INFORMATION FOR THE PROCESSING OF PERSONAL DATA

Pursuant to Articles 13 and 14 of EU Regulation 2016/679 (General Data Protection Regulation)

Dear Associate,

We inform you that according to Article 16 of the TFEU and Article 8 of the Charter of Fundamental Rights of the European Union, everyone has the right to the protection of personal data concerning him/her, regardless of nationality or residence. The data must be processed2 according to the principle of loyalty, for specific purposes and on the basis of the consent of the person concerned or other legitimate basis provided by law.

DATA CONTROLLER

Art. 13, par.l, lett,a

In accordance with the provisions of EU Regulation 2016/679, La Canunia ASD – via delle Terme 25, Lurisia (CN) as Data Controller3, provides you with information regarding the processing that will be carried out, described analytically below, in relation to your personal data or that of the person for whom you are the legal representative, as well as the rights that you may exercise at any time La Canunia which, in its associative form, operates in the sports, social and environmental world promoting amateur equestrian sport; promotes and disseminates the practice of equestrian sport, recreational recreational pre-competitive, aimed also for work on horseback, for the ancient arts and crafts and for environmental equestrian tourism. Your personal data will be treated according to the principles of lawfulness, correctness, transparency, security and confidentiality. The processing will be carried out automatically, through a computerized database, and manually, where necessary, in compliance with the provisions of art. 32 of GDPR 2016/679, by persons specifically appointed and in compliance with the provisions of art. 29 GDPR 2016/679.

Personal Data: is “any information, i.e. any linguistic term, graphic symbol, image, video format, audio format, frame, description, etc., concerning an identified or identifiable natural person; an identifiable person is considered to be the natural person who can be identified, directly or indirectly, with particular reference to an identifier such as a name, an identification number, location data, an online identifier or one or more characteristic elements of his/her physical, physiological, genetic, psychic, economic, cultural or social identity”. See Art. 4(l) , R.EU. 679/2016.

2Treatment: ‘any operation or set of operations which is performed upon personal data or sets of personal data, whether or not by automatic means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction’. See Article 4(2) R.EU. 679/2016.

3Holder of the processing: ‘the natural or legal person, public authority, service or other body which alone or jointly with others determines the purposes and means of the processing of personal data; where the purposes and means of processing are determined by Union or Member State law, the controller or the specific criteria applicable to his or her designation may be determined by Union or Member State law. 679/2016

SPECIFIC PURPOSES OF PERSONAL DATA PROCESSING

Art. 13, par.l, lett.c

The personal data provided by you are necessary for the following specific purposes:

a.) correct performance of institutional activities, management of the association relationship, fulfilment of legal obligations, sending of social communications and performance of the service or services requested (such as training courses, participation in riding lessons, walks, excursions and trekking, etc.);

b.) direct marketing concerning the possibility of communicating, via the web (e.g. via e-mail), information on the association’s initiatives, newsletters as well as requests for participation in surveys;

c.) use of your own image, or the image of a minor subject that you represent, in and for the performance of the association’s activities;

LEGAL BASIS

Art. 13, par], lett.d

The processing of data provided for the pursuit of the purposes indicated in point a) is based on the legitimate basis provided for by the GDPR Regulation 679/2016 in art. 6, par. 1, letter b, or is necessary for the execution of a contract to which the data subject is a party or for the execution of pre-contractual measures taken at the request of the same.

The processing of the data provided for the pursuit of the purposes indicated in point b) and c) is based on the legitimate basis provided for by the Regulation.

SPECIFIC PURPOSES OF PERSONAL DATA PROCESSING

Art. 13, par.l, lett.c

The personal data provided by you are necessary for the following specific purposes:

a.) correct performance of institutional activities, management of the association relationship, fulfilment of legal obligations, sending of social communications and performance of the service or services requested (such as training courses, participation in riding lessons, walks, excursions and trekking, etc.);

b.) direct marketing concerning the possibility of communicating, via the web (e.g. via e-mail), information on the association’s initiatives, newsletters as well as requests for participation in surveys;

c.) use of your own image, or the image of a minor subject that you represent, in and for the performance of the association’s activities;

LEGAL BASIS

Art. 13, par], lett.d

The processing of data provided for the pursuit of the purposes indicated in point a) is based on the legitimate basis provided for by the GDPR Regulation 679/2016 in art. 6, par. 1, letter b, or is necessary for the execution of a contract to which the data subject is a party or for the execution of pre-contractual measures taken at the request of the same.

