Source: https://www.interphone.com/en-it/privacy
Timestamp: 2020-07-13 10:03:25
Document Index: 280311673

Matched Legal Cases: ['ART. 13', 'Art. 6', 'Art. 6', 'Art. 6', 'Art. 6', 'Art. 6', 'Art. 6', 'Art. 28', 'Art. 46', 'Art 46']

PURSUANT TO ART. 13 OF (EU) REGULATION 2016/679 OF THE EUROPEAN PARLIAMENT AND THE COUNCIL OF 27 APRIL 2016 (“GENERAL DATA PROTECTION REGULATION”)
1.INTRODUCTION: THE ROLE OF CELLULARLINE SPA AND METAXY S.R.L SRL IN THE PROCESSING OF PERSONAL DATA COLLECTED THROUGH THE CELLULARLINE AND INTERPHONE WEBSITES
2. IDENTITY AND CONTACT DETAILS OF METAXY S.R.L AS THE INDEPENDENT DATA CONTROLLER
3. PROCESSING OF DATA BY METAXY S.R.L FOR THE PURPOSE OF CONCLUDING AND PERFORMING THE PURCHASE AGREEMENT
4. PROCESSING OF DATA BY METAXY S.R.L FOR THE PURPOSE OF CUSTOMER CARE/SERVICE
5. PROCESSING OF DATA BY METAXY S.R.L FOR THE PURPOSE OF PREVENTING FRAUD IN THE EVENT OF PAYMENT BY CREDIT CARD
6. PROCESSING OF DATA BY METAXY S.R.L FOR ADMINISTRATION/ACCOUNTING AND TAX PURPOSES
7. PROCESSING OF DATA BY METAXY S.R.L FOR THE PURPOSE OF ALLOWING THE USER TO EXERCISE THEIR RIGHTS
8. PROCESSING OF DATA BY METAXY S.R.L FOR THE PURPOSE OF THE ESTABLISHMENT, EXERCISE OR DEFENCE OF LEGAL CLAIMS
9. CATEGORIES OF SUBJECTS TO WHOM METAXY S.R.L DISCLOSES THE USER’S PERSONAL DATA (RECIPIENTS)
13. RIGHT TO RECTIFICATION
17. RESPONSE TIMES AND METHODS IN THE EVENT OF THE DATA SUBJECT EXERCISING THEIR RIGHTS
1. INTRODUCTION: THE ROLE OF CELLULARLINE SPA AND METAXY S.R.L SRL IN THE PROCESSING OF PERSONAL DATA COLLECTED THROUGH THE CELLULARLINE AND INTERPHONE WEBSITES
The following information notice is intended for all subjects that make purchases on the following e-commerce websites: cellularline.com/it, interphone.com/it, interphone.com/de, interphone.com/fr, interphone.com/es, interphone.com/uk (individually a “Website” and collectively “Websites”).
The websites are the property of CELLULAR LINE SPA (“CELLULAR LINE”) which is also the owner of the domain names and trade marks “Cellularline” and “Interphone”. As appointed by CELLULAR LINE the websites are managed by METAXY S.R.L s.r.l. (“METAXY S.R.L”) which sells the products with the trademarks “Cellularline” and “Interphone” promoted on the websites.
METAXY S.R.L manages the sales and transactions performed through the Websites (e.g.: management of orders, sale and delivery of products, management of returns and the legal guarantee and other activities necessary for the sale of the products through the Websites). CELLULAR LINE provides the services that enable access, browsing and registration on the Websites.
CELLULAR LINE and METAXY S.R.L will process the personal data you provide for registration on the Websites and respectively, for the conclusion of the purchase agreement through the Websites as independent data controllers (individually, an "Independent Data Controller" and collectively "Independent Data Controllers"), in compliance with the provisions of EU 679/2016 (the “Regulation”) and Italian Legislative Decree No. 196 of 30 June 2003 (the "Privacy Code").
