Whistleblowing
1.0 – PURPOSE OF THE DOCUMENT
Legislative Decree no. 24 of 10 March 2023 – Implementation of Directive (EU) 2019/1937 of the European Parliament and of the Council of 23 October 2019 on the protection of persons reporting breaches of Union law and laying down provisions regarding the protection of persons reporting breaches of national legislation (hereinafter the “Decree”) aims to strengthen the legal protection of persons who report specific behaviors, acts, or omissions that harm the interests and/or integrity of the private entity to which they belong and of which they have become aware in the course of their work.
AKU ITALIA SRL (hereinafter also the "Company"), in compliance with the provisions of Article 5, paragraph 1, letter e) of the Decree, hereby provides interested parties with information on the channel, procedure, and requirements for submitting internal reports, as well as the channel, procedures, and requirements for submitting external reports.
To ensure maximum visibility and awareness, this document is published in a dedicated section of the AKU ITALIA SRL website and an explicit reference to it is contained in an appropriate notice posted at AKU ITALIA SRL; the Company reserves the right to change, modify, add, or remove any portion of this notice at any time.
2.0 – OPERATIONAL INSTRUCTIONS
2.1 – WHO CAN MAKE A REPORT (INTERNAL OR EXTERNAL)?
A Reporting Person is a natural person who can make a report (internally or externally, as applicable) regarding a violation relevant to the Decree and belonging to one of the following categories:
a. subordinate workers, including those whose employment relationships are governed by Legislative Decree 81/2015 (temporary work) and art. 54-bis DL 50/2017 (occasional work);
b. self-employed workers employed by private sector entities, including those listed in Chapter I of Law 81/2017 (self-employment relationships referred to in Title III of Book V of the Civil Code, including self-employment relationships subject to specific regulations pursuant to Article 2222 of the Civil Code) and those in a collaborative relationship referred to in Article 409 of the Code of Civil Procedure (agency, commercial representation, and other collaborative relationships resulting in continuous and coordinated provision of work, predominantly personal) and in Article 2 of Legislative Decree 81/2015 (collaborations organized by the client);
c. workers or collaborators who carry out work for private sector entities that supply goods or services or carry out works for third parties;
d. freelancers and consultants who work for private sector entities;
e. volunteers and interns, paid and unpaid, who work for private sector entities;
f. shareholders and persons with administrative, management, control, supervisory or representative roles (even if merely de facto) at private sector entities.
2.2 – WHICH VIOLATIONS CAN BE SUBJECT TO AN INTERNAL REPORT?
An internal report may be made if a behavior, act, or omission harms the interests and/or integrity of AKU ITALIA SRL, of which the Reporting Person becomes aware in the context of his/her work and which consists of:
a. violations of European Union or national acts listed in the Annex to the Decree regarding: public procurement; financial services, products, and markets; and the prevention of money laundering and terrorist financing; product safety and compliance; transport safety; environmental protection; radiation protection and nuclear safety; food and feed safety and animal health and welfare; public health; consumer protection; privacy and personal data protection; and network and information system security;
b. violations of national acts implementing European Union acts that are not included in the annex to the Decree but concern the same sectors as above;
c. acts or omissions that harm the financial interests of the European Union as defined in Article 375 of the TFEU, as identified in European Union regulations, directives, decisions, recommendations, and opinions (e.g., fraud, corruption, or any other illegal activity related to Union expenditure);
d. acts or omissions affecting the free movement of goods, persons, services and capital within the internal market, including violations of European Union acts on competition, State aid and corporate taxation;
e. acts or behaviors that frustrate the object or purpose of the provisions of European Union acts in the sectors indicated above (e.g. use of abusive practices that undermine fair competition in the internal market).
The information reported internally may concern both violations committed and those not yet committed that the Reporting Person reasonably believes could be committed based on concrete evidence.
Internal reporting may also include information regarding conduct aimed at concealing violations.
