Regione Autonoma della Sardegna
Dear Data Subject
by this document the Data Controller, in accordance with the legislation on the protection of personal data (Regulation (EU) no. 2016/679, Legislative Decree 196/2003 and Legislative Decree no. 101/2018) intends to draw your attention in a simple and clear way to
- why we process your personal data;
- what personal data we process;
- who processes your personal data;
- how we process your personal data and how long we store them;
- how you can exercise your rights regarding personal data processing.
The data controller is Sardinia Regional Authority, in the person of its Legal Representative, the pro tem President of Sardinia Regional Authority - presidenza@pec.regione.sardegna.it
This information paper has general purpose. You will be allowed to view it on the dedicated page under the institutional website. We recommend you to regularly check out any possible available update.
By the Regional Council’s resolution no. 51/3 of 16.10.2018, the President of Sardinia Regional Authority has delegated the Data Controller’s tasks and functions to the relevant Director-Generals.
It will be under each Directorate-General’s responsibility, as part of the tasks assigned by the Data Controller, to detail the information concerning your personal data processing by specific information papers that you will be made aware of before the data processing starts.
WHY SARDINIA REGIONAL AUTHORITY / Agency / entity PROCESS YOUR DATA
Your personal data are processed, without the need to acquire your consent, for the following purposes:
- to carry out administrative, technical and control functions within the institutional tasks conferred by the law;
- to fulfil the obligations established by law, by a Regulation, by EU legislation or by an order of the relevant Authority;
- to allow you to use the services you requested;
- to implement and manage an employment relationship;
- to be able to exercise the Data Controller’s rights, for instance, in court.
- for information and institutional communication activities
Only with your prior specific consent, your personal data are processed for the following other purposes:
- to send you out by e-mail opinion and satisfaction surveys, newsletters and / or invitations to events or to register to events the Data Controller organizes or is part of, or to ensure direct communication with you.
Legal basis of the data processing
We lawfully process your data:
- as it is necessary for the execution of a contract which you are a party of, either as an interested party or because it is necessary for the execution of pre-contractual provisions adopted following your request - art. 6, point b) of the Regulation;
- as it is necessary to fulfil a legal obligation to which Sardinia Regional Authority is subject to as a data controller: art. 6(1), point c) of the Regulation;
- as it is necessary to carry out a task of public interest, or connected to the exercise of public powers vested in Sardinia Regional Authority as a data controller - art. 6(1) point e) of the Regulation;
- as you have expressed your consent to the processing of your personal data - art. 6(1), point a).
WHAT DATA SARDINIA REGIONAL AUTHORITY PROCESS
While exercising its functions and within the scope of the purposes aforementioned, the Data Controller processes the following data:
- personal data, represented by any information concerning the natural person, be he/she directly or indirectly identified or identifiable by reference to any other information, including his/her personal identification number (e.g. name, surname, residence address, e-mail address, telephone number);
- specific categories of personal data: within the limits and in accordance with the provisions of articles 9 and 10 of EU Regulation no. 2016/679, we process data that can be qualified as "special categories of personal data", i.e. those that reveal racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, data relating to health or to person's sex life or sexual orientation as well as judicial data;
- personal data resulting from general public accessible sources or which have not been directly acquired from you; in this latter case, you will be informed about the source the data originated from.
Most of the data requested to you must be compulsorily provided as necessary to provide for the respective service requested and, in any case, to achieve the institutional purposes stipulated by law. The refusal to provide for mandatory data will impede the Entity to carry out the services and tasks for which such data are necessary.
The provision of any data expressly indicated as optional requires your explicit consent, which you can revoke at any time by totally or partially opposing the processing.
WHO PROCESS YOUR DATA
Your data may be made accessible for the purposes communicated to you to the following people:
- Data Controller’s employees and / or collaborators, in their capacity as officials having been authorized for the data processing and / or system administrators;
- public authorities and third parties (professionals, companies) which have been entrusted with the supply of services on behalf of the Data Controller, in their capacity as data processors.
Your data may be disclosed or made available, without the need for your consent, to supervisory bodies, law enforcement agencies or judicial authorities, as well as other public authorities for institutional purposes when provided for by law, and as independent data controllers. Your data may be processed by European Union’s, national and regional audit and control bodies in the cases established under current law.
Some personal data are made public for transparency or legal publicity purposes in the cases established by the law.
