Procedure for the management and tracking of requests from Data Subjects
Data subjects may request information from the Data Controller regarding the guarantee of the following rights:
- Access to personal data (art. 15 of the GDPR): the Data Subject requests confirmation as to whether or not personal data concerning him or her is being processed and, if necessary, requests to obtain access to such data, a copy of the same and all the information provided for in letters a) to h) of art. 15, paragraph 1, of the GDPR.
- Request for intervention on the data (Articles 16-17 of the GDPR): the Data Subject requests to carry out the operations of rectification and/or updating of the data (Article 16 of the GDPR) or the deletion of the data (Article 17 of the GDPR).
- Request for restriction of processing (Art. 18 GDPR): when the data subject contests the accuracy of the personal data, or considers that the processing of the data is unlawful, or if the data are necessary for the establishment, exercise or defence of legal claims.
- Request for data portability (art. 20 of the GDPR): the Data Subject requests to receive such data in a structured format, or to transmit them directly to another data controller.
- Objection to processing (art. 21 of the GDPR): the Data Subject objects to the processing of his or her personal data.
Pursuant to Article 2-terdecies (Rights concerning deceased persons) of Legislative Decree 196/2003 as amended by Legislative Decree 101/2018, the rights referred to in Articles 15 to 22 of the GDPR may be exercised, if the data subject is deceased, by those who have an interest of their own, or act to protect the data subject, as his/her agent, or for family reasons worthy of protection.
In response to requests received from a Data Subject regarding the exercise of their rights, the following provisions must be observed.
The Data Controller, with the support of the internal contact persons for the management of the GDPR, shall verify that the subject of the request complies with the rights of the Data Subject, take the appropriate steps to provide all the information referred to in Article 12 of the GDPR and all communications regarding the processing of the Data Subject’s data in a concise, transparent, understandable and easy to access, formulated in clear and simple language. In the event of a request for a copy of the data in the possession of the Data Controller, the latter must transmit them in a structured, commonly used and machine-readable format.
If a Data Subject makes a request regarding the objection to the processing of data (Article 21 of the GDPR), the Data Controller and the internal contact persons for the management of the GDPR must promptly notify the Data Subject of the ongoing data processing to which the Data Subject may object, to allow the Data Subject to indicate the specific purpose to which he or she intends to object.
If the requests made by the data subjects also refer to data communicated to third parties, the Data Controller must also immediately communicate it to the third party, keeping a copy of the communication.
The information must be provided in writing or by other means, including in electronic form in appropriate cases. In the event that the request is submitted by a third party on behalf of an interested party, the proxy, or a copy of the proxy, must be acquired, together with a valid identity document of the interested party and the delegate.
In addition, the Data Controller, with the assistance of the internal contact person for the management of the GDPR, shall inform the Data Subject of the measures taken as a result of a request pursuant to Articles 15 – 22 of the GDPR, without delay and in any case within one month of receipt of the request. This deadline may be extended if necessary by a further two months, taking into account the complexity and number of requests received. The Data Controller must inform the Data Subject of any such extension within one month of receipt of the request, explaining the reasons. If the Data Subject’s request is in electronic format, the information shall be given in electronic format where possible, unless otherwise instructed by the Data Subject.
If the Data Controller does not take action following the request of a Data Subject, it must communicate to the same, without delay and at the latest within one month of receipt of the request, the reasons for such omission, informing the Data Subject of the possibility of submitting a complaint to the Supervisory Authority and of appealing to the judicial authorities.
The information provided and any communication and provision made pursuant to articles 15 – 22 and 34 of the GDPR will be free of charge. In the event that the requests of a Data Subject are manifestly unjustified or excessive, in particular because they are repetitive in nature, the Data Controller may:
- charge a reasonable fee, taking into account the administrative costs incurred in providing the requested information or communications or in taking the requested action; or
- refuse to comply with the request.
The burden of proving the manifestly unjustified or excessive nature of the request will lie with the Data Controller.
Without prejudice to Article 11 of the GDPR, if the Data Controller has a reasonable doubt regarding the identity of the natural person who made the request referred to in Articles 15 – 21 of the GDPR, it may request to receive additional data to confirm the identity of the Data Subject (such as, for example, a valid identity document).
In the event of exercising the right of access referred to in Article 15 of the GDPR, the Data Controller must provide a copy of the personal data being processed. For any additional copies requested by the Data Subject, the Data Controller may charge a reasonable fee based on the administrative costs incurred. If the Data Subject’s request is in electronic format, and unless otherwise indicated by the Data Subject, the information will be provided in a commonly used electronic format.
The electronic tools used to carry out the processing of personal data are managed by C.G.R. CORNELIO GHINASSI RICAMBI S.P.A., therefore, any technical intervention required for access to the personal data of a Data Subject will be carried out by the Data Controller or by the internal contact person for the management of the GDPR.
Procedures for submitting requests from interested parties and storing them
The interested party may exercise his/her rights in writing or by other means (e.g. electronically, by e-mail), taking into account the fact that specific formalities are not required by current legislation for the purpose of submitting applications.
The requests of the interested parties can be transmitted:
Each interested party may exercise his/her rights provided for by art. 15 et seq. of the GDPR in writing or by other means (e.g. electronically, by e-mail) to C.G.R. CORNELIO GHINASSI RICAMBI S.P.A. at the following addresses:
- Ordinary mail or registered mail with return receipt to the address Via di Mezzo 67/A – 41015 Nonantola
- E-mail to titolareprivacy@gbricambi.it
- PEC to the address cgrspa@legalmail.it
Requests from interested parties will be recorded in the Register for the management of the business of the interested parties, filed using the e-mail address titolareprivacy@gbricambi.it, or in paper archives
If a Data Subject expresses the desire to exercise his/her rights orally, the designated employee or the internal contact person for the management of the GDPR will help the Data Subject to formulate his/her request in writing in order to send this request to the Data Controller.
