Holobody.it Privacy policy 

Preamble
Holobody.it is aware of the importance of safeguarding privacy and the rights of individuals and, as the Internet is a potentially powerful tool for the circulation of your personal data, has committed itself to seriously respecting rules of conduct – in line with the European Regulation 679/2016 of the European Parliament and of the Council, of April 27, 2016, relating to the protection of individuals with regard to the processing of personal data, as well as the free movement of such data (hereinafter “GDPR”) – which guarantee safe, controlled, and confidential navigation on the network.

This privacy protection policy may change over time, also due to integrations and legislative and regulatory changes in the field or due to our institutional decisions, therefore, we invite you to periodically consult this section of our website. Thank you, therefore, for taking note of the rules that our organization has imposed on itself in collecting and processing personal data and in always providing a satisfactory service to the users of its sites.

Basic principles of Holobody.it’s privacy policy

• Process personal data (Art. 4, paragraph 2, GDPR: “any operation or set of operations, carried out with or without the aid of automated processes and applied to personal data or sets of personal data, such as collection, recording, organization, structuring, storage, adaptation or modification, extraction, consultation, use, communication by transmission, dissemination or any other form of making available, comparison or interconnection, restriction, deletion or destruction”) exclusively for the purposes and according to the methods illustrated in the information to be provided that are presented to the user each time they access a section of the site where the direct or indirect provision of personal data is envisaged;
• Use data that has been spontaneously released by the user;
• Use technical cookies to facilitate navigation on the site and analytical cookies for statistical purposes;
• Use profiling cookies only if the user has consented to such use;
• Transmit data to third parties (data processors – Art. 4, paragraph 8, GDPR: “the natural or legal person, public authority, service, or other body that processes personal data on behalf of the data controller”) exclusively for instrumental purposes to what is expressly requested and carefully selected by us;
• Communicate data to third parties for activities related to what is of interest or where it is imposed by law, regulation, or EU regulation;
• If applicable and with explicit consent (Art. 4, paragraph 11, GDPR: “any expression of will, free, specific, informed, and unequivocal by the interested party, by which the same expresses their consent, by statement or unequivocal positive action, that the personal data concerning them be subjected to processing”), communicate data to third parties for their independent processing;
• Respond to requests for access to personal data, rectification or deletion of the same, exercise of the right to be forgotten, restriction of processing or the right to object to their processing. Ensure the exercise of the right to data portability as well as oppose the processing of data for purposes of informative communications on our projects and requests for financial contributions in support of our institutional activities, surveys, and research, make known the possibility of lodging a complaint with the supervisory authority;
• Ensure a correct and lawful processing of your data, safeguarding your privacy, as well as applying appropriate security measures to protect the confidentiality, integrity, and availability of the data.

Purpose of data processing and method of processing – legal basis of processing – data collection criteria
Purpose of data processing
As better specified in the sections that allow you to subscribe – by releasing your personal data – to services reserved for users of our site, the requested data is used to respond to the requests expressly advanced by the user. In particular, all activities of collection – and subsequent processing – of data are aimed at pursuing the institutional purposes of Holobody.it and, in particular for:

• Provision of Holobody.it services;
• Payment for services provided by Holobody.it, performed in various ways (credit card, PayPal, or other);
• Request for collaboration with Holobody.it;
• Subscription to initiatives or specific projects and activities of Holobody.it;
• Request for information;
• Direct the user to our social channels;
• Comply with legal norms, regulations, and EU regulations;
• Send promotional material, advertising about our mission and on actions/projects for awareness, conduct surveys and research;

As reported in the list above, personal data may be processed for purposes other than those for which the user has released them. In any case, Holobody.it will not use the data provided for purposes other than those related to the service to which the user has subscribed, and, in any case, only within the limits indicated from time to time in the information to be provided under Art. 13, GDPR. Method of data processing All processing carried out within this site will be carried out with both paper and electronic or telematic tools, with logic related to the purposes for which the data were collected and in compliance with current security standards, for the specific purposes specified from time to time in the information provided pursuant to Art. 13, GDPR.

