This document (“Informative”) intends to provide you with information regarding the processing of information, as specified below, which will be provided by you or otherwise available at our facility and which will be handled by you and / or other parties identified for purposes indicated below. The Information, in particular, is provided pursuant to EU Regulation no. 679/2016 (“GDPR”) and subsequent national adaptation regulations (together with the GDPR “Applicable Regulations” below).
Identity and contact details of the Data Controller
The data controller, in accordance with articles 4 and 24 of Reg. EU 2016/679, is Flavio Prattico as administrator and legal manager of GIPAT Srl,, in the person of legal representative pro-tempore, in the person of legal representative pro-tempore (hereinafter “Owner”).

Contact details of the Data Protection Manager (c.d. “RPD-DPO”)

The Data Controller does not carry out activities that require the designation of the person responsible for the protection of personal data.

Purpose and legal basis of the processing

The Personal Data collected will be processed for the purposes and by virtue of the following legal bases:

Purpose Legal basis for the processing

point 3, lett. a): for the management of your contractual relationship or to execute pre-contractual measures (such as, for example, the request for information or that of a quote). In this case, you are free to provide your personal data; however, failure to provide the data will not allow you to establish the aforementioned relationship and satisfy your request. the treatment is necessary in relation to the execution of a contract of which you are part point 3, lett. b): with your specific consent, to send to you (i) promotional communications relating to the Holders and (ii) communications relating to events organized by the Data Controllers (hereinafter “marketing purposes”) your consent Categories of personal data processed (pursuant to article 14) Within the limits of the purposes and methods described in this Statement, they may be treat information that can be considered as “Personal Data”, which includes your personal details, your contact details (such as, for example, mobile phone number, e-mail address, etc.).

Recipients and categories of recipients

Personal data will not be disseminated, or will not be disclosed to undetermined subjects. Instead, they may be communicated to well-defined individuals, in full compliance with the provisions of the law, for purposes strictly related to those previously indicated. Any access to your personal data is limited to those authorized by the Data Controllers. The communication to the identified recipients, only if involved and functional, is linked to the achievement of the purposes referred to in the previous point 3, therefore the personal data collected and processed may be: used anonymously for statistical purposes; made available to the collaborators of the Data Controller, as managers or persons authorized to process personal data; communicated to third parties, physical or legal, public administrations, professionals, law enforcement agencies, governmental bodies, regulatory bodies, courts or other public authorities authorized by law; if necessary, transferred to another Data Controller in accordance with the provisions of the GDPR, including with regard to the right to data portability. The information may also be communicated whenever the communication may be necessary to fulfill the requests of the Judicial or Public Security Authorities. The data collected will in no case be disclosed. The list of Data Processors of personal data is available at the offices of the Data Controller.

Data transfer abroad

The data will not be transferred outside the European Union.

Data retention period (determination criteria)

Below is a table that contains the indications of the storage times (or the determination criteria) of the Personal Data:


Storage times

point 3, lett. a): contract management for the entire duration of the relationship and subsequently for 10 years (ordinary prescription). point 3, lett. b): marketing purposes 5 years from the collection, without prejudice to the possibility for the user to modify and / or revoke his / her will at any time

Data processing methods

The processing of Personal Data will be carried out using manual, IT or telematic tools, suitable for guaranteeing security and confidentiality and will be performed by personnel duly instructed to comply with the Applicable Regulations. There is no automated decision making process. In addition to the cases in which it is necessary to contact you for needs related to the management of your position, if you consent to the processing of your data for the purposes referred to in point 3, lett. b), you can be contacted via e-mail, newsletter, sms, or through any equivalent electronic tool or by paper mail or call by operator to all the contact details provided. If you prefer to be contacted only to one or some of these contact details, you can make an express written request to the Data Controller without formalities.

Rights that are recognized to you

We inform you that you can exercise the rights recognized by the Applicable Regulation including, by way of example only, the right:
to access their Personal Data and to know the origin, the purposes and the purposes of the processing, the data of the subjects to whom they are communicated, the period of data retention or the useful criteria to determine it (art.15);
to request the correction (art.16);
the cancellation (“oblivion”), if not more necessary, incomplete, erroneous or collected in violation of the law (art.17);
to request that the processing be limited to a part of the information concerning you (art.18);
to the extent that it is technically possible, to receive in a structured format or to transmit to you or to third parties indicated by you the information concerning you (c.d. “portability”) or those that you have voluntarily provided (art.20); to oppose their treatment based on legitimate interest (Article 21);
as well as to revoke your consent at any time, in the event that this constitutes the basis of the processing (the revocation of the consent in any case does not affect the lawfulness of the processing based on the consent carried out before the revocation itself).

The aforementioned rights may be exercised by written request without formalities to the Owner to the contacts indicated in point 1.
The owner must proceed in this way without delay and, in any case, at the latest within one month of receiving the request. The deadline can be extended by two months, if necessary, based on the complexity and the number of requests received by the Holders. In such cases the Owner within one month of receiving your request, will inform you of the reasons for the extension.
We remind you that, where the response to your requests was not in your opinion satisfactory, you may contact and submit a complaint to the Authority for the Protection of Personal Data ( in the ways provided for by the Regulation Applicable.

Revision May 2018