PRIVACY NOTICE - AWARD NOMINATOR
article 13 Regulation (EU) 2016/679
“General Data Protection Regulation”

Pursuant to art. 13 of the GDPR, Fondazione Penta ETS, an organization incorporated in Italy (Fiscal Code 92166930286) whose registered office is in Padova, Corso Stati Uniti, 4, email info@penta-id.org (hereinafter “Penta” or the “Organization”), in its capacity as Data Controller, provides you with the following information on the processing of your Personal Data carried out by Penta in connection to your role as Nominator (as defined in the Rules) in the Brighter Future Award (the “Award”), and according to the rules which can be consulted at the following link www.penta-id.org/bfa/ (the “Rules”).
The data processing will be carried out in compliance with Regulation (EU) 2016/679 General Data Protection Regulation (hereinafter the “GDPR”) and the Legislative Decree n. 196 of 30 June 2003 “Personal data protection Code” (the “Code”)

a) Data Controller
Penta is the Data Controller.

b) Data Protection Officer (DPO)
The Organization has appointed a Data Protection Officer (art.37 of the GDPR) whom may be contacted at the following e-mail address dpo@pentafoundation.org

c) Purposes and legal basis of the processing
Nominator’s personal data (name, surname, e-mail address) (“Personal Data”) are processed by Penta, according to the GDPR, for the following purposes:

1) to allow the Nominator to nominate a person (the “Nominee”) for the participation to the Award according to the Rules;
2) to allow Penta to send the Nominator an email confirming that it has correctly received the nomination;
3) to allow Penta to send the Nominee an email with the Nominator’s name, surname and e-mail address to inform the Nominee who made the nomination.

The data requested for purposes above are mandatory and, should these data be omitted or only partially provided, Penta might not be able to manage the nomination to the Award.
The legal basis of such data processing is the consent (art. 6, par. 1, let. a) of the GDPR). Where Nominator is under 18 years old, the consent of the subjects exercising parental responsibility over him/her must always be obtained.

In addition, if the Nominator wishes to provide us with his/her consent, his/her data will be processed by Penta for the following purposes:

4) to subscribe the Nominator to Penta’s newsletter and update him/her on Penta’s initiatives and activities.

The processing for the purpose 4) is optional and if the Nominator refuse to give us the consent this does not have any consequences, but Penta may not use his/her data neither for the purpose of subscribing him/her to Penta’s newsletter nor for updating him/her on Penta’s initiatives and activities.
The legal basis of such data processing is the consent (art. 6, par. 1, let. a) of the GDPR). Where Nominator is under 18 years old, the consent of the subjects exercising parental responsibility over him/her must always be obtained.

We remind the Nominator that his/her consent can be freely withdraw by sending an e-mail to info@penta-id.org
Withdrawing consent shall not affect the lawfulness of the processing based on consent before its withdrawal.

d) Means of the processing
Nominator’s Personal Data will be processed and stored either by computerized means and by not computerized means, in compliance with the legislation in force and, in any case, in a way that ensures their safety, confidentiality and prevents unauthorized dissemination or use, falsification or destruction.

e) Data storage period
The data processed:
(i) for the purposes 1) and 2) will be stored as long as it is necessary to fulfill the obligations connected with the management of the Award. At any rate, the processing of such data will be limited to the maximum period of 2 (two) years.
(ii) for the purposes 3), will be processed for the entire duration of Nominator’s subscription to Penta’s newsletter. As mentioned, consent can be freely withdrawn at any time by sending an e-mail to info@penta-id.org or by using the unsubscribing function inserted in the newsletter footer.

f) Processing recipients
Nominator’s personal data will mostly be processed electronically and will not be disclosed.
Nominator’s personal data may come to knowledge of personnel expressly authorized by Penta, pursuant to Article 29 of the GDPR.
For the above purposes, Nominator’s personal data may also be known to the following third parties:

(i) companies entrusted with the management of the website, electronic archives and IT systems;

And, if Nominator gives Penta consent to process his/her data to send him/her newsletters:

(ii) companies responsible for processing, managing, and sending newsletters.

Where necessary, the Organization has appointed such processing recipients as Data processor pursuant to art. 28 of the GDPR. A list of all the Data processor designated by the Organization can be required by notice to be sent to info@penta-id.org.

g) Transmission of data outside the European Union
Within the purposes listed above, Nominator’s Personal Data will not be the subject of transfer to countries not belonging to the European Union.

h) Data subject’s rights
By notice to be sent to the e-mail address bfa@pentafoundation.org, Nominator may at any time exercise the rights provided for by articles 15 to 22 of the GDPR, such as:
- obtaining confirmation as to whether or not personal data concerning him/her is being processed
- obtaining access to his/her personal data and to the information set out in Article 15 of the Regulation;
- obtaining the rectification of the inaccurate personal data that concern him/her without undue delay or the supplementing of incomplete personal data;
- obtaining the erasure of the personal data that concern him/her without undue delay;
- obtaining the restriction of processing the personal data that concern him/her;
- being informed of any rectifications or erasures or restrictions of processing in relation to the personal data that concern him/her;
- receiving in a structured, commonly used and machine-readable format the personal data that concern him/her;
- objecting at any time, on grounds associated with your specific situation, to the processing of the personal data that concern him/her.
You can find the full list of your rights on www.garanteprivacy.it.

i) Complaint to the Data Protection Authority
We remind the Nominator that, should him/her consider the processing of his/her data infringes the GDPR, him/her may in any event lodge a complaint before the Italian Data Protection Supervisory Authority, or to the Data Protection Supervisory Authority of the Member State of his/her habitual residence, place of work or place of the alleged infringement.

Fondazione Penta ETS

***