Privacy Statement

PRIVACY NOTICE

(EU Regulation 2016/679, hereinafter the "Regulation")

Dear Customer,

This Privacy Notice describes how your personal data (including, by way of example and not limitation, your first and last name, identification document details and a copy thereof, telephone number, and email address) are processed by Pensa MultiMedia S.r.l. (hereinafter the "Publisher"). The Publisher also processes the personal data of users of the journals hosted on the OJS platform of Pensa MultiMedia S.r.l. (ojs.pensamultimedia.it).

This Notice provides information on the following:

Who is the Data Controller?
How can the Data Protection Officer be contacted?
On what legal bases and for what purposes does the Publisher process your personal data?
To whom may your personal data be disclosed?
Can your personal data be transferred outside the European Union?
How long are your personal data retained?
What are your rights?
Why might the Publisher process special categories of personal data?
How is profiling carried out for marketing purposes?

1. Who is the Data Controller?

The Data Controller of your personal data is Pensa MultiMedia S.r.l., with registered office at Via A.M. Caprioli 8, 73100 Lecce, Italy. Tel. +39 0832 230435.

2. How can the Data Protection Officer be contacted?

The Data Protection Officer (hereinafter also referred to as the "DPO") may be contacted at:

Postal address: Pensa MultiMedia S.r.l., Via A.M. Caprioli 8, 73100 Lecce, Italy;
Email: info@pensamultimedia.it.

3. On what legal bases and for what purposes does the Publisher process your personal data?

The Publisher processes your personal data only where at least one of the following legal bases applies:

compliance with a legal obligation;
performance of a contract to which you are a party and the implementation of pre-contractual measures requested by you;
your consent for one or more specific purposes;
the legitimate interests pursued by the Publisher.

Accordingly, your personal data are processed in compliance with the lawfulness requirements laid down in the Regulation and only to the extent necessary for the Publisher, or third parties acting on its behalf, to carry out activities connected with and instrumental to the following purposes:

performing contractual obligations and implementing pre-contractual measures, including the management of judicial and extrajudicial disputes and the authorization to operate on accounts held in the name of other persons;
where you have given your consent:
- carrying out activities aimed at the continuous improvement of the services provided, including:
  - measuring customer satisfaction with the quality of the services provided;
  - marketing products and services;
  - conducting market research and surveys;
  - profiling activities designed to offer you personalized products and services that best meet your needs;
pursuing the Publisher's legitimate interest in offering products and services that best meet customers' needs. For this purpose, the Publisher identifies the recipients of commercial communications using non-intrusive criteria (such as age, place of residence, and similar information). Before undertaking these activities, the Publisher assesses their impact on the rights, interests, and freedoms of the individuals concerned. In addition, recipients are given the opportunity to opt out of receiving further communications by means of an unsubscribe option included in every contact.

Within the limits of the purposes described above, your personal data may be processed using manual, electronic, and automated means. The Publisher adopts appropriate technical and organizational measures to ensure the security and confidentiality of your personal data.

4. To whom may your personal data be disclosed?

The Publisher may disclose your personal data to third parties belonging to the following categories:

parties involved in the performance of the contract to which you are a party and in pre-contractual activities requested by you;
parties involved in carrying out optional activities for which you have provided your consent:
- marketing and market research companies.

5. Can your personal data be transferred to countries outside the European Union?

The Publisher does not transfer personal data to third countries. However, the Publisher reserves the right to use cloud-based services. In such cases, service providers will be selected only among those that provide appropriate safeguards, as required by Regulation (EU) 2016/679.

6. How long are your personal data retained?

The Publisher retains personal data in a form that allows the identification of data subjects for the period necessary to achieve the specific purposes of the processing, in compliance with contractual and/or legal obligations.

7. What are your rights?

We inform you that, as a data subject, you may exercise the specific rights provided for under data protection legislation, as listed below:

Right of access: the right to obtain confirmation from the Data Controller as to whether or not personal data concerning you are being processed and, where this is the case, to obtain access to such data and detailed information regarding their origin, purposes of processing, categories of processed data, recipients to whom the data have been or will be disclosed and/or transferred, and other relevant information.

Right to rectification: the right to obtain from the Data Controller, without undue delay, the correction of inaccurate personal data and the completion of incomplete personal data, including by providing a supplementary statement.

