text.skipToContent text.skipToNavigation

PERSONAL DATA PROCESSING INFORMATION NOTICE


PURSUANT TO ART. 13 OF (EU) REGULATION 2016/679 OF THE EUROPEAN PARLIAMENT AND THE COUNCIL OF 27 APRIL 2016 (“GENERAL DATA PROTECTION REGULATION”)

1.INTRODUCTION: THE ROLE OF CELLULARLINE SPA AND DATAEXPERT SRL IN THE PROCESSING OF PERSONAL DATA COLLECTED THROUGH THE CELLULARLINE AND INTERPHONE WEBSITES
2. IDENTITY AND CONTACT DETAILS OF DATAEXPERT AS THE INDEPENDENT DATA CONTROLLER
3. PROCESSING OF DATA BY DATAEXPERT FOR THE PURPOSE OF CONCLUDING AND PERFORMING THE PURCHASE AGREEMENT
4. PROCESSING OF DATA BY DATAEXPERT FOR THE PURPOSE OF CUSTOMER CARE/SERVICE
5. PROCESSING OF DATA BY DATAEXPERT FOR THE PURPOSE OF PREVENTING FRAUD IN THE EVENT OF PAYMENT BY CREDIT CARD
6. PROCESSING OF DATA BY DATAEXPERT FOR ADMINISTRATION/ACCOUNTING AND TAX PURPOSES
7. PROCESSING OF DATA BY DATAEXPERT FOR THE PURPOSE OF ALLOWING THE USER TO EXERCISE THEIR RIGHTS
8. PROCESSING OF DATA BY DATAEXPERT FOR THE PURPOSE OF THE ESTABLISHMENT, EXERCISE OR DEFENCE OF LEGAL CLAIMS
9. CATEGORIES OF SUBJECTS TO WHOM DATAEXPERT DISCLOSES THE USER’S PERSONAL DATA (RECIPIENTS)
10. TRANSFERS TO THIRD COUNTRIES
11. RIGHT TO OBJECT
12. RIGHT OF ACCESS
13. RIGHT TO RECTIFICATION
14. RIGHT TO ERASURE
15. RIGHT TO RESTRICTION OF PROCESSING
16. RIGHT TO DATA PORTABILITY
17. RESPONSE TIMES AND METHODS IN THE EVENT OF THE DATA SUBJECT EXERCISING THEIR RIGHTS
18. RIGHT TO LODGE A COMPLAINT WITH A SUPERVISORY AUTHORITY

1. INTRODUCTION: THE ROLE OF CELLULARLINE SPA AND DATAEXPERT SRL IN THE PROCESSING OF PERSONAL DATA COLLECTED THROUGH THE CELLULARLINE AND INTERPHONE WEBSITES
The following information notice is intended for all subjects that make purchases on the following e-commerce websites: cellularline.com/it, interphone.com/it, interphone.com/de, interphone.com/fr, interphone.com/es, interphone.com/uk (individually a “Website” and collectively “Websites”).
The websites are the property of CELLULAR LINE SPA (“CELLULAR LINE”) which is also the owner of the domain names and trade marks “Cellularline” and “Interphone”. As appointed by CELLULAR LINE the websites are managed by DATAEXPERT s.r.l. (“DATAEXPERT”) which sells the products with the trademarks “Cellularline” and “Interphone” promoted on the websites.
DATAEXPERT manages the sales and transactions performed through the Websites (e.g.: management of orders, sale and delivery of products, management of returns and the legal guarantee and other activities necessary for the sale of the products through the Websites). CELLULAR LINE provides the services that enable access, browsing and registration on the Websites.
CELLULAR LINE and DATAEXPERT will process the personal data you provide for registration on the Websites and respectively, for the conclusion of the purchase agreement through the Websites as independent data controllers (individually, an "Independent Data Controller" and collectively "Independent Data Controllers"), in compliance with the provisions of EU 679/2016 (the “Regulation”) and Italian Legislative Decree No. 196 of 30 June 2003 (the "Privacy Code"). 
Specifically:
-    CELLULARL LINE will process your personal data, as Independent Data Controller, in order to manage access to the services of the Websites and facilitate the purchase of products online and to enable your registration on the Websites and any conclusion of the purchase agreement through the Websites and, subject to your consent, for marketing and/or profiling purposes;
-    DATAEXPERT will process your personal data, as Independent Data Controller, in order to enable the conclusion of the purchase agreement, fulfil the obligations deriving from the agreement, to comply with all the legal obligations, including tax and administrative obligations, connected thereto and for all other purposes connected with such agreement and/or the performance of pre-contractual measures, as described herein;
The processing performed by CELLULAR LINE, as the Independent Data Controller, is described in the CELLULAR LINE Privacy Information Notice, to which reference is to be made, provided in the footer of the Websites under the link “Cellular Line Privacy Information Notice”. 
This information notice is therefore provided with exclusive reference to the processing performed by DATAEXPERT as the Independent Data Controller.

