Privacy notice pursuant to Articles 13 and 14 of EU Regulation 679/2016

This page represents the “Privacy Policy” of this website and is intended to provide information on how the personal data of users interacting with this website are processed, including users making use of the services provided through it, as well as to provide the information required under Articles 13 and 14 of EU Regulation 2016/679.

This notice applies only to this website and not to any other websites that may be consulted by the user through links available on the pages of this website.

Regulation (EU) 2016/679 concerning the protection of personal data (hereinafter, the “Regulation”) lays down rules relating to the protection of natural persons with regard to the processing of personal data, as well as rules relating to the free movement of such data, and protects the fundamental rights and freedoms of natural persons, with particular reference to the right to the protection of personal data.

Article 4(1) of the Regulation states that “Personal Data” means any information relating to an identified or identifiable natural person (hereinafter, the “Data Subject”).

“Processing” means any operation or set of operations which is performed on Personal Data or on sets of Personal Data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction (Art. 4(2) of the Regulation).

Pursuant to Articles 12 et seq. of the Regulation, the Data Subject must also be informed about the appropriate information relating to the Processing activities carried out by the Data Controller and about the rights of the Data Subjects.

Data Controller:

SOCIETÀ MULTISERVIZI ALTA VALLE S.p.A. – Via Breno, 10 – 23030 Valdisotto (SO), Italy
E-mail: multiservizialtavalle@gmail.com
Tel.: (+39) 0342-902666
Certified E-mail (PEC): multiservizialtavalle@pec.it

Data Protection Officer (DPO):

Centro Studi Enti Locali S.p.A., represented by lawyer Giuseppina Tofalo, who can be contacted at the following e-mail address: giuseppina.tofalo@centrostudientilocali.it

Purposes of processing and legal bases for processing

The user’s personal data will be processed for the following purposes and on the following legal bases:

1. for the conclusion and proper performance of a contract to which the data subject is party or in order to take pre-contractual measures at the request of the data subject, as well as for the provision of requested information and/or services/products, including subscription to newsletters; the legal basis for the processing activities listed above is Article 6(1)(b) of EU Regulation 2016/679;

2. to respond to requests sent by the user via e-mail and/or forms available on the website; the legal basis for the processing activities listed above is Article 6(1)(b) of EU Regulation 2016/679;

3. subject to the data subject’s consent, to periodically send commercial communications regarding services, products and activities offered by the Data Controller through remote communication technologies (e-mail, telephone, SMS, WhatsApp); the legal basis is consent pursuant to Article 6(1)(a) of EU Regulation 2016/679;

4. to carry out retargeting activities and/or use e-mail addresses to identify social media profiles (Facebook, Instagram) for personalised marketing campaigns; the legal basis is consent pursuant to Article 6(1)(a) of EU Regulation 2016/679. For these processing activities, tools provided by third-party platforms (e.g. Meta, Google Ads) are used; further information is available in the relevant privacy policies accessible through the links provided in the cookie policy;

5. to send e-mails containing commercial and promotional information regarding the sale of our products/services similar to those previously purchased by the data subject, unless the latter objects to such processing at any time; the legal basis for this type of processing is the legitimate interest of the Data Controller pursuant to Article 6(1)(f);

6. to ensure that marketing communications relating to products and services offered by the Data Controller, as well as those of its business partners and sponsors, including online advertising, are relevant to the interests of the data subject; for this purpose, personal data may be used to better understand the data subject’s interests and preferences in order to predict which other products, services and information may be of interest, allowing us to personalise communications and make them more relevant and engaging; the legal basis is consent pursuant to Article 6(1)(a) of EU Regulation 2016/679. Consent will be requested separately and specifically for each marketing purpose (e.g. newsletter, profiling, retargeting);

7. to conduct market research in order to develop and improve our range of products, services and activities offered by the Data Controller and its partners; the legal basis is consent pursuant to Article 6(1)(a) of EU Regulation 2016/679;

8. to enable and ensure the proper functioning of the website, as well as to guarantee an adequate level of security, integrity and availability; the legal basis for this type of processing is the legitimate interest of the Data Controller pursuant to Article 6(1)(f);

9. to analyse statistical data in aggregated or anonymous form for the purpose of monitoring the proper functioning of the website, traffic, usability and user interest; the legal basis for this type of processing is the legitimate interest of the Data Controller pursuant to Article 6(1)(f);

10. to establish, exercise or defend legal claims; the legal basis for this type of processing is the legitimate interest of the Data Controller pursuant to Article 6(1)(f);

11. to comply with obligations established by law, regulations, EU legislation or orders issued by public authorities; the legal basis for this type of processing is Article 6(1)(c) of EU Regulation 2016/679.

