INFORMATION ON THE PROCESSING OF PERSONAL DATA

pursuant to Article 13 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016

PRIVACY POLICY

This document describes how the website https://elearning.lavoro.gov.it (hereinafter "the site") is managed with regard to the processing of the personal data of the users who consult it. This is a document of a general nature that informs about the criteria for the correct processing of personal data carried out on or through the site. The notices relating to the individual services that the user will use, drawn up pursuant to Article 13 of General Regulation EU/679/2016 on the protection of data and their free movement (hereinafter "the Regulation"), can be consulted on the website in the specific sections and are available at the controller's offices.

This notice is provided pursuant to Article 13 of the Regulation to those who interact with the web services of the site and does not include the processing carried out on other sites that may be consulted by the user through links on the site itself. Users are invited to read this notice carefully before submitting any type of personal information.

The data controller

Following the consultation of this site, data relating to identified or identifiable persons may be processed (the data subject pursuant to the Regulation, hereinafter "user"). The data controller is the Ministry of Labour and Social Policies (hereinafter "controller"), with registered office at Via Vittorio Veneto 56, 00187, Rome. As of today, all information concerning the controller, together with the updated list of the designated processors and system administrators, is available at the controller's premises and at the following e-mail address: dgpoliticheattivelavoro@lavoro.gov.it

Purposes, lawfulness of processing, types of data and criteria used to determine the personal data retention period

Browsing data

Browsing the site involves the acquisition of certain personal data whose transmission is implicit in the use of Internet communication protocols (browsing data). This is information that is not collected to be associated with identified users, but which by its very nature could, through processing and association with data held by third parties, allow users to be identified. This category of data includes the IP (Internet Protocol) addresses or domain names of the computers used by users who connect to the site, the URI (Uniform Resource Identifier) addresses of the requested resources, the time of the request, the method used to submit the request to the server on which the site is hosted or which manages the provision of the requested services, the size of the file obtained in response, the numeric code indicating the status of the response given by the server (success, error, etc.) and other parameters relating to the operating system and the IT environment of the users.

The purposes for which the user's personal data are processed are listed below:

• use of the site;
• any checks on the correct functioning of the services made available to the user.

The lawfulness of the processing of personal data is based on the need to perform a task carried out in the public interest or in the exercise of official authority (Article 6.1(e) of the Regulation).

The user's browsing personal data are retained for the period necessary to achieve the purposes for which they are collected and in any case not exceeding seven days, without prejudice to the time necessary to satisfy requests received from the Judicial Authority for the purposes of defence and/or State security and/or the prevention, investigation or prosecution of crimes, or to satisfy requests received from the Data Protection Authority.

Methods of processing personal data

The processing of the user's personal data takes place at the controller's premises or, where necessary, at the premises of any processors of personal data identified and designated pursuant to Article 28 of the Regulation, or at the parties indicated in the "Communication and dissemination of personal data" paragraph. The processing of personal data is partially automated as it takes place with electronic tools. Specific security measures are observed to prevent the loss, unlawful and/or incorrect use and unauthorised access to the data. The processing of personal data is carried out within the limits of what is strictly necessary for the performance of the functions for which the service is requested, excluding processing when the purposes pursued can be achieved through anonymous data or methods that allow the user to be identified only when necessary.

Communication and dissemination of personal data

Where necessary, personal data may be communicated (this term meaning making them known to one or more specific parties):

• to parties whose right of access to the data is recognised by national and European Union legal provisions;
• natural and/or legal persons, public and/or private, when the communication is necessary or functional to the performance of the controller's activity in the ways and for the purposes illustrated above;
• to the controller's employees/collaborators, within the scope of their duties and/or any contractual obligations;
• to parties qualifying as processors and/or sub-processors of personal data pursuant to Article 28 of the Regulation, who are entrusted with institutional tasks and/or the technical management of the site (for example hosting, management of any databases used by the site).

Personal data are in no case disseminated, this term meaning making them known in any way to a plurality of indeterminate parties. Personal data, without prejudice to their free movement between the states of the European Economic Area (EEA), are not transferred outside the EEA.

Changes to the notice

The data controller reserves the right to make changes to this notice at any time, giving notice to the user on this page. The user is therefore invited to consult this page frequently to stay constantly updated.

Data Protection Officer (DPO)

The Data Protection Officer is:

The Data Protection Officer can be reached at the controller's premises at Via Vittorio Veneto 56, 00187, Rome. In the case of written requests/communications to be sent digitally, the Data Protection Officer can be contacted using the following e-mail addresses:

• dpo@pec.lavoro.gov.it
• dpo@lavoro.gov.it

Rights of the data subject (user)

Please note that, at any time, the user may exercise the following rights:

• the right to receive, in a structured, commonly used and machine-readable format, the personal data concerning them provided to a controller and the right to transmit such data to another controller without hindrance from the controller to which they were provided;
• the right to obtain access to their personal data;
• the right to obtain the rectification of their personal data, where this does not conflict with the legislation in force on the retention of such data;
• the right to obtain the erasure of their personal data, where this does not conflict with the legislation in force on the retention of such data;
• the right to obtain the restriction of processing of their personal data;
• the right to object at any time, on grounds relating to their particular situation, to the processing of their personal data;
• the right to withdraw consent to the processing of their personal data at any time without affecting the lawfulness of processing based on consent given before the withdrawal;
• the right to object at any time to the processing of their personal data for direct marketing purposes, including profiling to the extent that it is related to such direct marketing;
• the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning them or similarly significantly affects them.

The user may exercise the above rights by means of a request addressed without formality to the data controller by hand delivery, traditional mail, registered letter, fax or by e-mail to the following addresses:

• dpo@pec.lavoro.gov.it
• dpo@lavoro.gov.it

To facilitate the exercise of these rights, the Italian Data Protection Authority has prepared a specific form that can be downloaded from the website www.garanteprivacy.it

Right to lodge a complaint

The user has the right to lodge a complaint with a supervisory authority (in particular with the Italian Data Protection Authority www.garanteprivacy.it).

Cookie policy

Further information on the use of personal data can be found in the "Cookie policy" document accessible at the following link: https://elearning.lavoro.gov.it/cookie-policy/index.php