Privacy notice project
Pursuant to Article 13 of the General Data Protection Regulation (the “GDPR”), Fondazione Penta ETS, an organization incorporated in Italy (Fiscal Code 92166930286), whose registered office is in Padova, Corso Stati Uniti, 4 ( “Penta”, “we”, “our”, “us” or the “Foundation”), in its capacity as Data Controller, provides you with the following information on the processing of your personal data within the activities of the project in which you or your organization participate (the “Project”). The Personal Data Processing will be carried out in compliance with the GDPR and the Italian Legislative Decree n. 196 of 30 June 2003 “Italian Personal data protection Code”.
a. Data controller
Penta is the Data Controller of your personal data processed in relation to the activities described under let. c) below.
b. Data Protection Officer (DPO)
Penta appointed a Data Protection Officer (Article 37 of the GDPR) who may be contacted at the following e-mail address dpo@pentafoundation.org.
c. Purposes and legal grounds
Penta processes your personal data for the following purposes:
Purpose | Personal data processed | Description | Legal basis |
1) Project participation | – Full name – Professional specialty – Professional affiliation – Location where you exercise your profession – Contact information (e-mail address, telephone number) | – Allowing you to attend the Training/Meeting of the Project (including, if you ask us, organizing your trip and managing your staying) – Sending you communications strictly related to the Project activities – Sharing your personal information (full name, professional affiliation, contact details) with the staff of other organizations participating in the Project, in order to carry out its activities – Performing the obligations / exercising the rights arising from the contract concluded with you / your organization | – Performance of a contract to which you / your organization are party or provision of a service that you requested (Article 6, par. 1, let. b), of the GDPR) – Compliance with legal obligations, e.g. regarding project reporting (Article 6, par. 1, let. c), of the GDPR) |
2) Organizing your trip and managing your staying | Special categories of personal data (data concerning health, data revealing racial or ethnic origin, or religious beliefs) | If the organization of your trip or the management of your stay involves the processing of special categories of personal data (e.g., disabilities, intolerances, or dietary preferences), we will need your consent to process such categories of personal data. We may also request such consent at a later time with a dedicated communication. | Your consent (Article 6, par. 1, let. a) of the GDPR, and only for purpose n. 2, Article 9, par. 2, let. a) of the GDPR). Please note that your consent can be freely withdrawn by sending an email to the contacts listed below (par. h) of this privacy notice). The withdrawal of your consent will not affect the lawfulness of the previous processing. |
3) Development of Penta’s research activities | – Full name – Professional specialty – Location where you exercise your profession – Contact information (e-mail address, telephone number) | Keeping your personal information to contact you in order to propose new activity / professional collaborations related to your area of professional specialty, so as to develop Penta’s research activities | Legitimate interest of the Foundation (Article 6, par. 1, let. f), of the GDPR). Penta adopted this legal basis after evaluating the rights and interests of the data subjects and considering that these are not overriding. Specifically, also in view of the professional activity of the data subjects, Penta considered its interest in retaining personal data for the purpose of proposing future activities / professional collaborations to be prevalent. |
4) Dissemination and communication of general images of project activities | – Non-detailed and non-specific image | Promotion of Penta’s initiatives in the healthcare and research sector, also through dissemination on Penta digital communication channels, printed materials and communication to third parties (other participants, partners, newspapers) of general photos and videos collected during the Project events | Legitimate interest of the Foundation (Article 6, par. 1, let. f), of the GDPR). Penta adopted this legal basis after evaluating the rights and interests of the data subjects and considering that these are not overriding. Specifically, also in view of the fact that no directly identifying data will be processed, Penta considered its interest in the dissemination and communication of relevant news within the field of health research to be prevalent. |
5) Protection of Penta’s rights and interests | – Full name – Contact information (e-mail address, telephone number) – Other personal information related to the case | Protection of Penta’s rights and interests in judicial and extrajudicial proceedings | Legitimate interest of the Foundation (Article 6, par. 1, let. f), of the GDPR). |
Failure to provide your consent or the objection to the processing of personal data for purposes n. 2), 3) and 4) above will not affect your / your organization participation in the Project.
