Information on the processing of personal data pursuant to Art. 13 of the RGPD 679/2016

Dear Madam/Sir,

pursuant to art. 13 of the EU General Data Protection Regulation no. 679/2016, containing provisions on the processing of personal data (hereinafter, RGPD), we hereby inform you that DEFENX ITALIA S.r.l., as the Data Controller of the data you have provided, will use this information concerning you and, qualified as "personal data" by the RGPD. The regulation states that anyone who processes personal data must inform the person concerned of what data is processed and of certain elements qualifying the processing, which must in any case be carried out in a lawful, correct and transparent manner, protecting your confidentiality and guaranteeing your rights.

1. DATA CONTROLLER

   The Data Controller is DEFENX Italia Srl, with registered office at Via Larga 7, 20122 Milan.

   
   

2. DATA PROTECTION MANAGER (RPD/DPO)

   The Data Protection Manager can be contacted at the following email address: dpogruppo@bv-tech.it.

   
   

3. PURPOSE OF PROCESSING AND NATURE OF DATA

   The information and personal data indicated below will be processed for the following purposes

   to fulfil the execution of the contract with you for the supply and management of the following App: “Mobile Security Suite” and/or related services requested by you, namely:

   
   

   Necessary data:

   1. user's email address (necessary for user identification, registration and login);

   2. your license key (required to identify a specific license, for renewal and support);

   3. model and type of phone of the user (necessary to identify the available functions);

   4. type of operating system installed inside the phone referred to in point c) above (necessary to identify the available functions);

   5. Access pin to the App (necessary to protect access violations);

   6. administrative information for contract management.

      
      

      Optional data:

      
      

   7. information relating to any of your requests, if you contact us with questions or complaints;

   8. geographical location of the phone (usable to recover the phone in case of theft);

   9. visited URL addresses and browsing history and therefore we may also collect "special categories of data", in the sense that this term is defined in the RGPD (usable for the anti-phishing function);

   10. photo/ video gallery (can be used to check for the presence of any Malware through the Antivirus function);

   11. installed applications and their use (usable by the app manager function and for checking for the presence of any Malware through the Antivirus function);

       
       

   12. phone camera (can be used to view the environment in case of theft);

       
       

   13. phone microphone (can be used to listen to the phone in case of theft).

       
       

4. LEGAL BASIS FOR PROCESSING

   The personal data referred to in point 3) of the information notice will be processed lawfully because the following conditions are met:

   
   

   • processing is necessary for the performance of a contract to which the data subject is party or for the performance of pre-contractual measures taken at the request of the data subject (art. 6, par.1, letter b RGPD);

   • processing is necessary for the purposes of pursuing the legitimate interests of the Data Controller (Art. 6(1)(f) GDPR).

   
   

5. OBLIGATION OR FACULTY TO PROVIDE DATA AND CONSEQUENCES OF REFUSAL TO DO SO

   The provision of data is necessary for the establishment and management of the contractual relationship. We inform you that, in the absence of such data, it will be impossible for our Company to fulfil the obligations of the contract in place with you. Therefore, failure to provide such data will make it impossible to establish or continue the contractual relationship to the extent that such data are necessary for us to correctly fulfil the obligations related to the management of the contract.

   
   

6. STORAGE

   Personal data shall be stored in compliance with the principle of retention limitation provided for by the RGPD and/or for the time necessary to pursue the purpose of the service and for legal and/or contractual obligations.

   
   

7. DATA PROCESSING METHODS AND RECIPIENTS

   Your personal data will be processed both by the Company's staff, authorised to process them using electronic and paper-based instruments, and by external parties (collaborators and service providers) called upon to carry out specific tasks on behalf of the Data Controller, in their capacity as Data Processors, pursuant to art. 28 RGPD, subject to our letter of appointment imposing on them the duty of confidentiality and security in the processing of personal data, and with the adoption of suitable security measures to prevent loss and/or unlawful and incorrect use of the data and/or unauthorised access, in compliance with the provisions in force on the protection of personal data.

   
   

   All data is transmitted using the HTTPS protocol encrypted with TLS standard at the highest level of certification. All data on your mobile device is stored in an encrypted database for as long as you see fit.

   
   

   Below is a list of our service providers:

   a. Amazon Web Services (Amazon.com Inc.): provides some cloud hosting services. For more information visit their privacy policy:

   https://d1.awsstatic.com/legal/privacypolicy/AWS_Privacy_Notice-ITALIAN_2020-01-24.pdf

   
   

   a. Firebase (Google LLC) push notification service.

   
   

   For more information visit their privacy policy:

   https://firebase.google.com/support/privacy

   
   

8. TRANSFER, DISSEMINATION AND COMMUNICATION OF DATA

   The processed data will not be transferred to third countries or international organizations, will not be disseminated, and will not be communicated to third parties except, where necessary, for legal and/or contractual obligations.

   
   

9. RIGHTS OF THE INTERESTED PARTY

   As envisaged by the RGPD, in relation to your data you are entitled to exercise the rights envisaged by articles 15 et seq. of the RGPD, as set out below, and more precisely

   
   

   • "right of access" in order to obtain confirmation from the Data Controller as to whether or not data is being processed personal data concerning you, and if so, to obtain access to the personal data and to the following information: a) to know the purposes of the processing; b) the categories of personal data being processed; c) the recipients or categories of recipients to whom the data have been or will be communicated, in particular if they are recipients from third countries or international organizations; d) where possible, the expected data retention period or the criteria used to determine this period; e) if the data are not collected from the data subject, to obtain all available information on their origin;

   • "right to rectification" to obtain the rectification of data relating to you;

     
     

   • “the "right to erasure/oblivion" to obtain the erasure of data concerning you in the cases provided for by law;

     
     

   • "right to restriction of processing" to obtain restrictions on processing in the cases provided for by law;

     
     

   • "right to data portability" to obtain the portability of the data, i.e. to receive them from a Data Controller in a structured, commonly used and machine-readable format and to transmit them to another data controller without hindrance in the cases provided for by law;

     
     

   • "right to object" to object to the processing at any time in the cases provided for by law;

     
     

   • "right to be informed" of the existence of an automated decision-making process concerning natural persons, including profiling;

     
     

   • "right to lodge a complaint with a Supervisory Authority" ex art. 77 RGPD (Data Protection Authority).

   
   

   Please note that there may be conditions or limitations to the rights of the data subject. It is therefore not certain that, for example, you can exercise your right to data portability in all cases. This depends on the specific circumstances of the processing activity, or, if you decide to object to the processing of your data, the Data Controller has the right to evaluate your request, which may not be accepted if there are compelling legitimate grounds to proceed with the processing that override your interests, rights and freedoms.

   
   

10. METHODS OF EXERCISING YOUR RIGHTS

Without any formality, the data subject may at any time exercise his/her rights in a clear and explicit manner by sending:

• an email or by contacting the DPO/DPO: dpogruppo@bv-tech.it - +39 02/85.96.171

  
  

• by contacting the Controller directly by sending:

  
  

  • a registered letter with acknowledgment of receipt to the address Defenx Italia S.r.l. Via Larga 7, Milan 20122 Italy

  • an e-mail to: info@defenx.com

Last update: Milan 14 March 2021