COMMUNICATION OF COLLECTED DATA
For the pursuit of the purposes described above, your personal data will be made known to employees, assimilated personnel and collaborators of the Controller, who will act as authorised subjects for the processing of personal data.
Furthermore, your personal data will be communicated to and processed by third parties belonging to the following categories

parties which the Data Controller uses to manage the Site;
companies that manage the Data Controller’s IT system;
companies and consultants that provide legal and/or tax consultancy;
authorities and supervisory and control bodies, and in general public or private entities with public functions.

The subjects belonging to the above categories operate, in some cases, in total autonomy as separate Data Controllers, in other cases, as Data Processors specifically appointed by the Data Controller in compliance with Article 28 GDPR.
A complete and updated list of the subjects to whom your personal data may be communicated can be obtained from the Data Controller’s registered office questions@wider-yachts.com.

RIGHTS OF DATA SUBJECTS
In relation to the processing operations described in this Information Notice, as a data subject you may, under the conditions laid down in the GDPR, exercise the rights set out in Articles 15 to 21 of the GDPR and, in particular, the following rights:

• Right of access – Article 15 GDPR: the right to obtain confirmation as to whether or not personal data relating to you are being processed and, if so, to obtain access to your personal data – including a copy thereof – and communication of, inter alia, the following information:
  
  1. purposes of processing;
  2. categories of personal data processed;
  3. recipients to whom the data have been or will be disclosed;
  4. data retention period or criteria used;
  5. rights of the data subject (rectification, erasure of personal data, restriction of processing and right to object to processing;
  6. right to lodge a complaint;
  7. the right to receive information on the origin of my personal data if they have not been collected from the data subject;
  8. the existence of an automated decision-making process, including profiling.
• Right of rectification – Article 16 GDPR: the right to obtain, without undue delay, the rectification of inaccurate personal data concerning you and/or the integration of incomplete personal data;
• Right to erasure (right to be forgotten) – Article 17 GDPR: Right to obtain, without undue delay, the erasure of personal data concerning you, when:
  
  1. the data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;
  2. You have revoked your consent and there is no other legal basis for the processing;
  3. You have successfully objected to the processing of your personal data;
  4. the data have been processed unlawfully;
  5. the data must be deleted in order to comply with a legal obligation;
  6. the personal data was collected in connection with the provision of information society services as referred to in Article 8(1) GDPR. The right to erasure does not apply to the extent that the processing is necessary for the fulfilment of a legal obligation or for the performance of a task carried out in the public interest or for the establishment, exercise or defence of legal claims.
• Right of restriction of processing – Article 18 GDPR: right to obtain restriction of processing, when:
  
  1. the data subject contests the accuracy of the personal data;
  2. the processing is unlawful and the data subject objects to the erasure of the personal data and requests instead that their use be restricted;
  3. although the data controller no longer needs the personal data for processing purposes, the personal data are necessary for the establishment, exercise or defence of legal claims by the data subject;
  4. the data subject has objected to the processing, as indicated below, pending verification as to whether the data controller’s legitimate reasons prevail over those of the data subject.
• Right to data portability – Article 20 GDPR: the right to receive, in a structured, commonly used and machine-readable format, the personal data concerning you provided to the Controller and the right to transmit it to another controller without hindrance, where the processing is based on consent and is carried out by automated means. Furthermore, the right to have your personal data transmitted directly by the Controller to another controller if this is technically feasible.
• Right to object – Article 21 GDPR: right to object, at any time, to the processing of personal data concerning you based on the condition of legitimate interest, including profiling, unless there are legitimate grounds for the Controller to continue the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defence of legal claims.
• Submit a complaint to the Italian Data Protection Authority, Piazza di Montecitorio n. 121, 00186, Rome (RM). The above rights may be exercised vis-à-vis the Data Controller by contacting the references in the paragraph “Data Controller and Managers”. The Data Controller will take charge of your request and provide you, without undue delay and, in any case, no later than one month after receiving it, with information on the action taken regarding your request. The exercise of your rights as a data subject is free of charge in accordance with Article 12 GDPR. However, in the case of requests that are manifestly unfounded or excessive, including due to their repetitiveness, the Data Controller may charge you a reasonable expense contribution, in light of the administrative costs incurred in handling your request, or deny satisfaction of your request. Finally, we inform you that the Controller may request further information necessary to confirm the identity of the data subject.