PRIVACY POLICY GENERAL WEBSITE NAVIGATION AND CONTACTS www.mexedia.com

This disclosure does not apply to other websites that may be consulted through links available on the websites of the data controller, who shall not be considered in any way liable for the websites of third parties. 

1. The “DATA CONTROLLER” Mexedia Public limited company Benefit Company – Via Affogalasino 105 00148 Rome 
   

   To request information regarding the privacy policy, you can email privacy@mexedia.com.

2. For the purposes expressed in this policy, only non-particular personal data shall be processed. 
3. Purposes of processing, data, provision, basis for lawfulness of communication to third parties and storage times, transfers outside the European Economic Area (EEA)

For further processing, please refer to the specific information that will be presented before carrying out the same and, where necessary, consent will be obtained. 

For information on cookies, please refer to the same found on the website www.mexedia.com

4. Disclosure to third parties 

5. Transfers outside the European Economic Area (EEA)

6. Rights of the data subject Articles 15, 16, 17, 18, 19 20, 21 and 77 of the GDPR Rights of the data subject Articles 15, 16, 17, 18, 19, 20, 21, and 77 of the GDPR.

We inform you of the existence of the right to know the recipients of the possible communication, access to personal data, rectification, deletion and possibly complete deletion, limitation of processing, data portability and opposition at any time to the processing of personal data concerning you. 

We also inform you that, if the basis of lawfulness is consent, you have the right to revoke it at any time, without prejudice to the lawfulness of the processing based on the consent given before the revocation (Article 7, paragraph 3, of the GDPR). 

Pursuant to Article 77 of the Regulation, you have the right to lodge a complaint with a supervisory authority, in particular in the member state where you usually reside, work or in the place where the alleged violation occurred, which in Italy corresponds to the Guarantor Authority for the Protection of Personal Data, whose references can be found on www.garanteprivacy.it or you can activate your protection actions also by contacting the judicial authority. You can exercise these rights simply by contacting the data controller through the contacts indicated in this policy or on the company websites.

It is understood that the exercise of rights will be promptly assessed and guaranteed, where possible, as in certain cases, requests must be weighted in conjunction with other regulatory impositions that could limit the exercise.

It is understood that even in cases where the requests to exercise the rights cannot have been followed, the data subject shall be promptly informed of the circumstance and the reasons for it.

7. Contact details of the DPO: either at the registered office of the data controller or DPO@MEXEDIA.COM 

This information was prepared on _180723

Information on the processing of career data from the website

1. The “DATA CONTROLLER“ Mexedia S.p.A. SB  Via Affogalasino 105, 00148 Rome
2. For the purposes expressed in this policy, only non-particular personal data will be processed. Any information on particular data may be processed only if it is necessary to guarantee the right of protected categories and exclusively to guarantee this right. 
3. Purposes of processing, data, provision, basis for lawfulness of communication to third parties and storage times, transfers outside the European Economic Area (EEA)

Any particular or common data NOT strictly necessary for the selection purposes will NOT be processed and please do not include them in the materials sent.

4. Disclosure to third parties 

5. Transfers outside the European Economic Area (EEA)

6. Rights of the data subject Articles 15, 16, 17, 18, 19 20, 21 and 77 of the GDPR Rights of the data subject Articles 15, 16, 17, 18, 19, 20, 21, and 77 of the GDPR.

We inform you of the existence of the right to know the recipients of the possible communication, access to personal data, rectification, deletion and possibly complete deletion, limitation of processing, data portability and opposition at any time to the processing of personal data concerning you. 

We also inform you that, if the basis of lawfulness is consent, you have the right to revoke it at any time, without prejudice to the lawfulness of the processing based on the consent given before the revocation (Article 7, paragraph 3, of the GDPR). 

Pursuant to Article 77 of the Regulation, you have the right to lodge a complaint with a supervisory authority, in particular in the member state where you usually reside, work or in the place where the alleged violation occurred, which in Italy corresponds to the Guarantor Authority for the Protection of Personal Data, whose references can be found on www.garanteprivacy.it or you can activate your protection actions also by contacting the judicial authority. You can exercise these rights simply by contacting the data controller through the contacts indicated in this policy or on the company websites.

It is understood that the exercise of rights will be promptly assessed and guaranteed, where possible, as in certain cases, requests must be weighted in conjunction with other regulatory impositions that could limit the exercise.

