Procedure regarding the rights of data subjects

Procedure regarding the rights of data subjects

The General Data Protection Regulation (EU Regulation 2016/679) (hereinafter also “Regulation” or “GDPR”) grants interested parties the exercise of the following rights towards the Data Controller:

  • Right of access art. 15 GDPR: in order to request confirmation as to whether or not personal data is being processed;
  • Right of rectification art. 16 GDPR: to request the rectification or integration of the data provided, if inaccurate;
  • Right to cancellation art. 17 GDPR: to request that the processed data be canceled (for example if they are no longer necessary for the purposes for which they were collected; or in the event of withdrawal of consent; or even if the processing is unlawful);
  • Right to limitation of treatment art. 18 GDPR: so that the data processed by the Data Controller are marked in order to limit their processing in the future;
  • Right to data portability art. 20 GDPR: in order to obtain the receipt of personal data, or the transmission of data to another Data Controller, in a structured format, commonly used and readable by an automatic device;
  • Right to object art. 21 GDPR: to oppose the processing of data at any time, unless there are legitimate reasons for proceeding with the processing which are prevalent (for example for the exercise or defense in court).

Categories of interested parties

For the purposes of this procedure, the categories of interested parties, whose data are processed by Qura Srl as identified in the Data Processing Register drawn up pursuant to art. 30 of the GDPR:

  • Interested parties attributable to the HR Area : candidates, employees, family members of employees and former employees of Qura Srl as well as freelancers who work for the Company and employees of third parties who provide services in favor of the same;
  • Interested parties attributable to the Administration Area: customers, suppliers, professional firms, consultants, in relation to the management of the contracts stipulated with them and the relative fulfillment of all the activities connected, instrumental and/or complementary to the management of the relationship;
  • Other interested parties: web users as well as all individuals, external to Qura Srl and in general any natural person whose personal data Qura Srl is the owner of, which are not attributable to the previous categories

Exercise of the right by the interested party and receipt of the request by Qura Srl

  • The exercise of rights is free;
  • The exercise of rights is conditional on the prior identification of the interested party, the interested party together with the request must – therefore – enclose a copy of a valid identification document;
  • It can also be presented by means of a delegate with a specific mandate/delegation;
  • To exercise the rights, a request can be sent via PEC to the address qura srl or by registered letter with return receipt to the address of Qura Srl via di Mezzo 23, Mirandola, (MO).
  • Following receipt of the request, Qura Srl will take care of verifying the identity of the interested party as well as the submitted request;
  • Within 30 days of the request (extendable to 60 days in cases of complexity) the Data Controller will respond to the request submitted by the interested party.

Please note that Qura S.r.l. has appointed a Data Protection Officer pursuant to art. 37 of the EU Reg. 679/2016 which can be contacted at any time by interested parties at the e-mail address