NOTICE TO DATA SUBJECTS FOR THE PROCESSING OF PERSONAL DATA
Autotrasporti Chiarcosso S.r.l., with registered office at via Oderzo 22/1, 33100 - Udine (hereinafter the "Company" or the "Data Controller"), in its capacity as Data Controller, pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (General Data Protection Regulation, hereinafter "GDPR" or "Applicable Privacy Legislation"), hereby informs you of the following:
- Categories of personal data processed.
To achieve the purpose specified in point 3 below, the Company will process personal identification and contact data, as well as any other data provided with the Report (e.g., photographs, evidence, identification documents) in accordance with the privacy regulation (European Regulation 2016/679) and as further detailed below (collectively, the "Data"). The data subjects are the whistleblower and any individuals who are directly or indirectly the subject of the report. - Source of the Data.
The Data is obtained from the person submitting the report (the "Report") under Article 6, Legislative Decree 231/2001, and Legislative Decree 24/2023, in the form chosen by them (mailing a sealed envelope to the Supervisory Body (OdV) at the Company’s headquarters; sending an email to the dedicated address odv@chiarcosso.com; delivering by hand to the OdV; or using the "Whistleblowing" platform). - Purpose of the processing.
The processing of Data is aimed at the proper verification and subsequent management of the Report. - Methods of processing and retention period.
Processing is carried out in paper form and/or on magnetic, electronic, or telematic media, with the aid of automated means, and may involve any operation listed in Article 4, point 2, of the GDPR (collection, recording, organization, structuring, storage, adaptation or modification, retrieval, consultation, use, disclosure by transmission, comparison, restriction, erasure, destruction) except dissemination, except for legal obligations. In accordance with the principle of proportionality, the data will be processed for a maximum period of 5 years from the closure of the report. - Mandatory or optional nature of providing the Data and legal basis for processing.
Providing the Data by the whistleblower is optional. Any partial or total refusal to provide it will result in the inability to perform the activities referred to in point 3. The Data is collected and processed by the Company to comply with legal obligations and for the legitimate interest of the Company in proper business management, pursuant to Article 6, paragraph 1, letters c) and f) of the Regulation. The consent of the whistleblower is required for the communication of their data in the cases provided for in Article 12, paragraphs 2 and 5, of Legislative Decree 24/2003 and for documentation in the cases provided for in Article 14, paragraphs 2 and 4, of the same Decree. Communication and disclosure. Your data may be disclosed to any other third party when disclosure is mandatory by law, including in the context of preventing/repressing any unlawful activity. Depending on the reporting method chosen by the whistleblower, the Data may be shared with the Company's System Administrators, as well as persons authorized by Autotrasporti Chiarcosso S.r.l. to process the data (for example, DigitalPa S.r.l., the company responsible for developing and maintaining the Whistleblowing platform). Specific instructions will be provided to these parties regarding data handling. It should also be noted that, under Article 12 of Legislative Decree 24/2023, the identity of the whistleblower and any other information that could directly or indirectly reveal their identity may not be disclosed without their express consent to persons other than those authorized to receive or follow up on the reports, explicitly authorized to process such data under Articles 29 and 32, paragraph 4, of Regulation (EU) 2016/679 and Article 2-quaterdecies of the Italian data protection code, Legislative Decree 196/2003. Additionally, in disciplinary proceedings, the identity of the whistleblower cannot be disclosed if the disciplinary charge is based on findings separate from the report, even if stemming from it. If the charge is based, in whole or in part, on the report and knowledge of the whistleblower’s identity is essential for the defense of the accused, the report may only be used in disciplinary proceedings if the whistleblower has expressly consented to the disclosure of their identity. - Transfer of personal data to non-EU countries.
The collected Data will not be transferred to companies or other entities outside the European Union. - Data Protection Officer and rights of the data subject.
You may exercise the rights recognized to you by law as a data subject under Articles 15 et seq. of the GDPR (e.g., obtaining confirmation of the existence of data processing, requesting rectification or deletion of data unlawfully processed, objecting on legitimate grounds to the processing, etc.) by contacting privacy@chiarcosso.com. However, please note that the exercise of these rights is subject to the limitation provided for in Article 2-undecies of Legislative Decree 196/2003 (Privacy Code), when doing so could result in actual and concrete prejudice to the confidentiality of the identity of the person reporting violations learned in the course of their employment or duties. The exercise of these rights may, in any case, be delayed, restricted, or excluded with a justified notice given without delay to the Data Subject, unless doing so would compromise the purpose of the restriction, for the time and to the extent necessary and proportionate, considering the fundamental rights and legitimate interests of the Data Subject. In such cases, Data Subjects may also exercise their rights through the Data Protection Authority in accordance with Article 160 of the Privacy Code. The Company also reminds you that you may always lodge a complaint with the Data Protection Authority.