- CELLULARL LINE will process your personal data, as Independent Data Controller, in order to manage access to the services of the Websites and facilitate the purchase of products online and to enable your registration on the Websites and any conclusion of the purchase agreement through the Websites and, subject to your consent, for marketing and/or profiling purposes;
- METAXY S.R.L will process your personal data, as Independent Data Controller, in order to enable the conclusion of the purchase agreement, fulfil the obligations deriving from the agreement, to comply with all the legal obligations, including tax and administrative obligations, connected thereto and for all other purposes connected with such agreement and/or the performance of pre-contractual measures, as described herein;
The processing performed by CELLULAR LINE, as the Independent Data Controller, is described in the CELLULAR LINE Privacy Information Notice, to which reference is to be made, provided in the footer of the Websites under the link “Cellular Line Privacy Information Notice”.
This information notice is therefore provided with exclusive reference to the processing performed by METAXY S.R.L as the Independent Data Controller.
2.IDENTITY AND CONTACT DETAILS OF METAXY S.R.L AS THE INDEPENDENT DATA CONTROLLER
MEGAXY S.R.L is the Independent Data Controller of the processing of the data provided by you for the conclusion of a purchase agreement through the Websites, for the purposes as per sections 4, 5, 6, 7, 8 and 9 of this information notice. The identification and contact details of METAXY S.R.L are as follows: METAXY S.R.L with registered office in Milano, via Giuseppe Parini 9, tax code, VAT Noand registration number with the Milano – Monza – Brianza – LodiCompanies Register 11042630969;
-telephone number: 0331 48151
-email address: info@metaxy.eu
3.PROCESSING OF DATA BY METAXY S.R.L FOR THE PURPOSE OF CONCLUDING AND PERFORMING THE PURCHASE AGREEMENT
METAXY S.R.L, as the Independent Data Controller, will process your personal data: -to enable the conclusion of the purchase agreement through the Websites (e.g.: loading of products into the basket and choice of the payment method); -to fulfil the obligations undertaken by METAXY S.R.L as a result of such agreement such as, by way of example, the delivery of the products sold;
-to enable you to fulfil the obligations undertaken by you as a result of the purchase agreement concluded through the Websites such as, by way of example, the online payment of the products purchased;
-to implement the pre-contractual measures requested by you (e.g.: notification of the availability of a product).
The lawful basis for this processing is the performance of the agreement (Art. 6.1.b) of the Regulation).
For this purpose, METAXY S.R.L will process your data for the time strictly necessary for the performance of the individual processing activities (e.g. the data necessary for the performance of the purchase agreement, until the delivery of the product or, in the event of unsuccessful delivery, until the termination of the agreement), notwithstanding the fact that, after such date, METAXY S.R.L may retain the data for the purposes and maximum storage periods specified in sections 4, 5, 6, 7, 8 and 9 of this information notice and/or however, in the cases established by the Regulation and/or by law.
The provision of data for the specified purposes is optional: this means that there is not legal or contractual obligation to notify the data; it is, however, a necessary requirement for the conclusion of the purchase agreement through the Websites; failure to provide the data will therefore imply the impossibility for the user to conclude such agreement and therefore to make purchases through the Websites.
4.PROCESSING OF DATA BY METAXY S.R.L FOR THE PURPOSE OF CUSTOMER CARE/SERVICE
METAXY S.R.L, as the Independent Data Controller, will process the users’ data for general customer care and service activities and therefore to provide a response to requests for information from users, i.e. to respond to complaints, reports and objections.
The lawful basis for this processing is the performance of pre-contractual measures adopted on request by the data subject (Art. 6.1.b, last paragraph, of the Regulation) or, according to the case, the legitimate interest of METAXY S.R.L (Art. 6.1.f) of the Regulation).
