Notice pursuant to art. 13 of Legislative Decree 30 June 2003, n. 196 and articles 13 and 14 of EU Regulation 2016/679

Legislative Decree no. 196 of 30 June 2003 (the “Privacy Code”) as amended by Legislative Decree 101/2018 and EU Regulation 2016/679 (the “GDPR“) provide for the protection of persons and other subjects in relation to the handling of personal data.

Pursuant to such laws, such handling shall be carried out by our Company in compliance with the principles of fairness, lawfulness and transparency, protecting the privacy and rights of any Interested Party.

In accordance with the above mentioned laws, we therefore provide the following information.

1. Purposes of data handling

The personal data of the Interested Party will be handled for the following purposes:

• performing a contract to which an Interested Party is party, or carry out pre-contractual activities upon request of the Interested Party. The necessity for the Company to perform such activities constitutes the legal basis which legitimizes the consequent data handling. The provision of the data necessary for such purposes is either a contractual obligation or a compulsory requirement for the conclusion of the contract. Failure to provide such data would prevent us to establish the contractual relationship or perform the contract;
• complying with legal obligations (e.g. obligations arising under anti money laundering laws or dispositions issued by Surveillance Authorities, Courts, etc.). The necessity for the Company to comply with such obligations constitutes the legal basis which legitimizes the consequent data handling.  The provision of the data necessary for such purposes is a legal obligation; failure to provide such data would prevent the Company from establishing contractual relationships and may also result for us in reporting obligations;
• marketing and selling Company products and services , including marketing research (so-called “direct marketing”). The legal basis which legitimizes the consequent data handling is the Interested Party’s consent, which is voluntary and may in any case be withdrawn at any time. The provision of the data necessary for such purposes is not compulsory and refusal to provide them will have no consequences except that of preventing you from receiving marketing communications.

b) Methods of data handling

The data will be handled: 

• manually, by hardcopy storage
• electronically, by computer processing and storing.

A complete and comprehensive description of the security measures adopted can be requested by e-mail to  info@arcusadvisors.it or by telephone to +39 02 84174342.

c) Type of data handled, sensitive data handling, and automated data handling

The personal data handled by the Company are data collected directly from the Interested Party or from third parties, and include, by way of example, personal details (name, surname, address, place and date of birth), personal images (eg. photo on ID document) and other data related to the above categories.

Our Company does not, on its own initiative, request or handle sensitive data from its clients (such as data revealing ethnic or racial origin, religious or philosophical beliefs, membership of trade unions, genetic or biometric data, or any other data allowing to uniquely identify a person; data on personal health, sex life or sexual orientation). It is however possible that the Company must handle such data in the performance of specific services or operations requested by the client or connected with the client relationship. Because the Company cannot intercept or refuse such requests, the contract proposal cannot be accepted if the Interested Party has not given its consent to said data handling, which shall in any case be carried out only for the purpose of fulfilling the client’s request.

In the case of automated data processing, an Interested Party’s personal data may be processed exclusively with their explicit consent.

d) Communication of personal data

The personal data of an Interested Party may also be communicated by our Company, for purposes closely related to those mentioned above, to the following subjects or categories:

• banking institutions, for the purpose of paying any contractual compensation, indemnity and/or reimbursement;
• the Company’s legal advisers, for the purpose of examining and solving any legal issues relating to the Interested Party’s contract;
• insurance companies with whom our Company has entered into a contractual relationship;
• any other subjects to whom the provision of such data is necessary in order to comply with the applicable laws or regulations in force.

e) Data retention period

The personal data of an Interested Party will be stored until the end of the twelfth month following the termination and/or dissolution, however named, of the relative contract or agreement.

f) Transfer of personal data abroad

As part of the management of an existing contractual relationship, some of an Interested Party’s personal data may be transferred abroad.

The transfer of personal data abroad will be carried out in full compliance with the provisions of the applicable law such as, for example, obtaining the Interested Party’s prior consent, adopting Standard Contractual Clauses approved by the European Commission, selecting EU-US Privacy Shield certified companies or companies operating in countries considered safe by the European Commission.

Further information is available upon request to the data Controller.

g) Controller of personal data handling

The Controller (person responsible) of data handling is the company Arcus Financial Advisors, with registered office in Milan, Corso Magenta no. 56 and with office in Milan, via Gioberti no. 1, in the person of its legal representative Mr. Stefano Cassella.

Further information is available upon request by writing to info@arcusadvisors.it or by telephone to +39 02 84174342.

h) Rights

Pursuant to applicable laws, an Interested Party may at any time exercise the following rights and may amend the consensual approvals previously given:

(i) Right of access;

(ii) Right of rectification;

(iii) Right of cancellation;

(iv) Right of limitation;

(v) Right of transfer;

(vi) Right of objection;

(vii) Right of complaint.

Right of access
An Interested Party has the right to know which personal data regarding themselves are handled by our Company and to be provided a free copy thereof (if more than one copy is requested, the Interested Party may be charged a contribution towards the costs). The information an Interested Party has the right to know includes the purposes for which the data is handled, the categories of the data handled, the period of data retention or, if not available, the criteria used to define such period, together with the guarantees provided and the rights that may be exercised in the event of data transfer to third countries.

Right of rectification
An Interested Party has the right to obtain an update or rectification of incorrect or incomplete data regarding themselves.

Right of cancellation (or “right to be forgotten”)
An Interested Party has the right to obtain the cancellation of their personal data in the following specific cases:

1. if such data are no longer necessary to the purposes for which they had been collected and handled;
2. if the Interested Party withdraws their approval to data handling, provided that there are no other legal grounds authorising our Company to continue handling or storing such data;
3. if the Interested Party objects to the handling of their data, provided that there is no further legitimate reason for the Controller to do so in the pursuance of its own legitimate interests, or of the legitimate interests of third parties, and that there is no legitimate, prevailing reason for the Controller to handle such data;
4. if the data have been handled unlawfully.

Such right may be exercised even after consent is withdrawn.

Right of limitation
The right of limitation may be exercised:

1. if the data have been handled unlawfully, as an alternative remedy to the cancellation of data;
2. if the Interested Party has requested rectification of their data (while awaiting rectification) or has objected to data treatment (while awaiting the Controller’s decision).

Any handling – other than storage – of the data for which the right of limitation has been requested is forbidden.

Right of transfer
The right of transfer allows an Interested Party to use their personal data in the possession of our Company for other purposes. The Interested Party may request to receive the data referable to themselves or ask that it is transferred to another Controller in a structured, readable form commonly used.

Right of objection
The right of objection allows an Interested Party to object, for personal reasons, to the handling of their personal data at any time.

Right of complaint
An Interested Party has the right to bring a claim before the Privacy Authority (Autorità Garante per la Protezione dei dati personali). Such right may be exercised by sending an e-mail to: garante@gpdp.it, or to the certified e-mail address: protocollo@pec.gdp.it, or by registered letter with return receipt to Piazza di Monte Citorio n. 121, IT-00186 Roma.