GDPR – General Data Protection Regulation

Introduction

The General Data Protection Regulation (GDPR) has been the legal framework governing the processing of personal data in Europe since 25 May 2018. Unlike the previously applicable Directive 95/46/EC, the GDPR applies directly throughout the European Union and does not require transposition into national law. As such, it promotes the harmonisation of legal frameworks relating to the protection of personal data across Europe.

Furthermore, the GDPR includes a principle of extraterritoriality which, under certain circumstances, allows its scope of application to extend beyond European borders.

If personal data is processed within your organisation, there is a strong likelihood that you are subject to the provisions of the GDPR and will therefore be required to comply with certain obligations. The same applies to Sace Sistemi Srl, whose obligations will vary depending on its role: either as a Data Processor or as a Data Controller.

Definitions

Understanding a European regulation is not always easy, especially when it contains 99 articles, 173 recitals and numerous guidelines intended to clarify its provisions. However, a proper understanding is essential in order to avoid any risks arising from an incorrect interpretation of regulatory obligations.

It is therefore essential to understand the following terms:

• Personal Data: any information relating to an identified or identifiable natural person.
An identifiable natural person is a person who can be identified, directly or indirectly.

• Processing: any operation or set of operations performed on personal data or sets of personal data, whether or not by automated means (collection, recording, transmission, storage, retention, data mining, consultation, use, interconnection, etc.).

• Data Controller: a natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data.

• Data Processor: a natural or legal person, public authority, agency or other body which processes personal data on behalf of the Data Controller.

Sace Sistemi Srl as a Data Processor

This is certainly the situation in which the obligations placed on Sace Sistemi Srl are most significant.

Sace Sistemi Srl acts as a Data Processor when it processes personal data on behalf of a Data Controller.

This is the case when Sace Sistemi Srl services are used and personal data is stored on the Cloud infrastructure selected by us (Seeweb infrastructure).

Within the limits of its technical constraints, we will process hosted data exclusively in accordance with the customer’s instructions and on the customer’s behalf.

Sace Sistemi Srl’s Commitment as a Data Processor

In its role as Data Processor, Sace Sistemi Srl undertakes, in particular, to:

process personal data exclusively for the purpose of properly providing the services. We will never use customer information for any other purposes (marketing, etc.);
not transfer customer data outside the EU or outside countries recognised by the European Commission as providing an adequate level of protection;
inform the customer of any use of other processors that may process their personal data. At present, however, no service involving access to content stored by users is outsourced outside our own operational perimeter;
implement high security standards in order to ensure a high level of security for our services;
notify customers as soon as possible in the event of a personal data breach;
assist customers in fulfilling their regulatory obligations by providing appropriate documentation regarding our services.

FAQ: Sace Sistemi Srl as a Data Processor

1. Who owns the personal data used and stored by the customer as part of our services?

Data stored by customers using Sace Sistemi Srl services remains the property of the customer. Sace Sistemi Srl does not access or use such data except where strictly necessary and within the limits of its technical requirements.

Sace Sistemi Srl undertakes not to resell such data or use it for its own purposes, such as data mining, profiling or direct marketing activities.

2. Under what circumstances may Sace Sistemi Srl access data stored and used by the customer as part of our services?

Sace Sistemi Srl accesses data only in two situations:

for the purpose of providing the services and, in particular, to optimise customer assistance when customers contact Sace Sistemi Srl Support. In this case, access to user data remains controlled through specific authorisations and dedicated control and security measures;
in order to comply with legal obligations in connection with judicial and/or administrative requests, which are subject to strict controls.

Access in the event of intervention by Sace Sistemi Srl Support:

When a customer contacts our Support team, depending on the nature of the assistance required, two categories of data may be accessed.

Firstly, in order to manage the customer’s request effectively, Support may access the information provided by the user when creating their account (surname, first name, telephone number, email address, etc.).

Secondly, only at the customer’s express request and subject to the specific technical constraints of each service, Support may access data stored by the user on our services in order to identify the cause of the issue encountered and, where possible, resolve it.

Access in the event of a request from judicial and/or administrative authorities:

In order to comply with applicable laws and regulations, Sace Sistemi Srl is required to respond to requests from judicial and/or administrative authorities.

Since access requests are subject to a strict legal framework, Sace Sistemi Srl authorises such access only after verifying the validity of the request.

