INFORMATION NOTICE ON THE PROCESSING OF PERSONAL DATA FOR ONLINE SURVEYS

What does this Privacy Policy apply to?

This information notice has been drawn up in accordance with Arts. 13 and 14 of Regulation (EU) 2016/679 (“GDPR”) and applies to the personal data collected by Corcym S.r.l., with registered office in Via Giovanni Spadolini 7, Centro Leoni, 20141 Milan (Italy) – in its capacity of data controller (hereinafter “Corcym”, the “Controller”, “we”, “us” or “our”, as appropriate) – about you in the context of a survey.

How do we collect your Personal Data?

Corcym S.r.l. uses Microsoft Forms technology/tool. Therefore, the data entered by you are collected and processed by Microsoft which then sends them to Corcym S.r.l.

External Data Processor is Microsoft group ("Microsoft") with reference to the processing carried out by it, according to Articles 4 and 28 of the GDPR.

For more information on how Microsoft processes data, you can visit the following link https://docs.microsoft.com/en-us/compliance/regulatory/gdpr?view=o365-worldwide With regard to the place where your data is processed, you can consult the list of Microsoft data center locations at the following link https://docs.microsoft.com/it-it/microsoft-365/enterprise/eu-data-storage-locations?view=o365-worldwide/.

Corcym S.r.l., for its part, undertakes to guarantee the security and confidentiality of the data collected, in accordance with the regulations in force. As indicated in the Privacy policy section, Microsoft respects the regulations in force regarding the transfer of data and, in particular, the adequacy decisions of the European Commission and the Standard Contractual Clauses approved by the European Commission.

We do not use any form of solely automated decision-making process in connection to the processing of your personal data and the data you provide to us.

What categories of personal data do we collect?

We may collect the following categories of personal data:

• Identifiers such as name and surname;
• Contact details such as email address;
• Any other information voluntarily provided by you.

Provision of your personal data is voluntary but necessary for pursuing the purposes listed below; in the event you do not provide us your personal data, it will be impossible for us to pursue such purposes.

We do not collect any ‘special category’ personal information.

For which purposes and on which legal basis do we process your personal data?

Your personal data will be processed for the following purposes: improving quality of Corcym products and services and, if needed, contacting you for a follow-up related to your survey replies.

The processing of your data for the purpose above requires your consent. By clicking the “You agree to privacy policy” checkbox you give your consent to process your personal data as stated in this Privacy information notice.

How do we store your personal data?

We have security measures in place to protect your personal data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to the personal data. We inform you that the data that you voluntarily provide through the questionnaire will be transformed into an email by Microsoft that may be stored in the email receiving system used by Corcym.

How long do we keep your Personal Data?

We will retain your personal data only for as long as is reasonably necessary to satisfy the purposes for which it was collected, and for the purposes of satisfying any legal or reporting requirements.

With whom your personal data is shared?

Your Personal Data may be made accessible or communicated to the following persons who will act as persons authorized to the processing, data processors or autonomous data controllers:

• Our employees or collaborators where this is relevant to their role;

• Other Corcym group companies and employees or collaborators of these latter;

• public authorities or bodies, if and to the extent required by law.

We may share your personal data with third parties where it is required by law. In these circumstances, we require third parties to ensure the security of your personal data and to treat it in accordance with the law.

We inform you that if any of the third parties above are established outside the European Economic Area, we will transfer your personal data, in the absence of adequacy decisions and where any of the derogations referred to in Art. 49 of the GDPR applies, on the basis of the standard contractual clauses referred to in art. 46 (2) (c) and (d) of GDPR.

Your rights under the data protection law

Pursuant to Arts. 15 to 22 of GDPR, you have the right to:

• be informed on the purposes and methods of the processing of your personal data;

• access to your personal data;

• rectify incomplete, inaccurate or out-of-date data;

• obtain the deletion of your personal data;

• obtain the restriction of the processing of your personal data, where applicable;

• object to the processing, wholly or partly, where applicable;

• obtain the portability of your personal data, where applicable.

You can withdraw the consent at any time, without prejudice to the lawfulness of the processing based on the consent given before the withdrawal.

You may exercise any of the rights above by writing an email to your competent HR manager or to privacy@corcym.com.

In addition, you have the right to lodge a complaint with the competent Information Commissioner’s Office if you believe that your rights under the GDPR have been violated.