privacy-policy

CATEGORIES OF DATA SUBJECTS

List of data subject categories

Customers or Users, Potential Customers, Members, Associates and Subscribers

PROCESSING CARRIED OUT

Sooneat Web App (Client)

Description

Activity related to the processing of personal data for the provision of services and customer loyalty through the subscription to the Sooneat service via Web App

ORIGIN, PURPOSE, LEGAL BASIS AND NATURE OF THE DATA PROCESSED

Origin

The data are partly collected from the data subject and partly collected from third parties. Description of the source: Sooneat receives data subject data through platforms such as, but not limited to: Facebook, Instagram etc. The data comes from a publicly accessible source

Purpose

1. Marketing (analysis and market research) – Consent is requested from the data subject at the time of registration on the website www.sooneat.com.Il consent is stored within the Firebas database used by Sooneat s.r.l.In case of lack of consent, the data subject may continue to use the services provided by Sooneat2. Promotional activities – Consent received from the data subject during the collection of personal data through acceptance included in the policy. In case of non-consent, profiling of the data subject for promotional purposes will not be carried out.3. Sending of information and/or advertising material also by telephone or internet – Consent received from the data subject during the collection of personal data by acceptance included in the information. In case of non-consent, information and/or advertising material will not be sent.4. Fulfilment of contractual, tax and accounting obligations – Acquisition of data for printing and sending invoices in both paper and digital form

Legal basis

For purposes 1, 2, 3:Consent of the Data SubjectFor purposes 4:The processing is necessary for the performance of a contract to which the data subject is a party or for the execution of pre-contractual measures adopted at the request of the same

Personal data processed

Contact and communication data, Behavioural data, profiles of users, consumers, taxpayers, etc., name, address or other personally identifiable elements

The “special” data (sensitive data) are those defined by art. 9 and 10 of Regulation 2016/679/EU (“GDPR”). These data are processed in compliance with the provisions of the GDPR as well as in the light of the General Authorizations issued by the Data Protection Authority.

Special data processed

–

Legal basis Art. 9

RECIPIENTS OR CATEGORIES OF RECIPIENTS OF PERSONAL DATA

Categories of recipients

Your personal data will be communicated, based on the legal bases provided for in Article 6 of Regulation 2016/679/EU, to the following third parties:

Consultants and freelancers also in associated form, Companies and businesses, Authorized subjects

These bodies, bodies, companies and professionals act as Data Processors appointed by Sooneat s.r.l. or they are themselves Data Controllers of the personal data transmitted to them.

Your personal data, or the personal data of third parties in its ownership, may also be communicated to external companies, identified from time to time, to which Sooneat s.r.l. entrusts the execution of obligations deriving from the assignment received, to which only the data necessary for the activities requested of them will be transmitted. All employees, consultants, temporary workers and/or any other “natural person” who, authorized to process, carry out their activities on the basis of the instructions received from Sooneat s.r.l., pursuant to Article 29 of the GDPR, are designated as “Data Processors” (hereinafter also referred to as “Data Processors”). To the Persons in Charge or to the Data Processors, if appointed, Sooneat s.r.l. it gives adequate operating instructions, with particular reference to the adoption and compliance with security measures, in order to be able to guarantee the confidentiality and security of data. Precisely with reference to the aspects of personal data protection, you are invited, pursuant to art. 33 of the GDPR to report to Sooneat s.r.l. any circumstances or events from which a potential “data breach may arise” in order to allow an immediate assessment and the adoption of any actions aimed at countering such an event by sending a communication to Sooneat s.r.l. at the addresses indicated above.

The obligation of Sooneat s.r.l. remains unaffected. to communicate the data to Public Authorities upon specific request.

MOVING ABROAD

Transfers to third countries

YES

Your Information, including personal data, is processed at the Company’s operating offices and in any other place where the parties involved in the processing are located.

This means that such information may be transferred to – and maintained on– computers or devices located outside of your state, province, country, or other governmental jurisdiction where the data protection laws may differ from those in your jurisdiction.

Your consent to this privacy policy followed by your submission of such information constitutes your consent to the transfer, and is understood to be consent given in writing.

In the case of data transfer from the United Arab Emirates to other countries, it is specified that by using the service, you have explicitly and in writing expressed your consent to the transfer of data and their use.

Sooneat will take all steps reasonably necessary to ensure that your data is treated securely and in accordance with this privacy policy and no transfer of your personal data will take place to an organisation or country unless there are adequate controls in place, including the security of your data and other personal information.

METHODS, PROCESSING LOGICS AND STORAGE TIMES

Duration of treatment

The data for the purpose of providing the services offered by Sooneat, i.e. necessary to allow the subscription to the requested services, will be processed and stored until the administrative duration of the requested service, or in any case until cancellation and/or cancellation by the interested party. In the event of any withdrawal, disabling due to non-use within a certain period of time, expiry or non-renewal of the contract stipulated with Sooneat s.r.l. (based on the provisions of the separate General Terms and Conditions of Contract), the term of storage of personal data for exclusive administrative purposes (and not also for profiling or marketing) will not exceed one year (without prejudice to any specific legal obligations on the retention of documentation accountant). In such cases, the Data Controller has implemented suitable mechanisms for the automatic deletion of data. For the other purposes, the processing will last no longer than is necessary for the purposes for which the data were collected.