A legitimate interest of METAXY S.R.L is to respond to requests for information and/or reports and/or objections and/or complaints from users of the Websites (to whom METAXY S.R.L is obliged to respond, also on the basis of the legislation set out in the Consumer Code). Such legitimate interest of METAXY S.R.L also coincides with the legitimate interest of the users of the Websites who make the requests and/or reports and/or objections and/or complaints in question and who, therefore, within the context of the relationship with METAXY S.R.L, can be considered to reasonably expect their data to be used by METAXY S.R.L in order to provide them with a response.
The legitimate interest of METAXY S.R.L, thus identified, can therefore be considered to prevail over the fundamental rights and freedoms of the data subject, also because of such reasonable expectations and the relationship existing between the data subject and METAXY S.R.L and considering the nature of the processed data and the coinciding interest of the data subjects themselves.
In any case, you have the right, at any time, to object to the processing of your personal data for the purposes in question (i.e. customer care and service) for reasons connected with your personal situation.
To exercise such right, you can contact METAXY S.R.L in the following ways: by email to info@metaxy.eu, or by writing to the headquarters of Metaxy s.r.l , Via Pomini 92, 21050 Marnate (VA).
In the event of exercising the right to object to the processing of data for customer care/service purposes, METAXY S.R.L abstains from any further processing of users’ personal data for such purpose, unless it can demonstrate the existence of compulsory legitimate reasons for proceeding with processing that prevail over the interests, rights and freedoms of the data subject, or for the establishment, exercise or defence of legal claims.
The provision of personal data for the purposes in question is optional: this means that there is no legal and/or contractual obligation to provide the data; however, given the purpose of processing, failure to provide data and/or the exercise of the right to object can make it impossible to respond to requests and/or reports and/or complaints and/or objections from users, should the response to such requests imply the processing of the user’s personal data.
For these purposes, METAXY S.R.L shall process the user’s data for the amount of time necessary for performing the requested activities and, therefore, in particular, for the amount of time necessary for providing the information requested by the user or for responding to complaints and/or reports and/or objections put forward by the user.
5.PROCESSING OF DATA BY METAXY S.R.L FOR THE PURPOSE OF PREVENTING FRAUD IN THE EVENT OF PAYMENT BY CREDIT CARD
METAXY S.R.L, as the Independent Data Controller, shall process users’ personal data for the purpose of managing and possibly blocking payment transactions in relation to fraudulent orders, in the event of payment by credit card of the purchases made on the Websites. The data undergoing processing are data related to the order and data of the holder of the credit card used for payment, in the event in which METAXY S.R.L requests a copy thereof in order to guarantee secure payment, as indicated in the general conditions of sale that regulate the purchase. The processing in question does not relate to confidential credit card data (card number, expiry date and security code) which, together with the name of the card holder, are acquired directly by the provider of the payment services.
The lawful basis for this processing is the legitimate interest of METAXY S.R.L (Art. 6.1.f) of the Regulation).
In any case, you have the right, at any time, to object to the processing of your personal data for the purposes in question (i.e. prevention of fraud in the event of payment by credit card) for reasons connected with your personal situation.
To exercise such right, you can contact METAXY S.R.L in the following ways: by email to info@metaxy.eu, or by writing to the headquarters of Metaxy Srl Via Pomini 92, 21050 Marnate (VA).
For the purposes in question, METAXY S.R.L shall process users’ personal data for [24 months from collection].
In relation to the legitimate interest of METAXY S.R.L, the user is informed of the following:
- a legitimate interest of METAXY S.R.L consists of the performance of an activity, for fraud prevention purposes, in the event of online payment by credit card, to protect its own entrepreneurial interest, including the purpose of respecting the parameters defined by the international circuits in relation to the number of fraudulent payment attempts recorded on e-commerce websites. Such legitimate interest of METAXY S.R.L further coincides with the legitimate interest of the users of the Websites, as potential victims of fraud, such as the general public, who, in turn, have a legitimate interest in guaranteeing that fraudulent activities are discouraged and identified when they occur; it can therefore be considered that, within the context of relations with METAXY S.R.L, they reasonably expect their data to be processed also for the purpose of fraud prevention, for their protection and guarantee.