However, the following cannot be subject to internal reporting under the Decree:
- disputes, claims or requests related to a personal interest of the Reporting Person which pertain exclusively to their individual employment relationships or which are inherent to their employment relationships with hierarchically superior figures;
- reports of violations where they are already mandatorily regulated by the European Union or national acts indicated in Part II of the Annex to the Decree or by the national acts that implement the European Union acts indicated in Part II of the Annex to Directive (EU) 2019/1937, even if not indicated in Part II of the Annex to the Decree;
- reports of breaches relating to national security, as well as procurement relating to defence or national security aspects, unless such aspects are covered by the relevant secondary legislation of the European Union.
2.3 – WHEN CAN AN INTERNAL REPORT BE MADE?
Reporting Persons may make an internal report:
- when the legal relationship with AKU ITALIA SRL has not yet begun, if information on the violations was acquired during the selection process or in other pre-contractual phases;
- during the probationary period;
- during the course of the legal relationship with AKU ITALIA SRL;
- following the termination of the legal relationship with AKU ITALIA SRL, if information on the violations was acquired during the relationship itself.
2.4 – WHO MANAGES INTERNAL REPORTING AND HOW CAN IT BE CARRIED OUT?
Responsible for managing internal reporting and internal reporting procedure: AKU ITALIA SRL has decided to entrust reporting management to the Reporting Manager, Attorney Luca Bandiera, an independent entity responsible for receiving and reviewing reports. Management of the reporting channel has therefore been entrusted to an independent, experienced external entity.
The person responsible for managing the internal reporting channel:
a) Provide the reporting person with acknowledgement of receipt of the report within seven days of receipt. The acknowledgement will be sent to the address indicated by the reporting person in the report. If no address is provided, no acknowledgement can be given;
b) maintains discussions with the reporting person and may request additions from the latter, if necessary;
c) diligently follows up on received reports, conducting the necessary investigations, for example, collecting documents and information and always maintaining the confidentiality of the whistleblower's identity, informing the relevant company departments of the outcome if the report is found to be well-founded. Otherwise, it is archived;
d) provides feedback on the report within three months of the date of the acknowledgement of receipt or, in the absence of such acknowledgement, within three months of the expiry of the seven-day period from the submission of the report.
Internal reporting channels and internal reporting procedure adopted by AKU ITALIA SRL
Reports can be made in the following ways:
- by calling the Report Manager at 328/9165275 to arrange a telephone, videoconference, or in-person meeting to verbally report the subject of the report, which is recorded with the reporting party's consent or a report is drawn up;
- by registered mail, placing the report in two sealed envelopes. The first envelope should include the reporting person's identification data and contact details, along with an identity document. The second envelope should include the subject of the report. Both envelopes should then be placed in a third envelope marked "reserved for the reporting manager of Aku Italia srl" on the outside and addressed to: Luca Bandiera, Attorney at Law, Via Giacomo Camillo De Carlo, 3, 31100 Treviso.
Any documentation relating to the reported facts, as well as the results of any investigations already carried out, must also be forwarded to the Report Manager for their assessment.
In the event that the report has been erroneously transmitted/received to/from a person not authorised to receive it, and it is evident that it is a whistleblowing report, the latter will be obliged to promptly provide evidence of its receipt to the manager of the report, in any case within 7 (seven) days of such receipt, simultaneously giving notice of such transmission to the reporting party, without prejudice to all confidentiality obligations set forth in this policy also applicable to the latter (and consequent liability in the event of a violation thereof).
Anonymous reports may be considered for further investigations/investigations to verify the reported facts only if they present precise, consistent, and adequately detailed information. In any case, the protective measures for the whistleblower apply only if the reporting person is subsequently identified and has suffered retaliation.