Criteria for data collection
The forms to be filled out – online or to be downloaded – include both data that are strictly necessary to adhere to what is of interest and whose omission does not allow the request to be processed, and data whose provision is optional. Therefore, the user is free to provide the personal data reported in the request forms or otherwise indicated in contacts with Holobody.it to request information or for other purposes listed above. In these cases of mandatory data provision, their absence may result in the inability to obtain what is requested.

Criteria used to define the limit of data conservation
The data will be kept in our archives (Art. 4, paragraph 6, GDPR: “any structured set of personal data accessible according to determined criteria, regardless of whether this set is centralized, decentralized, or distributed in a functional or geographical manner”) according to varying criteria depending on the category of data, the nature of the processing, and the purposes of the processing itself. The criteria or the precise limit of conservation are described in the information to be provided pursuant to Art. 13, GDPR at the time of the provision of personal data. In principle, the following assessment by Holobody.it applies to establish the criterion for data conservation: all data regarding various forms of payment are kept as long as the relationship remains active and for a number of years equal to that imposed by laws, regulations, even community ones, for administrative and accounting purposes. In addition, they will be kept for the time strictly necessary to pursue Holobody.it’s legitimate interest in asserting or defending a right in court or otherwise disposed of by law enforcement, judiciary, and supervisory bodies for their institutional activities. For administrative and accounting purposes, the data will be compulsorily kept for 10 (ten) years. After the periods mentioned above, the identifying data are transformed into anonymous form and used only for statistical reports that do not allow the identification of the person but are useful for adapting the projects, initiatives, and actions for the realization and achievement of the statutory and institutional objectives of Holobody.it. Personal data (identifying the person) will, therefore, be destroyed. For purposes related to the provision of the service to which the user has subscribed, the data may be made available to third parties, who will act as independent data controllers, and who provide services instrumental to satisfying the user’s request (for example, credit institutions or credit card issuers to manage the payments necessary for the provision of services) or to whom the communication of data is necessary to comply with legal norms or regulations.

Place of data processing
The processing connected to the web services of this site takes place at the registered office of Holobody.it – Via Giuseppe Molteni 149, 00125 Rome (RM) – and is carried out by authorized technical personnel. If necessary, the data connected can be processed by the staff of third-party companies that take care of the maintenance of the technological part of the site (data processor pursuant to Art. 28, GDPR), at their premises.

Data Controller
Holobody.it – with registered office at Via Giuseppe Molteni 149, 00125 Rome (RM) – is the data controller (Art. 4, paragraph 7, GDPR: “the natural or legal person, public authority, service, or other body that, alone or together with others, determines the purposes and means of the processing of personal data”), pursuant to and for the effects of GDPR, because it decides in what way and for what reasons, communicated in the information to be provided to the interested parties, to collect and use the personal data provided by the user, as well as with what tools to treat them and what security procedures to activate to ensure the integrity, confidentiality, and availability, subjecting to the obligations and responsibilities provided for in Art. 24, GDPR.

Data Protection Officer
The Data Protection Officer is the person that Holobody.it involves in many matters concerning the protection of personal data and who supports Holobody.it in controlling, where required, how to treat and protect data. He is also the point of contact for those interested who want to know details about the processing of their data. The Data Protection Officer of Holobody.it can be contacted at the email dpo@Holobody.it

