INFORMATION ON THE PROCESSING OF PERSONAL DATA

(artt. 13 e 14 Reg. UE 2016/679 e D.lgs 196/2003 e smi)

Dear User,

Hereby we provide you some necessary information you have to be aware of, concerning the use of the D-Alert application (hereinafter referred to as the "Application"), not only to comply with legal obligations but also because transparency and fairness towards the data subjects constitute the foundational principles of our operations.

Data controller

The Data Controller of your personal data is D-Air Lab S.r.l. (P.IVA IT03926100243) liable for the lawful and proper use of your personal data and whom you can contact for any information or request at the following contact details:

• Headquarter – via dell’Economia 64/C – 36100, Vicenza (VI)
• Phone number – +39 0444 1429920
• E-mail – privacy@dairlab.com
• Pec – d-airlab@legalmail.it

Categories of processed data and sources of the data

For processing purposes, the Data Controller will process common data such as: personal informations (e.g., name, surname, gender, date of birth, etc.), contact data (e.g., email, phone number, etc.), address data (country), data related to purchases or use of services, data related to physical constitution (e.g., weight, height, etc.), multimedia content (e.g., account profile photo), location data (GPS, geographic coordinates), data related to the provision of an electronic communication service, access and identification data, data related to the devices used (identifier/serial number, device name, connection status, airlabid, last location, operating system of the client Device used), application usage data (permissions, last location, assistants' contacts, assisted contacts, notifications with creation and reading dates), as well as any other data you decide to share voluntarily.

The processed data are provided by you and/or automatically detected as a result of using the Application and/or communicated by other Users (e.g., in the case of data for inviting Assistants, provided by Users who issue the invitation).

Processings

Your personal data is collected and processed using automated, semi-automated, and non-automated methods, as specified below. The indicated retention period must include the time necessary for the expiration of the legal prescription periods related to mutual rights and the retention period for backups.

The Data Controller processes your data in order to execute pre-contractual measures adopted at your request or to execute a contract to which you are a party, specifically to:

• Allow user registration and authentication as well as the use of services reserved for registered users for optimal use of the Device (retention period: up to 10 years from the year the account is deleted);
• Allow the activation and management of the emergency procedure (retention period: until the account is deleted);
• Enable the full functionality of the application, within the management of technical tracking tools (retention period: depending on the analysis tool, up to 24 months from the deletion of the account, after which the data is aggregated and anonymized);
• Provide you with assistance, including technical support (retention period: 10 years from the year of cessation of the effects of the last contract);
• Respond to your requests and manage pre-contractual or contractual obligations (retention period: 10 years from the year of cessation of the effects of the last contract);
• Offer the Data Controller’s goods/services (retention period: 10 years from the year of last contact or from the cessation of the effects of the last contract).

The Data Controller processes your data in order to pursue a legitimate interest of the Data Controller, specifically to:

• Verify the quality of the service and assess your level of satisfaction, based on the Data Controller's legitimate interest in improving its products and services (retention period: 10 years from the year of cessation of the effects of the last contract);
• Carry out promotional activities, based on the Data Controller's legitimate interest in promoting its activities (retention period: 10 years from the year of last contact or from the cessation of the effects of the last contract);
• Prevent and/or detect any abuses and defend the rights and interests of the Data Controller, based on the Data Controller's legitimate interest in demonstrating compliance with contractual terms (retention period: Until the expiry of the limitation periods, unless a pre-litigation or litigation situation arises. In such case, the data will be retained until the definitive cessation of the subject matter of the dispute);
• Manage and maintain the network and computer systems, based on the Data Controller's legitimate interest in detecting any abuses and defending the rights and interests of the Data Controller (retention period: depending on the analysis tool, then aggregated and anonymized, 18 months concerning compliance with system administrator obligations).

