Privacy Notice on the Processing of Personal Data

Privacy notice regarding data processing for the ++39 SRL corporate video surveillance system

(Pursuant to Articles 12 et seq. of Regulation (EU) 2016/679 and Legislative Decree No. 196/2003, as amended)

Pursuant to Articles 12 et seq. of Regulation (EU) 2016/679 (GDPR), we hereby provide the following information regarding the processing of personal data collected.
The processing of personal data will be carried out in compliance with the data subject’s fundamental rights and freedoms, in accordance with the principles of fairness, lawfulness, and transparency.

Data Controller
The Data Controller is:
++39 S.r.l.
Strada degli Olmi n. 16/4,61122 Pesaro PU
0039@39-italy.it

Categories of Personal Data Processed
For the purposes set out below, the Data Controller will process the categories of personal data consisting of images of data subjects recorded through the video surveillance system installed on the Company’s premises and identified by appropriate signage.

Purposes and Legal Basis for Processing
The Company will process personal data exclusively for the following purposes:
a) Protection of the Company’s assets and the safety of employees and visitors;
b) Protection of the Company’s rights in the event of disputes before the competent authorities.

The above purposes are based on the legitimate interest of the Data Controller in protecting its corporate assets, safeguarding the safety of its employees and visitors, and defending its rights before the competent authorities, pursuant to Article 6, (1)(f) of the GDPR.

Nature of the Provision of Personal Data
The collection of personal data through the video surveillance system is generally necessary in order to access areas subject to video surveillance. Failure to enter such areas constitutes the only alternative to the collection of personal data through the surveillance system. Consequently, refusal to be recorded may result in the impossibility of accessing the monitored premises.

Recipients/Categories of Recipients
For the purposes described above, personal data may be disclosed to the following recipients acting as independent Data Controllers:
– Judicial Authorities or other competent public authorities, where required by law or upon lawful request.

Furthermore, solely for the purposes described above, personal data may be processed by the following entities acting as Data Processors appointed pursuant to (art. 28 GDPR):
– Company responsible for the installation and maintenance of the video surveillance system;
– IT services and consultancy providers;

Automated Decision-Making Processes
The Data Controller does not process the data subject’s personal data through automated decision-making processes.

Data Retention Period
Personal data collected for the purpose referred to under point a) will be retained for 48 hours from the time of recording. Upon expiry of this period, the data will be automatically erased by overwriting with new recordings.
Personal data collected for the purpose referred to under point b) will be retained for the entire duration of the judicial proceedings and until the expiry of any applicable appeal periods.

Rights of the Data Subject
At any time, the data subject may exercise the rights listed below in accordance with Regulation (EU) 2016/679 on the protection of personal data:

  • Right of access: the data subject has the right to obtain confirmation as to whether or not personal data concerning them are being processed and, where that is the case, to obtain access to such personal data. At any time, the data subject may request information regarding: the purposes of the processing, the categories of personal data processed, the recipients to whom the personal data have been or will be disclosed, the retention period, the rights available to the data subject, the source of the data, and the existence of any automated decision-making process.
  • Right to rectification: the data subject has the right to obtain from the Data Controller, without undue delay, the rectification of inaccurate personal data concerning them. Furthermore, the data subject has the right to have incomplete personal data completed, including by means of providing a supplementary statement. In such cases, the Data Controller shall inform each recipient to whom the personal data have been disclosed of any rectification carried out.
  • Right to erasure: the data subject has the right to obtain the erasure of personal data concerning them without undue delay. Furthermore, where the personal data have been made public, the Data Controller shall erase them and take reasonable steps, including technical measures, to inform other data controllers processing the personal data of the data subject’s request to erase any copies of such personal data.
  • Right to restriction of processing: where the data subject considers it appropriate, they may request the restriction of the processing of their personal data. In such cases, the Data Controller shall communicate any restriction of processing to each recipient to whom the personal data have been disclosed, unless this proves impossible or involves disproportionate effort.
  • Right to data portability: the data subject has the right to receive the personal data concerning them in a structured, commonly used, and machine-readable format and to request that such data be retained for further personal use. Furthermore, the data subject has the right to request the direct transmission of their personal data to another data controller, where technically feasible.
  • Right to object to processing: the data subject has the right to object, at any time, on grounds relating to their particular situation, to the processing of personal data concerning them.
  • Right to withdraw consent: where processing is based on consent, the data subject may withdraw the consent previously given. However, such withdrawal shall not affect the lawfulness of processing carried out prior to the withdrawal.

You may exercise your rights by submitting a request, without any specific formalities, to the Data Controller at the following address: 0039@39-italy.it

Should the data subject believe that their personal data have been processed unlawfully or in violation of the applicable data protection laws and principles, they have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la Protezione dei Dati Personali) using the information available on its website at www.garanteprivacy.it, or to bring proceedings before the competent judicial authority.

Cod. REG-PRI-INF-02-041– Rev.0 del 16/07/2026 [FGM-Rev.1.0 del 23/04/2026]