The Report, in addition to being timely, must be as complete as possible and preferably contain the following elements:
- personal details of the person making the report, as well as an address to which subsequent updates should be communicated;
- a clear and complete description of the facts being reported;
- if known, the circumstances of time and place in which the reported facts were committed;
- if known, the personal details or other information that allows the identification of the individual(s) who carried out the reported events;
- any indication of other persons who can report on the facts being reported;
- any indication of documents that can confirm the validity of such facts;
- any other information that may provide useful confirmation of the existence of the reported facts.
2.5– WHAT ARE THE PROTECTION MEASURES TO PROTECT THE REPORTING PERSON?
First and foremost, the Decree protects the confidentiality of the Reporting Person; the law provides that reports cannot be used beyond what is necessary to adequately follow up on them, and that the identity of the Reporting Person and any other information that may directly or indirectly reveal that identity cannot be disclosed, without the Reporting Person's express consent, to anyone other than those responsible for receiving or following up on reports and expressly authorized to process such data. The Company is also required to protect the identity of the individuals involved and those named in the report until the proceedings initiated as a result of the report have been concluded.
Furthermore, the Decree provides that the Reporting Person may not suffer any retaliation from the Company as a result of the report, meaning "any behavior, act, or omission, even attempted or threatened, carried out as a result of the report [...] and which causes or may cause the reporting person [...] unjustified harm, directly or indirectly" (e.g., dismissal, demotion, etc.). The Reporting Person may also report to the ANAC (National Anti-Corruption Authority) any retaliation they believe they have suffered as a result of their report.
Thirdly, limitations of liability are provided for the benefit of the Reporting Person, who in particular:
a. shall not be punishable if he or she reveals or disseminates information on violations covered by the obligation of secrecy or relating to the protection of copyright or the protection of personal data, or information on violations that damage the reputation of the person involved, when, at the time of disclosure or dissemination, there were reasonable grounds to believe that the disclosure or dissemination of the information was necessary to reveal the violation;
b. shall not incur any liability for the acquisition of information on violations or for access to the same, unless the act constitutes a crime;
c. shall not incur any liability for any conduct, actions, or omissions provided that they are related to the report and strictly necessary to reveal the violation.
However, in order to benefit from the indicated protection measures, both of these conditions must be met:
a. at the time of the report, the Reporting Person had reasonable grounds to believe that the information on the reported violations was true and fell within the objective scope of the Decree (see point 2.2 above);
b. the report was made using the adopted reporting channels and in compliance with the relevant procedures.
The protective measures provided are not guaranteed if the Reporting Person is found, even by a first-instance court ruling, to be criminally liable for defamation or slander, or to be civilly liable for having provided false information with intent or gross negligence. In these cases, the Company may also apply disciplinary measures to the Reporting Person, as set forth in the Disciplinary System of the applicable National Collective Bargaining Agreement.
It is emphasized that the aforementioned protection measures are recognized, in addition to the Reporting Persons, also to the following individuals who could be the recipients of retaliation, even indirectly, due to the role assumed in the reporting process and/or the particular relationship that binds them to the Reporting Person:
- the facilitator, i.e. the natural person who assists a Reporting Person in the reporting process, operating within the same work context and whose assistance must be kept confidential (hereinafter “Facilitator”);
- people from the same work context who are linked to the Reporting Person by a stable emotional or kinship relationship within the fourth degree;
- work colleagues with a habitual and ongoing relationship with the Reporting Person;
- entities owned by the Reporting Person or for which this person works and entities that operate in the same work context as this individual.
2.6– WHAT VIOLATIONS CAN BE SUBJECT TO AN EXTERNAL REPORT?
