Notice pursuant to Article 13 of Regulation

(EU) 2016/679 (General Data Protection Regulation or “GDPR”)

Pursuant to Article 13 of the General Data Protection Regulation (Regulation (EU) 2016/679), we inform you that the data you provide to our organization will be processed as follows:

 Summary

  1. Data Controller
  2. Types of Data Processed
  3. What Data is Processed?
  4. Purposes and Legal Bases of Processing
  5. Processing Methods
  6. Data Provision
  7. Data Retention
  8. Data Communication
  9. Data Dissemination and Transfer Outside the EU
  10. Rights of the Data Subject

  1. Data Controller

The Data Controller is OriginalSkills Srl, P.I. 02477180513, with registered office at Loc. Vallone C. S. Ossaia 39/b, 52044 Cortona (AR), Italy. Email: info@originalskills.com.

The Data Controller has appointed a Data Protection Officer (DPO) within OriginalSkills Srl pursuant to Article 37 of the GDPR. You can contact the DPO at any time for information regarding the processing of your personal data at:

Data Protection Officer

OriginalSkills Srl, P.I. 02477180513, Loc. Vallone C. S. Ossaia 39/b, 52044 Cortona (AR), Italy. Email: info@originalskills.com.

  1. Types of Data Processed

The data processed are related to business processes and activities. Specifically, we inform you that the data processed include:

  1. Service Provision and Online Sales

Data provided through the completion of forms on the company’s website will be processed to enable responses from offices regarding product and service information and for the sale of products through commercial offers and promotions on the website. Additionally, data collected via the site may be used for sending informational newsletters or for activating technical support.

  1. Pre-contractual and Contractual Activity Management

OriginalSkills Srl will use the data provided to carry out all pre-contractual and contractual activities necessary to fulfill your request and for the execution of commercial contracts and other fiscal and operational obligations related to proper business management. Personal data provided may be processed to comply with legal obligations to which the Data Controller is subject (e.g., tax, accounting, anti-money laundering) and the directives issued by Authorities and Control Bodies applicable to the Data Controller.

  1. Internal Statistical Surveys

OriginalSkills Srl will use the data collected to conduct internal statistical surveys within the scope of its business activities. These statistical surveys will be used solely for internal reporting purposes to improve the Data Controller’s products and services and to implement more effective management of its client portfolio and operations.

  1. Informational and Commercial Campaigns

Personal data may be used by the Data Controller to carry out informational campaigns about product updates or to verify purchased products. The Data Controller may send promotions and offers on products and services related to those sold by OriginalSkills Srl exclusively via the email address or other contact details provided by the data subjects. OriginalSkills Srl reserves the right to publish, with the necessary consent, news related to its commercial activities on social media (LinkedIn, Facebook, etc.) and to tag official posts published by its clients, suppliers, employees, and collaborators.

  1. Marketing Activities and Quote Management for Prospects

Personal data collected through forms on the company’s website, social network profiles, telephone contacts, business card exchanges at trade fairs, seminars, meetings, and other personal business interactions may be processed directly by OriginalSkills Srl or by other controlled companies appointed as “Data Processors” to promote the services and products of OriginalSkills Srl. The subjects interested in this processing are those who request information through the website, phone, etc., known as “Prospects.”

  1. What Data is Processed ?

Depending on the circumstances and within the limits of the purposes mentioned in point 2 (a, b, c, d, e), the Data Controller processes the following categories of personal data:

  • Personal data (e.g., name, surname, place and date of birth, tax code);
  • Contact data (e.g., address, phone number, email, possible social profile, and company affiliation
  • with corporate name);
  • Contractual data (e.g., products and/or services purchased);
  • Bank details (of clients and suppliers for payments, invoices, and other obligations);
  • Image of the applicant (if provided);
  • Curricular data of job applicants;
  • Data related to collaboration activities with experts, consultants, professionals, and similar figures.