It is understood that even in cases where the requests to exercise the rights cannot have been followed, the data subject shall be promptly informed of the circumstance and the reasons for it.

7. Contact details of the DPO: either at the registered office of the data controller or DPO@MEXEDIA.COM 

This information was prepared on _180723

Privacy Notice pursuant to Article 13 of EU Regulation 2016/679 GDPR for Telco Services Contract and Activation – SMS Business

MEXEDIA SPA SOCIETA’ BENEFIT

1. Data Controller: Mexedia S.p.A., located at Via di Affogalasino 105, contact information: +39 06 94502581

Purpose of the Notice: This document provides information on the processing of personal data related to telecommunications or telematics communication services, governed by a specific service contract referred to for further details. In this notice, our organization specifies the processing for which it is the data controller. Please note that for processes and activities whose processing purposes can be attributed to the data subject, our organization acts as the data processor, as appropriately regulated during the service contract subscription phase.

For processing carried out on other platforms: Specific information and, if necessary, consents will be provided before specific treatments related to access to platforms, apps, and websites.

2. Purpose of Processing, Data, Provision, Legal Basis, Retention Period, Transfers outside the European Economic Area (EEA)

Legal Basis:

The processing of such data is related to legal obligations of the data controller (Art. 6, letter c GDPR).

Timeframes

✓ Data related to telephone and telematic traffic is retained based on legal obligations. The ordinary reference for retention is Article 132 of the Privacy Code, which requires telecommunications traffic data to be retained by the provider for 24 months and telematics traffic data for 12 months from the date of communication. Data related to unanswered calls is retained for 30 days.

• ✓ Currently, in derogation from the above terms, data must be retained for up to 72 months due to legal requirements, but they are only available for certain types of offenses. Article 132 of the Privacy Code provides differentiated access to this data depending on the type of offenses for which access is requested. In case of changes in regulations, retention will necessarily be modified in compliance with legal requirements.
• ✓  It should be noted that data may be processed according to the principle of minimization (using only data strictly necessary for the specific case) for the data controller’s legal defense or any legal disputes until their conclusion.

What data we process: 

Depending on the type of request, we process all necessary data to ensure the correct exercise of data subject rights.

Legal Basis: Ensuring the exercise of rights is a specific legal obligation (Art. 6, letter c GDPR).

Timeframes:

✓ Data are processed for the time necessary to manage requests and to verify the same. The usual retention period is 5 years.

✓ It should be noted that data may be processed according to the principle of minimization (using only data strictly necessary for the specific case) for the data controller’s legal defense or any legal disputes until their conclusion.

D – Commercial communications regarding all products and activities of the data controller.

More details

• ✓  With the consent of the data subject, we may conduct commercial actions regarding all products and services provided by our organization. The data subject can choose the preferred contact method (SMS, email, calls with an operator, automated calls, or all methods).
• ✓  The data subject can object at any time, either through automated procedures managed with links provided in each communication, using systems made available by the data controller (apps, dedicated customer website area), or by contacting our organization. Opposition is simple and free and can apply to all communication methods or only to specific ones.
• ✓  Concerning phone contacts, in addition to the data subject’s right to object, the provisions of the regulations establishing and regulating the public opposition register will be guaranteed, even in case of service contract termination.
• ✓  If you do not provide your dati the indicated communications cannot be sent without any other consequences. What data we process: ✓ Name, surname, email, and/or phone number. ✓ The data subject can choose the preferred contact method: email, SMS, calls with or without an operator, all methods. Legal Basis: Consent of the data subject (Art. 6, letter a GDPR).

Timeframes:

• ✓ Data are processed until the data subject objects, which can apply to all or only specific contact methods, as chosen by the data subject. Subsequently, data are processed only for the management of data subject rights (see explicitly stated purpose).
• ✓  It should be noted that data may be processed according to the principle of minimization (using only data strictly necessary for the specific case) for the data controller’s legal defense or any legal disputes until their conclusion.

3. Third-Party Communications

Data will not be disclosed. They will be processed by providers of technological, professional, IT, and consulting services who, as a rule, operate as data processors. It is understood that data will be processed in compliance with the principle of minimization, handling only data strictly necessary for the specific activity and, where possible, anonymized or anonymized data.