An external report may be made, provided that the conditions set out in point 2.7 below are met, if any behavior, act, or omission that harms the interests and/or integrity of AKU ITALIA SRL, of which the Reporting Person becomes aware in the context of his/her work and which consists of:
a. violations of European Union acts or national acts indicated in the Annex to the Decree regarding: public procurement; financial services, products and markets and prevention of money laundering and the financing of crime
terrorism; product safety and compliance; transport safety; environmental protection; radiation protection and nuclear safety; food and feed safety and animal health and welfare; public health; consumer protection; privacy and data protection; and network and information systems security;
b. violations of national acts that implement European Union acts that are not present in the annex to the Decree but concern the same sectors as above;
c. acts or omissions that harm the financial interests of the European Union as defined in Article 375 of the TFEU as identified in the regulations, directives, decisions, recommendations and opinions of the European Union;
d. acts or omissions affecting the free movement of goods, persons, services and capital within the internal market, including violations of European Union acts on competition, State aid and corporate taxation;
e. acts or behaviors that frustrate the object or purpose of the provisions of the European Union acts in the sectors indicated above.
2.7– HOW AND WHEN CAN AN EXTERNAL REPORT BE MADE?
External reports must be submitted only to ANAC using the reporting channels adopted by the latter and the specific procedures set out in the "Guidelines on the protection of persons reporting violations of Union law and the protection of persons reporting violations of national regulatory provisions – procedures for submitting and managing external reports" available on the ANAC website: www.anticorruzione.it.
An external report can be made exclusively in these (alternative) cases:
a. the mandatory activation of the internal reporting channel is not foreseen within the working context of the Reporting Person, or this, even if mandatory, is not active or, even if activated, does not comply with the provisions of the Decree;
b. the Reporting Person has already made an internal report and it has not been followed up;
c. the Reporting Person has reasonable grounds to believe that, if he or she were to make an internal report, it would not be effectively followed up or that the report itself could give rise to the risk of retaliation;
d. the Reporting Person has reasonable grounds to believe that the violation may constitute an imminent or manifest danger to the public interest.
3.0 – PERSONAL DATA PROCESSING – PRIVACY POLICY
Any processing of personal data of persons involved in internal reporting (such as Reporting Persons, Facilitator, Report Manager, and natural persons mentioned in the internal reporting as persons to whom the reported violation is attributed or as persons in any way implicated in the reported violation) will be carried out by AKU ITALIA SRL, as data controller, pursuant to Regulation (EU) 2016/679 (hereinafter the “Regulation”), Legislative Decree no. 196 of 30 June 2003 (hereinafter the “Privacy Code”), and applicable data protection legislation, and, in particular, in compliance with the principles set out in Articles 5 and 25 of the Regulation.
PERSONAL DATA PROCESSED
Specifically, the personal data of the Reporting Person and/or data provided by the Reporting Person relating to other individuals involved in the internal report, such as ordinary personal data, personal data belonging to special categories (Article 9 of the Regulation) and, within the limits of the law, personal data relating to criminal convictions and offences (Article 10 of the Regulation), may be processed using automated tools, or, where applicable, on paper, by the persons responsible for receiving or following up on internal reports, expressly authorised/appointed by AKU ITALIA SRL to process such data pursuant to Articles 29 and 32, paragraph 4 of the Regulation and Article 2-quaterdecies of the Privacy Code. Personal data of the Reporting Person and/or data provided by the Reporting Person relating to other individuals involved in the internal report, such as ordinary personal data, personal data belonging to special categories (Article 9 of the Regulation) and, within the limits of the law, personal data relating to criminal convictions and offences (Article 10 of the Regulation), may be processed. It is understood that personal data that are manifestly not useful for processing a specific internal report will not be collected by AKU ITALIA SRL or, if collected accidentally, will be deleted immediately.
By way of example, the following categories of personal data may be processed:
• personal data of the Reporting Person (e.g. name, surname);
• professional data of the Reporting Person (e.g. company role);
• any information relating to the reported person, or to other interested parties, that the Reporting Person decides to share in the report to better contextualise it;
• the information that the reported person, or other interested parties, share in the context of managing the report.
Please note that in the event of anonymous reporting, no data relating to the Reporting Person will be processed.