- the provision of data for the purposes in question (i.e. for the purpose of preventing credit card fraud) is optional; this means that there is no legal or contractual obligation to provide such data for such purpose; however, failure to send a copy of a form of identification of the holder of the credit card with which the payment was made, where requested, implies the termination of the purchase agreement concluded through the Websites.
- for the purposes in question, METAXY S.R.L also uses data initially collected for different purposes (and, notably, to enable the conclusion of the purchase agreement and the performance thereof) the processing of which for the purpose of preventing credit card fraud, is permitted, being based on the legitimate interest of METAXY S.R.L, considering the compatibility of the purposes in question with the purpose for which the data were initially collected;
- in the event of exercising the right to object, METAXY S.R.L abstains from any further processing of users’ personal data for such purpose, unless it can demonstrate the existence of compulsory legitimate reasons for proceeding with processing that prevail over the interests, rights and freedoms of the data subject, or for the establishment, exercise or defence of legal claims.
6.PROCESSING OF DATA BY METAXY S.R.L FOR ADMINISTRATION/ACCOUNTING AND TAX PURPOSES
METAXY S.R.L, as the Independent Data Controller, will process users’ data for the purpose of fulfilling administrative and/or accounting and/or tax obligations, connected with the purchase agreement concluded through the Websites such as, by way of example, book-keeping and issuing sales invoices.
The lawful basis for this processing is compliance with the legal obligations to which METAXY S.R.L is subject (Art. 6.1.c) of the Regulation).
The provision of data for the purposes in question is compulsory as the processing thereof is necessary to enable METAXY S.R.L to fulfil the legal obligations to which it is subject. Any refusal to provide data for this purpose shall imply the impossibility for the user to conclude the purchase agreement through the Websites.
For this purpose, METAXY S.R.L shall process the user’s data until the expiry of the legal time limits envisaged for the performance of all the administrative/accounting and tax requirements and/or for the storage times envisaged by law for the storage of the related documentation.
7.PROCESSING OF DATA BY METAXY S.R.L FOR THE PURPOSE OF ALLOWING THE USER TO EXERCISE THEIR RIGHTS
METAXY S.R.L, as the Independent Data Controller, shall process users’ data in order to:
-respond to requests to exercise the withdrawal right and/or requests to exercise the legal guarantee of conformity and/or other rights deriving from the purchase agreement concluded through the Websites and/or envisaged by law in relation to such agreement;
-perform the activities that prove to be necessary as a result of exercising such rights and proceed, if appropriate, to process the related refunds;
-receive and respond to requests to exercise rights in relation to personal data protection envisaged by the Regulation and perform the consequent activities.
The provision of data for the purposes in question is compulsory as the processing thereof is necessary to enable METAXY S.R.L to fulfil the legal obligations and the user to exercise the rights attributed thereto by law or by the agreement. Any refusal to provide data for this purpose shall imply the impossibility for the user to exercise such rights.
For this purpose, METAXY S.R.L shall process the data until the expiry of the legal time limits envisaged for the exercise of the right (limitation period and/or time limit) i.e., in the event of exercising such rights, for the amount of time necessary for the handling and closure of the case; in the event of exercising the rights envisaged by the Regulation, the data shall be processed until the certification, from the Data Controller, that the request has been fulfilled or until the fulfilment itself, according to which of the two events takes place last.
8.PROCESSING OF DATA BY METAXY S.R.L FOR THE PURPOSE OF THE ESTABLISHMENT, EXERCISE OR DEFENCE OF LEGAL CLAIMS
METAXY S.R.L, as the Independent Data Controller, shall process users’ data for the establishment, exercise or defence of legal claims in all the relevant contexts.
The lawful basis for this processing is legitimate interest (Art. 6.1.f) of the Regulation).
