Privacy policy

Data controller

Definitions

Authorized Persons

The natural persons authorized to carry out Processing operations under the direct authority of the Controller or the Processor, pursuant to Art. 29 of the Regulation and Art. 2-quaterdecies of the Code.

Communication

Making Personal Data known to one or more specified parties other than the Data Subject, the Controller's representative in the territory of the State, the Processor and the Authorized Persons, in any form, including by making them available or allowing consultation.

Designated Persons

The natural persons assigned specific tasks and functions related to the processing of Personal Data who operate under the authority of the Controller or the Processor, pursuant to Art. 2-quaterdecies of the Code.

Personal Data or Data

Any information relating to a natural person, identified or identifiable, including indirectly, by reference to any other information, in particular to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to their physical, physiological, genetic, mental, economic, cultural or social identity.

Dissemination

Making Personal Data known to unspecified parties, in any form, including by making them available or allowing consultation.

Supervisory Authority

The supervisory authority referred to in Art. 51 of the Regulation.

Notice or Privacy Policy

This document.

Data Subject

The natural person to whom the Personal Data relate.

Security Measures

The set of technical, IT, organizational, logistical and procedural measures adopted by the Controller to ensure a level of security appropriate to the risk of the Processing, pursuant to Art. 32 of the Regulation.

Processor

The natural or legal person, public authority, agency or other body that processes Personal Data on behalf of the Controller.

Controller

The natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the Processing of Personal Data; where the purposes and means of such Processing are determined by Union or Member State law, the Controller or the specific criteria for its nomination may be provided for by Union or Member State law.

Processing

Any operation or set of operations performed on Personal Data or sets of Personal Data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, Communication by transmission, Dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

01Context of the Processing

This Notice is provided by the Controller in relation to the following context: access to and use of the services offered through the Ordinoo Platform.

02Processing operations carried out

Below, in detail, are the Data collected, the purposes for which they are processed, the legal bases and the retention periods.

03Methods of Processing and categories of Recipients

1. Unless otherwise expressly provided in this Notice, the Data Subject is informed that the Processing of their Personal Data is carried out by manual and/or IT, telematic or otherwise automated systems, in compliance with the principles of relevance, lawfulness, fairness and purpose limitation set out in the Legislation.
2. The Controller processes the Data Subject's Personal Data by adopting appropriate Security Measures aimed at minimizing the risks of unauthorized access, Dissemination, loss and destruction of such Data, pursuant to the Legislation.
3. The Data Subject is also informed that the Processing of Personal Data for the purposes indicated above may be carried out by the Controller directly or with the collaboration of other parties, acting as Processors, Designated Persons or Authorized Persons (e.g. employees and/or collaborators of the Controller).
4. The Data Subject is informed that Personal Data may be communicated to the following categories of external Processors:
   OpenAPIAnalytics service providersAccounting service providers
5. The complete and updated list of Processors may be consulted at any time by sending a request to the email address indicated at the beginning of this Notice.

04Data transfers

1. The Data Subject is informed that the Personal Data processed by the Controller may be transferred to other countries within the European Union.
2. The Data Subject is informed that the Personal Data processed by the Controller may be transferred to countries outside the European Union for which an adequacy decision of the Commission exists or for which additional safeguards are applied following an assessment by the Controller of the impact of the transfer on the rights and freedoms of the Data Subject.

05Rights of the Data Subject

The Data Subject may at any time exercise the rights provided for by the Regulation under Articles 15-22 by sending a communication to the addresses indicated at the beginning of this Notice. In particular:

• Accessart. 15The Data Subject has the right to request from the Controller access to their Personal Data, pursuant to and within the limits of Art. 15 of the Regulation.
• Rectificationart. 16The Data Subject has the right to request from the Controller the rectification of inaccurate Personal Data, pursuant to and within the limits of Art. 16 of the Regulation.
• Erasureart. 17The Data Subject has the right to request from the Controller the erasure of their Personal Data, pursuant to and within the limits of Art. 17 of the Regulation.
• Restrictionart. 18The Data Subject has the right to request from the Controller the restriction of the Processing of their Personal Data, pursuant to and within the limits of Art. 18 of the Regulation.
• Portabilityart. 20The Data Subject has the right to request from the Controller the communication of their Personal Data in a structured, machine-readable format, pursuant to and within the limits of Art. 20 of the Regulation.
• Objectionart. 21The Data Subject has the right to object to Processing by the Controller, pursuant to and within the limits of Art. 21 of the Regulation.
• ComplaintThe Data Subject has the right to lodge a complaint with a supervisory authority.
• Withdrawal of consentart. 7 and 13The Data Subject has the right to withdraw consent with regard to those Processing operations based on that legal basis. Pursuant to Art. 7(3) and Art. 13(2)(c) of the Regulation, the Data Subject is informed that, in any case, the withdrawal of consent does not affect the lawfulness of Processing based on consent before its withdrawal.

06Changes to this Privacy Policy

The Controller reserves the right to amend this Privacy Policy at any time, informing Data Subjects by publication on the Site.

This Notice was published on February 3, 2025.