The Data Controller processes your data to fulfill a legal obligation, for the following purpose:

• Manage compliance with personal data protection obligations (retention period: 10 years from the year of the request to exercise one of the rights provided for by applicable regulations);
• Support the security of the network and computer systems (retention period: depending on the analysis tool, then aggregated and anonymized, 18 months concerning compliance with system administrator obligations).

The Data Controller processes your data, based on your consent, for the following purposes:

• Acquire your location to enable live tracking functionality (retention period: data regarding the last detected position are kept until the next detection (if the app is no longer used, until the next access to it) or until the account is deleted);
• Allow analysis and optimization for usability purposes, within the management of analytical tracking tools (retention period: depending on the analysis tool, up to 24 months from the deletion of the account, then the data is aggregated and anonymized);
• Send you informative and/or promotional material (e.g., newsletters, push notifications, etc.) (retention period: until consent is revoked. Then the processing will be limited to mere retention for 10 years from the year in which consent was revoked).

It is highlighted that should you not provide your consent, your personal data will not be subject to processing for the specific purposes based on it. It is reminded that you may revoke your consent at any time and independently, using the application settings, as well as by contacting the Data Controller at the aforementioned contact details.

It is noted that in the event of your unsubscription from the application, your personal data will be anonymized and retained in this form for statistical purposes.

Automated individual decision-making

We inform you that for the pursuit of some of the aforementioned purposes, the Data Controller will not use automated processes (decision-making processes carried out using technological tools without human intervention).

Data Provision

For some of the purposes mentioned, where indicated, the provision of your data is mandatory. In this case, failure to provide your data may have legal and contractual consequences. Conversely, in all other cases, failure to provide your data may result in the impossibility of carrying out the processing or its partial execution. In other words, you may not achieve the expected result or achieve it only partially.

Data Recipients

Your data may be shared with individuals you have appointed as assistants based on the Application's functionalities, for example, in the event of inviting them to take on the role of assistant, activating the emergency management procedure, or live tracking.

Your data may be communicated exclusively for technical and operational needs strictly related to the aforementioned purposes, to subjects processing data under the authority of the Data Controller, duly appointed as authorized to process data pursuant to Art. 29 of EU Regulation 2016/679, or to subjects processing data on behalf of the Data Controller, appointed as data processors pursuant to Art. 28 of EU Regulation 2016/679.

On this regard, the Data Controller avails itself of the services of the following third parties, to whom the Data Controller may communicate your data:

Furthermore, your data may be disclosed to Authorities and public entities, for which there is a legal obligation to communicate.

Data Transfer outside the EU

The Data Controller commits to ensuring that the processing of personal data (e.g., data storage, archiving, and retention on servers or in the cloud, etc.) takes place within the European Economic Area. However, if necessary, your data may also be processed outside the EEA, but exclusively to countries that ensure an adequate level of protection or in the presence of one of the conditions provided for by EU Regulation 2016/679 in Articles 44 and following (e.g., adequacy decision of the European Commission, BCR, standard contractual clauses, User consent, etc.).

Data Subject Rights

• You have the right, as provided for in Articles 15 and following of EU Regulation 2016/679, to request the Data Controller access to your personal data, as well as their rectification or erasure (right to be forgotten);
• You have the right to request data portability or the restriction of processing;
• You have the right, for reasons related to your particular situation, to object to the processing of your data based on the legitimate interest of the Data Controller;
• For processing based on consent, you have the right at any time to withdraw your consent, without prejudice to the lawfulness of processing based on consent before its withdrawal;
• You can also lodge a complaint with the supervisory Data Protection Authority, located at Piazza Venezia 11, 00187 - Rome - protocollo@pec.gdpd.it.

To exercise your rights or to request additional information, you can act independently using the application settings or you can contact the Data Controller through the contact information provided above.

Changes to this Notice

The Data Controller reserves the right to update this information on personal data processing.

Any changes will be communicated in the most appropriate manner, and the date at the bottom will be updated. Therefore, it is advisable to periodically consult the Privacy Notice, also by requesting a copy from the Data Controller.

Last update 30/05/2024