ZETA RESEARCH S.R.L. would like to inform you that this notice is drafted in accordance with Article 13 of the European Regulation (EU) 679/2016 concerning the protection of personal data ("Regulation") and national legislation, including individual measures of the supervisory authority, Authority for the Protection of Personal Data, where applicable. We inform you, in your capacity as the data subject, that Zeta Research s.r.l. may collect data related to you, classified as personal according to the aforementioned Regulation. Therefore, as the data controller, it is obliged to provide you with some information regarding the processing of your data.
It is specified that, according to the Regulation, "processing" of personal data means any operation or set of operations carried out by Zeta Research s.r.l., with or without the use of automated processes, applied to your personal data or sets of personal data. This includes collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, communication by transmission, dissemination, or any other form of making available, comparison or interconnection, restriction, erasure, or destruction.
According to the specified regulations, such processing will be based on the principles of lawfulness, fairness, and transparency, as well as the protection of confidentiality and rights, following the principles outlined in Article 5 of the GDPR.
We also inform you that Zeta Research s.r.l. does not process personal data of individuals under 18 years of age. By participating in the survey, you declare that you have reached the age of 18. In the event that Zeta Research s.r.l. inadvertently collects personal information belonging to an individual under 18 years of age, it will proceed to delete such data.
In accordance with Article 13 of the GDPR, we provide the following information:
DATA CONTROLLER The Data Controller is ZETA RESEARCH, with registered office at Via Caccia, 8, 34129 TRIESTE, to which you can write to the following email address: info@zetaresearch.eu or call 0039 040358980.
DATA PROTECTION OFFICER (DPO) The Data Protection Officer pursuant to articles 37 and following of the GDPR is identified as PRATIKA S.R.L. (contact person Ilaria Galante), located at Via Carnia, n. 1, Rodeano Alto, Rive D'Arcano (UD), with the following contact details: email dpo@gruppopk.com;
PERSONAL DATA PROCESSED The personal data processed are those communicated to Zeta Research s.r.l. by you, in the context of the questionnaire submitted to you concerning the survey organized by Zeta Research s.r.l., through the appropriate sections to be optionally completed. The data are considered to fall within the protections of personal data regulations only if the user decides to consent to participation in the COHORT (a group of people who will participate in probable, future surveys) following the initial phase of the survey. If the individual does not join the cohort, the collected data and information will remain completely anonymous without the possibility of linking them in any way to the individual who provided them.
PURPOSE OF PROCESSING Collection and analysis of data for the execution of the Minerva Project: how Our lifestyles change – our Research – your Health, as explicitly stated:
ANONYMOUS SCIENTIFIC RESEARCH PURPOSE (PHASE 1) – data not subject to consent as they are anonymous
· Manage activities related to the realization and execution of the survey organized by Zeta Research s.r.l.;
· Conduct scientific and social research and collaborate in the publication of the results of the research and investigations carried out;
PURPOSE OF COHORTS FOLLOWING THE CONCLUSION OF PHASE 1 (PHASE 2) – data subject to consent
At the conclusion of PHASE 1, those who have given their consent and subsequently voluntarily provided their email address or mobile number will enter an active telematic cohort where they can be contacted for questionnaires with purposes and methods that may overlap with the current "round."
LEGAL PROTECTION PURPOSES – data not subject to consent
· Comply with requests from authorities, institutions, and public bodies and their measures, for the exercise of rights, including potentially those of third parties, in judicial, administrative, or arbitration/conciliation proceedings;
· Fulfill obligations stipulated by law, regulations, community legislation, or an order from authorities;
· Ascertain, exercise, and/or defend the rights of the Company in judicial proceedings.
DATA RETENTION PERIOD
The personal data you have provided to Zeta Research s.r.l. will be retained for a duration corresponding to that necessary for the completion of the survey organized by Zeta Research s.r.l. and the subsequent compliance activities. The maximum retention period is 2 years from the provision of your data, to which an additional period, as necessary, will be added in compliance with current civil, tax, and regulatory obligations, as well as for the exercise or defense of a right in legal proceedings.
