INFORMATION NOTICE ACCORDING TO
THE ITALIAN PERSONAL DATA PROTECTION CODE
Legislative Decree no. 196 of 30 June 2003
This information notice (the “Notice“) has been drafted pursuant to Legislative Decree no. 196/2003, Italian Personal Data Protection Code (the “Privacy Code“), by Kaleyra S.p.A. in its capacity as controller of the personal data (“Kaleyra” or ” Data controller“) as, among other activities, publisher of the newsletter Kaleyra Mobile Finance (the “Newsletter“).
Pursuant to and in compliance with the Privacy Code and in relation to personal data that Kaleyra will collect in its capacity as Data controller, you are advised as follows :
- processing of personal data means the collection, recording, organization, storage, processing, modification, selection, extraction, comparison, use, interconnection, blocking, communication, diffusion, cancellation and distribution or the combination of two or more of these operations;
- this treatment is based on accuracy, lawfulness, transparency and protection of your privacy and your rights, pursuant to Article 13 of the Privacy Code.
We provide you with the following information regarding the way, purpose, scope of communication and dissemination of personal data and your related rights.
- Personal data processed.
To provide you with the Newsletter service (the “Service“) as well as to correctly manage marketing communications and events invitations that may be addressed to you Kaleyra, as Data controller, must process some of your data, such as, but not limited to, your name and surname, your e-mail address, your mobile phone number and your navigation data (hereinafter “Personal data“).
The Personal data processed are only those strictly necessary for the purposes referred to in the following paragraph B.
- Purpose of the processing.
The processing of your Personal data is carried out for the following purposes:
- sending the Newsletter that will update you on the latest industry news;
- sending of information about promotions, commercial and marketing activities relating to products, services and events of the Data controller;
- compliance with the obligations imposed by laws, regulations and legislation or issued by authorities legitimated by law.
Please note that, with reference to paragraph (ii) above, Personal data shall not be disseminated or disclosed to third parties, and that they are handled exclusively by the Data controller or the data processors expressly appointed by the Data controller for the purposes set forth in the Notice, unless the person concerned sends a request for termination of the related processing. In the latter case, Personal data are deleted and are not copied, unless differently provided by law.
- Personal data processing modalities.
Personal data are processed only with methods and procedures necessary to provide the Service.
The processing is carried out by means of any operation or set of operations falling within those indicated in art. 4, paragraph 1, letter a, of the Privacy Code (collection, recording, organization, storage, consultation, processing, modification, selection, extraction, comparison, use, interconnection, blocking, communication, cancellation and destruction of data).
Personal data are processed both on paper and magnetic support by computer and are stored in a paper archive as well as in the electronic database of the Data controller to fulfill its obligations and the purposes set out in paragraph B of this Notice. The processing of Personal data contained in that automated information system takes place in accordance with appropriate security measures pursuant to art. 31 of the Privacy Code, so as to minimize the risk of destruction, loss, unauthorized access or processing not compliant with the purposes of collection.
As for the persons or classes of persons to whom your Personal data may be disclosed, we inform you that – without any prejudice for the communication to individuals who are authorized to access Personal data by law, order of authority or, in the case of funded projects, the communications to the related financing bodies as well as certification or supervisory bodies – they may be communicated to professionals who assist Kaleyra (eg. legal, tax consultant, labor consultant).
Your Personal data may also be disclosed to other companies which carry out on behalf of the Data controller in their capacity as data processors appointed by the Data controller, technical or organizational activities related to the Service.
Your Personal data may finally be processed by our collaborators specifically authorized to process them as data processors appointed by the Data controller and in any case, always for the achievement of the purposes set out in paragraph B above.
- Personal data processing nature.
The processing of your Personal data for the purposes listed in paragraph B (i) above is necessary for the execution of the Service and the related activities performed by the Data controller, therefore, any withdrawal of the consent to their processing will make it impossible to provide the Service.
The processing of your Personal data for the purposes listed in paragraph B (ii) above is discretionary but necessary if you want to register to Kaleyra events and the related activities performed by the Data controller.
- Rights of the person concerned.
The subjects whose Personal data are referred to may at any time exercise against the Data controller their rights under art. 7 of the Privacy Code – which, for ease of reading, is reproduced in full below – turning to this end their requests to the Data controller referred to in paragraph F.
Legislative Decree no. 196 of 30 June 2003
- A data subject shall have the right to obtain confirmation as to whether or not personal data concerning him exist, regardless of their being already recorded, and communication of such data in intelligible form.
- A data subject shall have the right to be informed
a) of the source of the personal data;
b) of the purposes and methods of the processing;
- c) of the logic applied to the processing, if the latter is carried out with the help of electronic
- d) of the identification data concerning data controller, data processors and the representative designated as per Section 5(2); and
- e) of the entities or categories of entity to whom or which the personal data may be communicated and who or which may get to know said data in their capacity as designated representative(s) in the State’s territory, data processor(s) or person(s) in charge of the processing.
- A data subject shall have the following rights:
- a) to obtain updating, rectification or, where interested therein, integration of the data;
- b) to obtain erasure, anonymization or blocking of data that have been processed unlawfully, including data whose retention is unnecessary for the purposes for which they have been collected or subsequently processed;
- c) to obtain certification to the effect that the operations as per letters a) and b) have been notified, as also related to their contents, to the entities to whom or which the data were communicated or disseminated, unless this requirement proves impossible or involves a manifestly disproportionate effort compared with the right that is to be protected.
- A data subject shall have the right to object, in whole or in part,
- a) on legitimate grounds, to the processing of personal data concerning him/her, even though they are relevant to the purpose of the collection;
- b) to the processing of personal data concerning him/her, where it is carried out for the purpose of sending advertising materials or direct selling or else for the performance of market or commercial communication surveys.
- Data Controller and availability of the list of data processors.
The Data controller is Kaleyra S.p.A., in the person of its legal representative pro tempore, based in Milan, via Teodosio, 65; e-mail: firstname.lastname@example.org; fax: +39 02 2829795.
The Data Controller holds the updated list of all data processors appointed.