PURPOSE AND LEGAL BASIS OF THE PROCESSING
The aforementioned data will be processed exclusively for the purpose of receiving and managing internal reports and any other necessary activities (e.g., gathering useful information to verify the validity of the reported matter), in compliance with and within the limits of the obligations set forth in Legislative Decree 24/2023, which represents the legal basis for the processing.
Providing your personal data is therefore mandatory, and failure to provide it will make it impossible to process your internal report.
The Reporting Person may be asked for specific consent in the following cases:
• pursuant to art. 12, paragraph 2 of the Decree, to authorize the Manager to communicate his/her identity and any other information from which such identity may be deduced, directly or indirectly, to parties other than the Manager himself/herself for the sole purpose of managing the report;
• pursuant to art. 14, paragraph 4 of the Decree, if the report is made orally during a meeting with the Manager, for documentation purposes by recording it on a device suitable for storage and listening or by means of a written report.
Furthermore, pursuant to Article 12, paragraph 5, the Reporting Person may be asked for specific consent to reveal their identity for the purpose of using the report in disciplinary proceedings, if the complaint is based in whole or in part on the report and knowledge of the Reporting Person's identity is essential for the defense of the individual facing the disciplinary charge.
TREATMENT METHODS
To manage reports, AKU ITALIA SRL has adopted technical and organizational measures that guarantee, regardless of the channel used, the protection and confidentiality of the Reporting Person, the persons involved in the report, as well as the content of the report and the related documentation.
Personal data that are clearly not useful for processing a specific complaint, if accidentally collected, are deleted once their relevance has been ruled out.
DATA COMMUNICATION
In compliance with the aforementioned procedure, personal data submitted in internal reports will be processed exclusively by the Manager and will not be disclosed to third parties, except for access by the internal reporting channel provider, who will act as data controller pursuant to Article 28 of the Regulation, and disclosure to the competent administrative or judicial authorities, in compliance with applicable legislation.
As specified above, only with the express consent of the Reporting Person, the identity and any other information from which such identity can be deduced, directly or indirectly, may be disclosed to persons other than the competent persons mentioned above.
Personal data reported internally, unless otherwise required by law, will not be disclosed or transferred to third countries outside the European Union.
RETENTION PERIOD
Personal data submitted in internal reports and related documentation will be retained for the time necessary to manage the internal report and, in any case, no longer than 5 (five) years from the date of communication of the final outcome of the reporting procedure, in compliance with Article 12 of the Decree and the principle set forth in Article 5, paragraph 1, letter e) of the Regulation. It is understood that personal data that are manifestly not useful for processing a specific internal report will not be collected by AKU ITALIA SRL, or, if collected accidentally, will be deleted immediately.
RIGHTS
Those involved in internal reporting, as data subjects, may exercise the rights set forth in Articles 15 to 22 by writing to info@aku.it, within the limits of Article 2-undecies of the Privacy Code and the Regulation:
Right of access: This is the right to obtain confirmation as to whether or not personal data concerning you is being processed and, if so, to obtain a copy of the personal data being processed and the following information: the purposes of the processing, the categories of data processed, the recipients of the data, the data retention period, the source of the data, the rights provided for by the GDPR, and the existence of an automated decision-making process.
Right to rectification: is the right to obtain the rectification or updating of personal data concerning them;
Right to erasure: is the right to obtain the erasure of personal data concerning them;
Right to restriction of processing: This is the right to obtain restriction of processing of personal data in one of the following cases: i) the data subject has contested the accuracy of the personal data; ii) the processing is unlawful, and the data subject has requested restriction of their use; iii) the personal data are required by the data subject for the establishment, exercise or defence of legal claims;
Right to object: is the right to object to the processing of personal data concerning them;
Right to withdraw consent: this is the right to withdraw consent at any time, in relation to the processing based on it, without prejudice to the lawfulness of the processing based on the consent given before the withdrawal;
Right to data portability: This is the right to receive your personal data in a structured, commonly used and machine-readable format and to request its transmission to another recipient.
