Further information for users

Legal basis for processing

The Owner may process Personal Data relating to Users in any of the following cases, if:

• Users have given their consent for one or more specific purposes.
• the provision of Data is necessary for the performance of an agreement with the User and/or for any pre-contractual obligations thereof;
• the processing is necessary to comply with a legal obligation incumbent on the Owner;
• the processing is related to a task carried out in the public interest or in the exercise of official authority vested in the Owner;
• the processing is necessary for the protection of the legitimate interests of the Owner or third parties.

In any case, the Owner is happy to clarify the specific legal basis applicable to the processing, and in particular whether the provision of Personal Data is a legal or contractual obligation, or a necessary requirement to enter into an agreement.

Further information on retention time

Unless otherwise indicated in this document, Personal Data is processed and stored for as long as necessary for the purpose for which it was collected and may be kept longer pursuant to an applicable legal obligation or based on User consent.
Therefore, the following applies:

• Personal data collected for purposes related to the performance of an agreement between the Owner and the User will be retained until that agreement is fully executed.
• Personal data collected for the legitimate interests of the Owner are retained for as long as necessary to fulfill these purposes.
  Users can find specific information about the legitimate interests pursued by the Owner in the relevant articles of this document or by contacting the Owner.

The Owner may be permitted to retain Personal Data for a longer period when the User has consented to such processing, so long as such consent is not withdrawn.
In addition, the Owner may be required to retain Personal Data for a longer period when necessary to comply with a legal obligation or by order of a government agency.
At the end of the retention period, Personal Data will be deleted.
Therefore, the right to access, the right to erasure, the right to rectification and the right to data portability cannot be imposed after the expiration of the retention period.

Rights of Users under the General Data Protection Regulation (GDPR)

Users may exercise certain rights with respect to their Data processed by the Owner.
In particular, to the extent permitted by law, Users have the right to do the following:

• Withdraw their consent at any time.
  Users have the right to withdraw their consent if they have previously given their consent to the processing of their Personal Data.
• Object to processing of their Data. Users have the right to object to the processing of their data if the processing is carried out on a legal basis other than consent.
• Access their Data. Users have the right to know whether the Owner is carrying out the Data Processing, to know about certain aspects of the processing and to obtain a copy of the Data being processed.
• To check and request rectification. Users have the right to verify the accuracy of their Data and to request its updating or rectification.
• Limit the processing of their Data. Users have the right to limit the processing of their Data.
  In this case, the Owner will not process their Data for purposes other than storing it.
• Have their Personal Data erased or otherwise deleted. Users have the right to have the Owner erase their Data.
• Receive their Data and have it transferred to another Controller. Users have the right to obtain their Data in a structured, common and machine-readable form and, if technically possible, to transfer that Data to another controller, without interference.
• Filing a complaint. Users have the right to file a claim with their competent data protection authority.

Users are also entitled to information about the legal basis of the transfer of Data abroad, including to an international organization under public international law or established by two or more countries, such as the UN, and about the security measures taken by the Owner to protect their Data.

Learn more about the right to object to processing

When Personal Data are processed in the public interest, in the exercise of public authority vested in the Owner or for the purpose of the legitimate interests of the Owner, the User may object to such processing by providing a reason related to his or her specific situation to justify the objection.

Users should be aware, however, that if their Personal Data is processed for direct marketing purposes, they may object to such processing at any time without giving reasons and free of charge.
If the User objects to processing for direct marketing purposes, the Personal Data will not be further processed for these purposes.
Users can find out whether the Owner processes Personal Data for direct marketing purposes in the relevant articles of this document.

How to exercise these rights

Requests to exercise User Rights may be addressed to the Owner using the contact information provided in this document.
These requests are free of charge and will be processed by the Owner as soon as possible and always within one month, providing the User with the information required by law.
Any rectification or erasure of Personal Data or restriction of processing will be communicated by the Owner to any recipient of such Personal Data, unless this proves impossible or requires disproportionate effort.
Upon the request of Users, the Owner shall notify Users of such recipients.

Definitions and legal framework

Most recent update: July 23, 2024