This section describes the methods and management of personal data that the user chooses to provide by submitting the contact form on the website www.navitus.it, owned by Navitus S.r.l.
This information is provided to users in accordance with the regulations set out in **EU Regulation 2016/679**, specifically Articles 12-23 of the same Regulation.
Data Controller
Pursuant to Articles 12 and 23 of Regulation (EU) 2016/679 (hereinafter “GDPR”), Navitus (hereinafter “NA”), with registered office at Via Sergio Forti, 33 00144 – Rome, Italy, VAT No. 13456691008 – ppf@navitus.it, in its capacity as “Data Controller,” informs you that your personal data, collected on the NA website (www.navitus.it) for the purpose of registration via the contact form and on all pages therein, will be processed in full compliance with applicable legislation, guaranteeing the fundamental rights and freedoms recognized to you.
Data collected via the contact form
By completing the contact form, the user:
- provides their full name;
- provides the email address at which they wish to be contacted;
- writes a message to be sent to ppf@navitus.it.
Retention period
The information provided by the user by filling out the contact form (name, email address, and message text) will be processed and stored for the time strictly necessary to achieve the purpose for which the data was collected—namely, to send a response to the submitted inquiry—or for a maximum period of 5 years from the time of collection.
Origin, legal basis, and purpose of processing
The processing of your personal data is carried out by NA to fulfill your request for registration via the contact form. The name, email address provided by the user at the time of filling out the form, and the information entered in the body of the message are used exclusively to respond to the user’s request.
Recipients of personal data
Personal data collected by NA through www.navitus.it may be processed by subjects involved in the organization of the site (such as administrative, sales, marketing, legal staff, and system administrators) or by external personnel (such as third-party technical service providers, mail carriers, hosting providers, IT companies, communication agencies) appointed, if necessary, as Data Processors in accordance with Art. 4 no. 8) GDPR. This defines a “processor” as a natural or legal person, public authority, agency, or other body which processes personal data on behalf of the controller.
In any case, users may always request an updated list of Data Processors from the Data Controller following the procedures in the user rights section (i.e., by sending an email to ppf@navitus.it).
Except for the cases mentioned above, user personal data is not communicated to third parties unless:
- the user has given express consent to the communication;
- the communication is necessary to provide the service requested by the user;
- the communication is necessary in reference to third parties collaborating with NA to provide the requested service (in this case, only data essential for the performance of the service will be communicated, and such third parties are prohibited from using the data for different purposes);
- it is required by law.
Right of access
The data subject has the right to ask the Data Controller whether personal data concerning them is being processed and, if so, to obtain access to it and the following information:
- the purposes of the processing;
- the categories of data concerned;
- the recipients or categories of recipients to whom the personal data has been or will be disclosed, particularly those in third countries or international organizations;
- where possible, the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period;
- the existence of the right to request from the controller rectification or erasure of personal data or restriction of processing concerning the data subject or to object to such processing;
- the right to lodge a complaint with a supervisory authority;
- where the data is not collected from the data subject, any available information as to its source.
Where personal data is transferred to a third country or an international organization, the data subject has the right to be informed of the existence of appropriate safeguards pursuant to Article 46 relating to the transfer.
NA specifies that:
- it does not communicate users’ personal data to international organizations or third countries;
- the data subject may at any time request the rectification or erasure of their personal data (by emailing ppf@navitus.it);
- personal data is not collected through fully automated processes; user consent is always required when entering data into the forms provided on the site.
Right to erasure and right to rectification
The data subject has the right to obtain from the Data Controller:
* the rectification of data, if incorrect;
* the erasure of their personal data.
To exercise this right, a written request can be sent to **ppf@navitus.it**. The Data Controller will proceed with the requested erasure without delay and in full compliance with Art. 17 of the European Regulation.
Right to restriction of processing
The data subject has the right to obtain from the controller restriction of processing where one of the following applies:
* the accuracy of the personal data is contested by the data subject, for a period enabling the controller to verify its accuracy;
* the processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of its use instead;
* the data subject has objected to processing pursuant to Art. 21, paragraph 1 of the GDPR, pending verification whether the legitimate grounds of the controller override those of the data subject;
* the personal data is no longer needed for the purposes of the processing but is required by the data subject for the establishment, exercise, or defense of legal claims.
Right to object to processing
The data subject may object to the processing:
* on grounds relating to their particular situation, pursuant to Art. 21, paragraph 1 of the GDPR; the controller shall no longer process the data unless they demonstrate compelling legitimate grounds which override the interests, rights, and freedoms of the data subject or for the establishment, exercise, or defense of legal claims;
* at any time, where data is processed for marketing purposes.
Right to data portability
If the processing is based on consent or a contract and is carried out by automated means, the data subject has the right to receive the personal data concerning them in a structured, commonly used, and machine-readable format and has the right to transmit those data to another controller without hindrance. If technically feasible, the data subject also has the right to have the personal data transmitted directly from one controller to another.
NA specifies that:
Personal data processing occurs exclusively upon user consent, solely for the purposes explained at the time of collection. Should the data subject wish to exercise the right to restriction of processing, they may send a written request to **ppf@navitus.it**. The data subject also has the right to withdraw their consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal.
Right to lodge a complaint
The data subject has the right to lodge a complaint with a Supervisory Authority.