Regulation (EU) 679/2016





Pursuant to Article 13 of Regulation (EU) 2016/679 on the protection for natural persons with regard to the processing of personal data (hereinafter for brevity referred to as the "Regulation" or "EU-REG")


P.RE.ST Ltd. (hereinafter referred to as the "Data Controller") hereby informs you about the processing of your personal data pursuant to Article 13 of Regulation (EU) No. 679/2016.


1.       Purpose of the processing for which the personal data are intended and legal basis of the processing

The Data Controller processes personal identification data (e.g. first name, surname, company name, address, telephone number, e-mail address, bank and payment details), hereinafter referred to as "personal data" or also "data", which you provide when concluding contracts for services provided or to be provided in the future for the following purposes:

a)       for the performance of contracted services or for the performance of pre-contractual processes related or connected to these services and/or for the performance of specific requests.

In these cases, the legal basis of the processing is the fulfilment of contractual or pre-contractual obligations by the Data Controller;

b)      for the proper performance of obligations provided for by law, regulation or EU legislation, as well as for the fulfilment of measures adopted by public authorities empowered to do so or by supervisory and control bodies to which the Data Controller is subject (e.g. tax audits, etc.). In these cases, the legal basis of the processing is compliance with a legal obligation pursuant to Article 6(1)(c) of the GDPR;

c)       with your express consent or pursuant to art. 130, par. 4 of the Legislative Decree 196/03, if applicable, for commercial or marketing purposes, such as the forwarding of commercial and marketing communications relating to the real estate sector, the newsletter with information on the activity of the Data Controller or company brochures, for surveys on the quality of service or statistical surveys. In these cases, the legal basis of the processing is the explicit consent pursuant to Art. 6.1, letter a) of the Regulation (EU) or Art. 130, para. 4 of the Legislative Decree 196/03. In any case, you can object to the processing by unsubscribing from the mailing list or the service.


2.       Data provision and consequences of non-provision of data

The provision of data for purposes a) and b) is necessary for the performance of the contractual relationship and for the fulfilment of the legal obligations. The refusal to provide the personal data or the lack of consent to their processing makes it impossible for the Data Controller to provide the requested services and fulfil the purposes stated in point 1, letters a) and b) of this information letter.

On the other hand, the provision of data for the purposes mentioned in point 1, letter c) of this information letter is on a voluntary basis. The data subject is free to give or refuse consent. Even after consent has been given, the data subject is free to revoke it at any time.


3.       Data processing methods

The processing of your personal data will be performed in accordance with the principles of lawfulness, accuracy and transparency, while respecting your confidentiality and the one of your family members in accordance with the principles of Article 5 of the Regulation (EU). The processing may be carried out manually, by paper means and also by electronic or otherwise automated means.

The data is collected and processed on the premises of the Data Controller in specific document archives/servers.

Your personal data will be processed using appropriate technical and organisational security measures in accordance with Article 32 of the Regulation (EU), in order to ensure a level of security appropriate to the risk, by minimising the risks of destruction or loss, unauthorised access or processing not in compliance with the purpose of the collection.

Your personal data will not be used for automated decision-making or profiling.


4.       Data transmission and transfer to third countries

Your personal data will not be forwarded.

In order to fulfil the purposes mentioned in point 1) of this information letter, it may be necessary for the Data Controller to disclose your personal data to external, trusted third parties, namely:

a)       to companies belonging to the Group;

b)      to credit institutions for banking and payment services, to companies providing computerised postal services, to companies archiving and storing documents and to other providers of outsourced functional services;

c)       to the Data Controller's legal and tax advisers;

d)      to insurance or reinsurance companies or directly to liable third parties if the banks, insurance or financing companies exercise their right of recourse.

The aforementioned legal entities process the data, , as the case my be, as independent Data Controllers or as data processors duly mandated to do so by contractual agreements pursuant to Article 28 of the Regulation (EU).

Your personal data will generally not be transferred to a third country outside the EU or to international organisations. However, should this be necessary, the data transfer will be performed in compliance with the provisions of the EU-REG.


5.       Storage period for personal data

Your personal data will be stored throughout the duration of the contractual relationship and also after its termination for a period as long as necessary to comply with all applicable legal (e.g. tax) and/or administrative obligations related to or arising from the relationship (10 years). Your consent to data processing for marketing activities will be stored as long as it is required by legal obligations and in any case until you withdraw it.


6.       Identity and contact details of the Data Controller, the privacy contact person and the data protection officer

The Data Controller is P.RE.ST Ltd., with registered office at Via Galileo Galilei 10, 39100 Bolzano (BZ), e-mail, phone secretariat/PR +39-0471-533.690, certified e-mail address

The privacy contact person, to refer to in order to exercise the rights foreseen in the Regulation (EU), listed in the following clause, can be addressed as follows: P.RE.ST Ltd., with registered office at Via Galileo Galilei 10, 39100 Bolzano (BZ), e-mail, telephone secretariat/URP +39-0471-533.690, certified e-mail address

Please also note that no data protection officer has been appointed.


7.       Rights of the person(s) concerned

The following rights are granted to you at any time, provided that you are able to exercise them in accordance with Articles 15 to 22 of Regulation (EU) 679/2016:

a)       to obtain confirmation as to whether or not personal data relating to you exist;

b)      to obtain information on the purposes of the processing, the categories of personal data, the recipients or categories of recipients to whom the personal data have been or will be disclosed and, where possible, the duration of the storage;

c)       to request the rectification and erasure of data;

d)      to obtain the restriction of processing;

e)      (where applicable) to obtain data portability, i.e. to receive the data from the Data Controller in a structured, commonly used and machine-readable format and to transmit it without hindrance to another Data Controller;

f)        to oppose processing at any time, including in the case of processing for direct marketing purposes;

g)       to oppose automated decision-making concerning data subjects, including profiling;.

h)      to obtain from the Data Controller access to and rectification or erasure of personal data concerning you, or to object to processing, in addition to the right to data portability;

i)        to revoke the consent at any time without affecting the lawfulness of the processing based on the consent given before the revocation;

j)        to lodge a complaint with the Italian Data Protection Authority, located in Rome, Piazza Venezia n. 11, official website of the Authority:

The rights can be exercised by contacting the Data Controller, the privacy contact person or the data protection officer (if any) at the addresses mentioned in the previous paragraph.


The Data Controller reserves the right to change, update, supplement or remove parts of this privacy policy if relevant legislation changes. Data subjects are obliged to check the company's website regularly for changes.