PRIVACY NOTICE ON THE PROCESSING OF PERSONAL DATA IN CONNECTION WITH REGISTRATION ON THE LUMOS ONLINE PORTAL
Pursuant to Article 13 of Regulation (EU) 2016/679 (“General Data Protection Regulation”, hereinafter also referred to as the “GDPR”) and the provisions of Legislative Decree No. 196 of 30 June 2003 (“Personal Data Protection Code”), as amended by Legislative Decree No. 101 of 10 August 2018, USB S.p.A., with its registered office at Via Piave No. 21, 20159 Milan, Italy, Tax Code and VAT No. 11905750961, owner of the commercial brand “Lumos” (hereinafter also referred to as “Lumos” or the “Data Controller”), hereby provides you with this Privacy Notice concerning the processing of your personal data, which is carried out in accordance with the principles of lawfulness, fairness, transparency, integrity, data minimisation and confidentiality, in order to safeguard your rights.
1. Identity and Contact Details of the Data Controller
The Data Controller is USB S.p.A., with its registered office at Via Piave No. 21, 20159 Milan, Italy, Tax Code/VAT No. 11905750961, operating under the commercial brand “Lumos”, email: [email protected], telephone: +39 02 5003 0462.
Your personal data will be processed by the Data Controller’s employees who have been formally designated and authorised to process personal data pursuant to Article 29 of the GDPR and Article 2-quaterdecies of the Italian Personal Data Protection Code, and who have been duly instructed in this regard.
Your personal data may also be processed, on behalf of the Data Controller, by external parties specifically appointed as Data Processors pursuant to Article 28 of the GDPR. The up-to-date list of Data Processors is kept at the Data Controller’s registered office and is available upon request.
2. Subject Matter of the Processing and Exclusion of Tracking Technologies in Communications
2.1 The Data Controller processes exclusively the following categories of personal data:
* Personal identification data: first name, last name, address, date of birth, Italian tax identification number, etc.
* Data required for registration on the portal: personal identification data (as specified above), email address and telephone number.
* Data required for registration via Google or Social Networks: unique identifier provided by the third-party platform (Google or Social Network). The Data Controller does not collect or obtain any other personal data through such platforms, except for data that is strictly necessary and permitted by the privacy settings configured by the data subject.
2.2 In accordance with the principle of data minimisation (Article 5(1)(c) of the GDPR) and the provisions governing electronic communications, the Data Controller does not use tracking pixels (also known as tracking pixels, web beacons or single-pixel GIFs) or encoded hyperlinks (link tracking) within the email communications it sends. Consequently, the Data Controller does not collect telemetry data or individual data relating to whether emails have been opened, clicks on hyperlinks, the date and time of viewing, the IP address of the device, or the characteristics of the email client used by the data subject.
3. Purposes of Processing and Legal Bases
Personal data are processed exclusively for the following purposes and on the following legal bases (Article 6 of the GDPR):
* Registration and Use of the Platform’s Services:
- Purpose: to enable the registration and operational management of the Service User’s personal account on the Lumos platform, allowing the publication and viewing of listings, as well as access to the related services.
- Legal basis: performance of a contract to which the data subject is a party or the taking of steps at the request of the data subject prior to entering into a contract (Article 6(1)(b) of the GDPR).
* Compliance with Legal or Regulatory Obligations:
- Purpose: to comply with mandatory legal obligations imposed by laws, regulations or European Union legislation, including administrative, accounting and tax-related obligations.
- Legal basis: compliance with a legal obligation to which the Data Controller is subject (Article 6(1)(c) of the GDPR).
4. Methods of Processing, Absence of Profiling and Data Retention
4.1 The processing of personal data is carried out using automated, electronic and/or paper-based systems, in accordance with procedures strictly related to the purposes specified above and in full compliance with the principles of security, integrity and confidentiality. Appropriate technical and organisational security measures are implemented pursuant to Article 32 of the GDPR to prevent the risks of data loss, theft, unlawful disclosure or unauthorised access.