Right to erasure ("right to be forgotten"): the right to obtain from the Data Controller the erasure of personal data without undue delay where:

the personal data are no longer necessary in relation to the purposes for which they were collected or processed;
the consent on which the processing is based has been withdrawn and there is no other legal basis for the processing;
the personal data have been unlawfully processed;
the personal data must be erased in order to comply with a legal obligation.

Right to object to processing: the right to object at any time to the processing of personal data based on the legitimate interest of the Data Controller and/or to processing carried out for marketing purposes, including profiling. If you object to processing for marketing purposes, your personal data will no longer be processed for such purposes.

Right to restriction of processing: the right to obtain from the Data Controller the restriction of processing where the accuracy of personal data is contested (for the period necessary for the Data Controller to verify the accuracy of such data), where the processing is unlawful and/or where the data subject has objected to the processing.

Right to data portability: the right to receive personal data in a structured, commonly used, and machine-readable format and to transmit such data to another Data Controller, only where the processing is based on consent or on a contract and only with regard to data processed by electronic means.

Right to lodge a complaint with a supervisory authority: without prejudice to any other administrative or judicial remedy, any data subject who considers that the processing of their personal data infringes the Regulation has the right to lodge a complaint with the supervisory authority of the Member State in which they reside or work, or of the Member State where the alleged infringement occurred.

You are also informed that you have the right to withdraw, at any time, any consent given for specific optional activities, without affecting the lawfulness of processing carried out before the withdrawal.

To exercise your rights, you may submit your request using the following contact details:

Postal address: Pensa MultiMedia S.r.l., Via A.M. Caprioli 8, 73100 Lecce, Italy – Tel. +39 0832 230435;
Email address: info@pensamultimedia.it.

The Publisher will provide information on the action taken in response to your request without undue delay and, in any event, no later than one month after receipt of the request.

8. Why might the Publisher process special categories of personal data?

The Publisher does not require you to provide special categories of personal data (including, by way of example and not limitation, personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, or data concerning a person's health, sex life, or sexual orientation).

However, the Publisher may occasionally process such data in order to fulfil specific requests for services or operations made by you (for example, the application of discounts or special benefits). For this reason, pursuant to Article 9 of the Regulation, the Data Controller is required to obtain your explicit consent for the processing of such data.

The Publisher processes this information exclusively for the purpose of complying with legal obligations and/or performing the contract.

9. How is profiling carried out for marketing purposes?

Profiling, aimed at personalizing the services and/or products offered to you, concerns the personal data that you provide directly and/or indirectly, as well as information available through social networks.

This processing is carried out only to the extent that you have provided your optional consent. You have the right to object at any time to profiling activities carried out for the purpose of personalizing commercial offers. In the event of an objection, your personal data will no longer be processed for this purpose.

Glossary

Data Protection Authority
An independent administrative authority established by Law No. 675 of 31 December 1996, responsible for supervising compliance with data protection legislation.

Personal data
Pursuant to Article 4(1)(1) of the Regulation, personal data means "any information relating to an identified or identifiable natural person ('data subject'); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person."

Special categories of personal data
Personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, as well as genetic data, biometric data intended to uniquely identify a natural person, data concerning health, or data concerning a person's sex life or sexual orientation.

Profiling
Pursuant to Article 4(1)(4) of the Regulation, profiling means "any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that natural person's work performance, economic situation, health, personal preferences, interests, reliability, behaviour, location, or movements."

Regulation
Regulation (EU) 2016/679 of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, repealing Directive 95/46/EC.

Data Processor
Pursuant to Article 4(1)(8) of the Regulation, the Data Processor is "a natural or legal person, public authority, agency, or other body which processes personal data on behalf of the Data Controller."

Data Protection Officer (DPO)
A role introduced by the Regulation, whose main responsibilities include informing and advising the Data Controller, Data Processors, and authorized personnel on matters relating to data protection; monitoring compliance with the Regulation; providing advice regarding data protection impact assessments; and cooperating with the supervisory authority.

Data Controller
Pursuant to Article 4(1)(7) of the Regulation, the Data Controller is "the natural or legal person, public authority, agency, or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data [...]."

Processing of personal data
Pursuant to Article 4(1)(2) of the Regulation, processing means "any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination, or otherwise making available, alignment or combination, restriction, erasure, or destruction."