In particular, categories of entities may include:

• Entities providing services for data acquisition, processing, and processing necessary for the use of services, user identification, handling of user requests, and more generally, activities related to the processing carried out by the data controller, and for the provision of contractually provided services.
• Customer support entities. Entities engaged in archiving and data entry.
• Entities providing services for the management of the data controller’s information system, including archiving and information security in accordance with regulations.
• Other electronic communications operators, for the management of interconnection and roaming relationships, and more generally, to ensure the correct provision of telephone and telematic connection services based on the provided service
• sEntities engaged in the transmission, packaging, transport, and distribution of communications to customers.
• Credit assignee companies or debt recovery entities, banks for domiciliation purposes.
• Entities performing control, review, and certification of activities carried out by the data controller.
• Entities performing technical and organizational tasks on behalf of the data controller
  Sales agents, studies, and companies within the scope of assistance and consultancy relationships.
• Data may also be communicated to independent third-party data controllers, particularly with reference to public authorities, if legal conditions are met and in the exercise of their functions.

4. Transfers outside the European Economic Area (EEA)

Data is processed within the European Union. If transfer is necessary, GDPR safeguards, such as standard contractual clauses promoted by the EU Commission for regulating transfers outside the European Economic Area, will be used, along with any supplementary measures as indicated by the EDPB.

5. Data Subject Rights – Articles 15, 16, 17, 18, 19, 20, 21, and 77 of the GDPR We inform you of the right to know the recipients of possible communications, access personal data, rectify, erase, and potentially forget, restrict processing, data portability, and object to the processing of personal data concerning you. We also inform you that, if the legal basis is consent, you have the right to revoke it at any time, without affecting the lawfulness of processing based on consent before revocation (Art. 7, paragraph 3 GDPR). Pursuant to Article 77 of the Regulation, you have the right to lodge a complaint with a supervisory authority, particularly in the Member State where you habitually reside, work, or where the alleged violation occurred, which in Italy corresponds to the Italian Data Protection Authority, whose details can be found at www.garanteprivacy.it or by contacting the judicial authority. The exercise of these rights will be evaluated and guaranteed promptly where possible because, in certain cases, such as access to telephone or telematic traffic data, requests must be balanced against other legal requirements that may limit their exercise.
6. Data Protection Officer Contact: dpo@mexedia.com
   This notice was prepared on July 4, 2023.

Information on the processing of email marketing data 

1. The “DATA CONTROLLER“ Mexedia S.p.A. SB  Via Affogalasino 105, 00148 Rome  
2. For the purposes expressed in this policy, only non-particular personal data will be processed. 
3. Purposes of processing, data, provision, basis for lawfulness of communication to third parties and storage times, transfers outside the European Economic Area (EEA)

4. Disclosure to third parties 

5. Transfers outside the European Economic Area (EEA)

6. Rights of the data subject Articles 15, 16, 17, 18, 19 20, 21 and 77 of the GDPR Rights of the data subject Articles 15, 16, 17, 18, 19, 20, 21, and 77 of the GDPR.

We inform you of the existence of the right to know the recipients of the possible communication, access to personal data, rectification, deletion and possibly complete deletion, limitation of processing, data portability and opposition at any time to the processing of personal data concerning you. 

We also inform you that, if the basis of lawfulness is consent, you have the right to revoke it at any time, without prejudice to the lawfulness of the processing based on the consent given before the revocation (Article 7, paragraph 3, of the GDPR). 

Pursuant to Article 77 of the Regulation, you have the right to lodge a complaint with a supervisory authority, in particular in the member state where you usually reside, work or in the place where the alleged violation occurred, which in Italy corresponds to the Guarantor Authority for the Protection of Personal Data, whose references can be found on www.garanteprivacy.it or you can activate your protection actions also by contacting the judicial authority. You can exercise these rights simply by contacting the data controller through the contacts indicated in this policy or on the company websites.

It is understood that the exercise of rights will be promptly assessed and guaranteed, where possible, as in certain cases, requests must be weighted in conjunction with other regulatory impositions that could limit the exercise.

It is understood that even in cases where the requests to exercise the rights cannot have been followed, the data subject shall be promptly informed of the circumstance and the reasons for it.

7. Contact details of the DPO: either at the registered office of the data controller or DPO@MEXEDIA.COM 

This information was prepared on _180723