The legitimate interest of the data controller is to pursue remedies in order to guarantee respect for its contractual rights i.e. to demonstrate that it has complied with the obligations deriving from the agreement with the data subject or imposed on the data controller by law. Such legitimate interest is in turn based on the constitutionally protected right to defence. It can be considered to prevail over the fundamental rights and freedoms of the data subject, also because of the reasonable expectations thereof.
In any case, the user has the right, at any time, to object to the processing of his/her personal data for the purposes in question (i.e. right to defence/purpose of legal proceedings) for reasons connected with his/her personal situation.
To exercise such right, the user can contact METAXY S.R.L in the following ways: by email to info@metaxy.eu, or by writing to the headquarters of Metaxy Srl Via Pomini 92, 21050 Marnate (VA).
It is hereby specified that, in particular, METAXY S.R.L shall store and possibly use the data:
a) for the purposes of fulfilling the purchase agreement and/or for initiating or responding to actions in relation to such agreement before any administrative and/or jurisdictional authority and/or for protecting its own rights in the preparatory stages of the legal proceedings and/or trial; for these purposes, the data shall be stored for [10 years from the delivery of the product or from the termination of the agreement in the event of unsuccessful delivery of the product];
b) to prove that the exercise of the rights envisaged by the Regulation and/or by law has been enabled (e.g. withdrawal right; legal guarantee) and/or by the purchase agreement and that it has performed the related actions that are required by law and/or by the agreement (e.g. refund, in the event of exercising the withdrawal right);
c) to prove that it has responded to complaints and/or reports and/or objections from users;
d) in the event of exercising the rights envisaged by the Regulation, the data shall be stored for [5 years starting from the certification of having responded to the request from the data subject or from such response, if later];
e) in the event of exercising the rights envisaged by the purchase agreement or by law, the data shall be stored for [10 years, starting from the closure of the case or from the performance of the action that defines it] (e.g. refund in the event of withdrawal; or delivery of the replacement product, in the event of legal guarantee); closure of the case means the last correspondence related to the exercise of the rights in question);
f) in the event of complaints and/or reports and/or objections, the data shall be stored for [three years from the closure of the case], meaning from the last related correspondence.
-the provision of data for this purpose is optional; there is no legal or contractual obligation that requires the data subject to provide data for this purpose;
-for the purpose in question, data initially collected for a different purpose are used, the further processing of which is permitted as it is based on the legitimate interest of the data controller, considering the compatibility of such further purpose with the initial purpose of the collection, also bearing in mind that, as the processing is necessary for the establishment, exercise or defence of legal claims, the data controller is also exempt from the erasure obligation, as specifically set out in the Regulation;
-in fact, in the event of exercising the right to object, the data controller abstains from any further processing of the personal data, unless it can demonstrate the existence of compulsory legitimate reasons for proceeding with processing that prevail over the fundamental interests, rights and freedoms of the data subject, or for the establishment, exercise or defence of legal claims.
The personal data provided by the user may be disclosed by METAXY S.R.L to the categories of recipients indicated below.
The subjects to which METAXY S.R.L discloses the data act as external data processors appointed by METAXY S.R.L through a relevant contract (“Data Processors”) or persons authorised to process personal data under the direct authority of METAXY S.R.L (“Appointed Persons”) or in the event of third parties called upon by the Data Controller, as “Sub-Processors”, according to Art. 28.4 of the Regulation, except in cases in which the recipient acts as the independent data controller such as, for example, in the case of the Payment Service Provider or couriers.
Users’ personal data may be disclosed by METAXY S.R.L to the following categories of recipients:
- companies in the group to which METAXY S.R.L belongs and/or to employees and/or collaborators of METAXY S.R.L, for the performance of administration, accounting and IT and logistic support activities;
- companies, consultants or professionals that may have been appointed for the installation, maintenance, updating and, in general, management of the METAXY S.R.L hardware and software, including providers of cloud computing and chat services, and the third parties of which they make use;
- companies that perform logistic support and/or warehousing and/or packaging and/or shipping and delivery or collection of the products purchased on the Websites and the third parties of which they make use;
- Payment Service Providers and/or acquirers and/or banks in order to enable the payment of the purchases made on the Websites or the refund thereof, if appropriate, and the third parties of which they make use;
- all subjects, including the public authorities, who have access to the data because of legislative or administrative provisions.
