Privacy Policy

Privacy Notice pursuant to Art. 13 of Regulation (EU) 2016/679

By means of this document (the “Privacy Notice”), the Data Controller, as defined below, wishes to inform you about the purposes and methods of the processing of your personal data and about the rights granted to you by Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (the “GDPR”). This Privacy Notice may be supplemented by the Data Controller where any additional services requested by you should entail further processing.

Data Controller
European Corporate Council on Africa and the Middle East (“ECAM Council”)
with registered office at Via Senato 12, 20121 Milan (MI), Italy, in the person of its legal representative pro tempore.
Contact e-mail: info@ecamcouncil.com

Types of data processed
The processing activities carried out are aimed at acquiring the following personal data:

Identification data (e.g. first name, surname, date of birth, address);
Contact data (e.g. telephone, e-mail);
Technical and browsing data (e.g. IP addresses, computer domain names);
Subject to the user’s consent, data acquired through cookies having functions other than the strict operation of the site.

Categories of data subjects
The processing activities carried out concern the following categories of data subjects: Web users and visitors of the Site, prospective clients, clients

Purposes, Legal Basis and Retention Periods

Purpose	Legal Basis	Retention Period
A) Processing of data is essential to ensure the proper functioning and usability of the site by users. By way of example and not limitation, such activity may include session management, traffic monitoring aimed at optimising the site’s performance, ensuring adequate response times and resolving any system errors.	Common data Processing is necessary for the pursuit of the legitimate interest of the Data Controller. Pursuant to Art. 6(1)(f) GDPR.	For the duration of the browsing session or, in any case, for a period strictly necessary to pursue the purpose (save for any need to ascertain offences by the judicial authority).
B) Processing is necessary for the use of cookies and other similar technologies. For further information, please see the Cookie Policy accessible from the footer of the site.	Common data For cookies other than technical ones strictly functional to the operation of the site, processing is based on consent. Pursuant to Art. 6(1)(a) GDPR. For further details on the use of these technologies and to manage cookie settings, please refer to the Cookie Policy.	For further details on the use of these technologies and to manage cookie settings, please refer to the Cookie Policy.

Processing activities beyond browsing purposes:

Purpose	Legal Basis	Retention Period
C) Processing of data is necessary to handle and respond to requests for information and/or contact submitted by the user by completing the dedicated form available on the Site, as well as to manage the relationships arising therefrom.	Common data Processing is necessary in order to respond to the data subject’s request and to take steps at the data subject’s request prior to entering into a contract. Pursuant to Art. 6(1)(b) GDPR.	For the time strictly necessary to fulfil the request and to handle any disputes that may arise therefrom.
D) Processing of data is necessary for the establishment, exercise or defence of the Data Controller’s rights in legal proceedings, as well as for taking debt-recovery actions against the data subject.	Common data Pursuit of the legitimate interest of the Data Controller. Pursuant to Art. 6(1)(f) GDPR. Special categories of data Establishment, exercise or defence of a right in legal proceedings. Pursuant to Art. 9(2)(f) GDPR.	For the entire duration of the dispute, until the expiry of the time limits for bringing appeals.
E) Processing is necessary to handle data subjects’ requests to exercise their rights pursuant to Art. 15 et seq. GDPR.	Common data Compliance with a legal obligation to which the Data Controller is subject. Pursuant to Art. 6(1)(c) GDPR.	The data will be retained for a maximum of 5 years from the request (save for disputes).

Methods of Processing
The processing of data is carried out by electronic means.

Transfer of data outside the EU
Personal Data are not transferred to third countries outside the European Union and the European Economic Area.
Should such a transfer become necessary and/or unavoidable for the Data Controller’s organisational needs, please note that:

it will take place exclusively towards countries for which an adequacy decision has been adopted by the European Commission;
where a country other than the one referred to in the previous point is involved, the transfer of data will be governed by the Standard Contractual Clauses, save for the adoption, subject to agreement between the Parties involved, of one of the other safeguards laid down in Art. 46 GDPR, or the application of one of the derogations set out in Art. 49 GDPR.

Recipients of the processing
Personal data may be shared with service providers closely connected to and functional for the Data Controller’s activities, which typically act as data processors pursuant to Art. 28 GDPR. The complete list may be obtained by contacting the Data Controller at the addresses indicated above.

Rights of the data subject – complaint to the supervisory authority
In relation to the processing described in this Privacy Notice, as a data subject you may, under the conditions provided for by the GDPR, exercise the rights set out in Articles 15 to 22 GDPR and, in particular, the following rights:

right of access – Article 15 GDPR: the right to obtain confirmation as to whether or not personal data concerning you is being processed and, in that case, to obtain access to your personal data;
right to rectification – Article 16 GDPR: the right to obtain, without undue delay, the rectification of inaccurate personal data concerning you and/or the completion of incomplete personal data;
right to erasure (right to be forgotten) – Article 17 GDPR: the right to obtain, without undue delay, the erasure of personal data concerning you. The right to erasure does not apply to the extent that processing is necessary for compliance with a legal obligation, for the performance of a task carried out in the public interest, or for the establishment, exercise or defence of a right in legal proceedings.
right to restriction of processing – Article 18 GDPR: the right to obtain restriction of processing where: a) the data subject contests the accuracy of the personal data; b) the processing is unlawful and the data subject opposes the erasure of the personal data and requests instead that its use be restricted; c) the personal data are needed by the data subject for the establishment, exercise or defence of a right in legal proceedings; d) the data subject has objected to processing pending verification as to whether the legitimate grounds of the Data Controller override those of the data subject.
right to data portability – Article 20 GDPR: the right to receive, in a structured, commonly used and machine-readable format, the personal data concerning you provided to the Data Controller, and the right to transmit it to another controller without hindrance, where the processing is based on consent and carried out by automated means. In addition, the right to have your personal data transmitted directly from this controller to another controller where technically feasible;
right to object – Article 21 GDPR: the right to object, at any time, to the processing of personal data concerning you based on the legal ground of legitimate interest, including profiling, unless there are legitimate grounds for the Data Controller to continue the processing which override the interests, rights and freedoms of the data subject, or for the establishment, exercise or defence of a right in legal proceedings.
right not to be subject to automated decision-making – Article 22 GDPR: the data subject has the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning them or similarly significantly affects them, unless this is necessary for entering into or performing a contract or you have given your consent. In any event, no automated decision-making will be carried out on your personal data, and you may at any time obtain human intervention on the part of the Data Controller, express your point of view and contest the decision.
right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali): http://www.garanteprivacy.it;
right to withdraw consent – to withdraw, on any occasion and with the same ease with which it was given, the consent provided, without affecting the lawfulness of processing based on consent before its withdrawal.

The above rights may be exercised vis-à-vis the Data Controller by contacting the references indicated above.
The exercise of your rights as a data subject is free of charge pursuant to Article 12 GDPR. However, in the case of manifestly unfounded or excessive requests, including because of their repetitive character, the Data Controller may charge a reasonable fee in light of the administrative costs incurred in handling your request, or refuse to act on the request.
Finally, please note that the Data Controller may request further information necessary to confirm the identity of the data subject.