Subject: Information document regarding data protection laws and the protection of privacy.
HRV.Swiss Sagl (hereinafter “HRV.SWISS”) with registered office in Capriasca (Switzerland) In Giágh Piánca 19, 6953 Lugaggia (Canton Ticino) – VAT number CHE-463.882.940 – VAT, registered in the Commercial Register Canton Ticino CH-501.4.020.903-2,
- Federal Data Protection Act (LPD): hereafter LPD. A framework law that allows a large margin of maneuver in judging data protection violations and personality injuries. The evaluation of the individual case is in the foreground. By single case we mean here not the single case of an interested person but certain data processing and if the problems that can result, if they are technical or organizational in nature. In essence, being able to govern the dynamics of information technology thanks to which it is possible to instantly collect and connect huge amounts of data.
- European Regulation n.2016 / 679 on the protection of personal data: hereinafter the “EU Regulation”, which provides the rights to the protection of personal data and guarantees its treatment in respect of fundamental rights and freedom, as well as dignity of the interested party, with particular reference to confidentiality and security, personal identity and the right to protection of personal data.
The references to the “treatment” of personal data refer to:
- LPD (Swiss Federal Data Protection Act): art. 34, 35, 3 and 15 on data protection
- Art 4, paragraph 1, and 2 of the EU Regulation (European Community),
Purpose: The purpose of these laws is to protect the personality and fundamental rights of the persons whose data are being processed.
Scope: data processing of natural and legal persons, in the context of the normal activities of an organization that provides training courses services;
Definitions and Meaning:
- personal data: all information relating to an identified or identifiable person;
- interested persons: natural or legal persons whose data are being processed;
- personal data worthy of particular protection: data relating to activities relating to training, surveillance and compliance of certification exams;
- Treatment: mainly the collection, storage, use, modification, communication to third parties, storage or destruction of data;
- communication: the fact of making the data accessible, for example the authorization of the consultation, transmission or diffusion;
- data collection: each complex of personal data whose structure allows to search for data according to the people concerned;
- Holder of a data collection: the private person or body that decides on the purpose and content of the data collection;
- federal laws (Confederation): binding decisions for Switzerland of international organizations and international agreements with regulatory content approved by the Federal Assembly.
- European Community regulations: objective regulation of abstract situations. The general scope of the regulation implies that this type of act has in principle the same territorial scope as the Treaties, that is to say the territory of the Member States. The regulation is mandatory in all its elements;
Personal data processing means any operation or set of operations, carried out with or without the aid of automated processes and applied to personal data or sets of personal data, such as the collection, registration, organization, structuring, the storage, adaptation or modification, extraction, consultation, use, communication by transmission, dissemination or any other form of making available, comparison or interconnection, limitation, cancellation or destruction .
HRV.SWISS in its capacity as Data Controller, in the person of its pro tempore legal representative, pursuant to and for the purposes of Article 13 of EU Reg. No. 2016/679, hereby
the natural person who operates on behalf of the “Customer” (as defined in the Contract) and is expressly involved in the stipulation / execution of the Contract of which this information constitutes an inseparable attachment, later defined as Interested, which, in relation to the Contract for the performance to the Customer of services of HRV.SWISS or of subsidiaries / associates or of commercial partners of which this Information is an inseparable attachment, will need to process your data based on what is illustrated in the following articles:
- DATA OBJECT OF PROCESSING AND PURPOSE OF DATA PROCESSING
The personal data processed are common personal data, collected in the manner and for the activities provided for in the Contract and / or through agents / employees / collaborators of HRV.Swiss and / or in any case provided by you voluntarily and in association with this information. The treatment will be based on the principles of correctness, lawfulness and transparency, protecting your privacy and your rights, in accordance with company regulations, as well as technical procedures on the use and access to data of company electronic tools, e-mail and the Internet.
