Information on the processing of personal data
Virtuous Circle SA (CHE 358787784) with registered office in Lugano (6900 – CH), via G. Calgari n. 2, in the person of its legal representative pro tempore, as the data controller, hereinafter reports the terms and conditions of use of its Epicentric® service, please read them carefully,
to the interested parties the following information concerning the processing of personal data provided by users (registered or otherwise) who interact with the services offered by the “Company”.
- Purposes of data processing.
The collection and processing of data is aimed solely at providing the Service.
- Method of collecting personal data
The processing is carried out by means of operations or operations complex, and in particular: collection, registration, organization, storage, consultation, processing, modification, selection, extraction, comparison, use, interconnection, blocking, communication, cancellation and destruction of data .
These operations may be carried out with or without the aid of electronic tools or in any case automated by the Company or by third parties appointed for this purpose.
- Type of data processed and purpose of the processing
The IT systems, the software used to operate the services provided by the Company, acquire certain data of the User whose transmission is implicit in the use of internet communication protocols.
This category of data includes, in particular, but without completeness claims:
- IP addresses;
- domain names of the terminals used by users;
- addresses in URI (Uniform Resource Identifier) notation of the requested resources;
- other parameters related to the operating system and the user’s computer environment;
- the time of the request.
The data are used for the sole purpose of obtaining statistical information on the use of the Services, to check its correct functioning and, lastly, to guarantee the User the best user experience.
The company undertakes not to communicate to third parties or to disseminate such data, except in aggregate and anonymous form.
- Authorization express to data sharing
By using the services provided by the Company, the User expressly confers the authorization to share it with the other Users accessing the platform, without any completeness claims, of the following data:
- Name, surname, username and nickname
- own profile picture (avatar)
- description of the profile
The details of the electronic payment method indicated by the User will be used exclusively by the Company that will be able to communicate them to the third-party intermediary responsible for managing payments through electronic systems.
- Provision of data
The provision of data by the User is strictly necessary for the purpose of providing the Services offered by the Company; any refusal by the User to provide the requested data implies the impossibility of providing the Services.
By registering for the Services offered by the Company, the User expressly authorizes the processing of their e-mail address.
The consent to the use of personal data for the purposes referred to in points 3 and 4 is mandatory, and the refusal by the User to allow the processing implies the impossibility for the Owner to provide its services through the Site.
- Processing of data provided voluntarily by the User
For the sole purpose of obtaining anonymous statistical information on the use of the Services, to check its correct functioning and, lastly, to guarantee the User the best user experience, the Company reserves the right to process the following data provided by User:
- Number of files uploaded and deleted, and related history
- Format and technical characteristics of uploaded files
- Title of music tracks and related metadata
- Amount of space used and corresponding free space and relative chronology
- Log register
- List of items, keys, links Mind and profile maps created and reproduced and their respective settings, description and history
- Profile settings, descriptions (including audiovisual) and related history
- list of reproduced contents and relative history
- list of shared contents and related history
- list of blocked content and history
- friends / contacts list, friend requests, contact suggestion, blocked contacts and related history;
- number and size of content and messages shared between Users and related history
The company undertakes not to communicate to third parties or to disseminate such data, except in aggregate and anonymous form.
- Processing of data provided by the User through third-party companies
By registering for services offered through the c.d. third part login, the User expressly authorizes the Company to process the following data:
- Name and surname
- Email used to sign up for the third part platform.
- Date of birth
- List of friends enrolled in the third part platform used for registration.
- Data communication.
Personal data may be disclosed to the persons in charge of processing and may be communicated for the purposes referred to in point 1 to external collaborators, subjects operating in the judicial sector, to counterparties and related defenders, to arbitrators’ colleges and, in general, to all those public and private subjects to whom communication is necessary for the correct fulfillment of the purposes indicated in point 1.
- Data transfer abroad.
Personal data may be transferred to European Union countries for the purposes referred to in point 1. In accordance with Article 26 (2) of Directive 95/46 / EC for the transfer of personal data to data controllers established in third countries that do not guarantee an adequate level of data protection, the Company undertakes to communicate, following a specific and explicit request by the user, the data of the “importer” subject in charge of processing established in a third country.
The user hereby authorizes the Company and / or the importer to appoint a “sub-processor” of data processing,
The User can assert, against the importer and the “sub-processor”, all the rights arising from the directive n. 95/46 / EC and by this contract.
