Pursuant to Article 13 of EU Regulation 2016/679, we wish to inform you of the following:
Purpose of processing:
Your ‘personal data’, freely communicated and acquired by us by reason of the activity carried out by Sopabroker S.r.l., in its capacity as data controller, shall be processed lawfully and fairly for the following purposes:
- Management of the insurance consultancy and brokerage service (analysis of the client’s needs – search for insurance cover – support in the finalisation and conclusion of the policy – periodic management of the policy including changes/deadlines and management of any claims);
- Management of commercial and marketing activities;
- Handling of any complaints and/or disputes;
- Management of ordinary administrative and accounting activities;
- Management of obligations under laws, regulations, EU legislation or an order of the Authority (such as anti-money laundering and anti-terrorism).
The data processed, which may be Personal Data (common) and/or Special Categories of Personal Data (sensitive) and/or Personal Data relating to criminal convictions and offences (judicial), are up-to-date, relevant, complete and not excessive in relation to the purposes listed above for which they are collected and subsequently processed.
Treatment modalities
The data will be processed with the necessary security and confidentiality. The data are collected from the data subject or from a third party and are recorded for specific, explicit and legitimate purposes and used in further processing operations in a manner compatible with these purposes. The processing will be carried out with the aid of paper and electronic instruments.
Legal basis for processing
The legal basis of the processing is founded:
- On the consent that you have given to the processing of your personal data, for one or more specific purposes and that you may revoke at any time without prejudice to the lawfulness of the processing on the consent given before revocation;
- On compliance in the performance of a contract to which you are a party or the performance of pre-contractual measures taken at your request;
- On the need to fulfil a legal obligation to which the data controller is subject;
- On the pursuit of the legitimate interests of the data controller or of third parties, provided that the interests or the fundamental rights and freedoms of the data subject requiring the protection of personal data do not prevail, in particular if the data subject is a child.
Compulsory or optional nature of providing data and consequences of a refusal to answer
The nature of the provision of data by you is obligatory in order for the Data Controller to be able to provide the services requested. In the event of refusal, it will therefore be impossible to carry out the service provision process.
Disclosure of data to third parties
The data may be communicated to:
- Employees and collaborators as data processors on behalf of the data controller;
- Third party companies or other subjects carrying out assistance, consultancy or collaboration activities in outsourcing (in insurance, IT, accounting, administrative, tax, legal, financial and/or credit matters) and in any case to all those subjects to whom communication is compulsory by law or for the performance of services in their capacity as Data Processors on behalf of the Data Controller;
- Inspection bodies responsible for checks and controls concerning the regularity of legal compliance, following inspections or audits (if requested);
Personal data are not disseminated.
Retention times
Personal data (hard copy and computerised) will be kept for 10 (ten) years, from the date of termination of the service provision relationship (mandate).
Existence of an automated decision-making process:
There is no automated decision-making process.
Transfer of data to a third country (non-EU) or to international organisations:
The data controller will not transfer your personal data to a third country or international organisation.
Right of access to personal data and other rights
As a data subject, you may at any time exercise the rights reserved to you under Article 15 of EU Regulation 2016/679, the full text of which is set out below:
1.The data subject shall have the right to obtain from the controller confirmation as to whether or not personal data relating to him are being processed and, if so, to obtain access to the personal data and to the following information:
- (a) the purposes of the processing; (b) the categories of personal data concerned; (c) the recipients or categories of recipients to whom the personal data have been or will be disclosed, in particular if they are recipients in third countries or international organisations; (d) where possible, the period for which the personal data are to be kept or, if this is not possible, the criteria used to determine that period; (e) the existence of the right of the data subject to request from the controller the rectification or erasure of personal data concerning him or her or to object to the processing of personal data concerning him or her (f) the right to lodge a complaint with a supervisory authority; (g) where the data are not collected from the data subject, all available information as to their source; (h) the existence of an automated decision making process, including profiling as referred to in Article 22(1) and (4), and, at least in such cases, meaningful information on the logic used, as well as the importance and the envisaged consequences of such processing for the data subject.
2. Where personal data are transferred to a third country or to an international organisation, the data subject shall have the right to be informed of the existence of appropriate safeguards within the meaning of Article 46 relating to the transfer.
3. The controller shall provide a copy of the personal data undergoing processing. In case of further copies requested by the data subject, the controller may charge a reasonable fee based on administrative costs. If the data subject makes the request by electronic means, and unless otherwise specified by the data subject, the information shall be provided in a commonly used electronic format.
4. The right to obtain a copy referred to in paragraph 3 shall not infringe the rights and freedoms of others.
And, he also has the rights set out in Articles 14, 16, 17, 18, 19, 20 and 21 of the EU Regulation 2016/679 (the titles of which are only given here): right to rectification, right to be forgotten, right to restriction of processing, right to data portability, right to object, as well as the right to complain to the Data Protection Authority.
You may exercise your rights at any time by sending to the Data Controller:
a registered letter with return receipt to Sopabroker S.r.l. – Piazza della Conciliazione, 1 20123 Milan or an e-mail to: sopabroke@sopabroker.com – or a certified email to: sopabroker@pcert.postecert.it.