Data processors and persons authorized to process
If deemed necessary, your personal data can be processed, either manually or electronically or telematically, either directly by Holobody.it or by third parties who, endowed with experience, technical skills, professionalism, and reliability, perform processing operations on our behalf, respecting the security and confidentiality of the information and constantly controlled by us in their work. The data processor is “the natural or legal person, public authority, service, or other body that processes personal data on behalf of the data controller” (Art. 4, paragraph 8, GDPR) and will be contractually bound by Holobody.it, with a definition of the limits of operation on the data, the data that can be processed and the categories of interested parties to which they are referred, the nature and purpose of the processing, the limits of data conservation, the obligations and rights that one has towards the processor, and with the prohibition of making different use than the assignment entrusted. If authorized, formally, in a general or specific way, by Holobody.it, they may use other processors, who are contractually bound by the initial processor appointed directly by Holobody.it: violations committed by such other processors fall under the responsibility of the initial processor and not of Holobody.it. The complete and updated list of data processors (and, if applicable, of the processors appointed by the initial processor, upon our authorization) can be requested at the address privacy@Holobody.it (alternatively, writing to Holobody.it ℅ Sylvie Renault – Via Giuseppe Molteni 149, 00125 Rome (RM)). Art. 29, GDPR, which carry out processing activities indispensable for the pursuit of the purposes indicated above; the categories of persons authorized to process are, from time to time, specified in the information to be provided pursuant to Art. 13, GDPR. Generally, they are the persons in charge of providing specific services, administration, management of information services, organizers of informative campaigns on our actions or projects.

Third parties to whom your data are communicated
For purposes related to the provision of the service to which the user has subscribed, the data may be made available to third parties, who will act as independent data controllers, and who provide services instrumental to satisfy the user’s request (for example, credit institutions or credit card issuers to manage the payment of the services) or to whom the communication of data is necessary to comply with legal norms or regulations. Your data may also be made available to control bodies, police forces, and the judiciary by virtue of legal norms and regulations that dispose of the communication and the performance of their institutional activities. In addition, the data may be communicated to third non-profit organizations, project partners, entities, for independent uses (as independent data controllers) for their institutional purposes: such “communication” will take place only if the interested party has expressed their explicit consent. The dissemination of the data, subject to the explicit consent of the user, could be consequent to the type of service or initiative to which the user has subscribed (e.g., list of subscribers to the mailing list).

Transfer of personal data to third countries
Any transfer of personal data to third countries (outside the EU), for processing instrumental to the management of the action or adherence of the user or for reasons of optimization of data processing, will take place by adopting the contractual clauses prescribed by the decision 05/02/2010 of the European Commission, as a mechanism allowed by law as an alternative to the explicit consent of the interested party, and in such a way as to provide appropriate and suitable guarantees pursuant to Arts. 46 or 47 or 49 of the GDPR.

Other third parties collaborating with Holobody.it
Holobody.it, in the context of its awareness activities and presentation of its mission, as well as to improve the services provided to people who have relationships with Holobody.it or otherwise interested and close to the institutional principles of Holobody.it, may turn to third-party services that collaborate with and receive information and data held in its archives. Here it is clarified that these transmissions of information and data always take place in an anonymized way or with techniques of “pseudonymization” (Art. 4, paragraph 5, GDPR (“the processing of personal data in such a way that personal data can no longer be attributed to a specific interested party without the use of additional information, provided that such additional information is kept separately and subject to technical and organizational measures intended to ensure that such personal data are not attributed to an identified or identifiable natural person”). Such anonymized data are processed, for example, and not exhaustively by:

• Facebook (privacy policy at the address https://it-it.facebook.com/policy.php)
• Mailchimp (privacy policy at the address https://mailchimp.com/legal/privacy/)
• Twitter (privacy policy at the address https://twitter.com/it/privacy)
• Linkedin (privacy policy at the address https://www.linkedin.com/legal/privacy-policy?)

