Whistleblowing policy
Personal Data Processing Statement
Pursuant to EU Regulation 2016/679 relating to the protection of sensitive data and Italian Legislative Decree 196/2003, CMC Marine S.r.l. (VAT no. 02918770138) having its head office in Milan at Piazza Castello no. 1, wishes to inform you that the personal data you have provided will be processed in compliance with the aforementioned legislation and the obligations of confidentiality to which it is bound.
Purpose of the processing and nature of the provision
- The data provided will be processed to properly perform the existing contractual relationship;
- The provision of your data is necessary for the proper performance of the existing contract and any refusal to provide such data could result in the non-performance of the existing contract with the consequent non-continuation of the relationship;
Methods of processing and retention
- The processing will be carried out in an automated and/or manual form, with methods and tools, in compliance with the security measures referred to in Article 32 of the GDPR 2016/679 and Annex B of the Privacy Code (Articles 33-36 of the Code), by specifically appointed subjects, in compliance with the provisions of Article 29 of the GDPR 2016/679;
- The aforementioned data could be communicated to controlled undertakings, affiliated undertakings or parties external to the controller present on European territory in order to comply with the obligations assumed by the contract and will not be communicated to other subjects, nor will they be disseminated. Any dissemination will be possible only if previously authorised by you;
- The controller will use, store and process the data transmitted exclusively in the performance of the contract signed in order to better fulfil its obligations and/or protect itself as appropriate;
- Where requested, the controller or processor will be able to transmit your personal data to Public Authorities even if such communication is deemed reasonably necessary;
- We inform you that, in compliance with the principles of lawfulness, purpose limitation and data minimisation, pursuant to Article 5 of the GDPR 2016/679, the period for the retention of your personal data is connected to the duration of the employment relationship and will continue for six months following the termination for the further fulfilment of data transmission if requested by the competent bodies;
- The period for the retention of personal data is connected to the duration of the contract; and will continue for six months following the termination for further data transmission requirements if requested by the competent bodies;
Rights of the data subject
- The data subject can ask the controller for access to personal data and rectification. The data subject has the right to rectify inaccurate personal data concerning him or her. The data subject has the right to have incomplete personal data completed also by providing an additional declaration.
- The data subject has the right to obtain from the controller the erasure of his or her data if they are no longer necessary with respect to the purposes for which they were collected or otherwise processed, or if they have been collected or processed unlawfully. It will not be possible to proceed to the erasure due to the exercise of right of freedom of expression or information; a legal obligation that must be complied with; a task that must be carried out in the public interest or the establishment, exercise or defence of a legal claim.
- The data subject has the right to obtain from the controller the restriction of the processing that concerns him or her if: the data subject disputes the accuracy of personal data for the period necessary for the controller to verify the accuracy of personal data; the processing is unlawful and the data subject opposes the erasure of personal data and instead requests that their use be restricted; although the controller does not need it for processing purposes, personal data are necessary for the data subject for the establishment, exercise or defence of a legal claim. The controller will inform the data subject before the restriction is lifted.
- The data subject has the right to oppose at any time, for reasons related to his/her particular situation, the processing of personal data concerning him or her. The controller shall refrain from further processing personal data unless it demonstrates the existence of binding legitimate reasons to proceed with the processing that prevail over the interests, rights and freedoms of the data subject.
- The data subject always has the right to exercise his/her rights via a complaint against the supervisory authority (Italian Data Protection Authority).
Methods and timeframe for response to requests
- The controller shall meet the requests of the data subject using the same method by which they were received promptly and without justified delay – in any event no later than one month from the receipt of the extendable request and in the event of a justified need, no later than one additional month thereafter.
Controller and Processor
- The controller is CMC Marine S.r.l. (VAT no. 02918770138) having its head office in Milan at Piazza Castello no. 1, tel 050815500 e-mail info@cmcmarine.com certified e-mail amministrazionecmcmarine@legalmail.it;
- The processor is Alessandro Cappiello tel 050815500 e-mail info@cmcmarine.com certified e-mail amministrazionecmcmarine@legalmail.it;