2.IDENTITY AND CONTACT DETAILS OF DATAEXPERT AS THE INDEPENDENT DATA CONTROLLER 
DATAEXPERT S.R.L. is the Independent Data Controller of the processing of the data provided by you for the conclusion of a purchase agreement through the Websites, for the purposes as per sections 4, 5, 6, 7, 8 and 9 of this information notice. The identification and contact details of DATAEXPERT are as follows: DATAEXPERT s.r.l. with registered office in Rome, via Ovidio 32, tax code and VAT No. 04352260964 and registration number with the Rome Companies Register 1557667;
-telephone number: 0331 48151
-email address: info@dataexpert.it

3.PROCESSING OF DATA BY DATAEXPERT FOR THE PURPOSE OF CONCLUDING AND PERFORMING THE PURCHASE AGREEMENT
DATAEXPERT, as the Independent Data Controller, will process your personal data: -to enable the conclusion of the purchase agreement through the Websites (e.g.: loading of products into the basket and choice of the payment method); -to fulfil the obligations undertaken by DATAEXPERT as a result of such agreement such as, by way of example, the delivery of the products sold;
-to enable you to fulfil the obligations undertaken by you as a result of the purchase agreement concluded through the Websites such as, by way of example, the online payment of the products purchased;
-to implement the pre-contractual measures requested by you (e.g.: notification of the availability of a product).
The lawful basis for this processing is the performance of the agreement (Art. 6.1.b) of the Regulation).
For this purpose, DATAEXPERT will process your data for the time strictly necessary for the performance of the individual processing activities (e.g. the data necessary for the performance of the purchase agreement, until the delivery of the product or, in the event of unsuccessful delivery, until the termination of the agreement), notwithstanding the fact that, after such date, DATAEXPERT may retain the data for the purposes and maximum storage periods specified in sections 4, 5, 6, 7, 8 and 9 of this information notice and/or however, in the cases established by the Regulation and/or by law.

Further Information
The provision of data for the specified purposes is optional: this means that there is not legal or contractual obligation to notify the data; it is, however, a necessary requirement for the conclusion of the purchase agreement through the Websites; failure to provide the data will therefore imply the impossibility for the user to conclude such agreement and therefore to make purchases through the Websites. 

4.PROCESSING OF DATA BY DATAEXPERT FOR THE PURPOSE OF CUSTOMER CARE/SERVICE
DATAEXPERT, as the Independent Data Controller, will process the users’ data for general customer care and service activities and therefore to provide a response to requests for information from users, i.e. to respond to complaints, reports and objections.
The lawful basis for this processing is the performance of pre-contractual measures adopted on request by the data subject (Art. 6.1.b, last paragraph, of the Regulation) or, according to the case, the legitimate interest of DATAEXPERT (Art. 6.1.f) of the Regulation).
A legitimate interest of DATAEXPERT is to respond to requests for information and/or reports and/or objections and/or complaints from users of the Websites (to whom DATAEXPERT is obliged to respond, also on the basis of the legislation set out in the Consumer Code). Such legitimate interest of DATAEXPERT also coincides with the legitimate interest of the users of the Websites who make the requests and/or reports and/or objections and/or complaints in question and who, therefore, within the context of the relationship with DATAEXPERT, can be considered to reasonably expect their data to be used by DATAEXPERT in order to provide them with a response.
The legitimate interest of DATAEXPERT, thus identified, can therefore be considered to prevail over the fundamental rights and freedoms of the data subject, also because of such reasonable expectations and the relationship existing between the data subject and DATAEXPERT and considering the nature of the processed data and the coinciding interest of the data subjects themselves.
In any case, you have the right, at any time, to object to the processing of your personal data for the purposes in question (i.e. customer care and service) for reasons connected with your personal situation.
To exercise such right, you can contact DATAEXPERT in the following ways: by email to info@dataexpert.it, or by writing to the headquarters of Dataexpert Srl Via Pomini 92, 21050 Marnate (VA).
Further Information
In the event of exercising the right to object to the processing of data for customer care/service purposes, DATAEXPERT abstains from any further processing of users’ personal data for such purpose, unless it can demonstrate the existence of compulsory legitimate reasons for proceeding with processing that prevail over the interests, rights and freedoms of the data subject, or for the establishment, exercise or defence of legal claims. 
The provision of personal data for the purposes in question is optional: this means that there is no legal and/or contractual obligation to provide the data; however, given the purpose of processing, failure to provide data and/or the exercise of the right to object can make it impossible to respond to requests and/or reports and/or complaints and/or objections from users, should the response to such requests imply the processing of the user’s personal data. 
For these purposes, DATAEXPERT shall process the user’s data for the amount of time necessary for performing the requested activities and, therefore, in particular, for the amount of time necessary for providing the information requested by the user or for responding to complaints and/or reports and/or objections put forward by the user.