The Company, in its capacity as “exporter”, declares and guarantees the following:
a) that the processing, including the transfer, of personal data is and continues to be carried out in accordance with all relevant provisions of the data protection legislation (and is communicated, where appropriate, to the competent authorities of the Member State in which the exporter is established) in full compliance with the laws in force in that State;
b) which has prescribed to the importer, and will continue to do so for the duration of processing operations, to process the personal data transferred only on his behalf and in accordance with the data protection legislation and the present clauses;
c) that the importer will provide sufficient guarantees with regard to technical and organizational security measures;
d) whereas, in the light of data protection legislation, security measures are designed to ensure the protection of personal data from accidental or unlawful destruction, accidental loss or alteration, unauthorized disclosure or access, in particular when the processing involves transmission of data within a network, or any other form of unlawful processing of personal data, and that such measures guarantee a level of security commensurate with the risks inherent in the processing and the nature of the data to be protected, taking into latest technology and implementation costs;
f) whereas, if the transfer concerns specific categories of data, the data subjects have been or will be informed before or after the transfer that the data concerning them could be transmitted to a third country which does not provide adequate protection under the terms of the Directive 95 / 46 / EC;
i) that, in the event of a subcontract, the sub-processor performs the processing activity in accordance with these terms, guaranteeing a level of protection of personal data and of the rights of the data subject at least equal to that to which the importer is kept pursuant to these clauses;
Obligations of the importer
The importer declares and guarantees the following:
a) process personal data solely on behalf of and according to the instructions of the exporter, as well as under these clauses, and undertake to promptly inform the exporter if it can not for any reason comply with this provision, in which case the exporter has the right to suspend the transfer and / or terminate the contract;
b) that it has no reason to believe that the legislation applicable to it would prevent the exporter from following the instructions of the exporter or fulfilling the contractual obligations, and communicating to the exporter, as soon as he is aware of it, any modification of that legislation which may affect the guarantees and the obligations under these clauses, in which case the exporter has the right to suspend the transfer and / or terminate the contract;
c) to have applied the technical and organizational security measures indicated in the appendix 2 before proceeding with the processing of the personal data transferred;
d) which will promptly communicate to the exporter:
i) any legally binding request submitted by judicial or police authorities for the purpose of communicating personal data, unless the communication is prohibited by specific rules, for example by criminal law rules aimed at protecting the secrecy of investigations;
ii) any accidental or unauthorized access
iii) any request received directly from the data subjects to which he / she has not replied, unless he / she has been authorized not to reply;
e) that it will respond promptly and appropriately to all requests from the exporter relating to the processing of personal data subject to transfer and which will comply with the opinion of the supervisory authority regarding the processing of the data transferred;
f) which will subject its treatment plants, at the exporter’s request, to the inspection of the exporter or an inspection body composed of independent persons, possessing the necessary professional qualifications, bound by confidentiality obligations and selected by the exporter, possibly in concert with the supervisory authority;
g) who will provide, at the request of the interested parties, a copy of those present, excluding Appendix 2, and a general description of the security measures if the data subjects are unable to obtain a copy directly from the exporter, or a copy of the subcontracts of the processing, omitting the commercial information contained in the clauses or in the contract;
h) which, in the event of a sub-contract, has informed the exporter and obtained written consent from them;
i) that the sub-processor will carry out the processing activity under the same conditions and guarantees as the exporter
The parties expressly agree that the User who has suffered an injury due to breach of the obligations set forth in these conditions by the sub-installer has the right to obtain compensation from the exporter for the damage suffered.
If the person concerned is unable to bring the action for damages referred to in paragraph 1 against the exporter for breach of one of the obligations under clause 3 or clause 11 by the importer or the sub-processor, in the fact that the exporter has disappeared de facto, has legally ceased to exist or has become insolvent, the importer recognizes the person concerned as having the right to act against him as well as if he were the exporter, unless all the obligations of the the exporter has been transferred, by contract or by law, to the possible successor, in which case the interested party can assert his rights towards the successor.
The importer can not assert the violation of the obligations by the sub-installer in order to exclude his responsibility.
Where the data subject is unable to bring proceedings, for the purposes of paragraphs 1 and 2, in respect of the exporter or importer for breach of one of the obligations set out in clause 3 or clause 11 by the sub-processor, since both the exporter and the importer have disappeared de facto, have legally ceased to exist or have become insolvent, the sub-processor acknowledges that the person concerned has the right to take action against him in respect of the treatments carried out under the present clauses as if he were the exporter or importer, unless all obligations of the exporter or importer have been transferred, by contract or by law, to his successor, in which case the person concerned may to assert its rights against the successor. The responsibility of the sub-processor is limited to the treatments performed by the one under these clauses.
The parties agree that at the end of the treatment activity the importer and the sub-installment will, at the choice of the exporter, return to the latter all the personal data transferred and the relative copies or to destroy such data, certifying to the exporter the destruction, unless the legal obligations prevent the return or destruction of all or part of the personal data transferred. In this case, the importer undertakes to guarantee the confidentiality of the personal data transferred and to refrain from processing the data on his / her own initiative.
- Holder of the processing of personal data
The data controller is Virtuous Circle SA (CHE 358787784) with an address for service in Lugano – Switzerland (6900 – CH), via G. Calgari n. 2
- Right of access
It is the right of the subjects to whom the personal data processed refer, in particular, to request and obtain from the Company:
- confirmation, or not, of the existence of personal data of the User, even if not yet registered, and receive a copy in an intelligible form;
- indication of the origin of personal data;
- indication of the purposes and methods of the processing of the same, of the logic applied in case of treatment carried out with the aid of electronic tools;
- indication of the identification details of the data controller, of the data processors and of the designated representative, of the subjects or categories of subjects to whom the data may be communicated or who may come to know as appointed representative in the territory of the State, managers or agents;
- obtain updating, rectification or, when interested, integration of data, deletion, transformation into anonymous form or blocking of data processed in violation of the law, including those that do not need to be kept in relation for the purposes for which the data were collected or subsequently processed;
- the attestation that the operations referred to in letters a) and b) have been brought to the attention, also with regard to their content, of those to whom the data have been communicated or disseminated, except in the case in which this fulfillment proves impossible o involves a use of means manifestly disproportionate to the protected right;
- to object, in whole or in part:
- for legitimate reasons, the processing of personal data concerning him, even if pertinent to the purpose of the collection;
- to the processing of personal data concerning him for the purpose of sending advertising or direct sales material or for carrying out market research or commercial communication.
Interested parties may exercise all the aforementioned rights by directing the requests to the Company at:
Virtuous Circle SA (CHE 358787784), Lugano (6900 – CH), via G. Calgari n. 2, or by e-mail to the e-mail address firstname.lastname@example.org.