Information on the processing of personal data pursuant to art. 13 of Regulation (EU) 2016/679

1. Data controller

The Data Controller is FERLOG SERVICE SRL , VAT number 05265570654 , REA 2706109 , with registered office in Via Valtellina 5/7 – 20259 Milan (MI) , PEC: ferlogservicesrl@pec.it .

2. Data Protection Officer (DPO)

The Data Protection Officer is Avv. Rocca Maria who can be contacted at privacy@lacadipietro.it .

3. Scope of application

This policy applies to personal data collected through the FERLOG SERVICE SRL website in relation to:

• site navigation;
• information requests;
• bed reservations;
• pre-contractual and contractual management of accommodation;
• administrative, fiscal, accounting and public safety obligations;
• Management of obligations related to the university housing project funded under the PNRR.

4. Types of data processed

They can be treated:

• personal and identification data (name, surname, date of birth, tax code, identity document details);
• contact details (address, email, telephone, certified email);
• data relating to bookings, bed assignments and contractual relationships;
• tax and payment data;
• data required for legal compliance, including reporting of guests to the competent authorities;
• Browsing data and data collected through cookies and similar tools.

5. Purpose of the processing

Personal data are processed for the following purposes:

1. allow navigation and the correct functioning of the site;
2. respond to requests for contact, availability and information;
3. manage reservations, assignments and the stipulation of rental or hospitality contracts;
4. carry out administrative, accounting, fiscal and civil obligations;
5. comply with public safety and other legal obligations;
6. protect the rights of the Data Controller, prevent fraud and manage any disputes;
7. Comply with the monitoring, reporting, verification, and document retention obligations associated with the PNRR project for the university residence in Monza, Via Valosa di Sopra no. 3.

6. Legal basis for processing

The treatment is based on:

• on the execution of pre-contractual measures adopted at the request of the data subject and/or on the execution of the contract, pursuant to art. 6, paragraph 1, letter b), GDPR;
• on the fulfillment of legal obligations to which the Data Controller is subject, pursuant to art. 6, paragraph 1, letter c), GDPR;
• on the legitimate interest of the Data Controller in security, prevention of abuse, and defense of its rights, pursuant to Art. 6, paragraph 1, letter f), GDPR.

7. Nature of the transfer

Providing the data required for requests, reservations, and the conclusion and execution of the contract is mandatory. Failure to provide such data may make it impossible to process the interested party’s request or conclude the contractual relationship.

8. Treatment methods

Data processing is carried out using paper, electronic, and IT tools, using methods strictly related to the indicated purposes and adopting appropriate technical and organizational measures to protect personal data, in accordance with the security obligations set forth in the agreement with the University.

9. Data recipients

The data may be communicated, within the limits of the purposes indicated above, to:

• banking institutions and payment service providers, including those involved in online payments via Nexi;
• tax, legal, administrative and IT consultants;
• providers of technical services, hosting, website management, maintenance and organizational support;
• public security authorities, administrative authorities, judicial authorities and public bodies, in the cases provided for by law;
• public bodies involved in the verifications, controls and reporting of the PNRR financing, including the Ministry, Cassa Depositi e Prestiti SpA and other competent bodies where applicable.

10. Data transfer

For processing related to the university agreement, the data “may be transferred exclusively within the European Union.”
FERLOG adopts the same criteria for processing governed by this policy, unless otherwise indicated to the interested party where permitted by law.

11. Retention period

The data is retained for the time strictly necessary for the purposes for which it is collected and, for legal and tax obligations, for 10 years after the termination of the contractual relationship .
Additional retention periods may arise from reporting, monitoring, and control obligations related to the PNRR funding.

12. Rights of the interested party

The interested party may exercise the rights provided for in Articles 15-22 of the GDPR, including:

• data access;
• rectification;
• cancellation in permitted cases;
• limitation of processing;
• opposition;
• portability, where applicable.

Requests can be sent to the Data Controller via certified email (PEC) at ferlogservicesrl@pec.it and to the DPO , Avv. Rocca Maria, via the address privacy@lacasadipietro.it .

The interested party also has the right to lodge a complaint with the Data Protection Authority.

13. Treatments carried out on behalf of the University

For data processed within the scope of positions reserved for the University, the agreement states that “The Data Controller is the University” and that “The ‘external’ Data Processor is Ferlog” .

In such cases, the separate privacy regulations relating to the relevant relationship apply.