INFORMATION on the processing of personal data
Articles 12 and following of Regulation (EU) 2016/679 (GDPR)
PREFACE
In compliance with the provisions of EU Regulation 2016/679 (hereinafter GDPR), we provide below the information regarding the processing of personal data provided by the data subject, in relation to the relationships with the Data Controller.
The Data Controller has developed a software platform dedicated to offering online services for managing corporate personnel (the "Platform"). Through the Platform, Clients have the ability to manage staff absences, track their presence even remotely, and manage the activities of their external collaborators.
The Client may use the Platform only after prior registration and the creation of an account by their representative. After this first step, the representative designated by the Client will proceed to create a Business Profile. Subsequently, the Client's staff will receive an invitation to register on the Platform to create their own account linked to the Business Profile.
The information is provided pursuant to Article 13 of the GDPR.
1. IDENTITY AND CONTACT DETAILS
Fluida will operate as Data Controller for the management of data related to the registration on the Platform. In this regard, Fluida will operate as Data Processor for the management of the data associated with the Business Profile account.
Fluida Europe Srl can be contacted at the following addresses: Via Carlo Imbonati 18, 20159 Milan (MI) - email: info@fluida.io.
2. CONTACT DETAILS OF THE DATA PROTECTION OFFICER (DPO)
The Data Protection Officer is ZHolding Spa, represented by Dr. Mario Brocca, tel. 0371/5943191, email: dpo@zucchetti.it; pec: dpogruppozucchetti@gruppozucchetti.it
3. PURPOSE OF THE PROCESSING, LEGAL BASIS, AND DATA RETENTION PERIOD
a) Registration of a user account for access to the Platform
Necessary for the creation of a Business Profile and for interaction with the Platform.
Type of data processed: Personal data, contact data (email, address, phone) of the Client's representative.
Legal basis: Performance of a contract to which the Client is a party or pre-contractual measures taken at their request; compliance with legal obligations. Article 6(1)(b) and (c) GDPR.
Retention period: For the time necessary to fulfill the purposes and in any case for 10 years from the end of the contractual relationship with the Client.
b) Direct Marketing
Sending newsletters, commercial communications, and/or advertising material on products and services offered by Fluida, for the assessment of satisfaction with the quality of services and for statistical analyses on aggregated data.
Type of data processed: Personal data, contact data (email, address, phone) of the Client's representative.
Legal basis: Consent (required by contract or specific request); (optional and revocable at any time). Article 6(1)(a) GDPR.
Retention period: For the time necessary to fulfill the purposes and in any case for 24 months from the date of data collection.
c) Assessment of satisfaction with service quality and statistical analysis
Type of data processed: Personal data, contact data (email, address, phone) of the Client's representative.
Legal basis: Legitimate interest.
Retention period: For the time necessary to fulfill the purposes and in any case for 24 months from the date of data collection.
d) Support for requests for information
Received through the completion of forms present on the site. The personal data you provide will be processed solely to fulfill your request for access to the service, or for receipt, via the WhatsApp Business messaging channel and/or phone communications.
Type of data processed: Data provided voluntarily by the user.
Legal basis: Express consent.
Retention period: Until the withdrawal of consent for this purpose and/or after five years from the expression of consent.
4. OBLIGATORY NATURE OF DATA PROVISION
The data subject must provide the Data Controller with the necessary data for the execution of the contractual relationship, as well as the data necessary to comply with obligations set out by laws, regulations, community standards, or by provisions of Authorities authorized by law and by supervisory and control bodies.
Data that are not essential for the performance of the contractual relationship are qualified and considered supplementary, and their provision by the data subject, if requested, is optional and subject to consent. The consent provided may be revoked by the data subject at any time by sending an email to: info@fluida.io. Such revocation will not affect the legality of the processing based on consents granted prior to the revocation.
5. METHODS OF PROCESSING
Personal data will be recorded, processed, and stored in the records of the Data Controller, both paper and electronic, in compliance with the appropriate technical and organizational measures as referred to in Article 32 of the GDPR. The processing of the data subject's personal data may consist of any operation or set of operations referred to in Article 4, paragraph 1, point 2 of the GDPR.
