Pursuant to Legislative Decree of 30 June 2003, No. 196, the Personal Data Protection Code, UniSapiens, as data controller, guarantees compliance with the rules on personal data protection.

The personal data provided will be used exclusively to carry out customer relations activities based on contractual agreements and will not be disclosed to third parties. Additional data (such as domain names, IP addresses, and browser types) collected through our website are used to compile traffic statistics and for control needs by the competent authorities regarding how the service is used, and are in no way accompanied by any additional personal information. UniSapiens also reserves the right to send its Customers offers, news, or updates by email, within the limits set by applicable law, it being understood that the data subject has the right to object at any time to this specific processing.

Data are processed only by processors and persons in charge appointed by the controller to manage relationships with customers. In all cases, disclosure to third parties or dissemination of the data is excluded.

You may at any time object to processing or request the deletion, rectification, or updating of all personal information in our possession by sending an email to: info@unisapiens.eu

Legislative Decree of 30 June 2003, No. 196 – Title II: rights of the data subject

Art. 7. Right of access to personal data and other rights

1. The data subject has the right to obtain confirmation as to whether or not personal data concerning them exist, even if not yet recorded, and communication of such data in an intelligible form.

2. The data subject has the right to obtain:

1. the source of the personal data;
2. the purposes and methods of processing;
3. the logic applied in the event of processing carried out with the aid of electronic instruments;
4. the identification details of the controller, processors, and the representative designated pursuant to Article 5, paragraph 2;
5. the entities or categories of entities to whom the personal data may be communicated or who may become aware of them in their capacity as designated representative in the State’s territory, processors, or persons in charge.

3. The data subject has the right to obtain:

1. the updating, rectification, or, where interested, integration of the data;
2. the erasure, transformation into anonymous form, or blocking of data processed unlawfully, including data whose retention is unnecessary for the purposes for which the data were collected or subsequently processed;
3. certification that the operations referred to in letters a) and b) have been notified, including as regards their contents, to those to whom the data were communicated or disseminated, except where such compliance proves impossible or involves a manifestly disproportionate effort compared with the right protected.

4. The data subject has the right to object, in whole or in part:

1. on legitimate grounds, to the processing of personal data concerning them, even if relevant to the purpose of the collection;
2. to the processing of personal data concerning them for the purpose of sending advertising material or direct selling or for carrying out market research or commercial communication.

Art. 8. Exercise of rights

1. The rights referred to in Article 7 are exercised by means of a request addressed without formalities to the controller or the processor, including through a person in charge, to which appropriate feedback is provided without delay.

2. The rights referred to in Article 7 may not be exercised by a request to the controller or processor, or by an appeal pursuant to Article 145, if the processing of personal data is carried out:

1. on the basis of the provisions of Decree-Law of 3 May 1991, No. 143, converted, with amendments, by Law of July 1991, No. 197, and subsequent amendments, on money laundering;
2. on the basis of the provisions of Decree-Law of 31 December 1991, No. 419, converted, with amendments, by Law of 18 February 1992, No. 172, and subsequent amendments, regarding support for victims of extortion demands;
3. by Parliamentary inquiry commissions established pursuant to Article 82 of the Constitution;
4. by a public body, other than state-owned economic entities, on the basis of an express legal provision, for the exclusive purposes relating to monetary and exchange-rate policy, the payment system, supervision of intermediaries and credit and financial markets, as well as the protection of their stability;
5. pursuant to Article 24, paragraph 1, letter f), limited to the period during which an actual and concrete prejudice could arise for the conduct of defensive investigations or for the exercise of a right in judicial proceedings;
6. by providers of publicly accessible electronic communications services with regard to incoming telephone communications, unless this could cause an actual and concrete prejudice to the conduct of the defensive investigations referred to in Law of 7 December 2000, No. 397;
7. for reasons of justice, at judicial offices of all orders and levels, or the High Council of the Judiciary, or other self-governing bodies, or the Ministry of Justice;
8. pursuant to Article 53, without prejudice to the provisions of Law of 1 April 1981, No. 121.

