Privacy Policy - Centrale Acquisti

DATA CONTROLLER AND CONTACT DETAILS

The Data Controller is the Lazio Regional Council, with registered office at Via Rosa Raimondi Garibaldi 7, 00145 Rome, contactable as follows:

• phone URP - Public Relations Office: 06/99500
• contact form available at: https://scriviurpnur.regione.lazio.it/
• e-mail: urp@regione.lazio.it
• PEC: urp@pec.regione.lazio.it .

DATA PROTECTION OFFICER (“DPO”)

The Data Controller has appointed a Data Protection Officer (DPO), who can be contacted at the institutional email address: dpo@regione.lazio.it.

CATEGORIES OF PERSONAL DATA PROCESSED

The types of information processed are exclusively those listed below:

Navigation Data: this refers to personal information whose transmission is necessary for the use of Internet communication protocols and which is acquired by the information systems and software procedures responsible for the operation of the Portal during their normal functioning.

This data category involves: 

- IP addresses; 

- the type of browser used; 

- the operating system used; 

- the domain names of the computers used by users who connect to the Portal;

- the addresses in URI notation (Uniform Resource Identifier) of the requested resources; 

- the time of the request; 

- the method used to submit the request to the server; 

- the size of the file received in response; 

- the numeric code indicating the status of the server's response; 

- internal path analysis; 

- other parameters related to the user's operating system and computing environment. 

Data provided voluntarily by the interested party: these are user contact data or personal data possibly included in communications which are acquired through voluntary sending to the contact addresses of the Data Controller present on the Portal, as well as through filling in forms on the pages dedicated to specific services or initiatives, for which please refer to the specific information on the protection of personal data. 

In general, please do not send judicial data or sensitive data (information that reveals racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, genetic, biometric and health data, or a person's life or sexual orientation) in messages. If the message sent by the user contains data that is irrelevant, inadequate and unnecessary with respect to the purpose pursued, the Data Controller will refrain from using such information. 

Cookies and other tracking systems: these are exclusively technical session cookies (non-persistent) or other similar tools whose use is strictly limited to what is necessary for safe and efficient navigation of the Portal; Profiling cookies aimed at creating user profiles are not used. When links to third-party websites, pages or services are provided, they are appropriately reported so that the user can consciously and unequivocally choose whether or not to continue browsing; the information and/or privacy policies present on third-party websites, pages or services are not to be considered related to those prepared for this Portal. For further details on the use of cookies on this Portal, please refer to the cookie policy available at the following link https://www.centraleacquisti.it/la-centrale-acquisti/centrale-acquisti/cookie;

FREEDOM OR OBLIGATION TO PROVIDE DATA AND CONSEQUENCES

The functioning of the Portal requires the transmission of some information essential in the use of Internet communication protocols; otherwise navigation would not be possible. For this reason, since the use of cookies and other technical identifiers falls within a codified hypothesis of exemption, there is no obligation for the Data Controller to acquire the consent of the interested party. 

Access to services or initiatives on the Portal (e.g. the registration request and use of the portal support) is not mandatory, nor is the provision of personal data for the purpose of access; however, failure, partial or incorrect provision of the same could result in the reduced or total impossibility of using the services.

PURPOSE AND LEGAL BASIS OF THE PROCESSING

PURPOSE

LEGAL BASIS

• Legality condition: Legal obligation (art. 6, paragraph 1, letter c), of the GDPR).
• Legal basis on which the processing is based: Art. 122, paragraph 1, Legislative Decree. 30 June 2003, n. 196 (Privacy Code).

PURPOSE

LEGAL BASIS

• Lawful basis: Legal obligation (Art. 6(1)(e) of the GDPR).
• Legal basis for processing: Art. 122, paragraph 1, Legislative Decree no. 196 of 30 June 2003 (Privacy Code).

STORAGE PERIOD

Without prejudice to the need for further conservation for the purpose of protecting one's rights in court with reference to ongoing disputes or pre-litigation situations, the processed data are stored as indicated below: 

• - For purposes no. 1 and 2 for cookies and other tracking systems, please refer to the cookie policy available at the following link: https://www.centraleacquisti.it/la-centrale-acquisti/centrale-acquisti/cookie; 

In any case, in compliance with the principle of limitation of conservation (art. 5.1, letter e) of the GDPR), your data will be retained for a period no longer than that necessary to pursue the purposes mentioned above. The adequacy, relevance and indispensability of the data will be constantly verified with respect to the relationship, performance, assignment or service in progress, to be established or terminated, also with reference to the data that you provide on your own initiative. Therefore, even following checks, the information and data that are found to be excessive or irrelevant or not indispensable will not be used, except for the possible conservation of the document containing them in accordance with the law.

RECIPIENTS

The processing of your personal data will be carried out by the persons responsible for the relevant procedure, by manual/paper-based means and by IT procedures involving human intervention, in the ways and within the limits necessary to pursue the aforementioned purposes. The list of recipients, recorded in the processing activities register, is kept up to date and available in case of inspections by the Data Protection Authority. 

The parties who may be recipients of your personal data are: 

• Processors: The Controller uses LAZIOcrea S.p.A., an in-house company, for the management of the Regional Council's information systems; in compliance with Article 28 of the GDPR, written data protection agreements are entered into with these parties, under which the Controller provides instructions, tasks and obligations to them. To comply with the GDPR and protect the rights and freedoms of data subjects, the Controller uses only Processors that provide sufficient guarantees (specialist knowledge, experience, capacity and reliability) to implement appropriate technical and organizational measures for the security of information and personal data and to protect data subjects. 
• Authorized personnel: Your personal data will be processed by individuals within the Controller's organization (e.g., managers, employees and auxiliaries, members of governing and control bodies) who have been identified and appointed as "Authorized" for processing; they are given appropriate instructions regarding measures, procedures and operating methods, all aimed at effectively protecting personal data. Access to data is limited to those who are actually authorized. 

In any case, personal data may be disclosed only to comply with legal or regulatory obligations or general administrative acts (e.g.: Law 241/1990; Legislative Decree no. 33/2013; etc.).

TRANSFER TO THIRD COUNTRIES (EXTRA EU) OR INTERNATIONAL ORGANIZATIONS

It is not the Data Controller's intention to transfer your personal data to countries not belonging to the European Economic Area (EEA) or international organizations that could jeopardize the level of protection of natural persons guaranteed by the GDPR.

In any case, in consideration of the obligations referred to in Chapter V of the GDPR, international transfers will be permitted in the presence of an adequacy decision (see  https://www.garanteprivacy.it/temi/trasferimento-di-dati-all-estero ).

RIGHTS OF INTERESTED PARTIES 

Pursuant to articles 15 to 22 of the GDPR, in relation to your personal data, in the cases provided for, you have the right to: access and request a copy; request rectification; request cancellation; obtain the limitation of processing; object to the treatment; portability; not be subjected to a decision based solely on automated processing. For any further information relating to the processing of your personal data, also following the updating of this information, and to assert the rights recognized to you by the GDPR, do not hesitate to contact the Data Controller or the DPO

COMPLAINTS

It is always possible to lodge a complaint with the Guarantor for the protection of personal data by following the procedures and indications published on the official website of the Authority available at the address www.garanteprivacy.it

The Director of the Regional Directorate 

“Programmazione Economica, Centrale Acquisti, Fondi Europei, PNRR” 

n.q. of Subject Designated for processing by the Owner 

Paolo Alfarone