The processing of personal data will occur using tools and procedures suitable for ensuring their security and confidentiality and may be carried out, directly and/or through delegated third parties, either manually through paper means or using IT or electronic tools. The data, for the correct management of the relationship and compliance with legal obligations, may be entered into the internal documentation of the Data Controller and, if necessary, in the mandatory records and logs by law.
The personal data of the data subject may be processed by employees of the Data Controller's business functions designated to pursue the above-mentioned purposes. Such employees have been expressly authorized to process and have received adequate operational instructions pursuant to and for the purposes of Article 29 of the GDPR.
6. CATEGORIES OF DATA RECIPIENTS
The personal data of the data subject may be communicated and processed by external subjects operating as independent controllers under Articles 4 and 24 GDPR, such as, by way of example, authorities and supervisory and control bodies and generally public or private subjects authorized to request data and/or subjects operating as Data Processors under Article 28 GDPR), such as, by way of example, consulting firms and/or professional firms and/or professionals, such as lawyers, tax consultants, and insurance companies.
In particular, the data of the data subject may be communicated to companies established within the European Union that perform tasks on behalf of the Data Controller, as Data Processors, of a technical and organizational nature such as the management of services related to the Platform, hosting services (including cloud), technical management and maintenance of the site and the app, newsletter sending services, professional services.
The list of such companies is constantly updated and is available upon request by sending a communication to the Data Controller at the email address info@fluida.io.
7. DATA TRANSFER TO NON-EU COUNTRIES
The data provided by the data subject will be processed only in countries located within the European Union. If the personal data of the data subject is processed in a country that does not belong to the EU, the rights granted to them by community regulations will be guaranteed and timely notice will be given to the data subject.
8. RIGHTS OF THE DATA SUBJECT
Pursuant to Articles 15 and following of the GDPR, the data subject may exercise the following rights:
access: confirmation or otherwise of whether processing of the data subject's personal data is in progress and the right to access the same; it is not possible to respond to manifestly unfounded, excessive, or repetitive requests;
rectification: correcting/obtaining correction of personal data if erroneous or outdated and completing them if incomplete;
deletion/erasure: to obtain, in some cases, the deletion of the personal data provided; this is not an absolute right, as the Data Controller may have legitimate or legal reasons to retain them;
limitation: the data will be stored, but may not be processed or otherwise used, in cases provided for by the regulation;
portability: to move, copy, or transfer data from the databases of the Data Controller to third parties. This applies only to data provided by the data subject for the performance of a contract or for which consent has been explicitly provided, and the processing is carried out by automated means;
objection to direct marketing;
revocation of consent at any time, where processing is based on consent.
Pursuant to Article 2-undecies of Legislative Decree 196/2003, the exercise of the rights of the data subject may be delayed, limited, or excluded, with a reasoned communication made without delay, unless the communication may compromise the purpose of the limitation, for the time and to the extent necessary to achieve the necessary and proportionate measure, considering the fundamental rights and legitimate interests of the data subject, in order to safeguard the interests referred to in paragraph 1, letters a) (interests protected in matters of money laundering), e) (in carrying out defensive investigations or in exercising a right in judicial proceedings) and f) (to the confidentiality of the identity of the employee who reports unlawful acts of which they became aware in the course of their duties). In such cases, the rights of the data subject may also be exercised through the Guarantor in the manner provided for in Article 160 of the same Decree. In such cases, the Guarantor will inform the data subject that all necessary verifications have been carried out or that a review has been conducted as well as the ability of the data subject to file a legal appeal.
It is also clarified that - before fulfilling requests - the Data Controller may carry out an identification check of the data subject, to assess the legitimacy of the received request.
To exercise these rights, the data subject may contact the Data Controller at the address info@fluida.io or by sending a letter to Fluida Europe srl, Via Carlo Imbonati 18 - 20159 Milan.
The Data Controller will respond within 30 days from the receipt of the formal request sent by the data subject.
We remind you that in the event of a breach of the personal data of the data subject, the latter may file a complaint with the competent authority: “Guarantor for the protection of personal data”.