The processing of the data provided for the pursuit of the purposes indicated in points b) and c) is based on the legitimate basis provided by the GDPR Regulation 679/2016 art. 6, par. l, letter a, or will be carried out with your free and explicit consent.

NATURE AND CATEGORY OF PERSONAL DATA PROCESSED

The following “common” personal data, provided by you, concerning the provision of the requested service are subject to processing: name, surname, place and date of birth. address of residence and/or domiciliation, tax code, e-mail or telephone number, photocopy of identification document, financial data extrapolated from payment transfers, images depicting the person concerned or, possibly, the person represented, data extrapolated from curriculum vitae, copy of any technical qualifications.

NON-COMMUNICATION OF PERSONAL DATA AND CONSEQUENCES OF REFUSAL

Art, 13, par. 2, lett.e

The conferment of your personal data for the purposes indicated in point a) above is mandatory, as it is indispensable for the provision of the service. The personal data relating to the pursuit of the purpose a) are: name, surname, place and date of birth, address of residence and/or domiciliation. tax code. e-mail or telephone contact, photocopy of identification document, financial data extrapolated from payment transfers. data extrapolated from curriculum vitae, copy of any technical qualifications.

The provision of your personal data in order to receive marketing communications, newsletters and information on the initiatives of the association is subject only to the provision of consent and is therefore not mandatory. The personal data related to the pursuit of the purpose b) are: name. surname, e-mail.

The conferment of your image, or the image of a minor subject that you represent, for the achievement of the purpose indicated in point c) is subject only to the provision of consent and therefore is not mandatory.

RECIPIENT OF PERSONAL DATA

Art. 13, par. l.

Your personal data will not be disclosed.

Under no circumstances will it be transferred to a non-EU country or to an international organisation.

6 We inform you that it is forbidden to process personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, as well as genetic, biometric, health or sexual life and sexual orientation data, except in cases where you have given your explicit consent in relation to one or more specific purposes, or in other cases expressly provided for by law.

Please also note that the general authorisation for the processing of judicial data by private individuals, public economic entities and public entities under GPDP no. 7/2016 does not fall within the scope of article 21, paragraph l, of Legislative decree no. 101/2018 and therefore ceased to have legal effect on 19 September 2018, pursuant to paragraph 3 of the aforementioned provision. Therefore, such data may be processed only under the control of the public authority or if the processing is authorized by Union or Member State law.

7 Recipient: ‘the natural or legal person, public authority, service or other body receiving a communication of personal data, whether or not a third party. However, public authorities which may receive communications of personal data in the context of a specific survey in accordance with Union or Member State law shall not be considered as recipients; the processing of such data by those public authorities shall comply with applicable data protection rules according to the purposes of the processing. See Art. 4, 11.9, R.EU. 679/2016

Your personal data may be transmitted to subjects in contractual relationship with La Canunia, who, in any case, will be formally designated as co-owners, managers or persons in charge of processing, receiving specific and appropriate instructions, as well as appropriate authorizations:

Data Processor: Consultants (e.g. Web Agency), to the extent necessary to carry out their duties, subject to obtaining adequate guarantees that impose on them the duty of confidentiality and security;

Persons in charge of data processing: La Canunia employees and collaborators, specifically authorized by a specific letter of appointment.

In addition, your personal data may be transferred to other subjects by virtue of legal obligations.

DATA PROCESSING DURATION – DATA STORAGE PERIOD

Art. 13, par.2, point a

In compliance with the principles of lawfulness, purpose limitation and data minimization, pursuant to art. 5 GDPR 2016/679, your personal data will be kept for the period of time necessary to achieve the specific purposes for which they are collected and processed, quantified in 10 years.

RIGHTS OF THE DATA SUBJECT

We inform you that you may exercise your rights under EU Reg. 2016/679, described in detail below:

Right of access ex art. 15

You have the right to obtain confirmation from the Data Controller as to whether or not personal data relating to your data is being processed, to know its content and origin, to verify its accuracy and, if so, to obtain access to said data. In any case, you have the right to receive a copy of the personal data being processed.

Right of rectification ex art. 16

You have the right to obtain, from the Data Controller, the integration, updating and rectification of your personal data without undue delay.

Right to cancellation ex art. 17

You have the right to obtain, from the Data Controller, the cancellation of personal data concerning you, without unjustified delay, in cases where one of the hypotheses provided for in art. 17 applies (personal data no longer necessary with respect to the purposes for which they were collected or processed, revocation of consent and no other legal basis for processing, personal data processed unlawfully, exercise of the right to object, etc.).

