PRIVACY NOTICE ON THE PROCESSING OF PERSONAL DATA
(Art. 13 Regulation (EU) 2016/679 – GDPR)
Dear Data Subject,
pursuant to Article 13 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (“GDPR”), Adventure Riding S.r.l. informs you that the personal data provided by you, both prior to and during the employment or collaboration relationship (hereinafter the “Data”), will be processed in compliance with the applicable data protection legislation.
a) Data Controller
The Data Controller is Adventure Riding S.r.l., with registered office at
C.so Piemonte 30/1 – 12037 Saluzzo (CN), Italy
e-mail: info@adventureriding.it
b) Purposes of processing and legal bases
Personal Data will be processed for the following purposes:
1. Management of the employment or collaboration relationship, including legal, administrative and economic obligations;
Legal basis: performance of a contract (Art. 6(1)(b) GDPR).
2. Compliance with legal obligations, including accounting, tax, social security, insurance and workplace safety obligations;
Legal basis: compliance with a legal obligation (Art. 6(1)(c) GDPR).
3. Management and maintenance of company IT systems;
Legal basis: legitimate interest of the Data Controller (Art. 6(1)(f) GDPR).
4. Organisation of travel, events, registrations for competitions, federations and sports bodies;
Legal basis: performance of a contract (Art. 6(1)(b) GDPR).
5. Creation and use of photographs and video recordings for promotional and advertising purposes related to the Company’s activities;
Legal basis: explicit consent of the Data Subject (Art. 6(1)(a) GDPR), to be provided separately and revocable at any time.
c) Categories of data processed
Where necessary, special categories of personal data pursuant to Art. 9 GDPR may also be processed, such as:
• data relating to health status (e.g. medical certificates, fitness for work);
• trade union membership;
• racial or ethnic origin (e.g. for non-EU workers);
• religious beliefs (e.g. requests for leave);
• political opinions (e.g. electoral leave).
Such data are processed exclusively within the limits permitted by law and, in particular, to comply with obligations under labour law, social security and occupational medicine (Art. 9(2)(b) and (h) GDPR), as well as in other cases provided for by applicable legislation.
d) Methods of processing
Data are processed using manual and electronic tools, in accordance with principles of lawfulness, fairness and transparency, and by adopting appropriate security measures to ensure confidentiality and
integrity.
Data are processed by authorised personnel pursuant to Art. 29 GDPR and by external parties appointed as Data Processors.
e) Recipients of the data
Data may be communicated to:
• consultants and professionals (e.g. labour consultants, accountants);
• social security and welfare institutions;
• banks and credit institutions;
• trade unions;
• occupational physician pursuant to Legislative Decree 81/2008;
• sports federations and bodies;
• Moto Club Adventure Riding ASD;
• Deus Ex Machina Milan (co-organiser of the Swank Rally di Sardegna).
Data will not be disclosed.
f) Transfer to third countries
Personal Data will not be transferred to non-EU countries.
g) Data retention period
Data will be retained:
• for the entire duration of the employment or collaboration relationship;
• thereafter, for 10 years or for the different period required by law;
• additionally, within the limits of applicable statutory limitation periods, for the protection of the Data Controller’s rights in legal proceedings.
h) Rights of the Data Subject
The Data Subject has the right to:
• access their Data;
• request rectification or erasure;
• obtain restriction of processing;
• object to processing;
• obtain data portability (where applicable);
• withdraw consent at any time, where given.
The Data Subject also has the right to lodge a complaint with the Italian Data Protection Authority (Garante per la Protezione dei Dati Personali).
To exercise these rights, the Data Controller may be contacted at:
info@adventureriding.it
i) Nature of data provision
The provision of Data is:
• mandatory where required for the performance of the contractual relationship or by law; • optional in all other cases.
Failure to provide mandatory Data may result in the impossibility to establish or continue the relationship.