The processing of personal data is aimed at fulfilling the obligations and exercising the customer’s specific rights for the purpose of fulfilling the obligations deriving from the law, the contract, uses or customs, and, by way of example, it will be carried out for the following purposes:
- Provide the services of HRV.SWISS or marketed by HRV.SWISS and its subsidiaries and associates or marketed by them under the contract mentioned in the introduction;
- To fulfill your commercial and information requests;
- Provide you with support and advice on the activated services;
- Eseguire le attività necessarie alla gestione ed estinzione dei rapporti contrattuali con;
- Carry out the activities necessary for the management and extinction of the contractual relationships with HRV.SWISS / its associated subsidiaries / me, where consent is given to the transfer of data to third parties, its commercial partners, in compliance with legal obligations and in fulfillment of the obligations arising from the contract, or from EU legislation, in particular for the purposes of compliance with tax legislation, social security and assistance, including supplementary, or in matters of hygiene and safety of the workplace or of the population, as well as in tax matters, of protection of the health, order and public safety
- Keep the information updated within the company archives, available to both HRV.Swiss employees and the network of HRV.Swiss agents and collaborators, with a strict prohibition on transferring to third parties;
- evaluate and send via telephone / e-mail / postal communications or other digital communication channels, also direct proposals from commercial partners in relation to initiatives or services marketed directly and not by HRV.Swiss and its subsidiaries and associates, including through insertion in dedicated mailing lists or newsletters, where you give optional consent;
- make direct proposals of products / services by commercial partners, relating to consultancy or training services
- LEGAL BASIS OF THE PROCESSING, OBLIGATORY OR OPTIONAL NATURE OF THE PROVIDING OF DATA AND CONSEQUENCES OF ANY REFUSAL
The provision of your personal data is mandatory for the provision of the requested services as well as for the fulfillment of obligations under the applicable laws and for the protection of the legitimate interest of HRV.SWISS to defend its rights, pursuant to and for the purposes of art. 6, paragraph, 1, lett. b), c) and f) of the EU Regulation. As for the possible processing of so-called data details, it will be carried out, only where strictly necessary, in the cases provided for by art. 9, paragraph 2, lett. b), c) and g) of EU Regulation n.2016 / 679. Your refusal to provide data for the purposes identified above will make it impossible to enter into and subsequently manage the contractual relationship for the services requested.
You can instead choose optionally and additionally, with respect to the consents necessary for the provision of the requested services, pursuant to and for the effects of art. 6, paragraph 1, lett. a) and f) of the EU Regulation, whether to also authorize the processing for the purposes of commercial proposals and information by HRV.SWISS.
The lack of consent, where required, will make it impossible to process the data for the individual purposes for which it is not provided.
- METHODS OF DATA PROCESSING
The processing of all acquired data will be carried out using paper and IT tools in compliance with the provisions on the protection of personal data and, in particular, with the security measures, pursuant to art.32 of the EU Regulation, with the compliance with any precautionary measure that guarantees its confidentiality and security.
DATA RETENTION PERIOD
All the data covered by this information will be processed and stored by the Data Controller and by the persons appointed as Data Processors, Internal Referrals and Authorized to the treatment, in compliance with the principle of proportionality, for the period of time strictly necessary for each identified purpose, assessed in 24 months from the last contact or from the termination of the reference contractual relationship, always without prejudice to the retention obligations for additional periods, foreseen by the penal, fiscal and financial legislation (which foresee a maximum time of 10 years from their acquisition and / or from the termination of the contract) and / or due to requests from the competent Authorities.
- COMMUNICATION SCOPE AND SPREADING OF PERSONAL DATA
Your personal data may be communicated, in close relation to the purposes indicated above and the consents given, to the following subjects or categories of subjects, both in Switzerland, both in the European Union and outside of these contexts:
- banking institutions, for the purpose of paying contractual fees;
- consultants (both natural and legal persons) or suppliers to whom the Data Controller should entrust assignments for the performance of some outsourcing activities;
- any subsidiaries or associates of HRV.Swiss, also in Switzerland and within the European Union;
- subjects operating in sectors of privacy or IT interest, to contractual counterparties and related defenders and, in general, to all those subjects to whom communication is necessary for the correct fulfillment of the purposes indicated above;
- any other subjects in favor of whom the obligation to communicate is envisaged, in compliance with the provisions of the current legal and contractual legislation;
- company employees and / or collaborators specifically appointed as managers, referents and / or authorized to process pursuant to articles 28 and 29 of the EU Regulation.