Rights of the interested parties with respect to data concerning them
You can exercise, at any time, at the address privacy@Holobody.it (alternatively, writing to Holobody.it ℅ Sylvie Renault – Via Giuseppe Molteni 149, 00125 Rome (RM)) the rights pursuant to Arts.15-22, GDPR as follows: Right of access (Article 15, GDPR) The person has the right to request whether their personal data is being processed and, therefore, has the right of access to the information concerning them and to know about:

• purposes of processing (e.g., management of a service);
• categories of personal data; (e.g., demographic, behavioral data)
• recipients or categories of recipients to whom the personal data have been or will be communicated, especially if recipients of third countries or international organizations; 
• where possible, the expected period of conservation of personal data or, if not possible, the criteria used to determine that period;
• existence of the right to request the rectification or deletion of personal data or limitation of processing of personal data or to oppose their processing;
• right to lodge a complaint with a supervisory authority;
• if the data is not collected directly from the person, all available information on their origin;
• existence of automated decision-making, including profiling, and, at least in those cases, significant information about the logic involved, as well as the importance and expected consequences of such processing for the data subject.

Right to rectification (Article 16, GDPR)
The person has the right to obtain the rectification of inaccurate personal data concerning them without undue delay. Taking into account the purposes of the processing, the person has the right to obtain the completion of incomplete personal data, also by providing an additional declaration.

Right to erasure (“right to be forgotten”) (Article 17, GDPR)
The person has the right to obtain the erasure of personal data concerning them without undue delay, and the data controller has the obligation to erase personal data without undue delay for one of the following reasons:

• the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;
• the consent on which the processing is based is withdrawn and if there is no other legal basis for the processing;
• the person opposes the processing for marketing and profiling purposes and there is no overriding legitimate reason to proceed with the processing;
• personal data have been unlawfully processed;
• personal data must be deleted to comply with a legal obligation under Union or Member State law to which the controller is subject.

Right to restriction of processing (Article 18, GDPR)
The person has the right to obtain the limitation of the processing of their personal data when one of the following applies:

• the accuracy of personal data is contested by the person;
• the processing is unlawful and the person opposes the deletion of personal data and requests instead that their use be limited;
• although the data controller no longer needs the data for processing purposes, personal data are necessary for the person to establish, exercise or defend a right in court;
• the person has objected to the processing if the processing is based on the legitimate interest of the data controller, pending the verification of the possible prevalence of the legitimate reasons of the data controller with respect to those of the person.

Obligation to notify in case of rectification or deletion of personal data or limitation of processing (Article 19, GDPR)
The person has the right to request that the rectification or deletion of data or limitation of processing be communicated by Holobody.it to other subjects to whom the data have been communicated. Holobody.it may not comply with the request if the means to be employed are disproportionate to the right to privacy invoked by the person.

Right to data portability (“data portability”) (Article 20, GDPR)
This right allows the person to receive in a structured format, commonly used and readable by an automatic device, personal data concerning them provided to a subject that subjects their data to processing and has the right to transmit such data to a subject for use by the latter without impediments from the subject to whom they have provided them. This right can be exercised in the following cases:

• the processing is based on consent or a contract or on pre-contractual measures requested by the same person and, simultaneously
• the processing is carried out with automated means. The person has the right to obtain that their data be transferred directly from one subject to another (from the one to whom they have conferred them to the one to whom they want them to be transmitted), if technically feasible.

Right to object (Article 21, GDPR)
The person has the right to object to the processing of their data for the pursuit of the legitimate interest of Holobody.it or third parties, provided that the interests or fundamental rights and freedoms of the person that require the protection of personal data do not prevail, even for profiling purposes. If personal data are processed for marketing purposes, the person has the right to object at any time to the processing of personal data concerning them carried out for these purposes, including profiling to the extent that it is connected to such marketing activity.

Automated decision-making process relating to natural persons, including profiling (Article 22, GDPR)
The person has the right not to be subjected to a decision based solely on automated processing, including profiling, which produces legal effects concerning them or that significantly affects their person in a similar way. In particular, they have the right to oppose the profiling to which they are subjected through automated processes. This right cannot be exercised if the decision:

• is necessary for the conclusion or execution of a contract;
• is authorized by the law of the Union or of the Member State to which they are subject, which also specifies adequate measures to protect the rights, freedoms, and legitimate interests of the person;
• is based on explicit consent. The person has the right to express their opinion and to challenge the decision of Holobody.it.