The Associazione Mystery Auditing Italia, Tax Code 97738590153, with registered office in Milan (MI), via Ariberto no. 31, in the person of its President/Legal Representative pro tempore Susanna Gonnella, in its capacity as Data Controller, pursuant to art. 13 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of personal data, and in relation to the information that will come into its possession, hereby provides you with the following notice:

​

1. Methods of processing

​

The personal data voluntarily provided within the scope of the commercial relationship with the Controller, communicated directly by the data subject, will be processed by manual and/or automated means for the purposes set out in point 3 below.

​

The processing of the data will be carried out by the Associazione Mystery Auditing Italia and by natural or legal persons specifically appointed by it as data processors or persons authorised to process the data.

The data may be disclosed to:

• companies/professional firms/collaborators that provide assistance, consultancy or collaboration services to the data controller in the field of promoting the Mystery Audit methodology (undercover audit) in accordance with standards UNI 11312-1:2017, UNI 11312-2:2022 and the related training courses;

• companies/professional firms/collaborators that provide assistance, consultancy or collaboration services to the data controller in matters of accounting, administrative, tax, legal, fiscal and financial consultancy;

• public administrations for the performance of their institutional functions within the limits established by law or regulations;

• third-party service providers, where such disclosure is necessary to fulfil the services covered by the contract concluded between the parties.

Personal data will not be disseminated.

2. Data Controller and Data Processor

​

The Data Controller is the Associazione Mystery Auditing Italia

Contact details of the Data Controller: email address mysteryauditingitalia[@]gmail.com

​ ​

3. Purposes of the processing

The personal data provided by the data subject will be processed in compliance with applicable legislation and with the principles of lawfulness, fairness, transparency and protection of confidentiality established therein, for the following purposes:

a) Communications regarding the Association's activities addressed to Members/Non-Members/Suppliers

b) Updates on the Mystery Audit standard (UNI 11312-1:2017, UNI 11312-2:2022)

c) Courses, events, seminars and initiatives promoting the Association and the undercover audit courses

d) Training

e) Carrying out, subject to the data subject's express written consent, direct marketing activities, such as sending — including by e-mail, WhatsApp messages, SMS and MMS — advertising material and communications of an informational and/or promotional nature relating to services and/or activities provided and/or promoted by the Associazione Mystery Auditing Italia.

The data processed are up to date, relevant, complete and not excessive in relation to the purposes listed above for which they are collected and subsequently processed.

​ ​

4. Transfer of personal data

​

The personal data collected will be processed in Italy and will not be transferred to a third country outside the EU or to an international organisation, or else will be transferred to and stored by our service provider(s) on secure servers located not outside the European Economic Area (EEA). The Data Controller protects your privacy by entering into EU-approved contractual clauses with such providers.

​

5. Mandatory or optional nature of provision

The provision of personal data is contractual in nature. It follows that the communication of the data is optional, but any refusal by the data subject, or a subsequent request for erasure, could make it impossible or extremely difficult to perform the contract to which the data subject is a party.

​

6. Data retention

​

Personal data will be retained for the time strictly necessary to fulfil the purposes set out in point 3 of this notice and in any case:

− no longer than 10 years from the issue of the last accounting and/or tax document;

− no longer than 3 years for activities promoting the association and the UNI 11312-1:2017, UNI 11312-2:2022 standards and the various updates on the methodology for informational purposes and the promotion of courses on the undercover audit methodology;

− no longer than 24 months for direct marketing purposes.

7. Transfer of data to third parties

The personal data collected will not be transferred for consideration to third-party companies for the sending of commercial communications.

​ ​

8. Rights of the data subject

​

Pursuant to articles 13(2)(b) and (d), 15, 16, 17, 18, 19, 20 and 21 of the Regulation, please note that:

a) the data subject has the right to request from the Data Controller access to the personal data, the rectification or erasure thereof or the restriction of processing concerning them, or to object to their processing, in addition to the right to data portability;

b) the data subject has the right to withdraw consent at any time without affecting the lawfulness of processing based on consent given before its withdrawal;

c) where the processing is based on article 6(1)(a), or on article 9(2)(a), the data subject has the right to withdraw consent at any time without this affecting the lawfulness of processing based on consent given before its withdrawal;

d) the data subject has the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali), following the procedures and instructions published on the Authority's official website.

The exercise of the rights indicated above is not subject to any formal requirement and is free of charge, and may be exercised by writing to the email address mysteryauditingitalia[@]gmail.com or by sending a communication by registered mail with return receipt to the following address: Associazione Mystery Auditing Italia, Via Ariberto, 31 – 20123 Milan. For the purposes of the above, the data subject is invited to communicate any updates to the data collected to the Data Controller at the email address mysteryauditingitalia[@]gmail.com.

​ ​

9. Automated decision-making

The data collected will not be subject to any automated decision-making process.

​

Last updated: April 2024