronically and/or on paper, in compliance with the principles established by personal data protection legislation. Processing is carried out after adopting all security measures, both technical and organizational, appropriate to the risks to fundamental rights and freedoms. The data is processed at the Data Controller's operational headquarters and in any other place where the parties involved in the processing are located. The personal data of the Data Subject may be transferred to a country other than the one in which the Data Subject is located. The processing operations are carried out by persons authorized by the Data Controller to access the information, who will be adequately trained in the protection of personal data and designated as data processors. The data is processed and stored for the time required for the purposes for which it was collected.
Therefore:
• Personal data collected for purposes related to the execution of a contract between the Data Controller and the Data Subject is retained until the execution of that contract is completed;
• Personal data collected for purposes related to the legitimate interest of the Data Controller is retained until such interest is satisfied;
• When the processing is based on the consent of the Data Subject, the Data Controller may retain the personal data for a longer period until such consent is revoked. Furthermore, the Data Controller may be required to retain personal data for a longer period in compliance with a legal obligation or by order of an authority. At the end of the retention period, personal data is deleted. Therefore, upon expiry of this period, the right of access, deletion, rectification, and portability of data can no longer be exercised.

7. Categories of subjects to whom the data may be disclosed

The mandatory data provided will not be disclosed in any way and may be communicated or made accessible, exclusively for the purposes illustrated, to other companies involved in the maintenance of IT systems, as well as to subjects involved in specific stages of processing, as independent data controllers, including external ones, duly designated by the Data Controller, whose names and qualifications are available upon request by the interested parties, as well as to subjects whose right to access the data is recognized by law.

8. Rights of the data subject

The GDPR grants a series of rights to protect the personal data of the data subject: the right to access information concerning them; the right to be informed about the methods and purposes of the processing to which such information is subject; the right to rectify data, if inaccurate or out of date; the right to erasure, objection to processing or restriction, if the conditions laid down by the legislation are met; the right to obtain the portability of personal data provided, if processed by automated means on the basis of consent or the need to execute a contract. If the processing is based on consent, the data subject always has the right to withdraw it: this does not invalidate the processing carried out by the Data Controller up to that point.