STATEMENT OF CONSENT FOR PROCESSING OF PERSONAL DATA
The following statement (hereinafter, “Statement”) concerns the processing of Personal Data performed by Satisfaid Ltd., with its headquarters in London, 20-22 Wenlock Road, N1 7GU, and registered with the “Companies House of London” under the following Company number: 11064154 (hereinafter referred to as the “Data Controller” or “SatisfAid”). The Statement is provided in accordance with EU Regulation 2016/679 (hereinafter, “GDPR”) and concerns the processing of Personal Data performed through the service named SatisfAid (hereinafter, referred to as “Service” or “App”).
«Personal Data»: means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;
«Statement»: means the following information on the processing of personal data, drafted in compliance with Regulation (EU) 679/2016, or GDPR and Italian Privacy Code 196/2003, as modified by Italian Decree n. 101/2018;
«Profiling»: means any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that natural person's performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements;
«Pseudonymization»: means the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organisational measures to ensure that the personal data are not attributed to an identified or identifiable natural person;
«Data Controller»: means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law;
«Data Processor»: means a natural or legal person, public authority, agency or other body which processes Personal Data on behalf of the Controller;
«Processing»: means any operation or set of operations which is performed on Personal Data or on sets of Personal Data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;
Identity and contact details of the Data Controller
The Data Controller is SatisfAid.
As the Data Controller is registered in England, no other representative has been named.
2. Personal Data
SatisfAid shall process Personal Data referred to the following subjects:
Users of the Service, downloadingand/or using the App;
Data Subjects who provide their Personal Data to leave feedbacks or evaluations through the App.
Collectively referred to as Data Subjects.
In the event that the Data Subject included Personal Data of a third party on the App, for instance concerning team members and employees, the Data Subject, compliant to GDPR, shall provide such third party with the Statement and acquire a valid consent.
Purpose and legal basis of the processing
Personal Data shall be processed for the following purposes:
a) for contractual purposes and/or any purpose related to the execution of pre-contractual measures based upon a specific request of the Data Subjects and aimed at the use the App, as well as to comply with legal obligations connected with such purposes.
In this case, processing Personal Data is required for the execution of the contract, for pre-contractual negotiations and to allow the use of the App.
b) for sending direct marketing communications, newsletters and advertising content via traditional means of communication and automated electronic systems, including commercial or promotional communications sent via email or SMS, for the purpose of research and market analysis. In this case, the legal basis for the processing of Personal Data is provided by the consent given by the Data Subject in accordance with the Statement;
c) for purposes originating from legal obligations in cases where the Data is processed for the purposes mentioned in point a). In this case, the legal obligation of the Data Controller to process Personal Data in compliance with the applicable national law provides legal basis for the processing.
4. Consenting to the processing of Personal Data
When consent is a requirement for the processing of Personal Data, it can be expressed through the execution of a computerized document, by way of specific flag boxes.
5. Procedures for the processing of Personal Data
With regard to Personal Data processed and stored for the purposes envisaged in number 2, point a) of the Statement (contractual, pre-contractual and usability purposes), point c), legal purposes), such Data shall be processed through paper means, automated procedures and the use of CRM software that will allow SatisfAid to better fulfill all its contractual obligations.
With regard to Personal Data processed for the purposes envisaged in number 2, point b) of the Statement (marketing purposes) the processing will be performed through a marketing automation software;
With regard to Personal Data processed and stored for the purposes envisaged in number 2, point c) of the Statement (legal compliance) the processing will be performed through paper means, automated procedures and the use of CRM software.
6. Source from which the Personal Data is obtained
Only Personal Data provided in accordance with the Statement through the completion in of an online form shall be processed. SatisfAid shall not process Data originating from sources that are available to the public.
7. Recipients and possible categories of recipients of your Personal Data
Potential recipients of the User’s Personal Data may be:
Companies that offer IT services including, in particular, those offering hosting services
8. Data categories
Satisfaid shall only process Personal Data.
Sensitive Data, for instance data revealing one’s state of health, shall never be processed.
9. Retention of Personal Data
Personal Data processed for the purposes envisaged in number 2, point a) of the Statement (contractual, pre-contractual and service purposes) is processed and stored for a period not longer than 10 years from the termination of the contract and, in the case of mere pre-contractual negotiations, for a period not longer than 10 years from the ending of the negotiations.
Personal Data processed for the purposes envisaged in number 2, point b) of the Statement (marketing purposes) is processed and stored until the Data Subject requests their cancellation.
Personal Data processed for the purposes envisaged in number 2, point c) (legal compliance) is processed and stored for not longer than 10 years commencing from the termination of the contract and, in case of mere pre-contractual negotiations, for a period not longer than 10 years from the ending of the negotiations.
10. Transfer of Personal Data
The Data Controller shall not to transfer Personal Data outside European Union.
