Introduction:
The General Data Protection Regulation (GDPR) has provided the legal framework for processing personal data in Europe since 25 May 2018. Unlike the previously applicable Directive 95/46/EC, the GDPR applies directly throughout the European Union and does not require transposition into national law. As such, it promotes the harmonisation of legal frameworks governing personal data protection across Europe. Moreover, the GDPR has an extraterritorial dimension that, in certain circumstances, extends its scope beyond European borders. If your organisation processes personal data, you are likely to be subject to the GDPR and will therefore need to meet certain obligations. The same applies to Sace Sistemi Srl, whose obligations differ depending on whether it acts as a data processor or a data controller.

Definitions:
Understanding a European regulation is not always easy, particularly one comprising 99 articles, 173 recitals and numerous guidelines intended to clarify its provisions. Nevertheless, a sound understanding is essential to avoid the risks associated with misinterpreting regulatory obligations. It is therefore important to understand the following terms:
• Personal data: any information relating to an identified or identifiable natural person.
An identifiable natural person is someone who can be identified, directly or indirectly.

• • Processing: any operation or set of operations performed on personal data or sets of personal data, whether or not by automated means (collection, recording, transmission, storage, retention, data mining, consultation, use, interconnection, etc.).
• Data controller: a natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of processing personal data.
• Data processor: a natural or legal person, public authority, agency or other body which processes personal data on behalf of the data controller.

———–
Sace Sistemi Srl as a data processor
This is certainly the role in which the most substantial obligations are placed on Sace Sistemi Srl. Sace Sistemi Srl acts as a “data processor” when it processes personal data on behalf of a data controller.
This occurs when customers use Sace Sistemi Srl’s services and store personal data on our chosen cloud infrastructure (Seeweb’s infrastructure).
Subject to technical constraints, we will process hosted data solely in accordance with the customer’s instructions and on their behalf.
———–
Sace Sistemi Srl’s commitments as a data processor
In its capacity as a data processor, Sace Sistemi Srl undertakes in particular to:

• process personal data exclusively for the proper provision of its services:
  we will never use customer information for other purposes (marketing, etc.).
• not transfer customer data outside the EU or to countries that have not been recognised by the European Commission as providing an adequate level of protection.
• inform customers of any use of other processors that may process their personal data, although, at present, no service involving access to content stored by users is outsourced beyond our own operational environment.
• implement high security standards to ensure a high level of protection for our services.
• notify customers as soon as possible in the event of a data breach.
• assist customers in meeting their regulatory obligations by providing appropriate documentation regarding our services.

———–
FAQ: Sace Sistemi Srl as a data processor
1. Who owns the personal data used and stored by customers through our services?
Data stored by customers using Sace Sistemi Srl’s services remains the property of those customers. Sace Sistemi Srl does not access or use such data except where strictly necessary and subject to technical constraints. Sace Sistemi Srl undertakes not to resell this data or use it for its own purposes (such as data mining, profiling or direct marketing).

2. Under what circumstances may Sace Sistemi Srl access data stored and used by customers through our services?
Sace Sistemi Srl accesses data in only two situations:
– to provide its services and, in particular, to optimise customer assistance when customers contact Sace Sistemi Srl Support.
In such cases, access to user data is controlled through specific authorisations and dedicated monitoring and security measures;
– to comply with legal obligations in connection with judicial and/or administrative requests, which are subject to strict controls.
Access during an intervention by Sace Sistemi Srl Support:
When a customer contacts our Support team, two categories of data may be accessed, depending on the nature of the request.
First, to handle the customer’s request effectively, Support reviews the information provided by the user when creating their account (surname, first name, telephone number, email address, etc.).
Second, only at the customer’s express request, and subject to the specific technical constraints of each service, Support may access data stored by the user through our services in order to identify the cause of the reported problem and, where possible, resolve it.
Access in response to requests from judicial and/or administrative authorities:
To comply with applicable legislation, Sace Sistemi Srl is required to respond to requests from judicial and/or administrative authorities. Because access requests are subject to strict legal requirements, Sace Sistemi Srl authorises them only after verifying their validity. Furthermore, unless prohibited by the request or by law, Sace Sistemi Srl undertakes to notify the customer of such requests as soon as possible. Requests originating from a third country are handled only if they are based on an international agreement, such as a mutual legal assistance treaty, in force between the requesting third country and the European Union or one of its Member States.

