LCM has always regarded the protection of its Users’ personal data as fundamentally important. With this document (hereinafter, the “Notice”), we intend to reaffirm our commitment to ensuring that the processing of personal data—performed in any manner, whether automated or manual—takes place in full compliance with the safeguards and rights recognized by Regulation (EU) 2016/679 (hereinafter, “GDPR” or “Regulation”) and any other applicable laws regarding the protection of personal data.

The term personal data refers to the definition contained in Article 4, point 1) of the Regulation, meaning:
“any information relating to an identified or identifiable natural person; an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person”
(hereinafter, the “Personal Data”).

The Regulation establishes that, before proceeding with the processing of Personal Data—meaning, according to the definition contained in Article 4, point 2) of the Regulation,
“any operation or set of operations which is performed on personal data or sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction”
(hereinafter, the “Processing”)—it is necessary that the person to whom such Personal Data belongs be informed about the reasons why the data are requested and how they will be used.

In this regard, this Notice—drafted in accordance with the principle of transparency and including all elements required under Article 14 of the Regulation—aims to provide you, in a simple and intuitive manner, with all the useful and necessary information so that you may provide your Personal Data consciously and in an informed manner and, at any time, request and obtain clarifications and/or rectifications.

A. THE DATA CONTROLLER AND JOINT CONTROLLERS

The association that will process your Personal Data for the purposes described in Sections C and D of this Notice, and which therefore will act as the Data Controller, according to the definition contained in Article 4, point 7) of the Regulation:
“the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data”,
is:

LCM DI G. MARZANO & C s.a.s., headquartered in TRANI – 76123 – (BT), Via Papa Giovanni XXIII n. 71

Your Personal Data will also be accessible to the other companies within the Group—acting as Joint Data Controllers—which have entered into a joint controllership agreement pursuant to Article 26 of the Regulation, through which they have committed to:

– jointly determine certain purposes and methods of Processing of your Personal Data;
– jointly determine, clearly and transparently, the procedures for providing timely responses should you wish to exercise your rights as provided by Articles 15, 16, 17, 18 and 21 of the Regulation, as well as in cases of Personal Data portability pursuant to Article 20 of the Regulation, as more fully described in Section H of this Notice;
– jointly define this Notice in the sections of mutual interest, indicating all information required by the Regulation.

The full list of Joint Controllers is available at the Controller’s headquarters and may be provided upon specific request by the Data Subjects, to be submitted using the contact details indicated in Section I.

B. CONTACT DETAILS OF THE DATA PROTECTION OFFICER (DPO)

In order to facilitate communication between you, as the Data Subject, meaning the “identified or identifiable natural person” to whom the Personal Data refer under Article 4, point 1) of the Regulation (hereinafter, the “Data Subject”), and the Joint Controllers, the Regulation has provided, in certain cases, for the appointment of a supervisory and support figure who, among other tasks, also acts as a contact point with the Data Subject.

The Joint Controllers have appointed this figure, known as the Data Protection Officer (DPO), pursuant to Article 37 of the Regulation, identifying and appointing Ms. Sara de Simone (hereinafter, the “DPO”).

The DPO, pursuant to and for the purposes of Article 39 of the Regulation, is entrusted with, inter alia, the following activities:

– informing and advising the Controller as well as employees carrying out Processing operations regarding the obligations deriving from the Regulation and other applicable EU or Member State provisions on Personal Data protection;
– monitoring and supervising compliance with the Regulation, with applicable legislation, and with policies and procedures adopted by the Controller;
– providing support in handling responses to the Data Subject;
– cooperating with the Supervisory Authority for Personal Data Protection.

As provided by Article 38 of the Regulation, you may freely contact the DPO for any issues related to the Processing of your Personal Data and/or should you wish to exercise your rights as provided in Section H of this Notice, by sending a written communication to the following email address: lcm@lcmtrani.it

C. MAIN PURPOSES

The Joint Controllers, in order to enable your registration on the website **www.lcmtrani.com**—in those sections where the possibility exists to register and/or send information requests by using contact forms and/or to subscribe to the newsletter service—need to collect some of your Personal Data.

The Processing of your Personal Data will be carried out by the Controller to allow you, therefore, to participate in initiatives (for example, events for condominium communities) promoted also through the Website, to receive newsletters, to send requests for information, as well as to use all the other services offered from time to time through the Website on which you have registered and/or within which you are browsing; the Processing of your Personal Data will be legally based on the contractual relationship created between you and the Controller as a result of your acceptance of the conditions for participation in the Website.

To allow the Controller to carry out the Processing activities for the purposes mentioned above, it will be necessary to provide the Personal Data marked with the symbol [*].

This Processing will be lawful pursuant to Article 6, paragraph 1, point b) of the Regulation.

If you fail to provide even one of the data marked with the symbol [*], it will not be possible to proceed with the Processing of your Personal Data and, consequently, it will not be possible to complete your registration to the Website and/or to benefit from the services provided by the Website that require the provision of Personal Data.