11. Discretionary consent and the consequences of a lack of consent
In relation to Personal Data processed and stored for the purposes envisaged in number 2, point a) of the Statement (contractual, pre-contractual and service purposes) providing Personal Data is a contractual obligation and a necessary prerequisite for pre-contractual negotiations and the conclusion of the contract. The Data Subject has the choice whether to provide Personal Data; however, when such Data are not provided, it will not be possible to conclude any contract or carry out any contractual negotiations;
In relation to Personal Data processed for the purposes envisaged in number 2, point b) of the Statement (marketing purposes) providing Personal Data is not a contractual obligation. The Data Subject can choose whether to provide Personal Data; however, when such Data are not provided, it will not be possible to carry out any marketing activity;
In relation to Personal Data processed for the purposes envisaged in number 2, point c) of the Statement (legal compliance) providing Personal Data is a legal obligation. In this case, it is imperative to provide Personal Data; in the case where this information is withheld, it will not be possible to conclude the contract.
12. The right to object
The Data Subject has the right to object as determined below:
Object, at any time, for reasons related to his particular situation, to the processing of his Personal Data, including profiling, according to art. 6, paragraph 1, point e) or f) of the GDPR. The Data Controller will refrain from further processing of the Data Subject's Personal Data, except in the case where he can show legitimate reasons to go ahead with the processingwhich prevail the interests, rights and liberty of the Data Subject or in the case of the examination, exercise or defense of a right in a seat of justice;
Object, at any time, to the processing of his Personal Data, if the Data has been processed for the purposes of direct marketing, including profiling, in so far as the profiling is connected to this direct marketing;
In the case of objection to the processing of Personal Data for the purpose of direct marketing, this Data will no longer be used for this purpose. We wish to point out that the right of the Data Subject to object to the processing of his Personal Data for direct marketing purposes can also be exercised in part, that is, by objecting only, for example, to the sending of promotional material via electronic and/or digital means, as well as on paper;
Object, for reasons related to his particular situation, to the processing of his Personal Data if the Data has been processed for the purposes of scientific or historical research or for statistical purposes, according to art. 89, paragraph 1 of the GDPR, except in the case where the processing is necessary for the performance of a public interest task.
13. Other rights
The Data Controller also wishes to notify the existence of the following rights:
Right of access: the Data Subject has the right to obtain confirmation from the Data Controller about whether or not his Personal Data is being processed and, if so, to obtain access to his Personal Data and to specific information, according to art. 15 of the GDPR;
Right of correction : the Data Subject has the right to request the Data Controller to amend any Personal Data which relates to him and is incorrect, without any undue delay. Keeping in mind the purposes of the processing, the Data Subject has the right to have his Personal Data updated, if necessary, by providing a supplementary declaration, according to art. 16 of the GDPR;
Right to cancellation and to withdrawal of given consent: the Data Subject has the right to request the Data Controller to cancel his Personal Data without any undue delay, in which case the Data Controller must cancel it without any undue delay, or to withdraw his consent at any time, if the reasons fall within the parameters of art. 17 of the GDPR. The withdrawal of consent shall not affect the lawfulness of processing based on consent and carried out before the withdrawal.
Right to limitation of processing: the Data Subject has the right to request the Data Controller to limit the processing if the reasons fall within the parameters defined by art. 18 of the GDPR;
Right to Data portability: the Data Subject has the right to be provided with his Personal Data, which he has previously provided the Data Controller, in a machine-readable structured format in common use and has the right to transfer this Data to another Data Controller without any impediment on the part of the Data Controller, according to the parameters defined by art. 20 of the GDPR;
Right of the Data Subject to object to commercial advertising: at any time, the Data Subject has the right to object, free of charge, to receiving commercial advertising.
14. Exercising one's rights
The requests to exercise one's rights as specified in the present Statement must be forwarded directly to the Data Controller via email email@example.com. Alternatively, it is possible to exercise one's rights by sending a written communication by registered mail with acknowledgement of receipt at the following address: 20-22 Wenlock Road, N1 7GU, London.
15. Access to the Statement of Consent
The Statement can be accessed at the following email address: firstname.lastname@example.org or can be obtained from the Data Controller.
The service offered by SatsfAid is not available to individuals under age 18 and SatisfAid, acting as the Data Controller, will never intentionally collect Personal Data belonging to minors. Whether Data relating to minors were to be involuntarily registered, the Data Controller shall promptly cancel them, upon the User’s request.
The Data Controller may modify the Statement, for instance to adapt it to national and/or EU law, to make it compliant to technology innovations or for additional reasons. Any new version of the Statement, shall be communicated through the website and/or, where possible, sent via email.
The Data Subject is invited to periodically review the Privacy Statement. Any modification shall be promptly communicated through App pop-ups or different means of communication. In case of major differences such as the purposes and legal basis of the processing, the Data Controller will inform the Data Subjects, requiring the adequate consent.