3. What commitments does Sace Sistemi Srl make regarding data location?
Where a service allows customers to store data, Sace Sistemi Srl informs them of the location or geographical area of the data centre.
This information is available on our website or can be provided by Sace Sistemi Srl Support.
Where several locations are available, customers may choose their preferred location when placing an order.
The location of the data centres used is agreed with the customer at the time of ordering.
Except under certain specific conditions applicable to particular services, Sace Sistemi Srl may not change the agreed location or geographical area without the customer’s consent.

4. Is data belonging to Sace Sistemi Srl’s European customers transferred outside the European Union?
There are two possible scenarios, depending on the customer’s choice of data centre location for storing their data.
In the first scenario, the customer chooses a service that uses one or more data centres located in Italy and/or the European Union.
Customer data will never be transferred outside:

– European Union countries;
– countries recognised by the European Commission as ensuring an adequate level of personal data protection with regard to privacy, freedom and individuals’ fundamental rights.The list of these countries can be consulted at any time on the European Commission’s website.
Following the invalidation of the Safe Harbor agreement, and although the European Commission considers US organisations participating in the Privacy Shield to provide an adequate level of protection, Sace Sistemi Srl never transfers data belonging to customers who have selected an EU data centre to the United States of America.
Sace Sistemi Srl also reserves the right to entrust certain support services that may require remote access to customer data to other entities based in countries recognised by the European Commission as providing an adequate level of protection (excluding the United States).
Thanks to the safeguards provided by Sace Sistemi Srl regarding data transfers, customers are able to meet their regulatory obligations.
Article 45 of the GDPR, concerning “Transfers on the basis of an adequacy decision”, establishes that personal data may be transferred to a third country or an international organisation where the Commission has decided that the third country, a territory or one or more specified sectors within that third country, or the international organisation in question ensures an adequate level of protection. In such cases, the transfer does not require any specific authorisation.
In the second scenario, the customer chooses a service that uses a data centre located outside the European Union.
In this case, the data is necessarily transferred outside the European Union.
The location or geographical area of the data centres used for the service is indicated on our website.
Where several locations are available, the customer selects their preferred location.
Sace Sistemi Srl may not change the location or geographical area agreed at the time of ordering without the customer’s consent.
To support customers wishing to process personal data in data centres located outside the European Union, in a country that does not provide an adequate level of protection, Sace Sistemi Srl may, upon request, discuss the implementation of safeguards enabling such transfers under Article 46 of the GDPR, “Transfers subject to appropriate safeguards”.
———–
Sace Sistemi Srl’s commitments as a data controller
We act as a “data controller” when we determine the purposes and means of processing personal data.
This is the case when Sace Sistemi Srl collects data for billing, service and performance improvement, sales operations, commercial management, etc., as well as when it processes the personal data of its employees.
In this case, customer data hosted through Sace Sistemi Srl’s services is not involved. Instead, the processing concerns certain information relating to customers or their employees (for example, the identity and contact details of a customer’s contact at Sace Sistemi Srl in connection with a Support request).
For this reason, Sace Sistemi Srl wishes to explain the safeguards it has implemented to protect such personal data:

• limit data collection to what is strictly necessary: when ordering a service, customers are therefore asked to provide only the information Sace Sistemi Srl needs for billing, support or compliance with legal data-retention obligations.
• not use personal data for purposes other than those for which it was originally collected.
• retain personal data for a limited period.

For example, data processed to manage customer relationships with Sace Sistemi Srl (surname, first name, address, email, etc.) is retained by the company throughout the contract term and for the following 36 months.
At the end of this period, the data is permanently deleted from all storage media and backups.

• not transfer such data to third parties other than companies affiliated with Sace Sistemi Srl that are involved in performing the contract.
• implement appropriate technical and organisational measures to ensure a high level of security.