3. The Data Protection Authority, including upon the data subject’s report, in the cases referred to in paragraph 2, letters a), b), d), e) and f), proceeds in the manner set out in Articles 157, 158 and 159 and, in the cases referred to in letters c), g) and h) of the same paragraph, proceeds in the manner set out in Article 160.

4. The exercise of the rights referred to in Article 7, when not concerning objective data, may take place except where it concerns the rectification or integration of evaluative personal data relating to judgments, opinions or other subjective assessments, as well as indications of conduct to be adopted or decisions being taken by the data controller.

Art. 9. Methods of exercise

1. The request addressed to the controller or processor may also be sent by registered letter, fax, or email. The Data Protection Authority may identify other appropriate systems with reference to new technological solutions. When it concerns the exercise of the rights referred to in Article 7, paragraphs 1 and 2, the request may also be made orally and, in that case, is briefly recorded by the person in charge or the processor.

2. In exercising the rights referred to in Article 7, the data subject may grant, in writing, a delegation or power of attorney to natural persons, entities, associations, or organizations. The data subject may also be assisted by a trusted person.

3. The rights referred to in Article 7 relating to personal data concerning deceased persons may be exercised by those who have their own interest, or act to protect the data subject, or for family reasons worthy of protection.

4. The identity of the data subject is verified on the basis of appropriate elements of evaluation, including by means of available documents or the presentation or attachment of a copy of an identity document. The person acting on behalf of the data subject shall present or attach a copy of the power of attorney, or a delegation signed in the presence of a person in charge or signed and submitted together with an unauthenticated photocopy of the data subject’s identity document. If the data subject is a legal person, entity, or association, the request shall be made by the natural person authorized under the respective statutes or regulations.

5. The request referred to in Article 7, paragraphs 1 and 2, is made freely and without constraints and may be renewed, unless justified reasons exist, at intervals of not less than ninety days.

Art. 10. Response to the data subject

1. To ensure the effective exercise of the rights referred to in Article 7, the data controller shall adopt appropriate measures aimed, in particular, at:

1. facilitating access to personal data by the data subject, including through the use of specific computer programs designed for accurate selection of data concerning individual data subjects who are identified or identifiable;
2. simplifying procedures and reducing response times to the applicant, including within offices or services in charge of public relations.

2. The data are extracted by the processor or persons in charge and may be communicated to the applicant, including orally, or made available for viewing by electronic means, provided that in such cases the data are easily understood, taking into account the quality and quantity of the information. If requested, the data shall be transposed onto paper or electronic media, or transmitted electronically.

3. Unless the request concerns a particular processing or specific personal data or categories of personal data, the response to the data subject shall include all personal data concerning the data subject processed in any way by the controller. If the request is addressed to a healthcare professional or a healthcare organization, the provision of Article 84, paragraph 1, shall apply.

4. When extracting the data proves particularly difficult, the response to the data subject’s request may also take place by showing or delivering copies of documents containing the requested personal data.

5. The right to obtain communication of data in an intelligible form does not concern personal data relating to third parties, unless the breakdown of the processed data or the removal of certain elements renders the personal data relating to the data subject unintelligible.

6. The communication of data shall be made in an intelligible form, including through the use of a legible script. In the case of communication of codes or acronyms, the parameters for understanding their meaning shall be provided, including by the persons in charge.

7. When, following the request referred to in Article 7, paragraphs 1 and 2, letters a), b) and c), the existence of data concerning the data subject is not confirmed, a contribution towards expenses not exceeding the costs actually incurred for the search carried out in the specific case may be requested.

8. The contribution referred to in paragraph 7 may not in any case exceed the amount determined by the Data Protection Authority by a general measure, which may set a flat amount where data are processed by electronic means and the response is provided orally. By the same measure, the Data Protection Authority may provide that the contribution may be requested when the personal data are on a special medium for which reproduction is specifically requested, or when, at one or more controllers, there is a significant use of resources in relation to the complexity or scale of the requests and the existence of data concerning the data subject is confirmed.

9. The contribution referred to in paragraphs 7 and 8 shall also be paid by postal or bank transfer, or by payment or credit card, where possible upon receipt of the response and in any case no later than fifteen days from such response.