Chatbot Privacy Notice

Pursuant to Art. 13 of EU Regulation 2016/679, concerning the processing and free movement of personal data with reference to natural persons (hereinafter also Regulation), FONDAPI National complementary pension fund for workers of small and medium enterprises (hereinafter Fondapi or Pension Fund), as Data Controller, provides the following information on the processing of personal data belonging to its members.

1. DATA CONTROLLER

The data controller is FONDAPI National complementary pension fund for workers of small and medium enterprises with headquarters at Piazza Cola di Rienzo, 80/A – Rome.

2. DATA PROTECTION OFFICER (DPO)

The Data Protection Officer is Protection Trade S.r.l. with headquarters at Via Giorgio Morandi 22, Itri (LT), e-mail dpo_fondapi@protectiontrade.it

3. PURPOSE OF PROCESSING

The Chatbot made available by Fondapi is an optional assistance service and does not in any way prejudice the possibility of contacting the Fund directly. The conversations are automatic: no operator intervention is provided. The queries made in the Chatbot may be viewed by an authorized person in case of software malfunction.

4. DATA PROVISION

The provision of the required data is mandatory; in its absence, it will be impossible to carry out the activity.

5. LEGAL BASIS FOR PROCESSING AND DATA RETENTION PERIOD

The legal basis for processing for the described purposes is the request of the data subject pursuant to Art. 6, par. 1, lett. b) – execution of pre-contractual or contractual measures. Personal data collected through the Chatbot service is retained for a period of 12 months from the date of registration or for a longer term where an interrupting and/or suspending act of limitation occurs that justifies the extension of retention.

6. NATURE OF DATA PROCESSED

The Chatbot present in the public area of the site will provide only general and public domain responses. The categories of personal data processed are as follows: Public Chatbot: a) Content of requests. The Private Chatbot: a) Text of requests; b) User name; c) User ID.

7. METHODS OF DATA PROCESSING

The processing of personal data is carried out through manual and computerized tools, with methods strictly related to the purposes indicated above and, in any case, in a way that guarantees the security, protection and confidentiality of the data itself.

8. DATA RECIPIENTS

Personal data collected may be processed within the data controller’s organization by authorized and trained persons. The Pension Fund may communicate the acquired personal data to external subjects and companies that provide services strictly connected and instrumental to its activity, also appointed as Data Processors pursuant to art. 28 of the Regulation. The list of data processors, constantly updated, is kept at the legal headquarters of the Data Controller. The acquired personal data is not subject to dissemination. The Pension Fund might use suppliers or sub-suppliers who do not reside in the European Union; in this regard, it is guaranteed that the transfer may only take place to subjects that guarantee an adequate level of data processing protection and/or to countries for which the competent Authorities have issued an adequacy decision, as well as to subjects that have provided suitable guarantees for data processing through adequate regulatory/contractual instruments such as, for example, the subscription of standard contractual clauses. To obtain information in this regard, you may send an e-mail to dpo_fondapi@protectiontrade.it.

9. DATA SUBJECT RIGHTS

We inform you, finally, that you may exercise the rights contemplated by the Regulation, by writing to dpo_fondapi@protectiontrade.it. In particular, you may:

• access your personal data, obtaining evidence of the purposes pursued by the Controller, the categories of data involved, the recipients to whom they may be communicated, the applicable retention period, the existence of automated decision-making processes, including profiling, and, at least in such cases, meaningful information about the logic used, as well as the significance and possible consequences for the data subject, where not already indicated in the text of this Notice;
• obtain without delay the rectification of inaccurate personal data concerning you;
• obtain, in cases provided by law, the deletion of your data;
• obtain the limitation of processing or object to it, when permitted based on the legal provisions applicable to the specific case.

We finally remind you that it is a right of the Data Subject to lodge a complaint with the supervisory authority: Data Protection Authority.