INFORMATION on ART 13 of the G.D.P.R.
Pursuant to and for the effects of art. 13 of the New Data Protection Regulation (GDPR 2016/679), we inform the Customer (so-called interested party) that:
1. Owner and other designated persons
The data controller is Il Ponte - Casa D'aste S.r.l. , with registered office in Milan, Via Pontaccio n. 12, in the person of the director, Dr. Rossella Novarini, mail: direzione.generale@ponteonline.com. For the purpose of replying to the interested party in case of exercise of rights by the latter, it is possible to contact Francesca Conte, mail: .
The appointed DPO is Programmastudio Spa, in the person of the Dr. Pasquale Iannone,
tel. 02 2829389, mail: .
2. Treatment and legal basis
Personal data, freely provided by the Customer to the company on the basis of the activity carried out by virtue of specific contractual regulations, will be treated in a lawful manner, according to correctness, and in accordance with the provisions of the Regulations, for the purpose of:
fulfilling the mandate to sell and / or participating in the scheduled auctions;
for the purposes established by the current anti-money laundering legislation (Legislative Decree 231/07 and subsequent amendments).
The provision of the above data is mandatory for the holder to be able to carry out the task assigned to him. In case of refusal to provide the requested data, the holder will find it impossible to perform the contractually provided services, due to fact and fault of the Customer concerned.
Personal data such as e-mail address, provided optionally by the Customer to the company on the basis of a specific consent issued by the same, will be processed in a lawful and correct manner, as well as in accordance with the Regulation for the purposes of forwarding information, updates and news regarding new auctions and / or future events.
For this purpose the company will collect the consent with electronic and /or written modalities.
The image will be recorded, by means of a video recording system and as per reported information, in the legitimate interest of the Owner, or in order to protect the safety of persons and the protection of the company's assets.
3. Processing tools and data storage methods
The data processed (which may be: common and identifying) are updated, complete, relevant and not excessive with respect to the aforementioned purposes of processing.
The same data will be processed, in compliance with the security and confidentiality required through the following procedures: collection of data from the interested party, registration and storage of the same for predetermined, explicit and legitimate purposes. The same data will be processed using both paper and electronic and automated means.
Personal data will be processed by the Data Controller as well as by employees and collaborators authorized to process the data.
The data may be communicated, to the public bodies recipients of the communications /declarations object of the present contract, as well as to the appointed inspection persons, where required, during the verification and control phases related to the regularity of the fulfilments.
The same data, object of this information, can be communicated to professionals and /or collaborators of the holder for the accomplishment of the assigned task and for the same purposes. Moreover, the data in question will not be disseminated beyond the limits specified therein, unless otherwise indicated by the interested party, provided in writing.
It is not the intention of the Data Controller to transfer the data object of this letter to a third country or to an international organization. It should be noted that the external backup is also performed by an Italian company, therefore also required to comply with the privacy legislation in question, through the use of server sites on Italian territory.
There is no automated decision making process.
Finally, the interested party is informed that the Data Controller has set up a great variety of security measures to protect data against the risk of loss, misuse or alteration.
4. Data retention period
The data, subject of this information, will be kept:
- for 10 years (ten years) from the conclusion of the contractual relationship,
for treatment with a contractual legal basis;
- 5 years from the withdrawl of consent for treatment with a consensual basis;
- no more than 72 hours, relative to the treatment of images of the
video surveillance.
5. Rights of the interested party
The interested party has the right:
to ask the Data Controller to confirm or not the possession of personal data concerning himself, even if not yet registered, and their communication in an intelligible form, as well as access to personal data, its possible updating or integration, correction or the cancellation of the same, the transformation of the same in anonymous form or the blocking of those treated in violation of the law, the limitation of the processing that concerns himself or to oppose its treatment, in addition to the right to data portability. The interested party also has the right to obtain an indication of the origin of personal data, its purpose and the methods of treatment, as well as the logic applied in case of treatment carried out with the aid of electronic instruments;
He may also object in whole or in part to the processing of data concerning him for the purpose of sending advertising material, direct sales or market research or commercial communications;
He has the right to withdraw the consent at any time, without prejudice to the lawfulness of the processing performed on the basis of the consent given prior to the revocation, as well as the right to place a complaint with a supervisory authority.