The Personal Data that will be requested from you for the achievement of the purposes described above are those indicated in the registration and/or contact form, meaning by way of example and not limitation: name, surname, username, date of birth, domicile/residence address, email address, landline and/or mobile phone numbers, tax code. In this case, you may view this Notice within the Privacy section of the Website.

D. ENTITIES TO WHOM YOUR PERSONAL DATA MAY BE DISCLOSED

Your Personal Data may be disclosed to specific subjects considered recipients of such Personal Data.

Indeed, Article 4, point 9) of the Regulation defines as a Recipient of Personal Data:
“a natural or legal person, public authority, agency or another body to which the personal data are disclosed, whether or not it is a third party”
(hereinafter, the “Recipients”).

In this regard, in order to correctly perform all Processing activities necessary to pursue the purposes outlined in this Notice, the following Recipients may find themselves in the position of processing your Personal Data:

– third parties who carry out part of the Processing activities and/or activities connected or instrumental to them on behalf of the Controller or Joint Controllers. These subjects have been appointed as Data Processors, meaning, pursuant to Article 4, point 8) of the Regulation:
“a natural or legal person, public authority, agency or other body which processes Personal Data on behalf of the Controller”
(hereinafter, the “Data Processor”);

– individuals, employees and/or collaborators of the Controller or Joint Controllers, who have been assigned specific and/or multiple Processing activities with regard to your Personal Data. These individuals have received specific instructions concerning security and the correct use of Personal Data and are defined, pursuant to Article 4, point 10) of the Regulation, as:
“persons authorised to process Personal Data under the direct authority of the Controller or the Data Processor”
(hereinafter, the “Authorised Persons”);

– subjects to whom the Joint Controllers have, for any reason, transferred the data indicated in point (iv) of Section D.

Where required by law or where necessary to prevent or prosecute the commission of an offence, your Personal Data may be communicated to public bodies or judicial authorities without these being considered Recipients. In fact, pursuant to Article 4, point 9) of the Regulation:
“public authorities which may receive Personal Data in the framework of a particular inquiry in accordance with Union or Member State law shall not be regarded as Recipients.”

E. RETENTION PERIOD

One of the principles applicable to the Processing of your Personal Data concerns the limitation of the retention period, set out in Article 5, paragraph 1, point e) of the Regulation, which states:

“Personal Data shall be kept in a form which permits identification of Data Subjects for no longer than is necessary for the purposes for which the Personal Data are processed; Personal Data may be stored for longer periods insofar as the Personal Data will be processed solely for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1), subject to implementation of the appropriate technical and organisational measures required by this Regulation in order to safeguard the rights and freedoms of the Data Subject.”

In light of this principle, your Personal Data will be processed by the Joint Controllers only for the time strictly necessary to pursue the main purposes referred to in Section C of this Notice.

In particular, your Personal Data will be processed for a period of time equal to the minimum necessary, as indicated in Recital 39 of the Regulation, meaning until the termination of the contractual relationship between you and the Controller and/or Joint Controller, subject to an additional retention period that may be required by law, as also provided for in Recital 65 of the Regulation.

With regard to Processing carried out to achieve the additional purposes referred to in Section D of this Notice, the Joint Controllers may lawfully process your Personal Data until you communicate, in one of the methods provided in this Notice, your intention to withdraw your consent for one or all of the purposes for which it was requested.
Any withdrawal of consent will, in fact, require the Joint Controllers to cease the Processing of your Personal Data for those purposes.

F. WITHDRAWAL OF CONSENT

As provided by the Regulation, should you have given your consent to the Processing of your Personal Data for one or more of the purposes for which it was requested, you may withdraw it, at any time, in whole or in part, without affecting the lawfulness of the Processing based on the consent given before the withdrawal.

The methods for withdrawing consent are very simple and intuitive: you only need to contact the Controller and/or the Joint Controllers and/or the DPO using the contact channels provided in this Notice, specifically in Sections B and H.

G. RIGHTS

As provided by Article 15 of the Regulation, you may access your Personal Data, request their rectification and updating if incomplete or incorrect, request their deletion if collected in violation of a law or regulation, as well as object to their Processing for legitimate and specific reasons.

In particular, below are all your rights, which you may exercise at any time vis-à-vis the Controller and/or Joint Controllers.

1. Right of access

Pursuant to Article 15, paragraph 1 of the Regulation, you have the right to obtain from the Controller confirmation as to whether or not Processing of your Personal Data is taking place and, if so, to obtain access to such Personal Data and to the following information:

a) the purposes of the Processing;
b) the categories of Personal Data concerned;
c) the Recipients or categories of Recipients to whom your Personal Data have been or will be disclosed, in particular if Recipients in third countries or international organisations;
d) where possible, the envisaged period for which the Personal Data will be stored, or, if not possible, the criteria used to determine that period;
e) the existence of the right of the Data Subject to request from the Controller rectification or erasure of Personal Data or restriction of Processing or to object to such Processing;
f) the right to lodge a complaint with a Supervisory Authority;
g) where the Personal Data are not collected from the Data Subject, any available information as to their source;
h) the existence of automated decision-making, including profiling, referred to in Article 22, paragraphs 1 and 4 of the Regulation, and, at least in such cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such Processing for the Data Subject.