All treatments carried out by third parties with respect to the Data Controller will be duly authorized by the Data Controller in the forms of law, and will take place in compliance with the regulations on security and privacy. Your personal data will not be disclosed, unless required by a law or regulation or by community legislation.
- SECURITY MEASURES
Your data are processed in a lawful and correct manner, by adopting the appropriate security measures to prevent unauthorized access, disclosure, modification or unauthorized destruction of data. HRV.SWISS, specifically, has implemented suitable measures to protect your personal data from accidental loss and from unauthorized access, use, modification and disclosure.
In the unlikely event that HRV.SWISS believes that the security of your personal data, in possession or under the control of the company, has been or may have been compromised, the same will inform you of the incident in the manner prescribed by current law, using the methods prescribed by it.
- DATA CONTROLLER, DATA PROTECTION OFFICER AND DATA PROCESSING OFFICERS
The Data Controller is HRV.SWISS Sagl (hereinafter also referred to as “HRV Swiss”) with registered office in Capriasca (Switzerland), Giágh Piánca 19, 6953 Lugaggia (Canton Ticino) – VAT number CHE-463.882.940 – VAT, registered in the Commercial Register of the Canton Ticino carrying CH-501.4.020.903-2.
The Data Protection Officer (DPO) to contact, for the exercise of your rights, is Alberto Ciardelli, who can be contacted via e-mail address firstname.lastname@example.org, and / or at the contact details indicated over time by the Owner.
The updated list of all Data Processors appointed over time is available at the Data Controller’s registered office and will be provided upon written request, in the forms provided for by law.
- RIGHTS RECOGNIZED BY THE INTERESTED PARTY
At any time, you can exercise your rights towards the Data Controller or Data Processor pursuant to Chapter III (articles 12-22) of the Regulation.
In particular, as an interested party, you have:
- the right to receive information about:
- the origin of personal data;
- the purposes and methods of treatment;
- the logic applied in case of treatment carried out with the aid of electronic instruments;
- the identity of the owner, manager and the designated representative in the territory of the State, where applicable;
e.. the subjects or categories of subjects to whom the personal data may be communicated or who can learn about them as appointed representative in the territory of the State, managers or agents.
- the right to access personal data contained in paper and / or electronic archives;
- the right to request their rectification, updating and cancellation, if incomplete or incorrect, as well as to oppose their treatment for legitimate and specific reasons;
- the right to obtain the correction of inaccurate personal data without undue delay. Taking into account the purposes of the processing, you also have the right to obtain the integration of incomplete personal data, possibly providing a specific supplementary declaration;
- the right to obtain the deletion of personal data concerning him without undue delay if there is one of the reasons referred to in art. 17, paragraph 1 of the EU Regulation;
- the right to object to the treatment and / or to obtain the limitation of the treatment when one of the hypotheses referred to in art. 18, paragraph 1, of the EU Regulation;
- the right to lodge a complaint with a supervisory authority;
- the right to data portability within the limits and in the ways provided for by art. 20 of the EU Regulation
The rights summarized above are exercised with a request addressed without formalities to the Data Controller, the DPO and / or the Manager, to whom appropriate feedback is provided without delay. The request addressed to the Data Controller, the DPO or the Manager can also be sent by registered letter, fax or e-mail.
The interested party can request a copy of the personal data being processed by contacting the offices of the data controller or sending the relevant request to the email address email@example.com.
The interested party, through the aforementioned inbox, can also request the data controller to correct or delete personal data, as well as oppose their processing or request their limitation (all compatibly with the purposes of the processing itself).
The exercise of the rights referred to in the previous points is not subject to any form constraint and is free of charge.
HRV.Swiss is required to provide an answer within one month of the request, extendable up to three months in case of particular complexity of the request.
- REPRESENTATIVE OF THE DATA CONTROLLER NOT ESTABLISHED IN THE EUROPEAN UNION.
HRV.Swiss Sagl with registered office in Capriasca (Switzerland), In Giágh Piánca 19, 6953 Lugaggia (Canton Ticino) – VAT number CHE-463.882.940 – VAT, registered in the Commercial Register of the Canton Ticino reporting CH-501.4.020.903- 2 appointed Alberto Ciardelli, representative of the data controller not established in the European Union, domiciled at the registered office of HRV.SWISS reachable by email at firstname.lastname@example.org