INFORMATION FOR MEMBERS (INDIVIDUAL MEMBER AND NATURAL PERSON APPOINTED BY A CORPORATE MEMBER)

Please note that the GDPR applies only to the personal data of natural persons. We are writing to follow up on what has already been communicated verbally to inform you again, in writing, that your personal data will be processed in accordance with the aforementioned legislation and the confidentiality obligations underpinning the activities of AiCARR – Italian Association of Air Conditioning, Heating and Refrigeration (hereinafter also “the Association” or “AiCARR”).

1) Source of Personal Data

The personal data held by the Association consists of the data you provided upon registration and that collected during the term of your membership.

2) Purposes and Methods of Processing

Your personal data will be processed for institutional purposes and for purposes connected with or instrumental to the Association’s activities and the membership contract, namely:

1. compliance with obligations laid down by law, regulations and EU legislation;
2. establishment and management of the membership relationship;
3. compliance with tax and/or accounting obligations associated with membership;
4. sending the receipt for payment of the membership fee by email;
5. sending, by email, communications relating to membership, the life of the Association and its governing bodies;
6. management of matters relating to the exercise of members’ voting rights;
7. access to the AgorAiCARR service, which allows members to submit technical queries to experts identified by the Association (questions and answers are published with only the member’s Association registration number shown);
8. access to the Job Placement service, which allows members to post a job advertisement in the dedicated section of the Association’s website and to be put in touch with interested parties; 
9. sending newsletters and other communications via email regarding the Association’s activities (conferences, technical meetings, courses, publications, etc.), including training activities/events organised by the Association through AiCARR Educational S.r.l. - SB, and sending selected issues of the print magazine AiCARR Journal to your address;
10. publication on the website www.aicarr.org of the member’s name and city of residence;
11. publication of your contact details (first name, surname, email address and profession) on the page reserved for full members on the website www.aicarr.org, in order to enable you to participate in the members’ network;
12. disclosure of your contact details to Meritorious Supporting Members (as defined in Article 4 of the Association’s Bylaws) for commercial purposes;
13. security and functionality of the IT system; 
14. management of disputes in the event of non-compliance, complaints, legal disputes or settlements;
15. anonymous and/or aggregated statistical analysis.
    
     

Members’ personal data may be selected and/or extracted by AiCARR based on region of residence, professional sector, etc. for statistical purposes in aggregated and therefore anonymous form.
The processing of your personal data will be based on principles of fairness, lawfulness and transparency, purpose limitation, relevance, adequacy, non-excessiveness in relation to those purposes, and accuracy; the processing will also be carried out whilst safeguarding your privacy and your rights, as well as using appropriate tools to ensure security and confidentiality.
The methods used to process your personal data will involve the use of manual, IT and telematic tools, with procedures strictly related to the purposes indicated above.

In order to fulfil all the purposes set out above, AiCARR will need to process your personal identification data (first name, surname, address, tax reference number, email address, telephone number, company name, etc.).

4) Legal Basis for Processing (Article 13(1)(c) GDPR)

In accordance with Article 6 of the GDPR, the legal basis for processing:

• with regard to purposes 1), 2), 3), 4), 5), 6) and 7), is the performance of the membership contract to which you are a party and the fulfilment of legal obligations to which the Data Controller is subject;
•  with regard to purposes 8), 9), 10), 11) and 12), is the consent you have given via the form below;
•  with regard to purpose 13), it is the Data Controller’s legitimate interest in the security of networks and information systems;
•  with regard to purpose 14), it is the need to establish, exercise or defend a legal claim in court;
•  with regard to purpose 15), it is the Data Controller’s legitimate interest in optimising the services offered.

We invite you to notify us promptly of any changes to your personal data so that we can keep our records up to date.

5) Mandatory or Optional Provision of Personal Data and Consequences of Failure to Provide Such Data (Article 13(2)(e) GDPR)

The provision of your personal data, in relation to purposes 1), 2), 3), 4), 5),6), 13) and 14), is optional but necessary for the establishment, performance and proper management of the membership relationship and is also mandatory for compliance with legal obligations. Therefore, failure to provide data will make it impossible to conclude and perform the membership contract.
The provision of your personal data in relation to purposes 7), 8), 9), 10), 11) and 12) is optional, and should you not wish to give your consent, this would in no way affect the establishment of the membership relationship but would solely result in the impossibility of using the specific services referred to in the aforementioned purposes.

Within the limits strictly relevant to the purposes indicated above, your personal data may be disclosed: 

• to the competent authorities, public and/or private bodies for the fulfilment of legal obligations;
• to credit institutions, service providers, consultants and independent professionals; 
• to the Association’s governing bodies and other members;
• to the regional representative for your region;
• to employees and/or collaborators of AiCARR in any capacity;
• to AiCARR Educational S.r.l - SB.

The aforementioned parties will process your personal data, as appropriate, in their capacity as independent Data Controllers, or as Data Processors,  System Administrators appointed in accordance with the law, including with regard to security measures to protect and safeguard your data.
Your data (first name and surname, town of residence) will be disseminated, subject to your consent, by publication on the Association’s website.

Your personal data may be transferred abroad through the use of the Outlook email service (Microsoft 365) and, specifically, may be transferred outside the European Economic Area (EEA).
With regard to such transfers, the contractual safeguards provided by Microsoft apply, and in particular the use of standard contractual clauses adopted or approved by the European Commission (Article 46(2)(c) and (d) of the GDPR), or adherence to the EU-US Privacy Shield, which guarantee an adequate level of protection.

8) Retention Period of Personal Data (Article 13(2)(a) GDPR)

Your personal data will be retained for the time strictly necessary to achieve the purposes indicated above, as well as to comply with statutory retention obligations, and in any case for the limitation period provided for by law.

9) Data Subject Rights (Article 13(2)(b), (c), (d) GDPR)

We remind you that you may at any time request the Association to grant you access to and rectify the data concerning you (Articles 15 and 16 GDPR). 
Furthermore, where the conditions are met, you may request the erasure of your personal data (Article 17 GDPR), restriction of processing (Article 18 GDPR), data portability (i.e. to receive your data from the Association in a structured, commonly used and machine-readable format, and to transmit it to another data controller without hindrance, Article 20 GDPR), and you may object to the processing of your data (Article 21 GDPR).
You also have the right to withdraw your consent at any time (where consent has been given), without affecting the lawfulness of processing based on consent given prior to withdrawal, and the right to lodge a complaint with the supervisory authority (Article 13(2)(c) and (d) of the GDPR).