INFORMATION ON THE PROCESSING OF PERSONAL DATA
ai sensi dell’articolo 13 del Regolamento (UE) 2016/679
This information is provided by d-flight Spa (hereinafter, the "Company" or the "Data Controller") as data controller pursuant to Regulation (EU) No. 679/2016 (hereinafter, the "GDPR") and Legislative Decree No. 196/2003 and its ss. mm. ii. (hereinafter, the "Code" and jointly with the GDPR, the "Privacy Regulations "
ENAC is the data controller in relation to the provision of services through the platform d-flight [www.d-flight.it/web-app]
ENAV Spa is the data controller
d-flight Spa is sub data controller.
Identity and contact details of the data controller
ENAC, headquartered in Rome, via Castro Pretorio 118, is the data controller for the provision of services through the platform d-flight to which you may contact to exercise the rights recognized by Regulation (EU) 2016/679 at the following contact points:
- telephone: (+39) 0644596200
- e-mail: segreteria.presidente@enac.gov.it
- e-mail: segreteria@d-flight.it
Data Protection Officer
Each Data Controller has appointed a Data Protection Officer, also referred to as the Data Protection Officer (DPO), who can be contacted, using the contact details provided in this policy, to receive more information about the processing of personal data and to obtain assistance in relation to any petitions addressed to the Data Controller regarding the protection of personal data.
- The d-flight Data Protection Officer (DPO) can be reached at the following email address: dpo@enav.it
- The ENAC Data Protection Officer (DPO) can be reached at the following email address: privacy.dpo@pec.enac.gov.it
Personal data processed
d-flight in connection with marketing related activities, will process the following categories of personal data, by way of example but not limited to:
- identification and contact data such as: first name, last name, email address, telephone number.
Consequences of non-disclosure of personal data
In cases where the provision of personal data (in particular, personal data, e-mail address) is necessary, any refusal to provide personal data will result in the impossibility to comply with the requests of the data subject or to provide the available services or, again, to properly fulfill the obligations incumbent on the data controller under the applicable legislation.
Purpose and legal basis
Personal data will be processed by ENAC in connection with services related to the registration of users of the platform and the services provided through it, the registration of operators of the Remotely Piloted Systems (SAPRs) and the electronic identification service of SAPRs, where provided for by the regulations in force issued by ENAC.
The legal bases for the processing of personal data are identified:
- in the performance of a contract to which the data subject is party or the performance of pre-contractual measures taken at the request of the data subject (Article 6(1)(b) of Regulation (EU) 2016/679);
- in the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller (Article 6(1)(e) of Regulation (EU) 2016/679).
Personal data will also be processed by d-flight in connection with marketing-related activities (e.g.: invitations to events, presentation of new products and/or services, periodic sending of newsletters, satisfaction surveys on the quality of services by e-mail, mail and/or sms or telephone contacts), in the presence of an appropriate legal basis identified in the express consent of the data subject (Article 6(1)(a) of Regulation (EU) 2016/679).
Retention of personal data
Data will be kept for the time necessary to achieve the purposes for which they were collected and for the duration of the requested service.
Transfer of personal data to third countries or international organizations
The processed personal data will not be disseminated and will not be transferred abroad to countries outside the European Economic Area (EEA).
Processing methods
The processing of personal data will be carried out by means of suitable electronic and/or telematic tools, with logic strictly related to the aforementioned purposes, in compliance with the security rules provided by law and/or internal regulations and, in any case, in such a way as to ensure the security and confidentiality of the data.
The management and storage of personal data take place on servers located at Enav and/or on external servers of suppliers of certain services necessary for the technical-administrative management, appointed as Data Processors, who, for the sole purpose of the requested service, may come to know the personal data of the interested parties.
Personal data are processed by d-flight employees and collaborators of companies appointed for this purpose as data processors, and/or Data Processors appointed pursuant to Article 28 of the GDPR.
The data will be processed with the use of security measures to ensure confidentiality to the data subject to whom the data relate, and to prevent undue access by third parties or unauthorized personnel.
This is without prejudice, in any case, to the communication of the data of the interested parties to all subjects whose right to access said data is recognized by law.
This information is also provided for the possible collection of individual personal data (first name, last name, e-mail address, etc.) through the computerized procedures implemented through the use of mailboxes and online services made available by d-flight.
The optional, explicit and voluntary sending of electronic mail or online forms involves the subsequent acquisition of the sender's address, necessary to respond to requests, as well as any other personal data included in the message. The legal basis for the highlighted processing can be found in the legitimate interest of the data controller pursuant to Article 6(1)(f) of Regulation (EU) 2016/679.
Rights of the interested party
Each data subject in relation to the personal data communicated may, at any time, exercise the rights granted to him/her under Articles 7 (withdrawal of consent at any time) and 15 to 21 of the GDPR including in particular:
- obtaining confirmation as to whether or not personal data concerning you are being processed;
- accessing and requesting copies of the following information: the purposes of the processing; the categories of personal data; the recipients or categories of recipients to whom the personal data have been or will be disclosed (including recipients in third countries or international organizations); the expected period of storage of the personal data or, if this is not possible, the criteria used to determine this period; the origin of the personal data where not collected from the data subject; the existence of automated decision making including profiling; and information on the logic used;
- requesting the rectification of inaccurate personal data;
- requesting deletion (right to be forgotten);
- obtaining restriction of processing;
- objecting to processing;
- integration of incomplete personal data;
- obtaining portability of data, through a structured, commonly used and machine-readable format and to transmit without hindrance such data to another data controller, where technically feasible.
The data subject may exercise the rights recognized by Regulation (EU) 2016/679, where applicable, by means of a request forwarded to the Data Controller or the Data Protection Officer (DPO) at the contacts indicated in this notice.
Right to lodge a complaint
If the data subject considers that the processing operations carried out by the Data Controller may have violated the applicable data protection regulations, he/she has the right to lodge a complaint with the Data Protection Authority pursuant to Article 77 of Regulation (EU) 2016/679 as provided on the institutional website of the Authority.