HOW WE PROCESS AND STORE YOUR DATA
The processing of your personal data is carried out electronically and by on paper modalities by means of the operations of collection, registration, organization, storage, consultation, processing, modification, selection, extraction, comparison, use, interconnection, blocking, communication, cancellation and destruction of the data.
The Data Controller does not implement any automated decision-making process. In case the data processing involves an automated decision-making process, including profiling, the Data Controller will deliver a specific information paper to inform you about the principles applied and the consequences of the processing on the data subject.
HOW LONG WE KEEP YOUR DATA
Sardinia Regional Authority will process your personal data for the time necessary to fulfil the purposes communicated to you and according to prearranged criteria that will be further communicated under specific data processing operations.
TRANSFER OF DATA TO OTHER COUNTRIES
Any transfer of your data to non-EU countries will be communicated to you by delivering a specific information paper.
HOW YOU CAN EXERCISE YOUR RIGHTS RELATING TO PERSONAL DATA PROCESSING
Sardinia Regional Authority inform you that, as an interested party, if the limitations established by law do not apply, you have the right to receive information about the processing of your personal data. For this reason, you have the right to:
- obtain confirmation whether your personal data exist or not, even if they are not yet registered and that such data be made available to you in an intelligible form;
- obtain information and, if necessary, copy about:
a) the origin and category of your personal data;
b) the principles applied in case of data processing carried out by electronic instruments;
c) purposes and methods of data processing;
d) identity references of the Data Controller and Processors;
e) individuals or categories of individuals to whom your personal data may be communicated or who can learn about them, in particular if they are recipients in third countries or international organizations;
f) the period of data storage or the criteria used to set out this period, when possible;
g) the existence of any automated decision-making process, including profiling, and in this case about the principles applied, the importance and consequences expected for you, as an interested party;
h) the existence of appropriate guarantees in case of transfer of your data to a non-EU country or to an international organization; - obtain, without undue delay, the update and correction of inaccurate data or, if interested, the integration of incomplete data;
- revoke at any time the consent given, without any hindrance, by using, if possible, the same channels used to provide them;
- obtain the cancellation, transformation into anonymous form or blocking of data processed unlawfully, no longer necessary in relation to the purposes for which they were collected or subsequently processed, or in case the consent the data processing is based upon has been revoked and in case there is no other legal basis, in case you have opposed the data processing and there is no legitimate prevailing reason to continue it, in case of fulfilment of a legal obligation;
- obtain the limitation of the data processing in the case of:
a) contestation of the accuracy of your personal data;
b) unlawful data processing by the Data Controller to prevent its cancellation;
c) exercise of your right in court; - verification of the possible prevalence of the Data Controller's legitimate reasons with respect to your rights;
- receive, without any hindrance and in a structured format of common and legible use, your personal data to be transmitted to another Data Controller or, if technically possible, obtain direct transmission to another Data Controller, in case the data processing is carried out by automatic means;
- object, in whole or in part:
a) to the processing of your personal data, for legitimate reasons, even if pertinent to the purpose of the collection;
b) to your personal data processing, for the purpose of sending off advertising or direct sale materials or for market research or commercial communication, through the use of automated unmanned call systems, by email and / or through traditional marketing methods by telephone and / or mail service; - submit a complaint to the European Data Protection Supervisor.
In the cases mentioned above, where necessary, Sardinia Regional Authority, as a Data Controller, will inform the third parties to whom your personal data have been communicated of your possible exercise of your rights, except for specific cases (e.g. when such fulfilment proves to be impossible or involves means manifestly disproportionate to the protected right).
You can exercise your rights by sending to the Data Controller:
- a registered letter with return receipt;
- a certified e-mail;
- an e-mail.
It is possible to use the specific format which is available on Sardinia Regional Authority’s institutional website under the section - Documents and legislation / format to exercise the rights of the interested parties, or by clicking on the following link: https://www.regione.sardegna.it/regione/strutture-di-garanzia/responsabile-protezione-dati/documenti-e-normativa
The address your requests may be sent to will be indicated in the information paper that you will read at the time your data will be processed. Lacking a specific address, you can contact the Data Controller or the Data Processor at their addresses indicated in this information paper.
For information regarding your rights concerning personal data protection, you can refer to Sardinia Regional Authority’s data protection officer at the following contact details:
viale Trieste 186 - 09123 Cagliari
telephone +39 070 6065735
e-mail rpd@regione. sardegna.it
Legal certified mail rpd@pec.sardegna.it