Right of limitation of processing pursuant to art. 18

You have the right to obtain, from the Data Controller, the limitation of the processing of personal data in the cases expressly provided for in the Regulation, or when: you contest the accuracy of the data, the processing is unlawful and requests that its use be merely limited, the data are necessary to ascertain, exercise or defend a right in court or you have opposed the processing for legitimate reasons.

If the processing is limited, the personal data will be processed only with your explicit consent. The Data Controller is required to inform you before the restriction is lifted.

Right to data portability ex art. 20

If the processing is carried out by automated means, has guaranteed the right to portability of data

Where the processing is carried out by automated means, it has guaranteed the right to the portability of personal data concerning you, where the processing is based on consent or on a contract, as well as the direct transmission of the same to another data controller, where technically feasible.

Right to object pursuant to art. 21

You have the right to object at any time, for reasons related to your particular situation, to the processing of personal data concerning you. In any case, the Data Controller will make a balance between your interests and the legitimate reasons for processing (including, for example, ascertaining, exercising and defending a right in court, etc.).

Requests for the exercise of the aforementioned rights should be addressed directly online to La Canunia (info@lacanunia.com, Tel: 339/7327877; 335/6789499; 338/4454071. Requests can be made from Monday to Sunday. There is no hourly limit to the sending of the above mentioned requests to exercise the rights.

Canunia will take care to facilitate the exercise of the rights of the interested party pursuant to Articles 15 to 22 GDPR, providing him/her with all the information relating to the action taken without undue delay and, in any case, at the latest within one month of receipt of the request.

This deadline may be extended by two months, if necessary, taking into account the complexity and number of requests (La Canunia will in any case inform the person concerned of this extension and the reasons for the delay, within one month of receipt of the request).

Should La Canunia decide not to comply with the interested party’s request, it will inform the interested party without delay, and at the latest within one month of receipt of the request, of the reasons for the non-compliance and of the possibility of lodging a complaint with a supervisory authority and of appealing to the courts.

We inform you, moreover, that you can propose motivated complaint to the Guarantor for the Protection of Personal Data:

by e-mail, at the address:

by fax: 06 696773785

or by post, to the Garante per la Protezione dei Dati Personali, located in Rome (Italy), Piazza di Monte Citorio n. 121, cap 00186.

REVOCATION OF CONSENT

Art. 13, par.2″ lett.d

We also inform you that you have the right to revoke, at any time, the consent relating to the purposes set out in points b) and c) above, as easily as it was granted. Requests for the exercise of the revocation of consent should be addressed directly to La Canunia, info@lacanunia.com.

Processing carried out prior to the aforementioned revocation shall remain unaffected.

EXISTENCE OF AN AUTOMATED DECISION-MAKING PROCESS, INCLUDING CHILD PROFILING

Children deserve specific protection with regard to their personal data, as they may be less aware of the risks, consequences and safeguards involved and their rights with regard to the processing of personal data. Where consent is given, the processing of the child’s personal data shall be lawful where the child is at least 16 years old. Where the child is under 16 years of age, such processing shall only be lawful if and to the extent that such consent is given or authorised by the holder of parental responsibility. A legitimate interest of the controller or of a third party may be pursued only if the interests or fundamental rights and freedoms of the data subject which require the protection of personal data, in particular where the data subject is a child, do not prevail.

PERSONS UNDER POTENTIAL PROTECTION, SUPPORT ADMINISTRATION, OTHER INSTITUTES

The guardian, support administrator or other person who has the legal representation of the person concerned, submits the form of consent to the processing of data on behalf of the person concerned, making it in the name of the person concerned and completing it with his personal data and his signature: with this signature he assumes responsibility for his declaration and, on request, produces the documentation issued by the judicial authority.

DECLARATION OF CONSENT

I, the undersigned

Name and Surname Fiscal Code Place of Birth Date of Birth

received, pursuant to art. 13 of EU Regulation 2016/679, the above information concerning the use of my personal data by LA CANUNIA

I Agree                                                     I don’t agree

Date and place

Signature

In relation to the processing of my common data, with regard to the purpose referred to in point b), i.e. direct marketing concerning the possibility of communicating, via the web (e.g. via e-mail), information on the association’s initiatives, newsletters as well as requests for participation in surveys

POST CONSIGLIATI