Privacy Policy

The Data Controller

It is the VERESIS MEDICAL INSTITUTE, in the person of the legal representative currently in office, Via Gaetano Filangieri, 11 – 80121 Naples, VAT number 10596771211, email: info@veresis.it (from now on also the “Owner”).

Origin of the data

Art. 13 GDPR: the data are collected directly by the input of the interested party on the contact forms present on the website made available by the Owner (e.g. contact us, book, Owner’s landing page);

Article 14 GDPR: the data are collected in an indirect way, that is, through communication by third parties (e.g., transmission via Social platforms, third-party landing pages, etc.). It is always possible for the interested party to know the origin of the data by sending a request to the contact details indicated in the ’Data Controller” section.

Purposes of the processing

1) Provision of the web service

The collection of data and information takes place in order to enable the proper functioning and use of the website (operational data, statistical data, security information, etc.).

The data collection takes place automatically when the website pages are opened.

The data will be kept for a maximum of 6 months.

Legal basis: legitimate interest of the Data Controller consisting in the application of technical requirements strictly related to the proper functioning of the web pages.

2) Receipt of requests

The data collection will be carried out in order to respond to requests for contact or interaction that are spontaneously submitted through the forms present on the web page (e.g., “contact us,“ ”book now,” landing page).

For the management of requests, an external platform could be used (e.g., Facebook), in which case the data could be known to the application’s operator, who could treat them as the sole Data Controller. VERESIS MEDICAL INSTITUTE It indicates the use of external applications, displaying the representative icon of the same before sharing the data.

The provision of data is optional.

The data will be kept for the time necessary to process the request.

Legal basis: exercise of contractual and pre-contractual activities at the request of the interested party.

3) Marketing

The data are processed for the purpose of communicating commercial information (marketing).

The marketing activities that the Data Controller may carry out are the following:

1. A) Marketing by the Owner.

The Data Controller may send advertising communications via email, WhatsApp, SMS, messaging apps, postal service, social networks, newsletters, if the respective data is provided (name, surname, email address, phone number, date of birth, etc.). The Data Controller’s marketing is an optional process, carried out after obtaining prior consent.

The data will be kept until the consent is revoked.

Legal basis: consent.

1. B) Soft Spam

The Owner may send promotional communications by email, WhatsApp or postal service to customers to advertise products or services similar to those previously purchased. It is always possible to object to the processing by sending a communication to info@veresis.it.

The data will be kept until a request to object to the processing is received.

Legal basis: legitimate interest of the Data Controller pursuant to Article 130, paragraph 4 of Legislative Decree 196/03.

4) Work with us

The data collection will be carried out in order to verify the possibility of establishing a collaboration/employment relationship with those interested who spontaneously submit their applications and CVs using the appropriate form available on the website.

The data relating to the figures of interest to the company will be kept for a maximum of 12 months.

Legal basis: exercise of pre-contractual activities at the request of the interested party.

Communication of data to third parties

The data may be disclosed to third parties under legal obligations, and may also be disclosed to companies that perform, on behalf of VERESIS MEDICAL INSTITUTE, activities in the management of computer systems, accounting, debt collection, etc.

Furthermore, the data may be communicated to companies that carry out, on behalf of the Data Controller, marketing activities, promotional initiatives, surveys, research and analysis, only with the express consent of the Data Controller. 

The dissemination of personal data is not foreseen, unless the interested party explicitly consents.

Transfer of data to countries outside the EU

Web pages may share some of the data collected with services located outside the European Union area. In this regard, please read the Cookie Policy.

There are transfers outside the EU, with specific reference to the service provided by Google, whose databases can be allocated to countries outside the EU.

The legal basis for this processing, pursuant to Article 45 of EU Regulation 2016/679, is the recent adequacy agreement “Adequacy decision for the EU-US Data Privacy Framework” which allows the transfer of data to the USA, available at the following link: https://commission.europa.eu/document/download/fa09cbad-dd7d-4684-ae60 be03fcb0fddf_en?filename=Adequacy%20decision%20EU-US%20Data%20Privacy%20Framework_en.pdf&prefLang=it.

The Data Controller verifies the existence of appropriate legal bases for the transfer of data outside the EU.

Automated processes

No automated processes are planned, such as, for example, profiling.

Rights of the Data Subject

Pursuant to Articles 15 – 22 of the GDPR, the rights of the data subject are:

1. a) Access and right to copy the data;
2. b) Rectification;
3. c) Cancellation;
4. d) Limitation of processing;
5. e) Opposition;
6. f) The receipt in a structured, commonly used and readable format by an automatic device and the unhindered transmission of such data to another data controller; where technically feasible.
7. g) Revocation of consent

The interested party also has the right not to be subjected to a decision based solely on automated processing. For more information about the processing and to exercise the rights listed above, you can send a communication to the email address info@veresis.it.  

In the event of a violation in the processing of personal data, the data subject may file a complaint with the Data Controller, the Data Protection Authority, or the competent Legal Authority. It is possible to file a complaint with the Data Protection Authority in the event of a personal data breach.