Your data are collected and recorded lawfully and correctly for the purposes indicated above in compliance with the principles and requirements of art. 5 c 1 of the GDPR.

The processing of personal data is carried out using manual, computerised and telematic tools with logics strictly related to the purposes themselves and, in any case, in such a way as to guarantee their security and confidentiality.

NATURE OF THE PROVISION

The processing of personal data will be carried out for the following purposes:

Purposes that do not require consent

– Fulfillment of contractual, tax and accounting obligations – Acquisition of data for printing and sending the invoice both in paper and digital form

In the event of data transfer from the United Arab Emirates to other third countries, consent is considered acquired, subject to acceptance of the terms of use and the Policy, before using the service.

Purposes requiring  consent

– Marketing (analysis and market surveys) – Consent is requested from the data subject at the time of use of the service, after access.

The consent is stored within the Firebas database used by Sooneat s.r.l.In case of lack of consent, the interested party may continue to use the services provided by Sooneat- Promotional activities – Consent received from the data subject during the collection of personal data through acceptance included in the policy. In case of non-consent, profiling of the data subject for promotional purposes will not be carried out.- Sending of information and/or advertising material also by telephone or internet – Consent received from the data subject during the collection of personal data through acceptance included in the information. In case of non-consent, information and/or advertising material will not be sent

Only with your explicit consent to be expressed at the bottom of this policy, the data, the purposes of which require consent, will be processed. The provision of data is in any case optional and will not prejudice the contractual relationship in place with the Data Controller

Your consent is not required for the data collected and used for needs related to the execution of activities related to the contractual relationship and compliance with the legal obligations indicated. Failure to provide the above personal data will make it impossible to follow up on the relationship in question. Your consent is not required for the data collected and used for the legitimate interest of the Data Controller (letter f, art. 6, of the GDPR). The communication of the above personal data is optional but necessary for the execution of the services offered by the Data Controller. Any refusal to communicate such data will make it impossible to provide all or part of the services requested.

For the data acquired and/or transferred from the United Arab Emirates, they are considered collected and used, exclusively with the explicit and written consent of the User.

The User, prior to using the service, explicitly accepts in writing the Privacy Policy and the conditions of use of the service and authorizes the use, collection, storage and transfer of his data.

Only with your express consent, you may use the service.

RIGHTS OF THE DATA SUBJECTS

(Art. 15 to 22 GDPR)

Right of way

The interested party has the right, according to the provisions of art. 15 to 22 of the GDPR to request access to their personal data from the data controller.

Right to rectification

The interested party has the right, according to the provisions of art. 15 to 22 of the GDPR to request the data controller to rectify their personal data.

Right to erasure

The interested party has the right, according to the provisions of art. 15 to 22 of the GDPR to request the data controller to delete their personal data.

Right to restriction

The interested party has the right, according to the provisions of art. 15 to 22 of the GDPR to request the data controller to limit the data concerning him.

Right to object

The interested party has the right, according to the provisions of art. 15 to 22 of the GDPR to object to their processing.

Right to portability

The interested party has the right, according to the provisions of art. 15 to 22 GDPR to exercise their right to data portability.

Right of revocation

The interested party has the right, according to the provisions of art. 15 to 22 GDPR to exercise your right to withdraw consent.

Right to lodge a complaint

The interested party has the right, according to the provisions of art. 77 of the GDPR to exercise their right to lodge a complaint with the supervisory authority.

AUTOMATED PROCESS

Is there an automated process?

YES

Automated processes or profiling methods

Without prejudice to the fact that, even in the case of the consent of the data subject, we will not proceed with the processing (in any case prohibited for profiling purposes) of data suitable for revealing the state of health and sex life, we inform you that the methods of processing will in any case be relevant and not excessive with respect to the type of goods marketed or services rendered. The profiling activity may concern “individual” personal data or “aggregated” personal data deriving from detailed individual personal data. Such processing may be carried out using personal data that are also aggregated according to predefined parameters according to business needs. Such data may include various types of personal information, including contractual data and data relating to consumption made, purchases made, spending habits and volumes, levels of procurement of goods and/or services, etc. from which it is possible to infer additional information referring to each data subject (e.g., consumption range,  level of expenditure incurred at regular intervals, etc.). We would like to draw particular attention to the fact that the provision of personal data and the consent to communication to third parties for the purposes illustrated above are absolutely optional and optional (and in any case revocable without formalities even after the service), and failure to provide it will not result in consequences other than the impossibility for the data controller to proceed with the aforementioned profiling. Even if you have given consent to authorise the Data Controller to pursue profiling purposes, you will still be free to revoke it at any time, sending a clear communication to that effect without any formalities. Following receipt of this opt-out request, the Data Controller will promptly remove and delete your data from the databases (the latter in any case not interconnected or a source of interweaving and comparison of data with those used for loyalty in the strict sense) and inform any third parties to whom the data have been communicated for the same deletion purposes. The mere receipt of your deletion request will automatically count as confirmation of cancellation.

In the case of User data not collected and/or received from the EU, such as data collected, used or transferred from the United Arab Emirates to Third Countries, the automated process occurs only with the prior written consent of the User, and is to be understood as acceptance of the conditions set out in this Policy, prior to the use of the service.

Legal basis

Explicit consent of the data subject