Rev. 01 of 11/10/2023

Foreword

Dear Data Subject, the “European Regulation 2016/679 on the protection of individuals with regard to the processing of personal data and on the free movement of such data” provides for the protection of persons and other subjects with regard to the processing of personal data.

FUNIVIE ALPE CERMIS S.p.A., in its capacity as Data Controller, pursuant to Article 13 of EU Reg. 2016/679, wishes to illustrate to you the purposes and methods with which your personal data are collected and processed.

In particular, we provide you with the following information:

• Identity and contact details of the data controller:

The data controller is FUNIVIE ALPE CERMIS S.p.A., with registered office in Via Cermis, 2 – 38033 Cavalese (TN).

It will be possible to contact the data controller using the following contact details: sicurezza@alpecermis.it

• Purpose of processing and legal basis

The collection or processing of personal data takes place for the following purposes:

Video surveillance

With reference to the installation of the video surveillance system, the purpose of the processing concerns the protection of company property and assets in accordance with a legitimate interest of the Data Controller, the protection of persons and assets from possible unauthorised access to company areas, attacks, thefts, robberies, damage, vandalism, fire prevention, work safety, etc. The images will be processed and stored in accordance with the law, and will not be disseminated except for the fulfilment of legal obligations for the purpose of crime prevention.

The legal basis that makes lawful the processing, carried out for the purposes described above, is the pursuit of the legitimate interest of the owner (Art. 6 co. 1 lett. f) GDPR)

• Method of processing

In relation to the aforementioned purposes, the processing of personal data is carried out using manual, computerised and telematic tools with logics strictly related to the purposes themselves and in any case in such a way as to guarantee the security and confidentiality of the data in compliance with the aforementioned legislation.

Automated decision-making processes, including so-called profiling, are excluded.

• Categories of third parties to whom the data may be disclosed.

FUNIVIE ALPE CERMIS S.p.A may communicate your personal data to the following categories of subjects:

• public entities institutionally vested with functions related to the employment relationship (INPS, INAIL, DIREZIONE PROVINCIALE DEL LAVORO, etc.);
• legal entities institutionally entrusted with supplementary, complementary and health care assistance on a negotiated basis;
• firms and companies within the scope of professional assistance and consultancy relationships, as well as insurance and legal institutions;
• public authorities, if the conditions are met;
• credit institutions or banks for the payment of fees due;
• technicians in charge of maintaining the IT infrastructure and the video surveillance system;

The subjects belonging to the above categories operate, in some cases, in total autonomy as separate Data Controllers; in other cases, as Data Processors on behalf of FUNIVIE ALPE CERMIS S.p.A., and as such specifically appointed by the Data Controller in compliance with Article 28 GDPR.

You may request a list of the Data Processors using the contact details of the Data Controller indicated in point 1.

The data will be disseminated through the Data Controller’s institutional website, in compliance with the obligations of publicity, transparency and dissemination of information by public administrations.

• Duration of processing and storage period.

Your data will be processed only for the time necessary to pursue the purposes mentioned above. In particular, we set out below the main periods of use and storage of your personal data with reference to the various processing purposes, which may be extended if the need for further storage arises in order to allow FUNIVIE ALPE CERMIS S.p.A. to defend its rights:

• Data transfer outside the European Union

The data collected will not be transferred to countries outside the European Union.

• Rights of the data subject

As a data subject, you may assert the rights set out in Articles 15 et seq. of the GDPR below:

Rights of access, rectification, integration and deletion of data, portability, restriction of processing and revocation of consent given.

1. Pursuant to Regulation (EU) 2016/679 you have the right to request from the Data Controller access to, and rectification, integration or deletion of, your data. Within 30 days of submitting your request, you will be provided with feedback in written form, including by electronic means.
2. You also have the right to object to the processing or request the restriction thereof, for legitimate reasons and in the cases provided for in Articles 18 and 21, EU Reg. 2016/679.
3. You may at any time revoke your consent to the processing of your data given for the purposes determined in this notice.
4. Lastly, you may exercise your right to data portability, requesting the Data Controller to transmit your data to another data controller.

To exercise the aforementioned rights, it will be sufficient to use one of the data controller’s contact details indicated in points 1 and 2.

Right to lodge a complaint with the Control Authority.

1. You have the right to lodge a complaint with the Supervisory Authority if you consider that your data is being processed unlawfully and contrary to the relevant legal requirements.