4.2 Email communications and informational or service-related messages are sent in a standard and neutral manner, without the inclusion of invisible elements or individual tracking markers.
4.3 Data relating to registration on the portal will be retained for the entire duration of the registration and, following termination of the relationship, for a period not exceeding 10 (ten) years, in accordance with the ordinary limitation periods applicable to contractual rights and for compliance with applicable legal and accounting obligations.
5. Disclosure and Scope of Data Sharing
5.1 Without prejudice to disclosures required by law or pursuant to orders issued by Public Authorities, your personal data may be disclosed or made accessible exclusively to third parties acting as Data Processors pursuant to Article 28 of the GDPR, whose activities are strictly necessary for the fulfilment of contractual purposes, such as:
* Providers of IT services, hosting services, and management of the portal’s technological infrastructure and information systems;
* Providers of email and messaging transmission and delivery platforms (used solely for technical routing purposes, without any telemetry data collection or tracking activities);
* Professionals, accounting consultants and legal advisers for compliance with the related regulatory obligations;
* Competent authorities for compliance with mandatory legal obligations.
5.2 Personal data are processed within the European Union. It is understood that data made publicly available at the express request of the data subject (for example, through the publication of a listing on the portal) will be accessible online and, therefore, technically accessible also to individuals residing outside the European Economic Area (EEA). Except in such circumstances, personal data are not transferred to third countries.
6. Nature of the Provision of Personal Data
6.1 The provision of personal data for the purposes described in Section 3 of this Privacy Notice (registration on the portal and use of its services) is mandatory and necessary to complete the registration process and provide the requested functionalities. Any refusal to provide such data will make it objectively impossible to complete registration on the Lumos.it portal and to access the associated services.
6.2 As no tracking tools, such as tracking pixels or electronic tracking markers, are implemented in email communications, no consent for telemetry purposes is required or sought. This ensures that users can read and access email messages without any behavioural profiling or individual monitoring of email openings and reading activity.
7. Rights of the Data Subject
In accordance with Articles 15 et seq. of the GDPR, the data subject has the right to exercise the following rights vis-à-vis the Data Controller at any time:
a) Right of Access (Article 15 of the GDPR): to obtain confirmation as to whether personal data are being processed and to access such personal data and the related detailed information;
b) Right to Rectification (Article 16 of the GDPR): to request the prompt correction of inaccurate personal data and the completion of incomplete personal data;
c) Right to Erasure (Article 17 of the GDPR): to request the deletion of their personal data where the conditions laid down by law are met;
d) Right to Restriction of Processing (Article 18 of the GDPR): to request the restriction of the processing of personal data in the specific circumstances expressly provided for by law;
e) Right to Data Portability (Article 20 of the GDPR): to receive the personal data provided in a structured, commonly used and machine-readable format, where the processing is based on a contract and carried out by automated means;
f) Right to Object (Article 21 of the GDPR): to object, on legitimate grounds, to the processing of their personal data, including the sending of direct marketing communications;
g) Right to Lodge a Complaint (Article 77 of the GDPR): to lodge a complaint with the competent supervisory authority (in Italy, the Italian Data Protection Authority – Garante per la Protezione dei Dati Personali, Piazza Venezia No. 11, 00187 Rome, Italy, email: [email protected], website: www.garanteprivacy.it).
8. Procedures for Exercising Data Subject Rights
The data subject may exercise their rights at any time by submitting a formal request:
* by registered mail with acknowledgement of receipt, addressed to the Data Controller’s registered office: USB S.p.A., Via Piave No. 21, 20159 Milan (MI), Italy;
* by Certified Electronic Mail (PEC) to the following address: [email protected];
* by ordinary email to the following address: [email protected].
Please specify precisely which right you wish to exercise. The Data Controller will respond to the data subject within the time limits established by Article 12(3) of the GDPR (normally within one month of receipt of the request).
