Privacy policy
according to articles 13 and 14 of the European Regulation EU 2016/679 (GDPR)

Data Controller and Data Protection Officer

The Data Controller is CVBF - Consorzio per Valutazioni Biologiche e Farmacologiche.

The Data Protection Officer is a figure foreseen by article 37 that cooperates with the Data Protection Authority and is the point of contact, concerning the interested parties, for matters related to the processing of personal data.

Below are the contact details of the Data Protection Manager:

Name: Giordano Francesco Saverio

Email: dataprotection@cvbf.net

Interested parties

The interested parties in the data processing are the users who fill the survey form provided.

Personal data processed

Based on the indicated purpose, the following personal data provided by the interested parties will be processed: name, surname, email address, phone number.

No sensitive or legal data will be processed.

There are no automatic decision-making processes.

No user profiling will be performed.

All data will be processed, ensuring their integrity, confidentiality and availability.

Purposes and legal bases of the data processing

The personal data provided will be used for statistical purposes and to avoid abuses.

Consent is required.

The lack or the revocation of consent will result in the deletion of all data, statistical ones included.

Recipients of the personal data

Personal data may be communicated, according to article 28, to Data Processors, who may be granted the use of sub-processors for the provision of consulting, IT and technical services.

A complete list of the Data Processors can be requested from the Data Protection Officer.

For this specific processing, the data may be transmitted to companies that collaborate in executing the project.

The data will not be communicated to other third parties and will not be published unless such communication is deemed necessary to fulfil legal obligations.

Statistical, grouped, or anonymised data may be disclosed to third parties or published while respecting the personal data and privacy of the interested parties.

Data retention

Data will be retained for a maximum period of 3 years from the date of receipt.

Processing localisation and Extra-EU data transfer

The data processing takes place at the Italian offices of the Data Controller. It is carried out through electronic instruments and is subject to adopting suitable security measures by personnel working in offices in charge of data processing.

For the correct performance of all the activities connected to the processing, it may be necessary to transfer the data of the interested parties outside the European Union. The transfer will occur based on adequate certification guarantees and standard data protection clauses (article 46, paragraph 2).

Rights of interested parties

Under the GDPR, the data subject has the right:

• to be informed about how their data is handled, e.g. in the event of a data breach or the possibility of changes to this policy (articles 12 and 13)
• to access, rectify or delete data previously provided (articles 15, 16 and 17)
• to limit the processing (article 18)
• to the portability of your data, e.g. download a copy (article 20)
• to oppose for reasons related to his particular situation (article 21)
• to revocate the consent (article 7, paragraph 3)

For the rights indicated here and for any other information, the interested party can enquire by email to the Data Protection Officer. Enquiries will be processed without delay and in any case no later than 30 days from the delivery.