Privacy Policy for Processing of Personal Data of Users

Aurora REcovery Capital S.p.A. (hereinafter “AREC”) would like to inform the users (the “Users”) of the website https://www.arecapital.com (the “Site”) about the modalities in which it processes the personal data according to the Legislative Decree No. 196/2003 (the “Privacy Code”) and to the new European Regulation No. 679/2016 on the protection of personal data (the “Privacy Regulation”).

1. Data controller and data processor

AREC with registered office in Via Abruzzi 3, 00187 Roma (Italy) is the data controller, which can be contacted at the following email address: privacy@arecapital.com. A complete list of the data processors can be requested through the above mentioned email address.

2. Personal data collected

AREC will process, according to this privacy policy, data provided by the Users, including:

  • personal data and contact details, in connection with the services provided through the Site;
  • browsing data related to the use of services offered through the Site collected through cookies and according to the cookie policy available at link to of the web site legal notes; and
  • data provided when requesting information or assistance

Health data or in general other special categories of personal data according to article 9 of the Privacy Regulation will not be processed. Personal data of minors will be processed according to the modalities explained in paragraph 8 below. The above mentioned data will be processed only in so far as it is necessary to the pursuit of the purposes described in paragraph 4 of this privacy policy.

3. Processing of personal data

Personal data of the Users are processed using electronic and/or paper means and are protected with the implementation of adequate security measures to ensure safety and confidentiality of the personal data. Specifically, AREC adopts appropriate technical and organizational measures to protect personal data against loss, theft, unauthorised use, disclosure, or alteration thereof.

When it is no longer necessary to process the personal data in an identifiable way for the purpose for which they were collected, or at the end of the retention period (further explained in paragraph 10), AREC will anonymize personal data and will remove identifiers.

4. Purposes of the processing

AREC asks its Users to provide their personal data for the following purposes:

  • to allow the User to enjoy the services provided through the Site, the customer service and to enforce or defend a rights toward the User or others (jointly defined as: “Contractual Purposes”);
  • to comply with legal and regulatory obligations (defined as “Legal Purposes”);
  • with the prior consent from the User, to send newsletters via email relating to the AREC and the funds that it manages and the Site as well as commercial information on AREC and the funds that it manages (defined as “Marketing Purposes of AREC”).

5. Legal basis for the processing

Processing of personal data for Contractual Purposes is mandatory since it is necessary to enjoy the specific services offered through the Site.

Processing of personal data for Legal Purposes is mandatory since it is required by the applicable laws. If the User does not wish his personal data to be processed for these purposes, he will not be able to enjoy the services offered through the Site.

Processing of personal data for Marketing Purposes of AREC, is not mandatory, and subject to prior consent of the User. If the User does not give his consent however, AREC will not be able to inform the User about new product or services.

6. Communication of personal data

For the purposes explained in paragraph 4, AREC might communicate Users’ personal data, strictly necessary to each type of processing, to the following categories of subjects:

  • employees, collaborators and suppliers of AREC, within the performance of their tasks and/or contractual obligation, in relation to the commercial relations with the Users;
  • subproviders and/or subcontractors within the context of the activities connected to the performance of services and the offer of products by AREC; and
  • Personal data of the Users will not be disseminated.

7. Overseas transfer of personal data

Personal data can be freely transferred outside the national territory, to other countries in the European Union.

8. Data subjects under 18 years old

The Site is not directed to minors. If the User is a minor, he will not be able to use the services offered through the Site.

9. Rights of the Users

Users will have at any time, and with no additional charge, the right to: (a) obtain confirmation as to the existence of personal data concerning him and, where that is the case, access to the personal data; (b) to know the origin of the data, the purposes of the processing, the ways in which the data are processed and the logic applied to the processing carried out through automated means; (c) to request the update, correction or – if he is interested – the integration of his data; (d) to request the erasure, the anonymization or the blocking of data unlawfully processed, and to object to the processing for legitimate reasons; (e) to object, fully or partially, to the processing of his personal data for direct marketing purposes carried out through automated and/or traditional means; (f) to withdraw his consent to the processing of his data at any time, without affecting the lawfulness of the processing based on the consent before its withdrawal.

In addition to the above mentioned rights, Users will also enjoy the rights enshrined in the following paragraph 10 c).

Users will be able, at any time, to exercise their right, to modify the contact details, to notify AREC updates regarding their data, to obtain the removal of the data communicated by third parties, or to obtain further information on the processing of their personal data carried out by AREC, by writing an email to the following address: privacy@arecapital.com.

10. Further provisions according to the Privacy Regulation

The following provisions are effective starting from May 25th 2018, when the Privacy Regulation starts to apply. Retention period of personal data:

  • AREC will process personal data for the time necessary to fulfil the specific purposes for which the data was collected according to paragraph 2 above. In any case, the following retention periods will apply to the processing of personal data for the following purposes:
  • data collected for Contractual Purposes according to paragraph 4 lett. a) will be retained for the duration of the contract and for 10 years after its termination to exercise/defend a right of DeA Capital, both in court and outside, where a claim should arise relation to the contract;
  • data collected for Legal Purposes according to paragraph 4 lett. b) shall be retained in accordance with the specific limitation periods defined by law;
  • data collected for Marketing Purposes of ARECaccording to paragraph 4 lett. c) shall be retained for the duration of the registration of the User to the Site through his account, and/or the participation to the online courses and/or the enjoyment of a service offered through the Site; and then for 2 years after the termination, deactivation and/or the deletion of the above;
  • Once these terms have expired, personal data of the Users will be deleted/anonymized and/or aggregated.

Additional rights: the User, at any time and in the ways and manners explained in the previous paragraph 9 will have the right to: (a) ask for a restriction of the processing when: (i) the accuracy of the personal data is challenged, for a period necessary for the controller to verify the accuracy of the personal data; (ii) the processing is unlawful and the User objects the to the erasure of the personal data and requests the restriction of their use instead; (iii) AREC no longer needs the personal data for the purposes of the processing, but they are required by the User for the establishment, exercise or defence of a legal claim; (iv) the User has objected to the processing pursuant to Article 21.1 of the Privacy Regulation, pending the verification on whether the legitimate reasons of the controller override those of the User; (b) object at any time to the processing of his personal data, except when AREC has an overriding legitimate interest; (c) ask for the erasure of his personal data without undue delay; (d) obtain the portability of his personal data; (e) where there are the conditions, bring a claim before the national data protection authority.

11. Updates

This privacy policy will be effective from the date indicated in its heading. AREC might change and/or integrate this document, also as a consequence of further modifications and/or integration of the Privacy Regulation. Updates and modifications will be notified in advance and Users will always be able to view the updated privacy policy at the following link http://www.arecapital.com/contactus If the User has doubts, questions or complaints with regard to the collection and processing of his personal data, he may contact AREC by writing an email to the address: privacy@arecapital.com.

Customer Satisfaction & Claims Italy : gestione.reclami@arecapital.com