5.PROCESSING OF DATA BY DATAEXPERT FOR THE PURPOSE OF PREVENTING FRAUD IN THE EVENT OF PAYMENT BY CREDIT CARD
DATAEXPERT, as the Independent Data Controller, shall process users’ personal data for the purpose of managing and possibly blocking payment transactions in relation to fraudulent orders, in the event of payment by credit card of the purchases made on the Websites. The data undergoing processing are data related to the order and data of the holder of the credit card used for payment, in the event in which DATAEXPERT requests a copy thereof in order to guarantee secure payment, as indicated in the general conditions of sale that regulate the purchase. The processing in question does not relate to confidential credit card data (card number, expiry date and security code) which, together with the name of the card holder, are acquired directly by the provider of the payment services.
The lawful basis for this processing is the legitimate interest of DATAEXPERT (Art. 6.1.f) of the Regulation).
In any case, you have the right, at any time, to object to the processing of your personal data for the purposes in question (i.e. prevention of fraud in the event of payment by credit card) for reasons connected with your personal situation.
To exercise such right, you can contact DATAEXPERT in the following ways: by email to info@dataexpert.it, or by writing to the headquarters of Dataexpert Srl Via Pomini 92, 21050 Marnate (VA).
For the purposes in question, DATAEXPERT shall process users’ personal data for [24 months from collection]. 
Further Information
In relation to the legitimate interest of DATAEXPERT, the user is informed of the following:
- a legitimate interest of DATAEXPERT consists of the performance of an activity, for fraud prevention purposes, in the event of online payment by credit card, to protect its own entrepreneurial interest, including the purpose of respecting the parameters defined by the international circuits in relation to the number of fraudulent payment attempts recorded on e-commerce websites. Such legitimate interest of DATAEXPERT further coincides with the legitimate interest of the users of the Websites, as potential victims of fraud, such as the general public, who, in turn, have a legitimate interest in guaranteeing that fraudulent activities are discouraged and identified when they occur; it can therefore be considered that, within the context of relations with DATAEXPERT, they reasonably expect their data to be processed also for the purpose of fraud prevention, for their protection and guarantee. 
- the provision of data for the purposes in question (i.e. for the purpose of preventing credit card fraud) is optional; this means that there is no legal or contractual obligation to provide such data for such purpose; however, failure to send a copy of a form of identification of the holder of the credit card with which the payment was made, where requested, implies the termination of the purchase agreement concluded through the Websites.
- for the purposes in question, DATAEXPERT also uses data initially collected for different purposes (and, notably, to enable the conclusion of the purchase agreement and the performance thereof) the processing of which for the purpose of preventing credit card fraud, is permitted, being based on the legitimate interest of DATAEXPERT, considering the compatibility of the purposes in question with the purpose for which the data were initially collected;
- in the event of exercising the right to object, DATAEXPERT abstains from any further processing of users’ personal data for such purpose, unless it can demonstrate the existence of compulsory legitimate reasons for proceeding with processing that prevail over the interests, rights and freedoms of the data subject, or for the establishment, exercise or defence of legal claims. 

