The data provided and processed by Composit Srl are: Administrative, Accounting, Banking, Financial, Municipalities, Personal data, Tax, Social security and employment.

Purpose of the processing

We inform you that the personal data, provided directly by the interested party and/or collected by filling in forms available on the websites managed by Composit Srl, are processed for purposes related to the management of the working relationship with the employee/collaborator

• I AGREE
• I DO NOT AGREE

Processing methods and access to data

The data collected by signing standard contracts in analogue format are processed both in paper form and with IT and telematic tools and may be processed in aggregate form for statistical purposes and for verifying the quality standards of assistance and maintenance services, excluding in in this case the processing of identification data.

The data collected by completing online forms are processed electronically and using management information systems.

The data is accessible exclusively by persons in charge, adequately trained and informed about their duties and the activities permitted to them on the data collected, who operate on behalf of Composit Srl and who are recipients of instructions and tasks given by the data controller, to means of appointment letter .

The data controller will process the data for the purposes indicated above, pursuing its legitimate interests which do not prevail over the interests or rights and freedoms of the interested party.

Scope of communication and possible dissemination

The data of customers and clients may be communicated to public administrations or operators of a public service when submitting applications for participation in procedures for the choice of the contractor, for the purpose of awarding contracts or concessions for the supply of goods or services, in accordance with the provisions of the legislation on public procurement, for technical qualification purposes.

The data relating to the contract and the service activity may be communicated to commercial consultants for administrative and accounting purposes and to lawyers for possible management of disputes.

The data, with the exception of those of a sensitive and judicial nature, may be communicated to anyone (private or public administration), even outside the European Union, in their legitimate interest and taking advantage of a right expressly attributed to them by the specific legislation in force in matter, requests an investigation into the identity of the owner of the service provided by Composit Srl for investigative purposes or in any case for the protection of its legitimate interest.

The data may also be communicated or made accessible to companies controlled and/or connected to Composit Srl, to other subjects who deal with the maintenance of IT systems, as well as to subjects who deal with specific phases of processing, as managers of Composit Srl whose names can be verified upon request by interested parties.

The data may also be communicated to police bodies or judicial authorities for the purposes of ascertaining or repressing crimes committed by users of telematic services, where necessary.

The data is not subject to dissemination, except for the data of businesses and companies for commercial reference purposes.

The data may be processed in order to identify certain characteristics of certain types of recipients in order to convey communication and advertising activities aimed at the interests of the recipients themselves.

Storage of personal data

Composit Srl will keep the data of the interested parties in a form that allows their identification for a period of time not exceeding the achievement of the purposes for which the data were collected; they will therefore be kept until the existence of the existing contractual relationship.

The data strictly necessary for tax and accounting obligations, once the purpose for which they were collected ceases to exist, will be retained for a period of 10 years as required by the relevant regulations. 

The interested party has the right to request, at any time, the modification of the structures regulated by this paragraph through the exercise of the rights referred to in the following paragraph.

The rights of the interested party

The interested party may exercise the rights referred to in articles 15 to 22 of European regulation 679/16:

Art 15 – Right of access of the interested party 1. The interested party has the right to obtain from the data controller confirmation as to whether or not personal data concerning him or her are being processed and, in this case, to obtain access to the personal data and the following information: a) the purposes of the processing; b) the categories of personal data in question; c) the recipients or categories of recipients to whom the personal data have been or will be communicated, in particular if recipients are from third countries or international organisations; d) when possible, the expected retention period of personal data or, if this is not possible, the criteria used to determine this period; e) the existence of the right of the interested party to ask the data controller to rectify or delete personal data or to limit the processing of personal data concerning him or to oppose their processing; f) the right to lodge a complaint with a supervisory authority; g) if the data are not collected from the interested party, all available information on their origin; h) the existence of an automated decision-making process, including profiling referred to in Article 22, paragraphs 1 and 4, and, at least in such cases, significant information on the logic used, as well as the importance and expected consequences of such processing for the interested party. 2.If personal data are transferred to a third country or to an international organisation, the interested party has the right to be informed of the existence of adequate guarantees pursuant to Article 46 relating to the transfer. 3.The data controller provides a copy of the personal data being processed. In case of further copies requested by the interested party, the data controller may charge a reasonable fee based on administrative costs. If the interested party submits the request by electronic means, and unless the interested party indicates otherwise, the information is provided in a commonly used electronic format. 4.The right to obtain a copy referred to in paragraph 3 must not adversely affect the rights and freedoms of others.

