Image ModifiedInformation on the processing of personal data pursuant to Art. 13 of the RGPD 679/2016

Dear Madam/Sir,

pursuant to art. 13 of the EU General Data Protection Regulation no. 679/2016, containing provisions on the processing of personal data (hereinafter, RGPD), we hereby inform you that BV TECH S.p.A., as the Data Controller of the data you have provided, will use this information concerning you and, qualified as "personal data" by the RGPD. The regulation states that anyone who processes personal data must inform the person concerned of what data is processed and of certain elements qualifying the processing, which must in any case be carried out in a lawful, correct and transparent manner, protecting your confidentiality and guaranteeing your rights.

1.DATA CONTROLLER

 The Data Controller is BV TECH S.p.A., with registered office at Piazza Diaz 6, 20123, Milan - Italy

2. DATA PROTECTION MANAGER (RPD/DPO)

The Data Protection Manager can be contacted at the following email address: dpogruppo@bv-tech.it.

3. PURPOSE OF PROCESSING AND NATURE OF DATA

 The information and personal data indicated below will be processed for the following purposes

...

1. Information relating to your request, if you contact us with questions or complaints;
2. Geographic location of the phone. The User can transmit the coordinates of his current geographical position to his contacts if he gives the PrivateWave application the permissions to access the position information. The coordinates are transmitted in end-to-end encrypted mode and are used to display the user's position on the map. The transmitted coordinates are anonymous and do not contain any data that can personally identify the user. Thanks to the end-to-end encryption, it is not possible for the PrivateWave server to trace the user's location;
3. Contacts in the address book. The User can optionally provide PrivateWave with the contact list of his telephone. The contacts are cryptographically hashed and transmitted to the server. They are used only to determine which contacts are PrivateWave users. The user's contact list is not stored in any way in the Privatewave server and is not shared with third parties;
4. Photo/video gallery. For sending photo or video attachments in messages. PrivateWave cannot in any way access end-to-end encrypted user messages and attachments;
5. Files on your phone. For sending attachments in messages. PrivateWave cannot in any way access end-to-end encrypted user messages and attachments;
6. Phone camera. For sending photo or video attachments in messages. PrivateWave cannot in any way access end-to-end encrypted user messages and attachments;
7. Phone microphone:
   1. for sending audio attachments in messages. PrivateWave cannot in any way access end-to-end encrypted user messages and attachments;
   2. for communication with other users. PrivateWave uses end-to-end encryption for VoIP calls and messages. The content of calls and messages is always encrypted and cannot be revealed to anyone except the sender and recipient.

4. LEGAL BASIS FOR PROCESSING

The personal data referred to in point 3) of the information notice will be processed lawfully because the following conditions are met:  

• processing is necessary for the performance of a contract to which the data subject is party or for the performance of pre-contractual measures taken at the request of the data subject (art. 6, par.1, letter b RGPD);
• processing is necessary for the purposes of pursuing the legitimate interests of the Data Controller (Art. 6(1)(f) GDPR).

5. OBLIGATION OR FACULTY TO PROVIDE DATA AND CONSEQUENCES OF REFUSAL TO DO SO

The provision of data is necessary for the establishment and management of the contractual relationship. We inform you that, in the absence of such data, it will be impossible for our Company to fulfil the obligations of the contract in place with you. Therefore, failure to provide such data will make it impossible to establish or continue the contractual relationship to the extent that such data are necessary for us to correctly fulfil the obligations related to the management of the contract.

6. STORAGE

Personal data in the rendez-vous cloud solution will be stored in the PrivateWave infrastructure in compliance with the conservation limitation principle provided for by the RGPD and/or for the time necessary to pursue the purpose of the service and for legal and / or contractual obligations.

Encrypted messages and their attachments are temporarily queued on the server to be delivered to recipient devices that are temporarily offline. PrivateWave cannot access end-to-end encrypted user messages in any way. The personal data for the on-premise solution are within the customer's infrastructure and therefore in the responsibility of the latter.

7. SECURITY MEASURES

We comply with all industry standard measures aimed at eliminating the risk of damage and unauthorized access or use of personal information, ensuring that we have implemented adequate technical and organizational policies to apply the security measures established by the RGPD.

...

Privatewave immediately realizes if a man-in-the-middle attack attempt is in progress, warning the user and immediately closing any type of communication. All data on the mobile device is stored in an encrypted database with an access PIN chosen by the user and which not even PrivateWave knows. The data is kept for the period of time that the user deems appropriate.

8. DATA PROCESSING METHODS AND RECIPIENTS

Your personal data will be processed both by the Company's staff, authorised to process them using electronic and paper-based instruments, and by external parties (collaborators and service providers) called upon to carry out specific tasks on behalf of the Data Controller, in their capacity as Data Processors, pursuant to art. 28 RGPD, subject to our letter of appointment imposing on them the duty of confidentiality and security in the processing of personal data, and with the adoption of suitable security measures to prevent loss and/or unlawful and incorrect use of the data and/or unauthorised access, in compliance with the provisions in force on the protection of personal data.

...

Instead, for the sake of brevity, the detailed list of authorized subjects and collaborators designated as Data Processors is available at the headquarters of the Data Controller and is at your disposal.

9. TRANSFER, DISSEMINATION AND COMMUNICATION OF DATA

The processed data will not be transferred to third countries or international organizations, will not be disseminated, and will not be communicated to third parties except, where necessary, for legal and/or contractual obligations.

10. RIGHTS OF THE INTERESTED PARTY

As envisaged by the RGPD, in relation to your data you are entitled to exercise the rights envisaged by articles 15 et seq. of the RGPD, as set out below, and more precisely

...