6.PROCESSING OF DATA BY DATAEXPERT FOR ADMINISTRATION/ACCOUNTING AND TAX PURPOSES
DATAEXPERT, as the Independent Data Controller, will process users’ data for the purpose of fulfilling administrative and/or accounting and/or tax obligations, connected with the purchase agreement concluded through the Websites such as, by way of example, book-keeping and issuing sales invoices.
The lawful basis for this processing is compliance with the legal obligations to which DATAEXPERT is subject (Art. 6.1.c) of the Regulation). 
The provision of data for the purposes in question is compulsory as the processing thereof is necessary to enable DATAEXPERT to fulfil the legal obligations to which it is subject. Any refusal to provide data for this purpose shall imply the impossibility for the user to conclude the purchase agreement through the Websites.
For this purpose, DATAEXPERT shall process the user’s data until the expiry of the legal time limits envisaged for the performance of all the administrative/accounting and tax requirements and/or for the storage times envisaged by law for the storage of the related documentation.

7.PROCESSING OF DATA BY DATAEXPERT FOR THE PURPOSE OF ALLOWING THE USER TO EXERCISE THEIR RIGHTS 
DATAEXPERT, as the Independent Data Controller, shall process users’ data in order to:
-respond to requests to exercise the withdrawal right and/or requests to exercise the legal guarantee of conformity and/or other rights deriving from the purchase agreement concluded through the Websites and/or envisaged by law in relation to such agreement;
-perform the activities that prove to be necessary as a result of exercising such rights and proceed, if appropriate, to process the related refunds;
-receive and respond to requests to exercise rights in relation to personal data protection envisaged by the Regulation and perform the consequent activities.
The lawful basis for this processing is compliance with the legal obligations to which DATAEXPERT is subject (Art. 6.1.c) of the Regulation). 
Further Information
The provision of data for the purposes in question is compulsory as the processing thereof is necessary to enable DATAEXPERT to fulfil the legal obligations and the user to exercise the rights attributed thereto by law or by the agreement. Any refusal to provide data for this purpose shall imply the impossibility for the user to exercise such rights.
For this purpose, DATAEXPERT shall process the data until the expiry of the legal time limits envisaged for the exercise of the right (limitation period and/or time limit) i.e., in the event of exercising such rights, for the amount of time necessary for the handling and closure of the case; in the event of exercising the rights envisaged by the Regulation, the data shall be processed until the certification, from the Data Controller, that the request has been fulfilled or until the fulfilment itself, according to which of the two events takes place last.

8.PROCESSING OF DATA BY DATAEXPERT FOR THE PURPOSE OF THE ESTABLISHMENT, EXERCISE OR DEFENCE OF LEGAL CLAIMS
DATAEXPERT, as the Independent Data Controller, shall process users’ data for the establishment, exercise or defence of legal claims in all the relevant contexts.
The lawful basis for this processing is legitimate interest (Art. 6.1.f) of the Regulation).
The legitimate interest of the data controller is to pursue remedies in order to guarantee respect for its contractual rights i.e. to demonstrate that it has complied with the obligations deriving from the agreement with the data subject or imposed on the data controller by law. Such legitimate interest is in turn based on the constitutionally protected right to defence. It can be considered to prevail over the fundamental rights and freedoms of the data subject, also because of the reasonable expectations thereof.
In any case, the user has the right, at any time, to object to the processing of his/her personal data for the purposes in question (i.e. right to defence/purpose of legal proceedings) for reasons connected with his/her personal situation. 
To exercise such right, the user can contact DATAEXPERT in the following ways: by email to info@dataexpert.it, or by writing to the headquarters of Dataexpert Srl Via Pomini 92, 21050 Marnate (VA).
Further Information
It is hereby specified that, in particular, DATAEXPERT shall store and possibly use the data:
a) for the purposes of fulfilling the purchase agreement and/or for initiating or responding to actions in relation to such agreement before any administrative and/or jurisdictional authority and/or for protecting its own rights in the preparatory stages of the legal proceedings and/or trial; for these purposes, the data shall be stored for [10 years from the delivery of the product or from the termination of the agreement in the event of unsuccessful delivery of the product];
b) to prove that the exercise of the rights envisaged by the Regulation and/or by law has been enabled (e.g. withdrawal right; legal guarantee) and/or by the purchase agreement and that it has performed the related actions that are required by law and/or by the agreement (e.g. refund, in the event of exercising the withdrawal right);
c) to prove that it has responded to complaints and/or reports and/or objections from users;
d) in the event of exercising the rights envisaged by the Regulation, the data shall be stored for [5 years starting from the certification of having responded to the request from the data subject or from such response, if later];
e) in the event of exercising the rights envisaged by the purchase agreement or by law, the data shall be stored for [10 years, starting from the closure of the case or from the performance of the action that defines it] (e.g. refund in the event of withdrawal; or delivery of the replacement product, in the event of legal guarantee); closure of the case means the last correspondence related to the exercise of the rights in question);
f) in the event of complaints and/or reports and/or objections, the data shall be stored for [three years from the closure of the case], meaning from the last related correspondence.
It is also specified that: 
-the provision of data for this purpose is optional; there is no legal or contractual obligation that requires the data subject to provide data for this purpose;
-for the purpose in question, data initially collected for a different purpose are used, the further processing of which is permitted as it is based on the legitimate interest of the data controller, considering the compatibility of such further purpose with the initial purpose of the collection, also bearing in mind that, as the processing is necessary for the establishment, exercise or defence of legal claims, the data controller is also exempt from the erasure obligation, as specifically set out in the Regulation;
-in fact, in the event of exercising the right to object, the data controller abstains from any further processing of the personal data, unless it can demonstrate the existence of compulsory legitimate reasons for proceeding with processing that prevail over the fundamental interests, rights and freedoms of the data subject, or for the establishment, exercise or defence of legal claims.