Art 16 – Right of rectification – The interested party has the right to obtain from the data controller the rectification of inaccurate personal data concerning him without unjustified delay. Taking into account the purposes of the processing, the interested party has the right to obtain the integration of incomplete personal data, including by providing a supplementary declaration.

Art 17 – Right to cancellation – The interested party has the right to obtain from the data controller the cancellation of personal data concerning him without unjustified delay and the data controller has the obligation to delete the personal data without unjustified delay, if any one of the following reasons: a) the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed; 4.5.2016 EN Official Journal of the European Union L 119/43 (b) the data subject withdraws the consent on which the processing is based in accordance with Article 6(1)(a) or Article 9(2) letter a), and if there is no other legal basis for the processing; c) the interested party objects to the processing pursuant to Article 21, paragraph 1, and there is no overriding legitimate reason to proceed with the processing, or objects to the processing pursuant to Article 21, paragraph 2; d) the personal data have been processed unlawfully; e) the personal data must be erased to comply with a legal obligation under Union or Member State law to which the data controller is subject; f) the personal data were collected in relation to the offer of information society services referred to in Article 8, paragraph 1. 2. The data controller, if he has made personal data public and is obliged, pursuant to paragraph 1, to delete them, taking into account the available technology and implementation costs, adopt reasonable measures, including technical ones, to inform the data controllers who are processing the personal data of the interested party’s request to delete any link, copy or reproduction of their personal data. 3. Paragraphs 1 and 2 do not apply to the extent that the processing is necessary: ​​a) for the exercise of the right to freedom of expression and information; b) for the fulfillment of a legal obligation which requires processing provided for by Union or Member State law to which the data controller is subject or for the performance of a task carried out in the public interest or in the exercise of public authority of which the data controller is vested; (c) for reasons of public interest in the field of public health in accordance with Article 9(2)(h) and (i) and Article 9(3); (d) for archiving purposes in the public interest, scientific or historical research or statistical purposes in accordance with Article 89(1), to the extent that the right referred to in paragraph 1 is likely to render impossible or seriously undermine the achievement of the objectives of such processing; oe) for the establishment, exercise or defense of a right in court.

Art 18 – Right to limit processing – 1. The interested party has the right to obtain from the data controller the limitation of processing when one of the following hypotheses occurs: a) the interested party disputes the accuracy of the personal data, for the period necessary for the data controller to verify the accuracy of such personal data; b) the processing is unlawful and the interested party opposes the deletion of the personal data and instead requests that their use be limited; c) although the data controller no longer needs them for the purposes of the processing, the personal data are necessary for the interested party to ascertain, exercise or defend a right in court; d) the interested party has objected to the processing pursuant to Article 21, paragraph 1, pending verification of the possible prevalence of the legitimate reasons of the data controller with respect to those of the interested party. 2. If processing is limited pursuant to paragraph 1, such personal data shall be processed, except for storage, only with the consent of the interested party or for the establishment, exercise or defense of legal claims. or to protect the rights of another natural or legal person or for reasons of important public interest of the Union or of a Member State. L 119/44 EN Official Journal of the European Union 4.5.2016 3. The interested party who has obtained the limitation of processing pursuant to paragraph 1 shall be informed by the data controller before that limitation is revoked.

Art 19 – Right to obtain notification from the data controller in cases of rectification or cancellation of personal data or cancellation of the same – The data controller communicates to each of the recipients to whom the personal data have been transmitted any rectifications or cancellations or limitations of the processing carried out pursuant to Article 16, Article 17(1) and Article 18, unless this proves impossible or involves a disproportionate effort. The data controller communicates these recipients to the interested party if the interested party requests it.

