Novartis Convention

In compliance with the obligations deriving from applicable national legislation (Legislative Decree no. 196 of 30 June 2003, Personal Data Protection Code, as updated by Legislative Decree 101/2018) and EU legislation (European Regulation 2016/679, the “GDPR”) and subsequent amendments, this website respects and protects the privacy of visitors and users, putting in place every possible and proportionate effort to not infringe on users’ rights.
This Privacy Policy applies only to online activities carried out on this website and is valid for visitors/users thereof. The Privacy Policy does not apply to information collected via channels other than this website. The purpose of the Privacy Policy is to provide maximum transparency with regard to the data collected by the website and to how this data is used.

DATA CONTROLLER AND DATA PROCESSOR.
The Data Controller is VIDEE S.p.A., with registered office in Via Roggizuole 3 – 33170 PORDENONE (PN), Italy, whom you can contact by email at [email protected] or by phone at +39 0434 593613.
Please also note that VIDEE S.p.A. appointed the OneMore S.r.l. company (contact person Natolino Alessandro), located in Via Carnia 1 – Fraz. Rodeano Alto – 33030 RIVE D’ARCANO (UD), Italy, as the Data Protection Officer (“DPO”), which can be contacted by phone at +39 0432 807545 or by email at [email protected].

DATA COLLECTED
This website collects and processes personal data, as defined by the GDPR, independently, through third parties or provided voluntarily by the user, including:

• Cookies and usage data, collected through automated processes;
• Data of a personal nature (e.g. names, email addresses, telephone numbers, CVs) pertaining to the user – the latter provided voluntarily by the user and not consequential to the operation of the website.

When marked with the "*" character, the data requested by the website is mandatory. If the user refuses to communicate such data, it may be impossible for the Data Controller to provide the service. In cases where the website specifies certain data as optional, users are free to refrain from providing such data, without this having any effect on the availability of the service or on the operation of the website.
Users who have questions concerning required data are encouraged to contact the Data Controller, including through the DPO.
Unless otherwise stated, any use of Cookies – or other tracking tools – by this website or by owners of third party services used by this website, aims to provide the service requested by the user, in addition to any other purposes described in this document and in the Cookie Policy, which should be referred to for additional information.
The user assumes full responsibility for the personal data of third parties obtained, published or shared using this website and warrants to have the right to communicate or disseminate such data, releasing the Data Controller from any liability towards third parties.

DATA PROCESSING METHODS.
The Data Controller shall take appropriate security measures aimed at preventing the unauthorised access, disclosure, modification or deletion of personal data. The personal data is processed using electronic and/or telematic tools, based on organisational procedures and logic strictly related to the purposes indicated above. In addition to the Data Controller, in some cases, other parties may have access to the data, such as employees involved in the organisation of the website (administrative personnel, sales staff, marketing staff, legal staff, system administrators, etc.) or external parties (third party technical service providers, mail carriers, hosting providers, IT companies, media agencies, etc.) also appointed, as necessary, as Data Processors by the Data Controller. The updated list of Data Processors may be requested from the Data Controller.

LEGAL BASIS OF THE DATA PROCESSING.
The Data Controller shall process personal data pertaining to the user according to the following conditions:

• the data processing is necessary in order to fulfil the user’s request;
• the user has given his/her explicit consent for one or more specific purposes.

It is however always possible to request for the Data Controller to clarify the actual legal basis for each specific data processing operation and in particular to specify if the data processing is based on the law, provided for by a contractual agreement or necessary to enter into a contract.

PLACE OF PROCESSING.
Data collected by the website is processed by the Data Controller located in Via Roggizuole 3 - PORDENONE (PN), Italy, and shall only be handled by technical personnel authorised to process the data, or by persons entrusted to carry out occasional maintenance operations.
This website may share some of the data collected with services located outside the European Union. The transfer of such data is authorised under specific decisions of the European Union and of the Italian Authority for the Protection of Personal Data, in particular Decision 1250/2016 (Privacy Shield), for which no additional consent is required.

DATA RETENTION PERIOD
Data is processed and retained for the time required in relation to the purposes for which such data was collected. In particular, personal data collected for purposes based on the User’s consent may be retained until such consent is revoked, or until the user’s request has been satisfied, and in any case for a period not exceeding 2 (two) years, unless a right is exercised by the user itself. CVs submitted through the “Work with us” section on the website shall be retained for a period not exceeding 2 (two) years.
Moreover, the Data Controller may be required to retain personal data for a longer period of time, in compliance with a specific legal obligation or by order of an Authority. At the end of the retention period, the personal data shall be deleted. Therefore, at the end of this period the user shall no longer be able to exercise their right of access, deletion, rectification and the right to data portability.

DATA COLLECTION PURPOSE
Users’ data is collected for the following purposes:

• monitor the infrastructure;
• allow the Data Controller to provide the service requested by the user;
• contact users to answer their requests or other solicitations received through the “Contact Us" section of this website;
• assess the user’s professional profile via the data and CVs received through the “Work with us” section of this website.

For more detailed information on the purpose of the data processing and on the specific personal data relevant to each purpose, the user may contact the Data Controller, including through the DPO.

SECURITY MEASURES
This website processes user data in a lawful and correct manner, adopting appropriate security measures to prevent the unauthorised access, disclosure, modification or unauthorised destruction of data. The personal data is processed using electronic and/or telematic tools, based on organisational procedures and logic strictly related to the purposes indicated above. In addition to the Data Controller, in some cases, other parties may have access to the Data, such as employees involved in the organisation of the website (administrative personnel, sales staff, marketing staff, legal staff, system administrators, etc.) or external parties (third party technical service providers, mail carriers, hosting providers, IT companies, media agencies, etc.).

USER’S RIGHTS
Pursuant to European Regulation 2016/679 (GDPR) and applicable national legislation, the user may, in the manner and to the extent permitted by applicable law, exercise the following rights:

• Request confirmation of the existence of personal data concerning him or her (right of access);
• Be informed of the origin of the data;
• Receive intelligible communication;
• Obtain information on the logic, methods and purposes of the data processing;
• Request the updating, rectification, integration, deletion, transformation into anonymous form or blocking of data processed unlawfully, including personal data that is no longer needed to achieve the purposes for which it was originally collected;
• In cases of processing of personal data based on consent, receive, incurring only the cost of any eventual media, the data provided to the Data Controller in a structured format, readable by a computer/data processing system and in a format commonly used by electronic devices;
• The right to file a complaint with the Supervisory Authority (Italian Authority for the Protection of Personal Data) and, more generally, to exercise all the rights recognised by current legislation.

Requests should be addressed to the Data Controller or to the appointed Data Protection Officer.
Where the data is processed based on legitimate interests, the rights of the data subjects are nevertheless guaranteed (with the exception of the right to portability, which is not provided for by applicable regulations), in particular the right to object to the data processing, which can be exercised by sending a request to the Data Controller.