All this information can be found within this Notice, which will always be available to you inside the Privacy section of the Website.

2. Right to rectification

You have the right, pursuant to Article 16 of the Regulation, to obtain the rectification of inaccurate Personal Data concerning you.
Considering the purposes of the Processing, you may also obtain the completion of incomplete Personal Data, including by providing a supplementary statement.

3. Right to erasure

You may obtain, pursuant to Article 17, paragraph 1 of the Regulation, the erasure of your Personal Data without undue delay, and the Controller will be obliged to erase your Personal Data where even one of the following grounds applies:

a) the Personal Data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;
b) you have withdrawn the consent on which the Processing is based and there is no other legal ground for the Processing;
c) you object to the Processing pursuant to Article 21, paragraph 1 or 2 of the Regulation and there are no overriding legitimate grounds for the Processing;
d) your Personal Data have been unlawfully processed;
e) your Personal Data must be erased for compliance with a legal obligation under Union or Member State law.

In some cases, as provided by Article 17, paragraph 3 of the Regulation, the Controller is entitled not to erase your Personal Data where their Processing is necessary, for example:

– for exercising the right to freedom of expression and information;
– for compliance with a legal obligation;
– for reasons of public interest;
– for archiving purposes in the public interest, scientific or historical research purposes, or statistical purposes;
– for the establishment, exercise, or defence of legal claims.

4. Right to restriction of Processing

You may obtain restriction of Processing, pursuant to Article 18 of the Regulation, where one of the following circumstances applies:

a) you contest the accuracy of the Personal Data (the restriction will continue for the period necessary for the Controller to verify the accuracy of such Personal Data);
b) the Processing is unlawful, but you oppose the erasure of the Personal Data and request that their use be restricted instead;
c) although the Controller no longer needs the Personal Data for the purposes of the Processing, they are required by you for the establishment, exercise, or defence of legal claims;
d) you have objected to Processing pursuant to Article 21, paragraph 1 of the Regulation and verification is pending as to whether the Controller’s legitimate grounds override yours.

Where Processing is restricted, your Personal Data will be processed—except for storage—only:

– with your consent, or
– for the establishment, exercise, or defence of legal claims, or
– for the protection of the rights of another natural or legal person, or
– for reasons of important public interest.

In any case, you will be informed before the restriction is lifted.

5. Right to data portability

At any time, pursuant to Article 20, paragraph 1 of the Regulation, you may request and receive all your Personal Data processed by the Controller and/or Joint Controllers in a structured, commonly used, and machine-readable format, or request that they be transmitted to another controller without hindrance.

In this case, it will be your responsibility to provide us with the exact details of the new controller to whom you wish to transfer your Personal Data, together with written authorization.

6. Right to object

Pursuant to Article 21, paragraph 2 of the Regulation and Recital 70, you may object at any time to the Processing of your Personal Data where they are processed for direct marketing purposes, including profiling to the extent that it is related to such direct marketing.

7. Right to lodge a complaint with a Supervisory Authority

Without prejudice to your right to seek remedy in any other administrative or judicial context, should you believe that the Processing of your Personal Data carried out by the Controller and/or Joint Controllers violates the Regulation and/or applicable law, you may lodge a complaint with the competent Supervisory Authority for Personal Data Protection.

H. CONTACTS

To exercise all your rights as identified above, you only need to contact the Controller and/or the Joint Controllers in the following ways:

– by sending an email to lcm@lcmtrani.it;
– by sending a registered letter to the Controller’s registered office.

We remind you that, at any time, you may also contact the DPO of the company “LCM” using the methods described in Section B of this Notice.

I. LOCATIONS OF PROCESSING

Your Personal Data will be processed by the Controller and/or Joint Controllers within the territory of the European Union, Vatican City, and the Republic of San Marino.

Should it become necessary, for technical and/or operational reasons, to make use of entities located outside the European Union, you are hereby informed that such entities will be appointed as Data Processors pursuant to and for the purposes of Article 28 of the Regulation, and that the transfer of your Personal Data to such entities—limited to the performance of specific Processing activities—will be carried out in compliance with Chapter V of the Regulation.

Accordingly, all necessary safeguards will be adopted to ensure the fullest protection of your Personal Data, and such transfer will be based on:

(a) adequacy decisions issued by the European Commission regarding the third-country recipients;
(b) adequate safeguards provided by the third-party recipient pursuant to Article 46 of the Regulation;
(c) the adoption of binding corporate rules (BCRs);
(d) the adoption of standard contractual clauses (SCCs) approved by the European Commission.

In any case, you may request more detailed information from the Controller and/or Joint Controllers should your Personal Data be processed outside the European Union, including evidence of the specific safeguards applied.