- all public and/or private subjects, natural and/or legal persons (legal, administrative and tax consultancy firms), should disclosure be necessary or functional to the correct fulfilment of the contractual obligations undertaken in relation to the purchases through the Websites and the obligations resulting from the law i.e. for the establishment, exercise or defence of legal claims.
The list of recipients is available at the METAXY S.R.L registered office.
User’s personal data are transferred by METAXY S.R.L to the following third countries: India.
The recipient of such data is Zoho Corporation PVL, LTD, supplier, together with Zoho Corporation B.V., of the Website chat service.
In relation to the transfer of data to India, the following is specified:
• there is no adequacy decision in relation to the guaranteed level of protection of data in India;
• in the absence of an adequacy decision, the data may only be transferred to the third country if the adequacy safeguards are provided as set out in Art. 46.2 of the Regulation, including the typical contractual clauses adopted by the Commission and/or by a national supervisory body;
• the transfer of data to India by METAXY S.R.L takes place on the basis of the typical contractual clauses set out in "Commission Decision of 5 February 2010 on standard contractual clauses for the transfer of personal data to processors established in third countries under Directive 95/46/EC of the European Parliament and of the Council" [notified under document C(2010)87/EU] and therefore on the basis of the consequent "Authorisation for transfers to third countries through the standard contractual clauses set out in Commission Decision 2010/87/EU in case of an importer established in a third country" issued by the personal data protection supervisory authority on 27 May 2010 and 15 November 2012, still in force on the basis of Art 46.5 of the Regulation.
The data subject has the right to object at any time, for reasons connected with his/her particular situation, to the processing of the personal data related to him or her for the purposes set out in sections 4, 5 and 8 of this information notice and based upon the legitimate interest of the data controller.
The data subject can exercise the right to object by contacting METAXY S.R.L in the following ways: by email to info@metaxy.eu, or by writing to the headquarters of Metaxy Srl Via Pomini 92, 21050 Marnate (VA).
In the event of exercising the right to object, the data controller abstains from any further processing of personal data, unless it can demonstrate the existence of compulsory legitimate reasons for proceeding with processing that prevail over the interests, rights and freedoms of the data subject, or for the establishment, exercise or defence of legal claims.
The data subject has the right to obtain from the data controller (and therefore from METAXY S.R.L) confirmation that processing of data relating to him or her is taking place and, in that case, to obtain access to the personal data and information indicated below.
The data subject can exercise the right of access by contacting METAXY S.R.L in the following ways: by email to info@metaxy.eu, or by writing to the headquarters of Metaxy s.r.l Via Pomini 92, 21050 Marnate (VA).
In the event of exercising the right of access, the user can obtain access to the personal data and to the following information:
h) the existence of automated decision-making, including profiling, which produces legal effects concerning the data subject or similarly significantly affects him or her and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject;
The data subject has the right to obtain from the data controller (and therefore METAXY S.R.L) the rectification of personal data concerning him or her without undue delay. Considering the purposes of processing, the data subject has the right to have incomplete personal data completed, including by means of providing a supplementary statement.
The data subject can exercise the right to rectification by contacting METAXY S.R.L in the following ways [●].
The data subject shall have the right to obtain from the controller (and therefore from METAXY S.R.L) the erasure of personal data concerning him or her without undue delay and the controller shall have the obligation to erase personal data without undue delay where one of the following grounds applies:
b) the data subject objects to the processing based on the legitimate interest of the data controller for reasons connected with his/her particular situation (and therefore in the hypothesis of objection to processing for the purposes set out in sections 4, 5 and 8 of this information notice);
d) the personal data have to be erased for compliance with a legal obligation in European Union or Member State law to which the controller is subject.