Furthermore, if the interested parties believe that their data is being processed in violation of the Regulation, they have the right to
The right to lodge a complaint with a supervisory authority competent for personal data protection. CONTACT DETAILS OF THE DATA CONTROLLER AND DATA PROTECTION OFFICER
For any further information regarding the processing of personal data, AKU ITALIA SRL can be contacted by writing an email to info@aku.it.
Internal reporting channels and internal reporting procedure adopted by AKU ITALIA SRL
Reports can be made in the following ways:
- by calling the Report Manager at 328/9165275 to arrange a telephone, videoconference, or in-person meeting to verbally report the subject of the report, which is recorded with the reporting party's consent or a report is drawn up;
- by registered mail, placing the report in two sealed envelopes. The first envelope should include the reporting person's identification data and contact details, along with an identity document. The second envelope should include the subject of the report. Both envelopes should then be placed in a third envelope marked "reserved for the reporting manager of Aku Italia srl" on the outside and addressed to: Luca Bandiera, Attorney at Law, Via Giacomo Camillo De Carlo, 3, 31100 Treviso.
Any documentation relating to the reported facts, as well as the results of any investigations already carried out, must also be forwarded to the Report Manager for their assessment.
PERSONAL DATA PROCESSING – PRIVACY POLICY
Any processing of personal data of persons involved in internal reporting (such as Reporting Persons, Facilitator, Report Manager, and natural persons mentioned in the internal reporting as persons to whom the reported violation is attributed or as persons in any way implicated in the reported violation) will be carried out by AKU ITALIA SRL, as data controller, pursuant to Regulation (EU) 2016/679 (hereinafter the “Regulation”), Legislative Decree no. 196 of 30 June 2003 (hereinafter the “Privacy Code”), and applicable data protection legislation, and, in particular, in compliance with the principles set out in Articles 5 and 25 of the Regulation.
PERSONAL DATA PROCESSED
Specifically, the personal data of the Reporting Person and/or data provided by the Reporting Person relating to other individuals involved in the internal report, such as ordinary personal data, personal data belonging to special categories (Article 9 of the Regulation) and, within the limits of the law, personal data relating to criminal convictions and offences (Article 10 of the Regulation), may be processed using automated tools, or, where applicable, on paper, by the persons responsible for receiving or following up on internal reports, expressly authorised/appointed by AKU ITALIA SRL to process such data pursuant to Articles 29 and 32, paragraph 4 of the Regulation and Article 2-quaterdecies of the Privacy Code. Personal data of the Reporting Person and/or data provided by the Reporting Person relating to other individuals involved in the internal report, such as ordinary personal data, personal data belonging to special categories (Article 9 of the Regulation) and, within the limits of the law, personal data relating to criminal convictions and offences (Article 10 of the Regulation), may be processed. It is understood that personal data that are manifestly not useful for processing a specific internal report will not be collected by AKU ITALIA SRL or, if collected accidentally, will be deleted immediately.
By way of example, the following categories of personal data may be processed:
• personal data of the Reporting Person (e.g. name, surname);
• professional data of the Reporting Person (e.g. company role);
• any information relating to the reported person, or to other interested parties, that the Reporting Person decides to share in the report to better contextualise it;
• the information that the reported person, or other interested parties, share in the context of managing the report.
Please note that in the event of anonymous reporting, no data relating to the Reporting Person will be processed.
PURPOSE AND LEGAL BASIS OF THE PROCESSING
The aforementioned data will be processed exclusively for the purpose of receiving and managing internal reports and any other necessary activities (e.g., gathering useful information to verify the validity of the reported matter), in compliance with and within the limits of the obligations set forth in Legislative Decree 24/2023, which represents the legal basis for the processing.
Providing your personal data is therefore mandatory, and failure to provide it will make it impossible to process your internal report.