d) Means of the processing
Your personal data will be processed and stored either by computerized means and by not computerized means, in compliance with the legislation in force and, in any case, in a way that ensures its safety, confidentiality and prevents unauthorized dissemination or use, falsification or destruction.
e) Data retention period
We retain your personal data in line with what is indicated in the table below:
Purpose | Retention period |
1) Project participation | The time necessary to fulfill the obligations arising from participation in the Project and, subsequently, to comply with legal obligations. At any rate, your personal data will not be stored for more than 10 years after the conclusion of the Project after which they will be destroyed or anonymized. In the event that you or your company are involved in activities related to a public project, data may be retained for 5 years from the payment of the balance by the public funding entity, even if this term exceeds the 10 years mentioned above. |
2) Organizing your trip and managing your staying | The time strictly necessary to provide you with the services during your attendance at the Training/Meeting of the Project. At any rate, your personal data will not be stored for more than 1 year after the conclusion of the Training/Meeting of the Project. |
3) Development of Penta’s research activities | 5 years after the conclusion of the Project. |
4) Dissemination and communication of general images of project activities | |
5) Protection of Penta’s rights and interests | As long as it takes to handle the hypothetical litigation |
f) Processing recipients
Your personal data will not be disseminated, unless you have provided us with specific consent.
Within Penta, your personal data may come to knowledge (for their respective areas of competence) of the persons expressly authorized to the processing.
Your personal data may come to knowledge of the following third parties: (i) entities which provide services related to the performance of your contract (e.g., in organizing the activities of the Project, including travel agencies, hotels, catering and event organization firms); (ii) companies responsible for processing, managing and sending newsletters and other promotional material; (iii) Legal or Tax Consultant as well as auditors; (iv) IT support companies; (v) partners of the Foundation belonging to the research and healthcare sector; (vi) newspapers; (vii) other participants in your same Project; (viii) Public Authorities. pursuant to Article 28 of the GDPR. A list of all the Data processors designated by Penta can be requested by contacting Penta at the details below (par. h) of this privacy notice).
g) Transfer of data outside the European Union
Within the purposes listed above, your personal data might be the subject to transfer to countries not belonging to the European Union. The transfer of personal data will take place in full compliance with the guarantees, measures, and rights provided by the GDPR, usually based on adequacy decisions or standard contractual clauses approved by the European Commission. By sending an email to the contact listed below (par. h) of this privacy notice), you can receive further information regarding the transfer of your personal data and the guarantees in place for their protection.
h) Data subject’s rights
By sending an e-mail to legal@pentafoundation.org, you may at any time exercise the following rights provided for by Articles 15 to 22 of the GDPR:
- obtaining confirmation as to whether your personal data is being processed;
- obtaining access to your personal data and to the information set out in Article 15 of the GDPR;
- obtaining the rectification of your inaccurate personal data without undue delay or the supplementing of your incomplete personal data;
- obtaining the erasure of your personal data without undue delay;
- obtaining the restriction of processing of your personal data;
- being informed of any rectifications or erasures or restrictions of processing in relation to your personal data;
- receiving in a structured, commonly used and machine-readable format your personal data ;
- objecting at any time, on grounds associated with your specific situation, to the processing of your personal data.
Moreover, pursuant to Article 21 of the GDPR, for all processing based on Penta’s legitimate interest pursuant to Article 6(1)(f) of the GDPR (see let. c) nn. 4, 5 and 6 above), you will be entitled to object at any time, on grounds associated with your specific situation, to the processing of your personal data.
You can find the full list of your rights on www.garanteprivacy.it.
i) Complaint to the data protection authority
Should you consider the processing of your data infringes the GDPR, you have the right to raise complaint with the Italian Data Protection Authority (www.garanteprivacy.it) or, if different, to the Data Protection Authority of the Member State of your habitual residence, place of work or place of the alleged infringement.
Fondazione Penta ETS
