Privacy Notice on the Processing of Personal Data
1. Introduction and Data Controller
In compliance with the provisions of Chapter III – art. 12 of Regulation (EU) 2016/679 concerning the protection of personal data (hereinafter, the “Regulation”), the Company:
LOZZI ROMA s.a.s. di Claudio Lozzi
Via R. R. Pereira 102/a – 00136 ROMA
VAT No. 05005851000
in its capacity as Data Controller pursuant to art. 4, paragraph 7 of the Regulation, hereby informs data subjects about the personal data held and processed.
2. Types of Data Processed
For the management of the requested service, the Data Controller needs to process:
- common personal data (identification data);
- where necessary, special categories of personal data pursuant to art. 9 of the Regulation, including data relating to the person’s health.
The data are collected directly from the data subject, pursuant to art. 13 of the Regulation.
3. Recipients of the Processing
The data will be processed, within the limits of what is necessary, by authorized personnel adequately instructed and trained by the Data Controller, as well as by third parties providing services to the Data Controller and processing data on its behalf and under its instructions, as External Data Processors.
External professionals and organizations may operate only after formal appointment as External Data Processors, pursuant to art. 28 of the Regulation.
Any other communication and/or disclosure of data is excluded in the absence of the explicit consent of the data subjects.
4. Purposes and Legal Basis of the Processing
The processing is necessary in order to provide the requested services and is based on the principles of fairness, lawfulness, transparency, data minimization, and protection of the confidentiality and rights of the data subject.
The data provided will be processed for the following purposes:
- company management;
- personnel management;
- commercial, accounting, and tax compliance;
- occupational health and safety;
- legal and economic management of personnel.
Legal basis: art. 6, para. 1, letter b) of the Regulation, as the processing is necessary for the performance of a contract or pre-contractual measures adopted at the request of the data subject.
Purpose: dispute management.
Legal basis: art. 6, para. 1, letter f) of the Regulation, for the pursuit of the legitimate interest of the Data Controller or third parties.
5. Data Processing Methods
Data processing is carried out at the offices of LOZZI ROMA s.a.s., both in paper form and by electronic or otherwise automated means, adopting all measures suitable to guarantee the security and confidentiality of personal and special category data.
The processing takes place in compliance with appropriate security measures, through methods and tools suitable to prevent:
- loss or destruction, including accidental loss or destruction, of data;
- unauthorized access;
- unauthorized processing.
No processing involving automated decision-making or profiling activities is envisaged.
6. Data Retention
In compliance with the principles of lawfulness, purpose limitation, and data minimization, pursuant to art. 5 GDPR, personal data are retained for a period no longer than necessary to achieve the purposes for which they are collected and processed, as well as in accordance with the mandatory retention periods established by law.
By way of example, some data may be retained for 10 years, as required for accounting records and supporting documents, and in any case for the minimum period necessary.
7. Transfer of Data to Non-EU Countries
Should personal data be transferred to non-EU countries, they will in any case be processed in compliance with the provisions of Regulation (EU) 2016/679.
8. Rights of the Data Subject
The data subject may exercise the rights recognized by the Regulation, including:
- to obtain confirmation as to whether or not personal data concerning him or her exist and to receive such data in an intelligible form;
- to know the origin of the data, the purposes and methods of processing, the categories of processed data, the recipients, the retention period, and the possible existence of automated decision-making processes;
- to obtain updating, rectification, or completion of the data;
- to obtain erasure, anonymization, or blocking of data processed unlawfully;
- to obtain data portability;
- to object, in whole or in part, on legitimate grounds, to the processing of personal data concerning him or her;
- to object to processing for direct marketing purposes.
To exercise the rights listed above, you may contact:
LOZZI ROMA s.a.s.
Via R. R. Pereira 102/a – 00136 ROMA
info@lozziroma.com
9. Complaint
Where the relevant conditions are met, the data subject has the right to lodge a complaint with the Italian Data Protection Authority, according to the procedures indicated on the Authority’s official website: www.garanteprivacy.it.
For any further information and to exercise the rights recognized by the European Regulation, the data subject may contact the Data Controller directly.
Notice updated on: March 2026