Types of data

The data necessary for the purposes described above will be collected and processed, including:

• identification data

• contact data

• data relating to the contractual relationship

• data relating to the data subject’s preferences and interests

• Browsing data and cookies: this website uses cookies and other tracking tools (including third-party tools) for technical, statistical and marketing purposes. For further details, please refer to the Cookie Policy.

Browsing data

The IT systems and software procedures used to operate this website acquire, during their normal operation, certain personal data whose transmission is implicit in the use of Internet communication protocols.

This information is not collected in order to be associated with identified data subjects; however, by its very nature, it could, through processing and association with data held by third parties, allow users to be identified.

This category of data includes IP addresses or domain names of the computers used by users connecting to the website, URI (Uniform Resource Identifier) addresses of the requested resources, the time of the request, the method used to submit the request to the server, the size of the file obtained in response, the numerical code indicating the status of the server response (successful, error, etc.), and other parameters relating to the user’s operating system and IT environment.

These data are used solely for the purpose of obtaining anonymous statistical information on the use of the website and to ensure its proper functioning, and are deleted immediately after processing.

The data may also be used to ascertain liability in the event of hypothetical cybercrimes against the website.

Refusal to provide data

Apart from what is specified for browsing data, users/visitors are free to provide their personal data. In some cases, the provision of data is necessary, since failure to provide such data may result in the impossibility of concluding or properly performing the contract to which the Data Subject is party and/or failure to comply with legal obligations to which the Data Controller is subject.

The provision of data for processing activities requiring consent is optional; failure to provide such data will not prevent the user from benefiting from the products/services offered by the Data Controller. Even where consent has been given, the Data Subject shall in any case have the right to subsequently object, in whole or in part, to the processing of their personal data for the purposes described above, by simply contacting the Data Controller using the contact details provided above.

Source of the data

The Data will be provided directly by the Data Subject or collected from third parties.

Methods of processing

In accordance with Article 5 of the Regulation, the Personal Data subject to processing shall be:

1. processed lawfully, fairly and transparently in relation to the Data Subject;

2. collected and recorded for specified, explicit and legitimate purposes and subsequently processed in a manner compatible with those purposes;

3. adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed;

4. accurate and, where necessary, kept up to date;

5. processed in a manner that ensures an adequate level of security;

6. stored in a form that permits identification of the Data Subject for no longer than is necessary to achieve the purposes for which the data are processed.

The processing will be carried out using both manual and/or electronic and telematic tools, with organisational and processing methods strictly related to the purposes themselves and, in any case, in such a way as to guarantee the security, integrity and confidentiality of the data in compliance with the organisational, physical and logical measures required by applicable law.

Disclosure of data

Personal data may be disclosed to persons authorised to process the data, as well as to external data processors appointed by the Data Controller (the complete list of external data processors is available from the Data Controller), who are responsible for managing the purposes described above.

Subject to your consent, the Data may also be disclosed to third-party sponsors and/or business partners of the Data Controller, who may use them for the purposes referred to in point no. 3 of the section “Purposes of Processing” above.

Within the scope of the purposes described above, the data may also be disclosed to other parties acting as independent data controllers.

Dissemination of data

Personal data will not be subject to dissemination.

Transfer of data abroad

For the purposes described above, Personal Data will be processed within the European Economic Area (EEA). Should the data be transferred to Third Countries, in the absence of an adequacy decision by the European Commission, the safeguards required by the applicable legislation concerning the transfer of Personal Data to Third Countries will in any case be respected, such as the Standard Contractual Clauses provided by the European Commission.

Data retention

In general, Personal Data will be retained for the period strictly necessary to achieve the purposes for which they were collected and processed, including any retention period required by applicable law and, in any case, for a maximum period of 10 years from the termination of the relationship with the Data Controller, and for a maximum period of 2 years for purposes requiring consent, unless the Data Controller needs to defend a right in court.

Data processed for marketing and profiling purposes are retained for a maximum period of 24 months from the last interaction with the user or until consent is withdrawn.

Rights of the Data subject

In accordance with EU Regulation 2016/679, article 15 et seq. and the applicable national legislation, the Data Subject may, under the procedures and within the limits specified by the applicable legislation, exercise the following rights:

Art 15 The Right to be informed

Description
The interested party has the right to be informed by the processing controller whether or not his/her data is currently being processed and, if so, has the right of access to the personal data and the following information:

• The purpose of the processing
• The type of personal data in question
• The recipients or type of recipients to whom the data has been or will be communicated, in particular where recipients are in third
• countries or international organisations
• Where possible, the length of time the data will be stored, where not possible, the criteria used to establish the length of time
• The existence of the interested party’s right to ask the data controller to rectify or delete the personal data or to restrict the
• processing of personal data concerning him or her or to oppose their processing
• The right to lodge a complaint with data protection regulators
• Where the data was not collected directly from the interested party, whatever information is available on the origin of the data

