As prescribed by Article 13 of Legislative Decree 196/2003 (“privacy code”), Penelope Srl, located at via Gustave Eiffel 100, Rome, 00148, RM, IT – VAT number 06092531000, data controller, (referred to as “Data Controller”), provides users who visit the website www.ordinaryheroes.it (hereinafter referred to as the “website”) with information on the processing of data.
What data is processed and for what purpose – Browsing data
During the ordinary course of operations, the IT systems and software procedures for running this website acquire some personal data whose transmission is implicit in the communication protocols of the Internet.
It concerns information that is not collected to be associated with specific individuals, but by its very nature could, through the processing and association with data held by third parties, allow users to be identified.
This category of data includes IP addresses or domain names of computers used by users who connect to the site, URI addresses (Uniform Resource Identifier) of requested resources, the time of the request, the method used to submit the request to the server, the size of the file obtained in reply, the numerical code indicating the status of the response from the server (successful, error, etc..) and other parameters related to the operating system and the user’s computer environment.
This data is used solely for the purpose of obtaining anonymous statistical data about the use of the website and to check its correct operation. The data may be used to ascertain responsibility in the event of possible computer crimes against the website.
Cookies and similar tools
Data provided directly by the user
The personal data provided voluntarily by the user (e.g. when requesting information or clarifications by phoning the numbers indicated on the website or writing to the email addresses therein) is used solely to process any requests made and to implement the legal obligations and/or pre-contractual obligations and/or contractual obligations arising from the legal relationship in the case established.
Should the user decide to contact the Data Controller through the appropriate forms on the website, he/she will be able to find out detailed information on the processing of the requested data by accessing the specific information provided on the pages of interest.
Communication and disclosure
The data collected will not be disclosed, sold or exchanged with third parties without the express consent of the data subject, without prejudice to the cases in which communication to third parties (competent authorities, consultants or companies providing IT supply and assistance services) is necessary to fulfil the legal obligations or the obligations arising from the existing relationship with the data subject or third parties (included in one of the categories indicated) acting as privacy managers.
The data subject can request from the Data Controller the list of external subjects who carry out their activities as privacy managers pursuant to Article 29 of the Privacy Code.
The data collected is processed with IT tools and only residually on paper. Specific safety measures are taken to prevent data loss, illicit or incorrect use and unauthorised access. Personal data is processed
exclusively by those authorised (specifically appointed as privacy manager) and is stored for the time strictly necessary to process the requests of the data subject and in any case in compliance with the law.
The Data Controller uses servers located within Europe to process the data related to the services of the website.
Rights of the data subject
The data subject may at any time and without formality assert his/her rights as set out in Article 7 of Legislative Decree n. 196 of the 30th June 2003 as provided below.
Article 7 Legislative Decree 196/2003
- The data subject shall have the right to obtain confirmation as to whether or not personal data concerning him/her exists and communication of such data in intelligible form.
- The data subject shall have the right to obtain information on:
- a) the source of the personal data;
- b) the purposes and modalities of the processing;
- c) the logic applied in case of processing performed with the aid of electronic means;
- d) the identifying information of the data controller, of those responsible for processing and of the representatives designated pursuant to article 5, paragraph 2;
- e) subjects or categories of subjects to which personal data may be disclosed or who may be made aware of it in their capacity of designated representative in the territory of the State, managers or agents.
- The data subject shall have the right to obtain:
- a) the updating, correction or, when interested, additions to the data;
- b) the cancellation, transformation into anonymous form or blocking of data processed in breach of the law, including data whose retention is unnecessary for the purposes for which the data was collected or subsequently processed;
- c) confirmation that the operations referred to in letters a) and b), and their content, have been brought to the attention of those to whom data was communicated or disclosed, unless this requirement proves impossible or involves a manifestly disproportionate effort compared with the right that is to be protected.
- The data subject is entitled to fully or partially object to:
- a) for legitimate reasons, the handling of the personal data regarding him/her even if it is pertinent to the purpose of its collection;
- b) the handling of personal data which pertains to him/her for the purpose of sending advertising materials or for carrying out market research or direct sales.
Nature of the provision of data and consent
With the exception of the browsing data necessary for carrying out IT and electronic protocols, the provision of personal data by the users through the various methods made available is free and optional.
However, failure to provide the data will make it impossible to respond to the requests made and take advantage of the services of interest.
In accordance with prevailing laws, consent is not necessary for the processing of data required for legal or regulatory obligations or to fulfil the obligations arising from specific requests of the