This page informs data subjects about how their personal data is processed by the GDPR Facil service.
Pursuant to Art. 13 of Legislative Decree No. 196 of 30 June 2003 (known as the “Privacy Code”) and Articles 12 et seq. of EU Regulation 2016/679 (known as “GDPR” – General Data Protection Regulation), we inform you that:
The Data Controller is Studio De Finis Strumia, located at Corso Rosselli 1, 10128 Turin, Italy – Tel: +39 011 3042132 – Fax: +39 011 3164567 –
Email: maddalenadefinis@studiodefinis-strumia.it, robertostrumia@studiodefinis-strumia.it, areafiscale@studiodefinis-strumia.it, segreteria@studiodefinis-strumia.it
Under the above regulations, the term “personal data” refers only to data concerning natural persons. Therefore, this policy does not apply to the processing of data relating to legal entities, which are not covered by the Privacy Code or GDPR.
The only personal data processed will be those of users, namely the client if an individual business or professional, or their employees who may use the service.
The data processing consists of recording and storing the data entered by the user, to allow them to use the service and to provide proof at any time that the related actions were carried out.
The sole purpose of the data processing is to deliver the GDPR Studio De Finis Strumia service to the client as effectively as possible.
Data may be processed using automated systems or paper-based means.
Studio De Finis Strumia does not carry out any profiling of user data, nor does it disseminate or disclose them to third parties, except where required by law (e.g., to an accounting firm) or necessary for the service (e.g., banks for payment processing).
Personal data will not be transferred outside the European Union.
Personal data will be retained only for the period necessary to provide the service or to comply with legal or regulatory obligations.
The legal bases for the processing are:
the data subject’s consent,
the necessity to perform the GDPR Studio De Finis Strumia service,
compliance with legal obligations to which the Controller is subject.
The provision of the requested data is mandatory; failure to provide such data will prevent the user’s data from being recorded or stored in the system, thereby making it impossible to provide the service.
Data subjects may withdraw their consent to the processing at any time, without affecting the lawfulness of processing carried out before withdrawal.
They also have the right to obtain confirmation as to whether personal data concerning them exists, and to receive such data in an intelligible form.
They have the right to access their personal data and to receive information including:
the origin of the data;
the purposes and methods of processing;
the logic applied in case of processing using electronic tools;
the identity of the Data Controller, any processors, and designated representatives under Article 5(2);
the recipients or categories of recipients to whom the personal data may be disclosed or who may become aware of them as designated representatives, processors, or persons in charge.
The data subject has the right to request:
the updating, rectification, or, where interested, integration and/or portability of the data;
the restriction of processing;
the deletion, anonymization, or blocking of data processed unlawfully, including data whose retention is unnecessary for the purposes for which they were collected or subsequently processed;
certification that these actions (update, deletion, etc.) have been notified to those to whom the data were communicated, unless this is impossible or involves a disproportionate effort.
Data subjects also have the right to lodge a complaint with a supervisory authority and to object, in whole or in part:
for legitimate reasons, to the processing of their personal data, even if relevant to the purpose of collection;
to the processing of their personal data for purposes of marketing, direct sales, market research, or commercial communication.