The existence of an automated decision-making process, including profiling as referred to in Article 22 para. 1 and 4 and at least in such cases, significant information on the logic used, as well as the importance and expected consequences of such processing for the interested party. Where personal data are transferred to a third country or an international organization, the data subject shall have the right to be informed of the existence of adequate safeguards under Article 46 relating to the transfer. The data controller shall provide a copy of the personal data processed. Where additional copies are requested by the interested party, the controller may charge a reasonable fee based on administrative costs. Where the interested party makes the request by electronic means, and unless otherwise indicated by the interested party, the information shall be provided in a commonly used electronic format

Assumptions
The right to obtain a copy of your personal data must not infringe the rights and freedoms of others.

How to exercise it
The interested party can exercise this right by written request to email address

To be able to provide a positive response to the request, the interested party must provide the information necessary to identify the interested party

Before providing a response, the data controller may need to identify the interested party as the right can only be exercised by the interested party his/her self or his/her delegate.

Art 16 Right to rectification

Description
The interested party has the right to request the data controller to rectify incorrect data without unjustified delay. Taking into account the purposes of the processing, the interested party has the right to obtain the integration of incomplete personal data, including by providing a supplementary statement.

Assumptions
Processing of incorrect and/or incomplete data

How to exercise it
The interested party can exercise this right by written request to email address

To be able to provide a positive response to the request, the interested party must provide the information necessary to identify the interested party

Before providing a response, the data controller may need to identify the interested party as the right can only be exercised by the interested party his/her self or his/her delegate.

Art 17 Right to erasure

Description
The interested party has the right to request the data controller to cancel personal data without unjustified delay and the data controller has the duty to cancel the personal data without undue delay Where the controller has made personal data public and is obliged, in accordance with the preceding paragraph, to delete them, taking into account the available technology and the costs of implementation, he shall take reasonable steps, also technical, to inform the controllers who are processing the personal data of the interested party’s request to delete any link, copy or reproduction of his personal data.

Assumptions
The right may be exercised if one of the following reasons exists:

• personal data are no longer necessary for the purposes for which they were collected or otherwise processed;
• the interested party withdraws the consent on which the processing is based in accordance with Article 6 paragraph 1 letter a) or Article 9 paragraph 2 letter a), and if there is no other legal basis for the processing;
• the interested party opposes the processing as stated in Article 21, paragraph 1, and there is no overriding legitimate reason for processing, or opposes the processing as stated in Article 21, paragraph 2;
• the personal data has been unlawfully processed;
• the personal data must be deleted in order to comply with a legal obligation under European Union or Member State law to which the controller is subject;
• the personal data has been collected in relation to the offer of the information services company referenced in Article 8(1) (where Article 6 paragraph 1 letter a)applies), regarding the direct offer of the information services company to minors, the processing of personal data of the child is lawful where the child is at least 16 years old. Where the child is under the age of 16, such processing shall only be lawful if and to the extent that such consent is given or authorised by the holder of parental responsibility. Member States may establish by law a lower age for these purposes provided that it is not less than 13.

The right of cancellation does not apply to the extent that processing is necessary for:

• exercising the right to freedom of expression and information;
• the fulfilment of a legal obligation regarding processing under European Union or Member State law to which the controller is subject, or for the performance of a task carried out in public interest or during exercise of official authority vested in the Controller;
• reasons of public interest in the field of public health in accordance with Article 9, paragraph 2, paragraphs h) and i), and Article 9, paragraph 3;
• archiving for reasons of public interest, scientific or historical research or for statistical purposes in accordance with Article 89, to the extent that the right referred to in paragraph 1 risks rendering impossible or seriously affecting the achievement of the objectives of such processing;
• the establishment, exercise or defense of a right in court.

How to exercise it
The interested party can exercise this right by written request to email address

In order to be able to provide a positive reply to the request, the necessary identification details of the data subject must be provided.

Before providing a response, the controller may need to identify the data subject as the right may only be exercised by the data subject or their delegate.

Art 18 Right to the limitation of processing

Description
The interested party has the right to insist that the data controller limits the processing.

Where processing is restricted in accordance with the preceding paragraph, such personal data shall be processed, except for the purpose of storage, only with the consent of the interested party or for the purpose of verification, the exercise or defence of a right in court or to protect the rights of another natural or legal person or on grounds of a major public interest of the Union or a Member State.

The interested party who has obtained the restriction of processing in accordance with the initial paragraph shall be informed by the controller before the restriction is lifted.