The data subject can exercise the right to erasure by contacting METAXY S.R.L in the following ways: by email to info@metaxy.eu, or by writing to the headquarters of Metaxy Srl Via Pomini 92, 21050 Marnate (VA).
If the data controller has made public the personal data and is obliged to erase them, considering available technology and implementation costs - it adopts reasonable measures, including technical measures, to inform controllers processing personal data of the data subject’s request to delete any link, copy or reproduction of his or her personal data.
b) for compliance with a legal obligation which requires processing by European Union or Member State law to which the controller is subject or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
d) for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in so far as the right to erasure is likely to render impossible or seriously impair the achievement of the objectives of that processing;
The data subject shall have the right to obtain from the controller (and therefore from METAXY S.R.L) restriction of processing where one of the following applies:
- the data subject has objected to processing in the processing hypotheses based on the legitimate interest of the data controller, for reasons connected with his/her particular situation (and, therefore, in the event of objecting to the processing of data for the purposes according to sections 4, 5 and 8 of this information notice), pending the verification whether the legitimate grounds of the controller override those of the data subject.
The data subject can exercise the right to restriction by contacting METAXY S.R.L in the following ways: by email to info@metaxy.eu, or by writing to the headquarters of Metaxy Srl Via Pomini 92, 21050 Marnate (VA).
If the processing is restricted, the personal data subject to restriction are processed, other than for storage, only with the consent of the data subject or for the establishment, exercise or defence of legal claims or for safeguarding the rights of another natural or legal person or for reasons of substantial public interest, on the basis of European Union or Member State law.
The data subject that has obtained restriction of processing shall be informed by the controller before the restriction of processing is lifted.
a) the processing is based on consent of the data subject or on a contract;
The data subject can therefore exercise the right in question in relation to the purposes according to the following sections of this information notice: 3. The data subject can exercise the right to data portability by contacting METAXY S.R.L in the following ways: by email to info@metaxy.eu, or by writing to the headquarters of Metaxy Srl Via Pomini 92, 21050 Marnate (VA).
In exercising his/her right to data portability, the data subject shall have the right to have the personal data transmitted directly from one controller to another, where technically feasible.
The exercise of the right to data portability shall be without prejudice to the right to erasure.
The controller shall provide to the data subject information on action taken on a request under Articles 15 to 22 of the Regulation (i.e. right of access, right to rectification, right to erasure, right to restriction of processing, right to data portability, right to object) according to sections 11, 12, 13, 14, 15 and 16 of this information notice (“Rights of the Data Subject”) without undue delay and in any event within one month of receipt of the request. That period may be extended by two further months where necessary, taking into account the complexity and number of the requests. The controller shall inform the data subject of any such extension within one month of receipt of the request, together with the reasons for the delay. Where the data subject makes the request by electronic means, the information shall be provided by electronic means where possible, unless otherwise requested by the data subject.
Any communications in response to the exercise of the Rights of the Data Subject and actions taken shall be provided free of charge. Where requests from a data subject are manifestly unfounded or excessive, in particular because of their repetitive character, the controller may either:
a) charge a reasonable fee taking into account the administrative costs of providing the information or communication or taking the action requested;
Where the controller has reasonable doubts concerning the identity of the natural person making the request in relation to the Rights of the Data Subject, the controller may request the provision of additional information necessary to confirm the identity of the data subject.
Without prejudice to any other administrative or judicial remedy, every data subject shall have the right to lodge a complaint with a supervisory authority, in particular in the Member State of his or her habitual residence, place of work or place of the alleged infringement if the data subject considers that the processing of personal data relating to him or her infringes this Regulation. The supervisory authority with which the complaint has been lodged shall inform the complainant on the progress and the outcome of the complaint including the possibility of a judicial remedy.