9. CATEGORIES OF SUBJECTS TO WHOM DATAEXPERT DISCLOSES THE USER’S PERSONAL DATA (RECIPIENTS)
The personal data provided by the user may be disclosed by DATAEXPERT to the categories of recipients indicated below.
The subjects to which DATAEXPERT discloses the data act as external data processors appointed by DATAEXPERT through a relevant contract (“Data Processors”) or persons authorised to process personal data under the direct authority of DATAEXPERT (“Appointed Persons”) or in the event of third parties called upon by the Data Controller, as “Sub-Processors”, according to Art. 28.4 of the Regulation, except in cases in which the recipient acts as the independent data controller such as, for example, in the case of the Payment Service Provider or couriers.

Further Information
Users’ personal data may be disclosed by DATAEXPERT to the following categories of recipients:
- companies in the group to which DATAEXPERT belongs and/or to employees and/or collaborators of DATAEXPERT, for the performance of administration, accounting and IT and logistic support activities;
- companies, consultants or professionals that may have been appointed for the installation, maintenance, updating and, in general, management of the DATAEXPERT hardware and software, including providers of cloud computing and chat services, and the third parties of which they make use;
- companies that perform logistic support and/or warehousing and/or packaging and/or shipping and delivery or collection of the products purchased on the Websites and the third parties of which they make use; 
- Payment Service Providers and/or acquirers and/or banks in order to enable the payment of the purchases made on the Websites or the refund thereof, if appropriate, and the third parties of which they make use; 
- all subjects, including the public authorities, who have access to the data because of legislative or administrative provisions.
- all public and/or private subjects, natural and/or legal persons (legal, administrative and tax consultancy firms), should disclosure be necessary or functional to the correct fulfilment of the contractual obligations undertaken in relation to the purchases through the Websites and the obligations resulting from the law i.e. for the establishment, exercise or defence of legal claims.

The list of recipients is available at the DATAEXPERT registered office.

10. TRANSFERS TO THIRD COUNTRIES
User’s personal data are transferred by DATAEXPERT to the following third countries: India. 
The recipient of such data is Zoho Corporation PVL, LTD, supplier, together with Zoho Corporation B.V., of the Website chat service.
In relation to the transfer of data to India, the following is specified: 
•    there is no adequacy decision in relation to the guaranteed level of protection of data in India; 
•    in the absence of an adequacy decision, the data may only be transferred to the third country if the adequacy safeguards are provided as set out in Art. 46.2 of the Regulation, including the typical contractual clauses adopted by the Commission and/or by a national supervisory body; 
•    the transfer of data to India by DATAEXPERT takes place on the basis of the typical contractual clauses set out in "Commission Decision of 5 February 2010 on standard contractual clauses for the transfer of personal data to processors established in third countries under Directive 95/46/EC of the European Parliament and of the Council" [notified under document C(2010)87/EU] and therefore on the basis of the consequent "Authorisation for transfers to third countries through the standard contractual clauses set out in Commission Decision 2010/87/EU in case of an importer established in a third country" issued by the personal data protection supervisory authority on 27 May 2010 and 15 November 2012, still in force on the basis of Art 46.5 of the Regulation.

