INFORMATION NOTICE PURSUANT TO ARTICLE 13 OF EU REGULATION 2016/679
AND CONSENT TO THE USE OF PERSONAL DATA.
Pursuant to Article 13 of EU Regulation no. 2016/679 on the protection of personal data (hereafter "Regulation", applicable from 25 May 2018), InvestiRE SGR SpA (hereafter "InvestiRE" or the "Company" or the "Data Controller"), based in Rome, Via Po, no. 16/a and with offices in Milan, Largo Donegani, no. 2, in its capacity as data controller, pursuant to Articles 4, no. 7) and 24 of the Regulation, provides the following information on the processing of personal data of users (hereafter "Users" or "User", or "Data Subject" or "Data Subjects") of both the desktop and mobile versions of the website "investiresgr.it" (hereinafter "Website") which is owned by the Data Controller, in order to allow Users of the Website to understand the purposes and ways that the Data Controller handles the processing of the personal data that they provide. The processing of the Data Subject's personal data on behalf of InvestiRE will be based on principles of correctness, lawfulness, transparency, protection of privacy and respect for the rights of the Data Subject. The processing of personal data will be in accordance with the provisions of the Regulation.
As per Article 13 of the Regulation, with reference to the processing of personal data, the Data Controller supplies the following information to the Data Subject:
1. Collection of navigation data
During regular operation, the information systems and technical procedures and software which support website operation collect some personal data; transmission of this data is implicit in the functioning and user protocols in use on the Internet.
Each time the User connects to the Website and each time they recall or request content, the access data is stored in our systems, in the form of tabular or linear data files. For example, this data category includes the IP addresses, the domain names of the computers used by users connecting to the Website, the request by the User's browser, in the form of addresses in URI (Uniform Resource Identifier), the date and time of the request to the server, the method used to submit the request to the server, the quantity of data transmitted, the numerical code indicating the status of the response given by the server and other parameters related to the operating system and to the User's IT environment.
This data can be used by the Data Controller for the sole purpose of obtaining anonymous statistical information about the Website to identify Users' favourite pages, provide more adequate content and monitor proper functioning. At the request of the Authority, the data could be used for the establishment of liability in case of computer crimes against the Website or its Users.
Users can access some services (e.g. search for properties) anonymously, while for other services it is necessary to register before use.
2. Purpose of data processing
The data collected through the Website will be processed in a lawful manner and according to principles of correctness, and will be used in order to provide the services provided for by the Website.
In addition to the collection of browsing data which occurs automatically (see paragraph 1 above), the User may voluntarily supply personal Data which may be collected by the Data Controller exclusively through the compilation of specific data entry fields (“Fields”) available online on the Site.
The personal data provided by the User will be registered and stored on protected electronic media and processed with appropriate security measures grouping and integrating the data with other electronic archives or databases. Hereafter, "Data" shall refer to all the personal data related to the Data Subject.
In particular: for the “contact request” option, to receive more information with regard to a particular advertisement or to organise a site visit, the Data will be communicated to the designated Real Estate agencies by the Controller to enable requests for information to be fulfilled, thus authorising them to subsequently process said data (see also paragraph 6).
The nature of these services requires the User to communicate via the Site certain Data and information on User preferences and objectives concerning the location, type and features of properties, and the subsequent processing of such data and information; this data and information, and the processing thereof, is in fact indispensable for fulfilling and identifying the User’s requirements.
The Data gathered may be used to deliver services intended to facilitate the procurement of business proposals and requests for financing provided by banks or financial intermediaries.
Sending emails to the Data Controller's email address on the Website means that the Data Controller will acquire the sender's email address. This email address, together with any other personal data collected, is necessary to respond to requests that are sent and to provide the services which are specifically requested.
The Data will be processed in electronic and/or paper format, mainly through the use of automated and computerised procedures, and will be carried out directly by the Data Controller's organisation and by parties external to that organisation, in their capacity as managers and/or co-controllers of data, as well as service companies, in their capacity as managers and/or co-controllers of data (see paragraph 6 below).
There are adequate security measures to prevent incorrect or illegal use of Data, access by unauthorised parties and loss of Data.
No Data collected on the Website is subject to disclosure without the purpose of providing the service provided for by the Website.
The Data, indicated in paragraph 3 below, is processed by the Data Controller for the following purposes:
a)to respond – directly and/or through the data subjects indicated in paragraph 6 below – to contact requests made through the Site for the purposes of providing information on a property covered by a specific advertisement, to organise site visits and transmit the documents involved in negotiations for the sale and/or lease of a property;
b)manage the communications relating to negotiations for the sale and/or lease of a property;
c)to obtain anonymous statistical information related to the number and type of accesses and the number of Website views and/or related to individual ads;
d)to monitor the service levels of the Website and the suppliers of the Data Controller in terms of speed, adequacy and completeness of the answers provided;
e)to carry out surveys and customer satisfaction questionnaires for Users of the Website.
The legal basis of the aforementioned processing activities, pursuant to Article 6, paragraph 1, section a) of the Regulation, is at the consent of the Data Subject.
3. Categories of processed data
In relation to the purposes indicated in paragraph 2 above, the Data Controller collects and processes the navigation data referred to in point 1 above and the following personal data "name", "surname", "email address" and "telephone" through the Website, as well as any other information that may be provided by the Data Subject.
For Site Services, the Data Controller does not need to process particular categories of personal data (such as, for example, personal data that reveals health status, political and union opinions, religious beliefs, etc.). For these reasons, Users must not communicate such data categories through the Website.
