In compliance with Article 13 of Regulation (EU) No. 2016/679 (General Data Protection Regulation, hereinafter “GDPR”), Legislative Decree No. 196 of 30 June 2003, as amended by Legislative Decree No. 101 of 10 August 2018, as well as Regional Government Resolution of Regione Campania No. 466 of 17 July 2018, Regione Campania (hereinafter also the “Controller”) informs users that the personal data of users of the “Invest in Campania” portal are processed in accordance with the legislation in force on the protection of personal data and as described in this notice.
The “Invest in Campania” portal is dedicated to promoting investment opportunities in the regional territory and disseminating informational content, tools, guides, updates, news, events and contact channels aimed at investors, businesses and parties interested in starting, establishing or developing economic initiatives in Campania.
This notice refers exclusively to the processing of personal data carried out through the “Invest in Campania” portal and does not extend to processing carried out through third-party websites, platforms or digital services that may be accessed via hyperlinks on the portal. Access to such websites is made at the user’s free choice. Regione Campania assumes no responsibility for the processing of personal data carried out by the operators of such third-party websites; the privacy notices issued by the respective data controllers remain applicable.
Data Controller. Data Processors pursuant to Article 28 GDPR
The Data Controller of the personal data is Regione Campania, represented by the Regional Government, with registered office in Naples, Via Santa Lucia No. 81, postcode 80132, tax code 80011990639.
The updated list of data processors is kept at the Controller’s registered office.
Data Protection Officer
The Data Protection Officer of Regione Campania may be contacted at the following addresses:
- e-mail: dpo@regione.campania.it
- PEC: dpo@pec.regione.campania.it
Purposes and legal basis of the processing
The personal data processed through the “Invest in Campania” portal are used exclusively for purposes connected with the operation of the portal and the provision of the informational and contact services made available through it.
In particular, personal data may be processed to:
- enable browsing and consultation of the informational content of the portal;
- make available to users information, tools, guides, updates, news, events and content connected with investment opportunities in Campania;
- enable users to contact Regione Campania through the contact details published on the portal;
- manage requests for information submitted by users through the contact form available on the portal;
- reply to requests made by users concerning the content and services illustrated on the portal;
- ensure the proper technical operation of the portal, the security of the systems and monitoring of the digital infrastructure;
- comply with any obligations provided for by law, regulations or applicable European legislation.
With specific regard to the contact form, the processing of personal data is based on Article 6(1)(b) GDPR, as it is necessary for the performance of pre-contractual measures adopted at the request of the data subject.
With regard to browsing data and processing necessary for the technical operation of the portal, the legal basis is Article 6(1)(e) GDPR, for the performance of a task carried out in the public interest connected with the management of institutional digital services, as well as, where applicable, Article 6(1)(c) GDPR for compliance with legal obligations to which the Controller is subject.
Source of the data
The personal data processed through the “Invest in Campania” portal are collected:
- directly from the data subject, when voluntarily completing the contact form or spontaneously sending communications to the e-mail addresses indicated on the portal;
- automatically, during browsing, through the IT systems and software procedures used to operate the portal.
Categories of data subjects
The personal data processed may relate to the following categories of subjects:
- users who consult the portal;
- investors, businesses, partners, professionals and parties interested in the content and services illustrated on the portal;
- users who submit requests for information or contact through the dedicated form or by e-mail.
Types of data processed
Data voluntarily provided by the user
Through the contact form available on the portal, the user may voluntarily provide the following personal data:
- surname;
- first name;
- telephone;
- mobile phone;
- e-mail;
- message content.
These data are processed exclusively to follow up on the request submitted by the data subject and to provide the related response.
The optional and voluntary sending of communications to the contact addresses published on the portal entails the acquisition of the sender’s contact data and any personal data contained in the communication itself.
Users are invited not to enter, in the free-text fields of the form or in communications submitted through the portal, data belonging to the special categories referred to in Article 9 GDPR, nor data relating to criminal convictions and offences referred to in Article 10 GDPR, as such data are not necessary for the purposes pursued. If such data are nevertheless provided, they will not be processed except insofar as strictly necessary to follow up on the request and, failing this, will be promptly deleted or otherwise made unusable.
Browsing data
The IT systems and software procedures used to operate the portal acquire, in the course of their normal operation, certain personal data whose transmission is implicit in the use of Internet communication protocols. This category includes, by way of example:
- the IP addresses or domain names of the devices used by users connecting to the portal;
- the URI/URL addresses of the requested resources;
- the time of the request;
- the method used to submit the request to the server;
- the size of the file obtained in response;
- the numerical code indicating the status of the response provided by the server (successful, error, etc.);
- other parameters relating to the user’s operating system and IT environment.