11. RIGHT TO OBJECT
The data subject has the right to object at any time, for reasons connected with his/her particular situation, to the processing of the personal data related to him or her for the purposes set out in sections 4, 5 and 8 of this information notice and based upon the legitimate interest of the data controller. 
The data subject can exercise the right to object by contacting DATAEXPERT in the following ways: by email to info@dataexpert.it, or by writing to the headquarters of Dataexpert Srl Via Pomini 92, 21050 Marnate (VA).

Further Information
In the event of exercising the right to object, the data controller abstains from any further processing of personal data, unless it can demonstrate the existence of compulsory legitimate reasons for proceeding with processing that prevail over the interests, rights and freedoms of the data subject, or for the establishment, exercise or defence of legal claims.
Return to the summary 
In the event of exercising the right to object, the data controller abstains from any further processing of personal data, unless it can demonstrate the existence of compulsory legitimate reasons for proceeding with processing that prevail over the interests, rights and freedoms of the data subject, or for the establishment, exercise or defence of legal claims.
Return to the summary

12. RIGHT OF ACCESS 
The data subject has the right to obtain from the data controller (and therefore from DATAEXPERT) confirmation that processing of data relating to him or her is taking place and, in that case, to obtain access to the personal data and information indicated below. 
The data subject can exercise the right of access by contacting DATAEXPERT in the following ways: by email to info@dataexpert.it, or by writing to the headquarters of Dataexpert Srl Via Pomini 92, 21050 Marnate (VA).

Further Information
In the event of exercising the right of access, the user can obtain access to the personal data and to the following information:
a)    the purposes of the processing;
b)    the categories of personal data concerned;
c)    the recipients or categories of recipient to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organisations;
d)    where possible, the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period; 
e)    the existence of the right to request from the controller rectification or erasure of personal data or restriction of processing of personal data concerning the data subject or to object to such processing; 
f)    the right to lodge a complaint with a supervisory authority;
g)    where the personal data are not collected from the data subject, any available information as to their source;
h)    the existence of automated decision-making, including profiling, which produces legal effects concerning the data subject or similarly significantly affects him or her and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject;
Where personal data are transferred to a third country or to an international organisation, the data subject shall have the right to be informed of the appropriate safeguards pursuant to Article 46 of the Regulation relating to the transfer. 
The controller shall provide a copy of the personal data undergoing processing. For any further copies requested by the data subject, the controller may charge a reasonable fee based on administrative costs. Where the data subject makes the request by electronic means, and unless otherwise requested by the data subject, the information shall be provided in a commonly used electronic form. 

13. RIGHT TO RECTIFICATION
The data subject has the right to obtain from the data controller (and therefore DATAEXPERT) the rectification of personal data concerning him or her without undue delay. Considering the purposes of processing, the data subject has the right to have incomplete personal data completed, including by means of providing a supplementary statement.
The data subject can exercise the right to rectification by contacting DATAEXPERT in the following ways [●].

14. RIGHT TO ERASURE
The data subject shall have the right to obtain from the controller (and therefore from DATAEXPERT) the erasure of personal data concerning him or her without undue delay and the controller shall have the obligation to erase personal data without undue delay where one of the following grounds applies:
a)    the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;
b)    the data subject objects to the processing based on the legitimate interest of the data controller for reasons connected with his/her particular situation (and therefore in the hypothesis of objection to processing for the purposes set out in sections 4, 5 and 8 of this information notice);
c)    the personal data have been unlawfully processed;
d)    the personal data have to be erased for compliance with a legal obligation in European Union or Member State law to which the controller is subject.
The data subject can exercise the right to erasure by contacting DATAEXPERT in the following ways: by email to info@dataexpert.it, or by writing to the headquarters of Dataexpert Srl Via Pomini 92, 21050 Marnate (VA).

Further Information
If the data controller has made public the personal data and is obliged to erase them, considering available technology and implementation costs - it adopts reasonable measures, including technical measures, to inform controllers processing personal data of the data subject’s request to delete any link, copy or reproduction of his or her personal data.
The right to erasure shall not apply to the extent that processing is necessary:
a)    for exercising the right of freedom of expression and information;
b)    for compliance with a legal obligation which requires processing by European Union or Member State law to which the controller is subject or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
c)    for reasons of public interest in the area of public health;
d)    for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in so far as the right to erasure is likely to render impossible or seriously impair the achievement of the objectives of that processing;
e)    for the establishment, exercise or defence of legal claims.