  1. Purposes and legal bases of processing

The data provided by the data subject as outlined in point 2 are processed for the duration of the contractual relationship and also subsequently for reasons related to contractual, fiscal, legal, and administrative obligations and for the optimization of business activities.

The legal basis for this processing purpose is the necessity to comply with legal obligations to which the Data Controller is subject. It would not be possible for the Data Controller to fulfill its legal obligations without using personal data. Therefore, the collection of personal data is necessary for the Data Controller to comply with contractual obligations and to protect its legitimate interests also in judicial and extrajudicial settings in case of contractual or extracontractual violations to the detriment of the Data Controller (e.g., actions for debt recovery).

Moreover, the legal basis for the processing purposes in cases 2.d and 2.e (commercial and marketing campaigns) is the consent provided from time to time, which will be specifically collected. If the data subject decides not to provide consent, no processing of their personal data will be carried out in relation to these specific purposes.

  1. Processing methods

The data provided will be processed with fairness, transparency, and lawfulness, in compliance with all the principles of Article 5 of the GDPR (specifically, data are: a) collected for specified, explicit, and legitimate purposes; b) collected to the extent necessary according to the principle of “data minimization”; c) accurately identified and updated when necessary; d) stored for the strictly necessary time; f) guaranteed by adequate security and protection measures) and using both manual and electronic tools.

The security and confidentiality of the personal data provided will be ensured by adopting appropriate measures to prevent, among others, the disclosure, unauthorized access, alteration, and loss of the information processed.

Processing is carried out by the Data Controller, the Data Processors, and/or the persons in charge of the processing.

  1. Data provision

The specific consent to the processing of personal data for the purposes in points 4.d) and e) is required. The processing of data that we are obliged to know is strictly necessary for carrying out the activities listed in point 2. Any refusal to provide personal data makes it impossible to carry out the activities mentioned in point 2.

  1. Data retention

The Data Controller will process personal data for the time necessary to fulfill the purposes outlined in point 4 and in any case for no longer than 10 years from the termination of the relationship.

Please note that any consent given can be revoked at any time by writing to the Data Protection Officer: info@originalskills.com.

  1. Data communication

Within the limits of the purposes mentioned in point 4, personal data may be communicated to the following categories of subjects, appointed as necessary Data Processors pursuant to Article 28 of the GDPR:

– Subsidiary companies;

– Concessionaires and/or distributors and partners of OriginalSkills Srl;

– Service providers for the management of IT systems and the Website;

– Service providers of legal, accounting, and tax consultancy;

– Companies that the Data Controller uses for the provision of the requested service (e.g., personnel selection and organizational consultancy);

– Banks and other financial institutions for the management of payments;

– Authorities and supervisory and control bodies and generally public or private entities with public functions.

Personal data provided may be known, within their respective competences, by employees, seconded or temporary workers, and collaborators of the Data Controller who will act as persons authorized to process data pursuant to Article 29 of the GDPR.

  1. Data dissemination and transfer outside the EU

The personal data provided will not be disseminated. The data will not be transferred to a third country (outside the EU) or international organizations.

  1. Rights of the data subject

By simple email communication indicated in point 1, you can exercise the rights under Articles 15 to 22 of the GDPR.

In particular, you can ask the Data Controller to access your data, modify and/or delete them, as well as restrict the processing in the cases provided for in Article 18 of the GDPR. According to the procedures specified in Article 21 of the GDPR, you can oppose the processing of your personal data at any time and receive and/or have transmitted to another Data Controller the information concerning you.

Please also note that any consent given will always be revocable with the same ease with which it was granted. The Data Controller will provide all requested information and/or communicate the actions taken to fulfill your request without undue delay and in any case no later than one month from the exercise of the right.

Finally, we inform you that, in the event of the exercise of one of the above rights, some information necessary to confirm your identity may be requested.

In case of complaints regarding the processing carried out by OriginalSkill Srl, the data subject may file a complaint with the Data Protection Authority by filling out the form available on the website ([https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9041356](https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9041356)).