European Lupus Society (hence, the “Controller”, “SLEuro” or the “Association”), in its quality of Data Processing Controller, as per section 13 of Italian Law Decree n. 196 dated June 30, 2003 (hence, the “Privacy Law”) and of section 13 of the European Union Regulation n. 679 dated 2016 (hence, the “Data Protection Regulation”) and subsequent modifications and integrations, collects and subsequently processes personal data1 of its members (hence, the “Data Subject” or the “Member”).

As per section 29 of the Privacy Law and section 28 of the Data Protection Regulation, the Association has designated in writing AIM Italy S.r.l., with legal offices in Italy, Milan (20141), Via Giuseppe Ripamonti n. 129, Italian fiscal number 00927270587, VAT number IT00943621003, phone +390256601.1, fax +390270048578 and email sleurosecretariat@aimgroup.eu as Data Processor; indeed, aforementioned company has been charged with the management of the Members’ addresses database.

1. Ways and purposes of use.

The Data Subject’s personal data are processed in the context of the institutional activity of SLEuro for the following purposes:

1. creation and subsequent management of the membership relationship;
2. fiscal, administrative and accounting duties strictly connected to aforementioned membership;
3. specific duties as foreseen by law, regulation or EU rules;
4. recurring distribution of scientific reviews and other editorial products by SLEuro;
5. mailing of the Association’s newsletter to update the Data Subject on all projects, initiatives and events promoted by the Association in the context of its activities for members;
6. mailing of information relating to initiatives and activities deemed to be of interest to the Member by Italian and international scientific associations and entities in contexts and with purposes similar to the ones of SLEuro, by means both of automated tools (such as newsletters, e-mails, SMS’s, MMS’s, robocalls, etc.) and of traditional tools (hardcopy mail and/or operator calls).

The processing of the personal data is executed, under authority of the Controller, by staff specifically commissioned, authorized and instructed for the processing as per section 30 of the Privacy Law and sections 28 and 29 of the Data Protection Regulation, by means of manual, automated or telecom tools, with logics strictly connected to the scopes and in any case in such a way as to guarantee confidentiality and security of the personal data.

The personal data will be stored for the entire duration of the membership relationship.

2. Juridical basis for processing, nature of the transfer and consequences of denial, consent by the Data Subject.

1. Purposes listed at preceding section 1, items 1., 2., 3., 4. and 5.
   With reference to the purposes listed at preceding paragraph 1, items 1., 2., 3., 4. and 5., the transfer of personal data is mandatory and represents a necessary condition for the creation and subsequent management of the membership relationship; indeed, the denial of transfer determines the impossibility to subscribe the Data Subject to the Association and to involve him/her in any initiative of the Association and, thus, the juridical basis of the related processing is the appropriate creation and management of the contract of membership, as per section 6, paragraph 1, letter b) of the Data Protection Regulation.
2. Purpose listed at preceding section 1, item 6.
   With reference to the purpose at preceding section 1, item 6., the transfer is optional and the denial of the related consent determines only the impossibility to receive information relating to initiatives and activities deemed to be of interest to the Member by Italian and international scientific associations and entities in contexts and with purposes similar to the ones of SLEuro. Thus, the juridical basis of the related processing is the explicit consent of the Data Subject, as per section 6, paragraph 1, letter a) of the Data Protection Regulation.

3. Entities and categories of entities to which the personal data may be communicated and context of communication.

With regards to the purposes of the processing as indicated above, and within the strict boundaries of pertinence to these purposes, the personal data of the Data Subject will be communicated in Italy, or in any case within the European Union, to the following entities, for the purpose of realization of the membership relationship:

1. to fiscal Authorities and other public Authorities, where mandatory by law or upon their request;
2. to financial institutions for the execution of payments related to the membership fee;
3. to the structures and/or external companies that SLEuro uses for the purpose of executing connected activities, instrumental or consequent to the creation and subsequent prosecution of the membership (such as for mailing congress programs, for training initiatives, for scientific project, for the mailing in subscription of scientific reviews, etc.);
4. to external consultants (e.g. for management of fiscal duties) if not designated Processors in writing;
5. provided specific consent is given, to Italian and international scientific associations and entities in contexts and with purposes similar to the ones of SLEuro, for mailing of information relating to initiatives and activities deemed to be of interest to the Member by means of both automated and traditional tools of communication.

Above entities, to whom the personal data of the Data Subject will be or may be communicated (insofar as not being designated as Processors), will treat the personal data as Controllers as per the Privacy Law, in full autonomy, being completely separated from the original processing executed by AIM.

Without the consent to communication of the personal data and to related processing, in those cases where it is foreseen by the Privacy Law, the operations which require communication might not be executed, with consequences known to the Data Subject.

A detailed and constantly updated list of these entities, including their respective offices, is always available at SLEuro’s legal offices.

Provided specific consent is given, the data of the Data Subject may be published on the website of the Association or on its reviews and/or scientific publications, as well as on the occasion of other initiatives – on hard-copy or soft-copy – strictly related with the participation to the membership activities. In case of training sessions filmed and/or recorded during events, an ad hoc Information Sheet will be provided and a specific consent will be requested.

4. Rights of the Data Subject.

Section 7 of the Privacy Law and sections 15 and following of the Data Protection Regulation grant the Data Subject the right to obtain:

• confirmation or denial of existence of personal data related to the Data Subject, even if not yet registered and their communication in an understandable form;
• indication of the origin of the personal data, of their purposes and of their ways of processing, of the logic applied in case of processing by means of electronic tools and of the identifying details of the Controller;
• update, rectification, integration, cancellation, transformation into anonymous data or blocking of data treated in violation of the law – including data for which conservation is not necessary for the purposes for which they were collected and subsequently processed. Documentation of these operations, also pertaining to their content, is brought to the attention of the Data Subjects whose data have been communicated or published, except for the case in which this duty is impossible to perform or requires the use of tools which are obviously disproportionate in relationship to the granted right.

Moreover, the Data Subject has the right to:

• revoke at any time the consent to data processing (without prejudice to the legitimacy of the processing prior to revocation);
• oppose, partially or completely, for legitimate reasons, to processing of his/her personal data, even if coherent with the purpose of collection;
• oppose, partially or completely, to processing of his/her personal data for the purpose of distribution of advertising materials or for direct sales or for market research or for commercial communication;
• propose a complaint to the Data Protection Authority as foreseen by the Data Protection Regulation.

Given that any consent expressed by the Data Subject related to being contacted for the purpose listed at preceding section 1, item 6 by automated means extends to traditional means as well, the Data Subject may contact SLEuro, at below addresses at any time, to exercise his/her right to oppose, also only partially, i.e. with reference to either one or the other of abovementioned methods.

In order to know the detailed and constantly updated list of the entities to whom personal data of the Data Subject may be communicated and to exercise the rights granted by section 7 of the Privacy Law and by sections 15 and following of the Data Protection Regulation, the Data Subject may contact the Data Processing Controller at the following addresses:

SLEuro c/o AIM Italy srl
Via Ripamonti n. 129
20141 Milan – Italy
Phone: +39 02566011
Fax: +39 0270048578
Email: SLEuroSecretariat@aimgroup.eu

5. Duration of the membership relationship

Without prejudice to the legal obbligations, the personal data of the Data Subject will be kept for the entire duration of the membership relationship.