15. RIGHT TO RESTRICTION OF PROCESSING
The data subject shall have the right to obtain from the controller (and therefore from DATAEXPERT) restriction of processing where one of the following applies:
-    the accuracy of the personal data is contested by the data subject, for a period enabling the controller to verify the accuracy of the personal data;
-    the processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of their use instead;
-    the controller no longer needs the personal data for the purposes of the processing, but they are required by the data subject for the establishment, exercise or defence of legal claims;
-   the data subject has objected to processing in the processing hypotheses based on the legitimate interest of the data controller, for reasons connected with his/her particular situation (and, therefore, in the event of objecting to the processing of data for the purposes according to sections 4, 5 and 8 of this information notice), pending the verification whether the legitimate grounds of the controller override those of the data subject.
The data subject can exercise the right to restriction by contacting DATAEXPERT in the following ways: by email to info@dataexpert.it, or by writing to the headquarters of Dataexpert Srl Via Pomini 92, 21050 Marnate (VA).

Further Information
If the processing is restricted, the personal data subject to restriction are processed, other than for storage, only with the consent of the data subject or for the establishment, exercise or defence of legal claims or for safeguarding the rights of another natural or legal person or for reasons of substantial public interest, on the basis of European Union or Member State law.
The data subject that has obtained restriction of processing shall be informed by the controller before the restriction of processing is lifted.
Return to the summary

16. RIGHT TO DATA PORTABILITY
The data subject shall have the right to receive the personal data concerning him or her, which he or she has provided to a controller, in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller without hindrance from the controller to which the personal data have been provided, where:
a)    the processing is based on consent of the data subject or on a contract;
b)    the processing is carried out by automated means.
The data subject can therefore exercise the right in question in relation to the purposes according to the following sections of this information notice: 3. The data subject can exercise the right to data portability by contacting DATAEXPERT in the following ways: by email to info@dataexpert.it, or by writing to the headquarters of Dataexpert Srl Via Pomini 92, 21050 Marnate (VA).

Further Information
In exercising his/her right to data portability, the data subject shall have the right to have the personal data transmitted directly from one controller to another, where technically feasible.
The exercise of the right to data portability shall be without prejudice to the right to erasure. 
The right to data portability shall not adversely affect the rights and freedoms of others.

17. RESPONSE TIMES AND METHODS IN THE EVENT OF THE DATA SUBJECT EXERCISING THEIR RIGHTS
The controller shall provide to the data subject information on action taken on a request under Articles 15 to 22 of the Regulation (i.e. right of access, right to rectification, right to erasure, right to restriction of processing, right to data portability, right to object) according to sections 11, 12, 13, 14, 15 and 16 of this information notice (“Rights of the Data Subject”) without undue delay and in any event within one month of receipt of the request. That period may be extended by two further months where necessary, taking into account the complexity and number of the requests. The controller shall inform the data subject of any such extension within one month of receipt of the request, together with the reasons for the delay. Where the data subject makes the request by electronic means, the information shall be provided by electronic means where possible, unless otherwise requested by the data subject.

Further Information
If the controller does not take action on the request of the data subject, the controller shall inform the data subject without delay and at the latest within one month of receipt of the request of the reasons for not taking action and on the possibility of lodging a complaint with a supervisory authority and seeking a judicial remedy.
Any communications in response to the exercise of the Rights of the Data Subject and actions taken shall be provided free of charge. Where requests from a data subject are manifestly unfounded or excessive, in particular because of their repetitive character, the controller may either:
a)    charge a reasonable fee taking into account the administrative costs of providing the information or communication or taking the action requested;
b)    refuse to act on the request.
Where the controller has reasonable doubts concerning the identity of the natural person making the request in relation to the Rights of the Data Subject, the controller may request the provision of additional information necessary to confirm the identity of the data subject.

18. RIGHT TO LODGE A COMPLAINT WITH A SUPERVISORY AUTHORITY
Without prejudice to any other administrative or judicial remedy, every data subject shall have the right to lodge a complaint with a supervisory authority, in particular in the Member State of his or her habitual residence, place of work or place of the alleged infringement if the data subject considers that the processing of personal data relating to him or her infringes this Regulation. The supervisory authority with which the complaint has been lodged shall inform the complainant on the progress and the outcome of the complaint including the possibility of a judicial remedy.