Employee and collaborator privacy policy

Dear colleague, we understand that you care about how your information is used and shared, and we want to use this information responsible and diligently. Regardless of whether you are one of our employees or a collaborator, this privacy policy describes how we collect and process your personal data in your capacity or, to use legal terminology, as a “Data Subject”. All processing complies with the provisions of EU Regulation 2016/679 (GDPR) and relevant national legislation.

Data Processor and Data Protection Officer (DPO)

The data controller is the person who defines the purposes of the processing of personal data and, after having collected the data, "uses" the data in compliance with the principles of the GDPR.

The Data Controller is Finwave SpA.

Finwave SpA has appointed its own Personal Data Protection Officer, who can be contacted at the following e-mail address: dpo-finwave@finwave.it

Legal Basis and Processing Methods

The legal basis on which the processing is based is the performance of the contract and the fulfilment of legal obligations, to which the Data Controller is subject and to which you, as the Data Subject, are a party.

During your relationship with us there will be several occasions when your data will have to be collected and “used”. The purpose of this privacy policy, through the following table, is to inform you about the reasons and recipients who may come into contact with your personal data.

As is evident, the provision of the data in question is mandatory to enable us to fully implement your business relationship. Mindful of the importance of your data and all that of our employees and collaborators, we will ensure that we process it, using electronic instruments and/or paper media, taking all appropriate security measures to protect it while guaranteeing its free circulation.

Data processing purposes

Personal Data Categories

Recipient Categories

Execution of the contractual relationship with Finwave S.p.A.

Common data including biographical data (including household details), residential address, telephone numbers and e-mail addresses, bank details, work tool monitoring data;
special categories of personal data including trade union membership data, health conditions.

Companies belonging to the same business group as Finwave S.p.A.
Customers and/or suppliers and/or partners
Social Security and Financial Administration Institutions
Professional firms (administrative, tax, legal)

Legal obligations to which Finwave SpA is subject.

Common data including biographical data (including household details), residential address, telephone numbers and e-mail addresses, bank details, work tool monitoring data;
special categories of personal data including trade union membership data, health conditions and legal data

Companies belonging to the same business group as Finwave S.p.A.
Finwave customers and/or suppliers and/or partners
Social Security and Financial Administration Institutions
Competent doctor appointed pursuant to Article 18, paragraph 1 of Legislative Decree 81/08
Auditing companies or equivalent
Professional firms (administrative, tax, legal)
Police and/or public authorities

Data processing purposes	Personal Data Categories	Recipient Categories
Safeguarding the vital interests of the data subject or of another natural person (Article 6, letter D, GDPR)	Common data including biographical data (including household details), residential address, telephone numbers and e-mail addresses, bank details; special categories of personal data including health conditions.	Companies belonging to the same business group as Finwave S.p.A. Customers and/or suppliers and/or partners Social Security and Financial Administration Institutions Police and/or legal authorities First-aid medical personnel
The Data Controller’s legitimate interest	Common data including biographical data (including household details), residential address, telephone numbers and e-mail addresses, bank details, work tool monitoring data; special categories of personal data including trade union membership data, health conditions and legal data	Companies belonging to the same business group as Finwave S.p.A. Customers and/or suppliers and/or partners Professional firms (administrative, tax, legal) Police and/or legal authorities
The Data Subject's consent	Image, in the form of a photograph and/or video depicting solely/also the data subject	Employees of companies belonging to the same business group to which Finwave SpA belongs Customers and/or suppliers and/or partners Website visitors Social media users

Please note that in the performance of your professional activities at Finwave SpA, you will use various work instruments that are provided to Finwave by third parties; the rules governing these are contained in the PSQ-400_F Acceptable Use of Work Instruments Policy published on the company intranet.

Some instruments allow personalisation of privacy options (cookies, enrichment of personal data, images, logging, etc.) by the user. We would like to remind you that when these tools collect your personal data, the provider/vendor of the instrument used is also a data controller.

Transfer of personal data

We will not transfer your personal data to any company or individual that does not guarantee full data protection. Sometimes it is possible that in contractual relationships with our Customers/Suppliers your data is transferred to a third country. In this case, we will require the customer/supplier to comply with the GDPR principles to guarantee effective protection of your personal data.

Security Measures

Our security system is based on the correct use by all employees and collaborators of the instruments made available to them. For this reason, we invite you to read and act in accordance with our company security procedures.

Any data you provide us with will be processed in accordance with the principles of lawfulness, transparency and fairness, in accordance with the company's security policy, published on the intranet, which allows us to guarantee, with your cooperation, the secure processing of personal data.

Should there be a particular risk of breach, we will notify you promptly.

Rights of the Data Subject

In addition to guaranteeing the right to lodge a claim with the Supervisory Authority, which for Italy is the Italian Data Protection Authority, the GDPR grants you the following rights:

Right of access (Article 15): Possibility for the Data Subject to obtain from the Controller confirmation as to whether or not his or her personal data is being processed and to obtain further information, including the purposes of the processing, the categories of personal data and the recipients.
Right to rectification (Article 16): Possibility for the Data Subject to obtain rectification of inaccurate personal data from the Data Controller.
Right to be forgotten (Article 17): Possibility for the Data Subject to request the deletion of his or her personal data if one of the reasons provided for in the article exists, including: revocation of consent, unlawful processing and exercising the right of defence.
Right to restriction of processing (Article 18): Possibility for the data subject to obtain the restriction of processing, which can be configured as a total or partial suspension of the processing of the data or also, in some cases, as a blocking of the same. This can only be requested in exceptional cases expressly determined by the rule, including the period necessary to establish the accuracy of personal data, unlawful processing, the exercise of a right in a court of law.
Right to data portability (Article 20): The Data Subject has the right to request that his or her data be disclosed to him or her, when exercising his or her rights, in an easily comprehensible format.
Right to object (Article 21): Possibility for the Data Subject for reasons relating to his or her particular situation to object to the processing of his or her data pursuant to Article 6, paragraph 1, letters e) and f).
Right not to be subject to automated decision-making (Article 22) Possibility for the data subject to object to processes based solely on automated processing if they have legal effects on him or her or significantly affect him or her.

We inform you that should you decide to exercise one or more of the above-mentioned rights, the Data Controller will disclose your personal data to the processors for related fulfilments (Article 19 GDPR).

If you have any doubts or need clarification, or if you wish to exercise your rights, please contact us at the following address: dataprivacy@finwave.it

Personal Data Retention Times

Your data will be retained on our systems even after termination of the relationship for 10 years. This is required by law to ensure that we can fulfil all contractual obligations, including those after termination of the relationship, as well as the proper handling of any litigation.