Art 20 – Right to portability – 1. The interested party has the right to receive the personal data concerning him/her provided to a data controller in a structured, commonly used and machine-readable format and has the right to transmit such data to another data controller without impediments on the part of the data controller to whom he provided them if: a) the processing is based on consent pursuant to Article 6, paragraph 1, letter a), or Article 9, paragraph 2 , letter a), or on a contract pursuant to Article 6, paragraph 1, letter b); and b) the processing is carried out by automated means. 2. When exercising his or her rights regarding data portability pursuant to paragraph 1, the interested party shall have the right to obtain the direct transmission of personal data from one data controller to another, if technically feasible. 3. The exercise of the right referred to in paragraph 1 of this article is without prejudice to Article 17. This right does not apply to processing necessary for the execution of a task of public interest or connected to the exercise of public powers referred to the data controller is vested. 4. The right referred to in paragraph 1 must not adversely affect the rights and freedoms of others.

Art 21 – Right to object – The interested party has the right to object at any time, for reasons related to his particular situation, to the processing of personal data concerning him pursuant to Article 6, paragraph 1, letters e) of) , including profiling on the basis of these provisions. The data controller shall refrain from further processing the personal data unless he demonstrates the existence of compelling legitimate reasons to proceed with the processing which prevail over the interests, rights and freedoms of the interested party or for the assessment, exercise or the defense of a right in court. 2. If personal data are processed for direct marketing purposes, the interested party has the right to object at any time to the processing of personal data concerning him or her carried out for such purposes, including profiling to the extent that it is connected to such marketing direct. 3. If the interested party objects to the processing for direct marketing purposes, the personal data will no longer be processed for these purposes. 4.5.2016 EN Official Journal of the European Union L 119/45 4. The right referred to in paragraphs 1 and 2 shall be explicitly brought to the attention of the data subject and presented clearly and separately from any other information at the latest at the time of first communication with the interested party. 5. In the context of the use of information society services and without prejudice to Directive 2002/58/EC, the data subject may exercise his or her right to object by automated means using specific techniques. 6. If personal data are processed for scientific or historical research purposes or for statistical purposes in accordance with Article 89, paragraph 1, the interested party, for reasons related to his particular situation, has the right to object to the processing of personal data concerning him, unless the processing is necessary for the performance of a task in the public interest.

Art 22 – Right to refuse automated processing – The interested party has the right not to be subjected to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or which similarly significantly affects him or her. . 2. Paragraph 1 does not apply if the decision: a) is necessary for the conclusion or execution of a contract between the interested party and a data controller; b) is authorized by Union or Member State law to which the data controller is subject, which also specifies adequate measures to protect the rights, freedoms and legitimate interests of the interested party; c) is based on the explicit consent of the interested party. 3. In the cases referred to in paragraph 2, letters a) and c), the data controller shall implement appropriate measures to protect the rights, freedoms and legitimate interests of the data subject, at least the right to obtain human intervention on the part of the data controller of the treatment, to express one’s opinion and to contest the decision. 4. The decisions referred to in paragraph 2 shall not be based on the special categories of personal data referred to in Article 9(1), unless points (a) or (g) of Article 9(2) apply. and there are no adequate measures in place to protect the rights, freedoms and legitimate interests of the interested party.

In this sense, the interested party is allowed to access their data for

• Verify its veracity
• Change them if they become inaccurate
• Also integrate them with a supplementary declaration
• Request deletion
• Limit its treatment
• Object to the treatment

The data controller is obliged to respond without unjustified reason.

Deletion of data

Composit Srl, in compliance with the corresponding right of access to the interested party, has set up procedures for which interested parties can request the cancellation without unjustified delay of personal data or the limitation of the processing of personal data concerning them for the following reasons:

• Because the data is no longer necessary for the purposes for which it was collected
• Because the interested party has withdrawn consent
• Because the interested party opposes the processing
• Because the data is processed unlawfully.

To exercise the rights provided for by the articles. From 15 to 22 of EU Reg. 679/16 the interested party must send a specific written request addressed to: Composit Srl