The Data Controller is SURETY SHIELD SRL, VAT Number 13827730964, with registered office at Via Santa Maria Valle, 5, Milan – 20123.

• Certified Email (PEC): sure@pec.suretyshield.it
• Data Protection Officer (DPO): available at the following email address: privacy@goaps.it.

The Company minimizes the collection and processing of personal data strictly to what is necessary for the purposes pursued. The data collected include:

• Identification and contact data: Surname and First Name, telephone contact details, email address.
• Administrative and financial data: Tax data and banking details necessary for the organization and management of the contractual relationship.
• Images and audiovisual recordings: Photographic images and videos that may be collected during events or courses organized by Surety Shield S.r.l.

In order to provide our services and manage the Fideiussioni Digitali platform effectively, we process your data only where there is a valid legal basis (the so-called “legal basis”). Specifically, processing activities are divided into two main categories:

Data may be processed in paper-based, electronic and through systems using artificial intelligence, always in compliance with applicable legislation.

Surety Shield S.r.l. plans and adopts the necessary technical and organizational measures to minimize the risks of loss of confidentiality, availability and integrity, ensuring the continuity of the services provided. The Company adopts a privacy and compliance management system aligned with the following international standards:

• ISO 27001 (Information Security Management System) to protect data from unauthorized processing, loss or accidental destruction.
• ISO 37301 (Compliance management systems).
• ISO 31000 (Risk Management).
• ISO/IEC 29134 (Guidelines for privacy impact assessment – PIA).

SURETY SHIELD SRL does not disclose or communicate personal data to third parties for purposes other than those described above. For the performance of its activities, the Data Controller may use third-party entities that will be appointed as External Data Processors (Article 28 GDPR), and instructed to process data in compliance with appropriate security measures:

• Providers of administrative services (e.g. accountants);
• Providers of technical assistance for IT systems and software providers;
• CETIF ADVISORY SRL (controlling company);
• Banking and insurance institutions.

Company employees and collaborators are appropriately trained and appointed as authorized persons/data processors pursuant to Article 29 of the GDPR. A system administrator has also been appointed in accordance with the provisions issued by the Italian Data Protection Authority.

Personal data are stored according to the following criteria:

• For the entire duration of the existing contractual relationship;
• Until the termination of the contractual activity and the fulfilment of the administrative and tax requirements provided by law (e.g. 10 years for accounting documentation);
• For a longer period in relation to specific requests from public authorities;
• Within the limits of the statutory limitation period of rights, for purposes related to exercising the right of defense in the event of disputes.

As a data subject, the GDPR (Articles 15 and following) grants you specific rights that you may exercise at any time by contacting the Data Controller at the contact details indicated in Section 1:

• Right of access: to know whether or not processing of your personal data is taking place;
• Right to rectification or erasure (right to be forgotten): to correct inaccurate data or request its deletion;
• Right to restriction of processing: in the cases provided for by Article 18 of the GDPR;
• Right to data portability: to receive your personal data in a structured and machine-readable format;
• Right to object: to object at any time to processing for legitimate reasons or for marketing purposes;
• Right to lodge a complaint with a supervisory authority (in Italy, the Italian Data Protection Authority – www.garanteprivacy.it).