Such data are processed solely to obtain anonymous and aggregate statistical information on the use of the portal, as well as to verify its proper operation, ensure system security and prevent unlawful or unauthorised use.
Cookies and other tracking tools
The portal may also use cookies and other similar technical tools, where present, for purposes strictly connected with the operation of the website, the use of content, the aggregate measurement of visits and, where provided for, the management of preferences expressed by the user.
Information regarding the types of cookies that may be used, their purposes, retention periods and the methods for managing user preferences is set out in the Cookie Policy, to which reference is made.
Provision of data and consequences of failure to provide data
The provision of personal data requested in the contact form is necessary to enable Regione Campania to take charge of the submitted request and provide the requested response.
Any failure to provide, incomplete provision or inaccurate provision of the requested data will make it impossible to validly submit the request or to receive an adequate response.
Selecting the specific checkbox in the form, confirming that this notice has been read, is a necessary condition for sending the message, as it is intended to ensure the transparency of the processing pursuant to Article 13 GDPR.
Processing methods
The processing of personal data is carried out by Regione Campania using IT and telematic tools, in compliance with the principles of lawfulness, fairness, transparency, minimisation, integrity, confidentiality and storage limitation.
Processing operations are carried out exclusively by authorised personnel of Regione Campania and, where necessary, by external parties formally designated as Data Processors pursuant to Article 28 GDPR, on the basis of documented instructions and in compliance with appropriate confidentiality obligations.
The data are processed using technical and organisational measures appropriate to ensuring a level of security proportionate to the risk, pursuant to Article 32 GDPR.
Based on the current functionalities described for the portal, there is no processing based on automated decision-making processes pursuant to Article 22 GDPR, nor any user profiling activities.
Recipients or categories of recipients
The personal data processed through the portal may be communicated, within the limits strictly relevant to the purposes indicated above, to:
- the organisational structures of Regione Campania responsible for managing the portal and the requests received;
- external parties providing technical, maintenance, application, hosting or support services connected with the operation of the portal, designated, where necessary, as Data Processors pursuant to Article 28 GDPR;
- other public entities, exclusively in the cases provided for by law or where communication is necessary to comply with legal obligations.
Personal data are not disseminated.
Transfer of Data to third countries
Personal data are generally processed within the European Economic Area.
Where, for technical needs connected with the digital services used, a transfer to third countries or international organisations becomes necessary, such transfer will take place exclusively in compliance with the conditions set out in Chapter V of the GDPR and, in particular, in the presence of an adequacy decision of the European Commission or other appropriate safeguards provided for by the legislation in force.
Retention period
Personal data provided through the contact form or by sending communications to the e-mail addresses on the website are retained for a period not exceeding 90 days from receipt of the request, unless retention for a further period is necessary:
- to follow up on further interactions initiated by the data subject;
- to comply with legal obligations;
- for the establishment, exercise or defence of a right in administrative or judicial proceedings.
Browsing data are retained for the time strictly necessary to pursue the technical and security purposes indicated above, without prejudice to any further period required by the legislation in force or by the need to ascertain liability in the event of cybercrimes or abuse against the portal.
Rights of the data subject
Data subjects are granted, where applicable, the rights set out in Articles 15 et seq. of the GDPR. In particular, the data subject may:
- obtain confirmation as to whether or not personal data concerning him or her are being processed and, where that is the case, obtain access to the data and to the information provided for by Article 15 GDPR;
- obtain the rectification of inaccurate personal data and the completion of incomplete data;
- obtain the erasure of personal data in the cases provided for by Article 17 GDPR;
- obtain restriction of processing in the cases provided for by Article 18 GDPR;
- object to processing in the cases and according to the methods provided for by Article 21 GDPR;
- exercise the right to data portability, where the legal requirements are met.
Requests to exercise rights may be addressed to the Controller or to the Data Protection Officer at the contact details indicated above.
Right to lodge a complaint with the Supervisory Authority
Each data subject may lodge a complaint with the Italian Data Protection Authority (Garante per la Protezione dei Dati Personali) if he or she considers that the rights held under the GDPR have been violated, according to the procedures indicated on the Authority’s website, accessible at: www.garanteprivacy.it.
Changes
The Controller reserves the right to update or amend this notice, including as a result of any regulatory, organisational or technical changes relating to the “Invest in Campania” portal. Users are invited to consult this page periodically.