WHISTLEBLOWING PRIVACY POLICY IN ACCORDANCE WITH THE EUROPEAN REGULATION 2016/679 AND D.LGS. 196/03 and the following
We inform you that the personal data you provide may be processed through duly authorized persons and our Supervisory Body in the event of reporting by you of alleged illegal conduct and / or irregularities of which you have become aware, in compliance with the aforementioned legislation and the confidentiality obligations provided for therein.
About Us
This communication is made available – pursuant to art. 13 of the European Regulation 2016/679 on the protection of personal data (“Regulation” or “GDPR”), of Legislative Decree 30/06/2003 n. 196 (“Privacy Code”), as amended and supplemented by Legislative Decree 101/2018, and subsequent amendments and additions – by PIETRO BARBARO S.p.A. (hereinafter also “PIETRO BARBARO” or the “Company“”) with registered office in Via Jacopo Peri 1 – 00198 – Rome, Italy, as Data Controller of personal data.
Categories of data processed
- your personal information, where indicated, such as: name, surname, gender, date and place of birth, nationality, tax code, postal and / or e-mail addresses, landline or mobile telephone number;
- your current job position (title, position and company name of the company where you are employed);
- any other information in your report.
Legal basis and purpose for which we process your data
PIETRO BARBARO will process your Personal Data only if required or justified by law for the specific purposes indicated in the introduction. The legal basis of the processing is represented by the obligations dictated by Legislative Decree 231/2001, Legislative Decree 24/2023 and the applicable laws and regulations. For this reason, we will only process your Personal Data if:
- the processing is necessary to carry out verification and investigation activities regarding the reporting, reporting of alleged illegal conduct and / or irregularities and to take the necessary measures;
- the processing is necessary to fulfill legal obligations or requirements of the Supervisory Authorities to which we are subject and for the obligations established by Legislative Decree 231/2001 and Legislative Decree 24/2023;
- processing is necessary to protect your interests or fundamental rights or those of other persons;
- The processing is necessary for the pursuit of our legitimate interest or that of a third party, provided that the interests or fundamental rights and freedoms of the data subjects do not prevail.
Sharing and transfer of personal data
The data collected by the Data Controller will be shared only for the purposes mentioned above; we will not share or transfer your personal data to third parties other than those set out in this Privacy notice. In the course of our activities and exclusively for the same purposes as those listed in this Privacy notice, your personal data may be transferred to the following categories of recipients:
- the subjects belonging to the Supervisory Body, appointed to manage reports;
- company personnel in charge of the investigation;
- companies, entities, consortia, persons who provide us with processing services or who carry out activities connected, instrumental or support to the one covered by the information;
- subjects to whom the right to access your personal data is recognized by provisions of law or European Union legislation.
The updated list of Data Processors is available at the registered office of the Data Controller and will be provided upon written request. This Privacy notice is also applicable in the case of data transfer to third countries where the level of data protection is different from that of the European Union: any transfer of personal data to third parties will be carried out only after informing you and, where required, after receiving your consent. Any transfer of data to countries other than those for which the European Commission has taken an adequacy decision takes place on the basis of agreements that use standard contractual clauses adopted by the European Commission or other appropriate guarantees in compliance with applicable laws.
Protection of personal data
The Data Controller has implemented technical and organizational measures suitable to provide an adequate level of security and confidentiality to personal data. These measures take into consideration:
- the state of the art of technology;
- the costs of its implementation;
- the nature of the data;
- the risk of processing.
The purpose is to protect them against accidental or unlawful destruction or alteration, accidental loss, unauthorized disclosure or access and other unlawful forms of processing. Furthermore, when managing your personal data, the Data Controller:
- collects and processes personal data that is adequate, pertinent and not excessive, as required to satisfy the aforementioned purposes: for this purpose, data that is manifestly not useful for managing the specific report is not collected. In the event of accidental collection, immediate reporting is guaranteed;
- ensure that such personal data remains up-to-date and accurate.
Data retention times
Without prejudice to your right to object to the processing of personal data and / or to request its cancellation, the Data Controller will keep your personal data only for the time strictly necessary to achieve the purpose for which they were collected or to meet legal or regulatory requirements. The retention period is the time of their actual use, plus the period that may be required by the applicable rules and/or regulations for their storage. At the end of the period your personal data will be removed from the systems.
Your rights under the law
The rights related to the personal data processed by the Data Controller are:
- Right to rectification. You can obtain the correction of personal data concerning you or communicated by you. The Data Controller makes every reasonable effort to ensure that the personal data in its possession are accurate, complete, up-to-date and relevant, based on the most recent information available;
- RIGHT TO RESTRICTION. You can obtain a limitation to the processing of your personal data if:
– you dispute the accuracy of your personal data in the period in which the Data Controller must verify its accuracy; – the processing is unlawful and you request a limitation of processing or erasure of your personal data; – there is no longer a need for the Data Controller to keep your personal data but you need it to ascertain, exercise or defend your rights in court or
- you oppose the processing while the Data Controller verifies whether the legitimate motivations of the company prevail.
- Right of access. You can request information on the personal data held concerning you, including information on which categories of personal data the Data Controller owns or controls, for what purpose they are used, where they were collected (if not directly by you) and to whom they may have been communicated;
- Right to portability. Following your request, the Data Controller will transfer your personal data to another Data Controller, if technically possible, provided that the processing is based on your consent or is necessary for the execution of a contract;
- Right to erasure. You can obtain the cancellation of your personal data if:
- the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;
- you have the right to object to further processing of your personal data and exercise this right to object;
- The personal data have been processed unlawfully;
unless the processing is necessary by virtue of legal obligations, the law or to establish, exercise or defend a right in court.
- Right to object. You can object to the processing of your personal data at any time, provided that the processing is not based on your consent but on the legitimate interests of the Data Controller or of third parties. In such cases, your personal data will no longer be processed unless it is possible to demonstrate the compelling and legitimate reasons, a prevailing interest in the processing or verification, or the exercise or defense of a right in court. If you object to the processing, please specify if you intend to cancel your personal data or limit their processing;
- Right to complaint. In the event of an alleged violation of applicable privacy law, you may lodge a complaint with the competent authorities of your country or the place where the alleged violation took place.
Changes to this privacy notice
Any future changes or additions to the processing of personal data as described in this Privacy notice will be notified in advance through an individual notification, through the usual communication channels used by the Data Controller (for example by e-mail or via the website).
Data Controller and Data Protection Contact
To exercise the rights referred to in Articles. 15 et seq. of the Privacy Regulation, you can contact the Data Controller PIETRO BARBARO S.p.A. with registered office in Via Jacopo Peri 1 – 00198 – Rome, Italy. VAT number and Tax Code: : 03231530829 E-mail: privacy@pietrobarbaro.com