Anonymized data will be used for scientific research and statistical purposes.
After the
specified retention periods, the data will be destroyed, deleted, or anonymized, in accordance with the technical procedures for deletion and backup.
LEGAL BASIS
The legal basis for the processing is constituted by your consent to participate in the survey organized by Zeta Research s.r.l. and the subsequent execution of services related to the acceptance of participation in the survey, as well as the sending of communications regarding initiatives and services by Zeta Research s.r.l., expressly highlighted;
DATA PROVISION
The provision of your personal data, if indicated as optional in the relevant sections, is voluntary; your potential refusal to provide them does not prevent your participation in the survey organized by Zeta Research s.r.l. However, if the requested data are indicated as mandatory in the relevant sections, their non-provision determines the impossibility of participating in the survey organized by Zeta Research s.r.l
DATA RECIPIENTS
With reference to the above-mentioned purposes, Zeta Research s.r.l. may communicate your personal data for the aforementioned purposes to the following categories of recipients:
· Delegates and/or agents appointed by Zeta Research s.r.l. for the performance of activities or part of the activities related to the planning and execution of the survey;
· Competent authorities (including courts) to which Zeta Research s.r.l. is subject for the exercise of their institutional functions within the limits established by law or regulations;
· Companies identified by Zeta Research s.r.l., as Data Processors, for the performance of internal administrative, instrumental, related, or support activities to those of Zeta Research s.r.l., or as independent Data Controllers or Joint Data Controllers.
The complete list of recipients and Data Processors appointed by the Data Controller is always available at the legal headquarters of the Data Controller. Your data will not be subject to disclosure.
AUTHORIZED PERSONS TO PROCESS DATA
The data may be processed by employees of the company functions appointed to achieve the above-mentioned purposes, who have been expressly authorized to process data and have received adequate operational instructions.
TRANSFER OF PERSONAL DATA
In accordance with Articles 44 and following of the GDPR 2016/679, some of your personal data may be communicated to recipients and Data Processors (the latter duly appointed by the Data Controller), located in non-European third countries, always following principles of legality, fairness, transparency, and protection of your privacy.
RIGHTS OF THE DATA SUBJECT AND COMPLAINT
Regarding personal data, the data subject may exercise the rights provided for in Articles 15 and following of the GDPR, namely:
Right of access (Article 15) – consists of obtaining from the Data Controller confirmation of whether a processing of personal data concerning the data subject is ongoing and, in that case, obtaining access to the same data and certain information (explicitly mentioned in the cited article) about the data in question.
Right to rectification (Article 16) – allows the data subject to modify their data if they are inaccurate.
Right to erasure (Article 17) – gives the data subject the possibility to delete their data held by the controller when, for example, consent to processing is revoked or the pursued purpose is achieved, or when it is unlawful. Of course, it will not always be possible to comply with a deletion request. This happens, for example, when the data is necessary to fulfill a legal obligation or is required for the defense of a right in judicial proceedings.
Right to object (Article 21) – the possibility to object to processing must be guaranteed when the legal basis is legitimate interest or the performance of a task in the public interest. This right also has its limits, as there may be cases where the legitimate interest of the controller prevails over that of the data subject; it is essential to strike the right balance. Alternatively, processing may be necessary for a task of public interest or for the establishment, exercise, or defense of a right in court.
Right to data portability (Article 20) – provides that, in the case where processing is based on a contract or consent, upon request, the data subject should be provided with their personal data in a structured and readable format by an automatic device (JSON, XML, CSV). This right applies only to data provided voluntarily and not to data inferred or derived.
Right to withdraw consent (Article 7) – In the case of subscribing to any form of consent for processing requested by the Data Controller, it is noted that the data subject can withdraw it at any time, subject to mandatory obligations specified by current regulations at the time of the withdrawal request. The data subject has the right to lodge a complaint with the competent supervisory authority in the member state where they habitually reside, work, or where the alleged violation occurred.
All the aforementioned rights can be exercised by sending a specific request to the Data Controller through the contact channels indicated in this information.