The Reporting Person may be asked for specific consent in the following cases:
• pursuant to art. 12, paragraph 2 of the Decree, to authorize the Manager to communicate his/her identity and any other information from which such identity may be deduced, directly or indirectly, to parties other than the Manager himself/herself for the sole purpose of managing the report;
• pursuant to art. 14, paragraph 4 of the Decree, if the report is made orally during a meeting with the Manager, for documentation purposes by recording it on a device suitable for storage and listening or by means of a written report.
Furthermore, pursuant to Article 12, paragraph 5, the Reporting Person may be asked for specific consent to reveal their identity for the purpose of using the report in disciplinary proceedings, if the complaint is based in whole or in part on the report and knowledge of the Reporting Person's identity is essential for the defense of the individual facing the disciplinary charge.
TREATMENT METHODS
To manage reports, AKU ITALIA SRL has adopted technical and organizational measures that guarantee, regardless of the channel used, the protection and confidentiality of the Reporting Person, the persons involved in the report, as well as the content of the report and the related documentation.
Personal data that are clearly not useful for processing a specific complaint, if accidentally collected, are deleted once their relevance has been ruled out.
DATA COMMUNICATION
In compliance with the aforementioned procedure, personal data submitted in internal reports will be processed exclusively by the Manager and will not be disclosed to third parties, except for access by the internal reporting channel provider, who will act as data controller pursuant to Article 28 of the Regulation, and disclosure to the competent administrative or judicial authorities, in compliance with applicable legislation.
As specified above, only with the express consent of the Reporting Person, the identity and any other information from which such identity can be deduced, directly or indirectly, may be disclosed to persons other than the competent persons mentioned above.
Personal data reported internally, unless otherwise required by law, will not be disclosed or transferred to third countries outside the European Union.
RETENTION PERIOD
Personal data submitted in internal reports and related documentation will be retained for the time necessary to manage the internal report and, in any case, no longer than 5 (five) years from the date of communication of the final outcome of the reporting procedure, in compliance with Article 12 of the Decree and the principle set forth in Article 5, paragraph 1, letter e) of the Regulation. It is understood that personal data that are manifestly not useful for processing a specific internal report will not be collected by AKU ITALIA SRL, or, if collected accidentally, will be deleted immediately.
RIGHTS
Those involved in internal reporting, as data subjects, may exercise the rights set forth in Articles 15 to 22 by writing to info@aku.it, within the limits of Article 2-undecies of the Privacy Code and the Regulation:
Right of access: This is the right to obtain confirmation as to whether or not personal data concerning you is being processed and, if so, to obtain a copy of the personal data being processed and the following information: the purposes of the processing, the categories of data processed, the recipients of the data, the data retention period, the source of the data, the rights provided for by the GDPR, and the existence of an automated decision-making process.
Right to rectification: is the right to obtain the rectification or updating of personal data concerning them;
Right to erasure: is the right to obtain the erasure of personal data concerning them;
Right to restriction of processing: This is the right to obtain restriction of processing of personal data in one of the following cases: i) the data subject has contested the accuracy of the personal data; ii) the processing is unlawful, and the data subject has requested restriction of their use; iii) the personal data are required by the data subject for the establishment, exercise or defence of legal claims;
Right to object: is the right to object to the processing of personal data concerning them;
Right to withdraw consent: this is the right to withdraw consent at any time, in relation to the processing based on it, without prejudice to the lawfulness of the processing based on the consent given before the withdrawal;
Right to data portability: This is the right to receive your personal data in a structured, commonly used and machine-readable format and to request its transmission to another recipient.
Furthermore, if the interested parties believe that their data is being processed in violation of the Regulation, they have the right to
The right to lodge a complaint with a supervisory authority competent for personal data protection. CONTACT DETAILS OF THE DATA CONTROLLER AND DATA PROTECTION OFFICER
For any further information regarding the processing of personal data, AKU ITALIA SRL can be contacted by writing an email to info@aku.it.