Furthermore, unless prohibited by the request itself or by applicable law, Sace Sistemi Srl undertakes to inform the customer of such a request as soon as possible.

Requests originating from a third country are processed only if they are based on an international agreement, such as a mutual legal assistance treaty, in force between the requesting third country and the European Union or one of its Member States.

3. What commitments does Sace Sistemi Srl make regarding data location?

When a service allows customers to store data, Sace Sistemi Srl informs them of the location or geographical area in which the relevant data centre is located.

This information is available on our website or may be provided by Sace Sistemi Srl Support.

Where multiple locations are available, customers may select their preferred location when placing their order.

The location of the data centres used is agreed with the customer at the time of ordering.

Except for specific conditions relating to certain services, Sace Sistemi Srl is not permitted to change the location or geographical area agreed upon at the time of ordering without the customer’s consent.

4. Is data belonging to Sace Sistemi Srl’s European customers transferred outside the European Union?

There are two different scenarios, depending on the customer’s choice regarding the location of the data centres in which their data is stored.

In the first scenario, the customer chooses a service that uses one or more data centres located in Italy and/or within the European Union.

Customer data will never be transferred outside:

European Union countries;
countries recognised by the European Commission as providing an adequate level of protection for personal data with regard to privacy and the fundamental rights and freedoms of individuals.

The list of these countries can be consulted at any time on the European Commission’s website.

Following the invalidation of the Safe Harbor agreement, and although the European Commission considers US organisations participating in the Privacy Shield to provide an adequate level of protection, Sace Sistemi Srl never transfers to the United States of America the data of customers who have selected a data centre located within the European Union.

Sace Sistemi Srl also reserves the right to entrust certain Support services that may require remote access to customer data to other entities located in countries recognised by the European Commission as providing an adequate level of protection, excluding the United States.

Thanks to the safeguards provided by Sace Sistemi Srl regarding data transfers, customers are able to comply with their regulatory obligations.

Article 45 of the GDPR, which governs “Transfers on the basis of an adequacy decision”, provides that personal data may be transferred to a third country or international organisation where the European Commission has decided that the third country, a territory or one or more specified sectors within that third country, or the international organisation in question, ensures an adequate level of protection. Such transfers do not require any specific authorisation.

In the second scenario, the customer chooses a service that uses a data centre located outside the European Union.

In this case, the data is necessarily transferred outside the European Union.

The location or geographical area of the data centres used to provide the service is indicated on our website.

Where several locations are available, the customer selects their preferred location.

Sace Sistemi Srl is not permitted to change the location or geographical area agreed upon at the time of ordering without the customer’s consent.

To support customers who wish to process personal data in data centres located outside the European Union in a country that does not provide an adequate level of protection, Sace Sistemi Srl may, upon request, discuss the implementation of appropriate safeguards allowing such data transfers in accordance with Article 46 of the GDPR, “Transfers subject to appropriate safeguards.”

Sace Sistemi Srl’s Commitment as a Data Controller

We act as a Data Controller when we determine the purposes and means of processing personal data.

This is the case when Sace Sistemi Srl collects data for billing, service and performance improvement, sales activities, business management, etc., as well as when it processes the personal data of its employees.

In this case, customer data hosted through Sace Sistemi Srl services is not concerned. Instead, the processing relates to certain information concerning the customer or their employees, for example identity and contact details relating to communications with Sace Sistemi Srl in connection with a Support request.

For this reason, Sace Sistemi Srl wishes to explain the safeguards implemented to ensure the protection of such personal data:

limiting data collection to what is strictly necessary: when ordering a service, customers are required to provide only the information necessary for Sace Sistemi Srl to provide billing and support services or to comply with legal obligations concerning data retention;
not using personal data for purposes other than those for which it was originally collected;
retaining personal data only for a limited period. For example, data processed for the purpose of managing the relationship between customers and Sace Sistemi Srl (surname, first name, address, email address, etc.) is retained by the company for the entire duration of the contract and for the following 36 months.

At the end of this period, such data is permanently deleted from all storage media and backups.

not transferring such data to third parties other than companies affiliated with Sace Sistemi Srl that are involved in the performance of the contract;
implementing appropriate technical and organisational measures in order to ensure a high level of security.