4. Nature of data provisions
The provision of Personal Data is mandatory for the purposes referred to above in paragraph 2 and any refusal by the User to provide such Data will make it impossible to receive the service of the Website.
5. Processing method
The collection of Data is carried out in compliance with the principles of necessity, minimisation and relevance.
The data processing of the Data Subject will be carried out in any case by means of tools and procedures suitable to guarantee security and confidentiality in accordance with the law and may be carried out either on paper, or with the aid of information technology (for example, with databases) designed to store, manage and process the data with logic strictly related to the purposes mentioned above.
Data is not subjected to automated decision making.
On the specific point regarding the correct management of the Data received, the Data Subject must promptly notify the Company of any corrections, additions and/or updates to the Data previously provided. In order to prevent data loss, or the illegal/incorrect use of Data and unauthorised access, specific security measures are implemented.
The Data Controller will process the Interested Party's Data for the time necessary to fulfil the purposes referred to in paragraph 2 above and to comply with the laws to which, from time to time, they are subject to. Data processing will last no longer than is necessary to satisfy the purpose of the collection, as described above, and the fulfilment of the regulatory obligations by the Owner, and in any case within the limits indicated by law. The processing will be interrupted if the interested party decides to delete, by communication to the Data Controller, the Data transmitted by the Site.
6. Categories of data subjects to whom the Data may be communicated or those that may gain knowledge of it in their capacity as data processors and persons in charge of data
Certain categories of Company employees, in their capacity as internal representatives and persons in charge of processing, will be able to access the Data of the Data Subject in order to fulfill the tasks assigned to them by the Company, which are aimed at pursuing the aforementioned purposes.
Furthermore, the Company, which constantly aims to fulfill the purposes outlined in this information notice, may need to communicate the Data of the Data Subject to third parties belonging to the following categories:
▪ subjects who perform tasks of a technical nature and those who provide assistance or professional advice on behalf of the Company or for the benefit of the Company;
▪ central and peripheral bodies of the Public Administration; Local Authorities and their peripheral bodies; Supervisory and Control authorities and bodies; FIUs (Financial Intelligence Units), Judicial Authorities and Public Security Authorities; auditing companies;
▪ professionals, professional associations, banking and financial intermediaries, suppliers of goods and services;
▪ call centre service management companies, Website management and maintenance companies.
The subjects belonging to the above mentioned categories act as Data processors appointed by InvestiRE or operate in total autonomy as Co-Controllers of processing activities.
The Data of the Data Subject processed by the Company will not be published or disseminated in other ways and will not be transferred abroad or to an international organisation for any reason.
7. Information on cookies, search engines and location data
By using the Website with the function of detecting active locations, the Website may collect and process information on the current location of the User. This data is processed anonymously, in a format that does not allow the User to be personally identified, and is used for the sole purpose of facilitating the use of certain Website functions based on location and to process statistical information on the use of the Website. Location services can be activated or deactivated by the User at any time by accessing their device settings.
8. Rights of the Data Subject
Pursuant to the Regulation, the Data Subject may exercise, at any time, their rights towards the Data Controller, more specifically:
1. The data subject has the right to obtain confirmation from the Data Controller that processing of their personal data is in progress and, in such case, to obtain access to the personal data and the following information: a) purposes of processing;
b) categories of personal data concerned;
c) recipients or categories of recipients to whom the personal data have been or will be disclosed, in particular if recipients in third countries or international organisations;
d) wherever possible, storage period of personal data provided, or if that is not feasible, the criteria used to determine said period;
e) the existence of the right to request rectification or deletion of personal data from the Data Controller, or restriction of processing of personal data concerning the data subject, or to object to such processing;
f) the right to lodge a complaint with a supervisory authority;
g) whereby the personal data is not collected from the data subject, any available information regarding its source;
h) the existence of automated decision-making, including profiling, referred to in Article 22 paragraphs 1 and 4 and, at least in those cases, meaningful information about the logic involved, as well as the significance and anticipated effects of such processing for the data subject;
i) the right to Data portability.
2. If personal data is transferred to a third country or international organisation, the Data Subject has the right to be informed of the existing and appropriate safeguards relating to such transfer, according to Article 46. 3. The data controller shall provide a copy of the personal data which is undergoing processing. For any further copies requested by the data subject, the controller may charge a reasonable fee based on administrative costs. Where the data subject makes the request by electronic means, and unless otherwise requested by the data subject, the information shall be provided in a commonly used electronic form.
4. The right to obtain a copy referred to in paragraph 3 shall not adversely affect the rights and freedoms of others.
Finally, the Data Controller specifies that the Data Subject has the right to withdraw their consent at any time. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal.
9. The Controller and Responsible Person for the processing of personal data
The Data Controller referred to in this information notice is "InvestiRE SGR SpA", with registered office in Via Po, 16/a - 00198 Rome.
The following details allow you to contact the Company quickly:
Tel: 06 - 696291;
Fax: 06 - 69629212.
The updated list of designated Data processors and co-controllers is available at InvestiRE's registered office or on the website www.investiresgr.it.
10. The procedure for the exercise of rights on behalf of the Data Subject
The requests relating to the exercise of the rights referred to in paragraph 6 of this information notice can be sent in writing by email to the following address: firstname.lastname@example.org.
This information may be subject to change. If substantial changes are made to the use of the Data relating to the User of the Website by the Data Controller, the latter will notify the User by publishing such changes with adequate evidence on the Website.