Assumptions
The right can be exercised if one of the following is true:

• the interested party contests the accuracy of their personal data, for the time necessary for the data controller to verify the accuracy of such data;
• the processing is illegal and the interested party opposes cancellation of personal data and requests instead that such data be limited;
• even if the data controller no longer needs the data for processing purposes, the personal data is necessary to the interested party for verification, exercise or defence of a right in a court of law;
• the interested party is opposed to the processing in accordance with art.21 para 1 pending the verification of the possible prevalence of the legitimate reasons of the data controller with respect to those of the interested party.

How to exercise it
The interested party can exercise this right by written request to email address

In order to be able to provide a positive reply to the request, the necessary identification details of the data subject must be provided.

Before providing a response, the controller may need to identify the data subject as the right may only be exercised by the data subject or their delegate.

Art. 19 Notification obligation regarding rectification or erasure of personal data or restriction of processing

Description
The controller shall communicate to each of the recipients to whom the personal data have been transmitted any corrections or cancellations or limitations of the processing carried out in accordance with Article 16 of Article 17, paragraph 1, and Article 18, unless this proves impossible or involves a disproportionate effort. The controller shall notify the interested party of such recipients if the data subject so requests.

How to exercise it
The interested party can exercise this right by written request to email address

To be able to provide a positive response to the request, the interested party must provide the information necessary to identify the interested party

Before providing a response, the data controller may need to identify the interested party as the right can only be exercised by the interested party his/her self or his/her delegate.

Art 20 Right of data on demand

Description
The interested party has the right to receive in a structured format, of common use and readable by automatic device the personal data relating to him/her provided to a data controller and has the right to transmit such data to another data controller without hindrance by the data controller to whom he/she has provided them.

In exercising his/her data portability rights under the previous paragraph, the interested party shall have the right to obtain the direct transmission of personal data from one controller to another, if technically feasible.

The exercise of the right referred to in the initial paragraph shall not affect Article 17 - Right to erasure («right to be forgotten»).

Assumptions

The right cannot be exercised if one of the following applies:

• processing is based on consent under Article 6, paragraph 1, letter a), or Article 9, paragraph 2, letter a), or a contract under Article 6, paragraph 1, letter b);
• the processing is carried out using automated procedures.

This right shall not apply to the processing necessary for the performance of a task in the public interest or relating to the exercise of official authority by the controller.

The exercising of the right must not affect the rights and freedoms of others.

How to exercise it
The interested party can exercise this right by written request to email address

To be able to provide a positive response to the request, the interested party must provide the information necessary to identify the interested party

Before providing a response, the data controller may need to identify the interested party as the right can only be exercised by the interested party his/her self or his/her delegate.

Art. 21 Right to object

Description
The interested party has the right to object at any time

The data controller shall refrain from further processing of personal data unless he demonstrates the existence of compelling legitimate grounds for processing that outweigh the interests, rights and freedoms of the interested party or for verification, the exercise or defence of a right in court.

Where personal data are processed for direct marketing purposes, the interested party has the right to object at any time to the processing of personal data concerning him/her carried out for such purposes, including profiling to the extent that it is related to such direct marketing.

Where the interested party objects to processing of personal data for direct marketing, personal data are no longer processed for these purposes.

Where personal data are processed for scientific or historical research purposes or for statistical purposes in accordance with Article 89, paragraph 1, the interested party for reasons related to his/her particular situation, has the right to object to the processing of personal data concerning him/her, except where processing is necessary for the performance of a task of public interest.

Assumptions

The right can be exercised if one of the following is true:

• reasons relating to his particular situation,
• processing of personal data concerning him/her in accordance with Article 6(1) letter e) and processing is necessary for the performance of a task in the interest of the public or in connection with the exercise of official authority by the controller (the processing is necessary for the pursuit of the legitimate interest of the controller or third parties, provided that the interests or fundamental rights and freedoms of the interested party that require the protection of personal data do not prevail, in particular if the person concerned is a minor.), including profiling on the basis of such provisions

How to exercise it
The interested party can exercise this right by written request to email address

To be able to provide a positive response to the request, the interested party must provide the information necessary to identify the interested party Before providing a response, the data controller may need to identify the interested party as the right can only be exercised by the interested party his/her self or his/her delegate.

In the context of the use of information society services and without prejudice to Directive 2002/58/EC, the data subject may exercise his right of objection by automated means using technical specifications

Before providing a response, the data controller may need to identify the interested party as the right can only be exercised by the interested party his/her self or his/her delegate.

In general, to exercise these rights, the Data Subject may contact the Data Controller using the contact details provided above.

Before providing a response, the Data Controller may need to verify the identity of the Data Subject by requesting a copy of an identity document.

A written response will be provided without undue delay and, in any case, no later than one month from receipt of the request.

Version 4.1
Last updated: 19 May 2026