Privacy policy

Notice pursuant to ex art. 13 of Legislative Decree 30 June 2003, n. 196 and art. 13 of the 2016/679 EU Regulation

Legislative Decree no. 196 of 30 June 2003 (the “Privacy Code”) and EU Regulation 2016/679 (the "GDPR") provide for the protection of persons and other subjects in relation to the processing of personal data.
Pursuant to such laws, our Company’s handling of personal data shall follow the principles of fairness, lawfulness and transparency, protecting the privacy and rights of the Interested Party.

In accordance with the above mentioned laws, we therefore provide the following information.


Purposes of data processing

The personal data of the Interested Party will be handled for the following purposes:
  • the performance of a contract to which the Interested Party is a party or to carry out pre-contractual activities at his request. Such necessity represents the legal basis that legitimizes the consequent handling of data. The provision of the necessary data for these purposes represents, depending on circumstances, either a contractual obligation or a requirement necessary to the conclusion of the contract, without which the Company would be unable to establish the relationship or implement it;
  • comply with legal obligations (e.g. obligations under anti-bribery las, provisions of the Autorità di Vigilanza (Vigilance Body), Courts, etc.). Such necessity represents the legal basis legitimizing the consequent handling of data. The provision of the data necessary to such purposes is a legal obligation, without which the Company would not be able to enter into certain relationships and issuing alerts.
  • promotion and sales of goods and services of the Company, including market research services (so-called “direct marketing”). The legal basis that legitimizes the consequent handling of data is the consent of the Interested Party, who is free to provide it at will, and who may, however, withdraw it at any time. The provision of the necessary data is not mandatory, and the refusal to supply them does not determine any negative consequences, except for the impossibility of receiving commercial communications;

Methods of data processing

The data will be handled:
  • manually, with hardcopy storage
  • electronically, by computer processing and storing.

Type of data handled, sensitive data handling, and automated data handling

The Company handles personal data directly obtained from the Interested Party, or from third parties, which include – by way of example – personal data such as name, surname, address, date and place of birth; image data (e.g. photos on ID card) and other data falling within such categories.
The Company does not request nor handle “sensitive” data (e.g. data revealing racial or ethnic origin, political opinions, religious or philosophical convictions, union membership, genetic data, biometric data – allowing to uniquely identify a person , data on health or sexual life or sexual orientation). It may occur, however, that such data comes into the knowledge of the Company in the performance of normal professional activity or business, or in order to perform specific services or operations connected with client service/relationship. Since the Company cannot intercept or reject these requests, a proposed contract may not be accepted if the Interested Party has not provided written approval to the aforementioned handling. Such data shall be handled exclusively to perform the services requested by the client.
In case of automated data processing, the personal data of the Interested Party may be processed exclusively with his explicit consent.

Communication of personal data

The personal data of the Interested Party can be communicated, in close relation to the purposes mentioned above, also to the following subjects or categories of subjects:
  • to banking institutions, for the purpose of payment of any contractual compensation and of any indemnity and / or reimbursement;
  • to corporate legal advisers, for the purpose of studying and resolving any legal problems related to the contractual position of the Interested Party;
  • to insurance companies with whom our Company maintains relationships or conventions;
  • to any other subjects, to whom the provision of such data is necessary to comply with current applicable law.

Data retention period

The personal data of the Interested Party will be stored until the end of the twelfth month following the termination and/or dissolution, however named, of the relative contract and/or agreement.

Transfer of personal data abroad

As part of the management of the existing contractual relationship, some personal data concerning the Interested Party may be transferred abroad.
The transfer of personal data abroad will be carried out in full compliance with applicable law and, where necessary, with the prior authorization of the Data Privacy Guarantor.

Controller and Supervisor of personal data handling

The Controller of data handling is Otherwise Spa, with registered office in Milano (MI) Via A. Sangiorgio no. 12, in the person of its legal representative [•].


Rights of an Interested Party

Pursuant to applicable laws, an Interested Party may at any time exercise the following rights and amend, whenever he/she so wishes, the optional approvals given:

1. Right of access;
2. Right to obtain rectification;
3. Right to obtain cancellation;
4. Right to obtain limitation;
5. Right to obtain transfer;
6. Right of objection.

Right of access
An Interested Party has the right to receive an indication on which personal data regarding themselves are handled by our Company and to be provided a free copy thereof (if more than one copy is requested, the Interested Party may be charged with part of the costs). The information provided to the Interested Party includes the purposes of data handling, the categories of the data handled, the period of preservation or, if not available, the criteria use to define such period, as well as the guarantees applied in the event of data transfer to third Countries and the rights that may be exercised by an Interested Party.

Right to obtain rectification
An Interested Party has the right to obtain the update or rectification of incorrect or incomplete data regarding themselves.

Right to obtain cancellation (or “right to be forgotten”)
Il diritto di cancellazione, o all’oblio, permette all’Interessato di ottenere la cancellazione dei propri dati personali nei seguenti casi particolari: An Interested Party has the right to obtain the cancellation of his/her personal data:

1. if such data are no longer necessary to the purposes for which they had been collected and handled;
2. if the Interested Party withdraws the approval to data handling, provided that there are no legal grounds to continue handling or storing such data;
3. if the Interested Party objects to the handling of his/her data, provided that there exists no further legitimate reason for the Company to do so for the pursuance of its own interests, or of the interests of third parties, and that there exists no legitimate, prevailing reason for the Controller to handle such data;
4. if the data have been handled unlawfully.

The above right may be exercised even after withdrawal of consent.

Right to obtain limitation
The right to obtain limitation may be exercised:
1. if the data have been handled unlawfully, as an alternative remedy to the request of cancellation;
2. if an Interested Party has requested rectification of his/her data (while awaiting rectification) or has object to data treatment (while awaiting the Controller’s decision).
Any handling – other than storage – of the data for which limitation has been requested is forbidden.

Right to obtain transfer
An Interested Party has the right to use his/her personal data handled by the Company for other purposes, and may request to be provided with such data or that such data be transferred to another controller in a structured, readable for of common use.

Right to object
An Interested Party may at any time object to the handling of personal data regarding themselves, for personal reasons.