•  DATA PROCESSING METHODS AND DATA RETENTION PERIOD  

The Controller will process Users’ personal data using manual and computerized tools, with logic strictly related to the purposes themselves and, in any case, in such a way as to ensure the security and confidentiality of the data.

Users’ Personal data will be retained for the time strictly necessary to fulfill the primary purposes outlined in paragraph 3 above, or otherwise as necessary for the protection in civil law of the interests of both Users and the Controller.

•  SCOPE OF DATA COMMUNICATION AND DISSEMINATION

Users’ personal data may be transferred outside the European Union and, if so, the Controller will ensure that the transfer is made in accordance with the Applicable Law and, in particular, in accordance with Articles 45 (Transfer on the basis of an adequacy decision) and 46 (Transfer subject to adequate safeguards) of the Regulation. 

Users’ personal data may be disclosed to the employees and/or collaborators of the Data Controller in charge of managing the Platform and the Users’ requests. These subjects, who have been instructed to this effect by the Controller in accordance with Article 29 of the Regulation, will process Users’ personal data exclusively for the purposes indicated in this privacy policy and in compliance with the provisions of the Applicable Law.

Third parties who may process personal data on behalf of the Controller as “Data Processors” may also become aware of Users’ personal data, such as, but not limited to, IT and logistics service providers functional to the operation of the Site, outsourcing or cloud computing service providers, professionals and consultants.

Users have the right to obtain a list of any data processors appointed by the Controller by making a request to the Controller in the manner indicated in paragraph 7 below.

•  RIGHTS OF THE DATA SUBJECTS

Users may exercise their rights pursuant to the Applicable Law by contacting the Controller in the following ways:

• By sending a registered letter with return receipt to the Company’s registered office in Maglie (LE), Via Scorrano, 57;  
• By sending an e-mail to info@audioboost.it or to the certified e-mail address audioboostsrl@pec.it.

The Controller has not identified a Data Protection Officer (DPO), as it is not subject to the designation requirement under Article 37 of the Regulation.

Pursuant to the Applicable Law, the Controller informs Users that they have the right to obtain information on (i) the origin of their personal data; (ii) the purposes and methods of processing; (iii) the logic applied in case of processing carried out with the aid of electronic tools; (iv) the identification details of the data controller and data processors; (v) the subjects or categories of subjects to whom the personal data may be communicated or who may become aware of them in their capacity as data processors or persons in charge of processing.

In addition, Users have the right to obtain:

(a) access, updating, rectification or, when interested, integration of their personal data;

(b) cancellation, transformation into anonymous form or limitation of data processed in violation of the law, including data whose retention is not necessary in relation to the purposes for which data were collected or subsequently processed;

1. c) certification that the operations referred to in letters a) and b) have been brought to the attention, also as regards their content, of those to whom the data have been communicated or disseminated, except where this proves impossible or involves the use of means manifestly disproportionate to the protected right.

In addition, Users have:

(a) the right to withdraw consent at any time if the processing is based on their consent;

(b) the right (where applicable) to data portability (the right to receive all their personal data in a structured, commonly used, machine-readable format);

(c) the right to object:

(i) in whole or in part, for legitimate reasons to the processing of their personal data, even if relevant to the purpose of collection.

1. ii) in whole or in part, to the processing of their personal data for the purpose of sending advertising or direct sales material or for carrying out market research or commercial communication;

(iii) where personal data are processed for direct marketing purposes, at any time to the processing of their data carried out for that purpose, including profiling insofar as it is related to such direct marketing.

1. d) if they believe that the processing of their data violates the Regulation, the right to lodge a complaint with a Supervisory Authority (in the Member State in which they normally reside, in the Member State in which they work, or in the Member State in which the alleged violation occurred). The Italian Supervisory Authority is the Garante per la protezione dei dati personali, based in Rome, Piazza Venezia n. 11, 00187 (http://www.garanteprivacy.it/).