Privacy Policy

In compliance with the regulations regarding personal data protection, FasiOpen, in its capacity as Data Controller, pursuant to the provisions of Articles 13 and 14 of EU Regulation 679/2016 wishes to provide you with information regarding:

• the purposes of and methods used in processing your personal data;
• the scope of communication and possible dissemination of the same;
• the nature of the data collected and their provision.

Since it is in the primary interest of FasiOpen to protect and guarantee your right to the protection and confidentiality of the common and special personal data that you must provide to enable refunds for supplementary health care services, we inform you that our use of your personal data will be based on the principles of correctness, lawfulness and transparency in light of our obligations and compliance with the above-mentioned regulations.

If, at the moment of registering with FasiOpen or subsequently to this, you decide to extend our health services to the members of your family unit (spouse, civil partner, de facto cohabiting partner, children, foster children), please ask them to read this notice and everything is set out in it regarding both the purpose and method of processing and the rights that may be exercised by the membership holder.

1. Data Controller

   The Data Controller is Fondo Aperta di Assistenza Sanitaria Integrativa (FasiOpen) – Viale Pasteur, 6 – 00144 Roma, in the person of its President pro tempore.

2. Data Protection Officer

   The Fund has appointed a Data Protection Officer (DPO), who can be contacted by email at dpo@fasiopen.it.

3. Purpose and legal basis of processing

   Purpose

   The common and special data provided by you and any changes you may communicate in the future to FasiOpen, in its capacity as Data Controller, will be processed for the following purposes:

   1. To proceed with the registration of your membership and of the relevant eligible persons, handling your personal details for administrative purposes and related support.
   2. To manage and process, including with the assistance of FasiOpen’s service providers, any refund claims for healthcare costs that you and your family members, acting through you, may submit to this Fund, together with any relevant reports and information.
   3. Institutional communications to clients such as, for example, regarding changes to the FasiOpen Statute, Regulations and Nomenclature, the election of member representatives, the implementation of new services.
   4. The sending of questionnaires intended to monitor the quality of services and health benefits refundable by the Fund, in which the client may take part by giving his or her explicit consent.
   5. The handling of any litigation and disputes.
   6. Telephone support to clients for the management of administrative and refund files.
   7. Security of access and multi-factor authentication in the Members’/Clients’ section of the FasiOpen portal

   Legal bases

   The legal bases on which the above-mentioned processing may be carried out are as follows:

   • performance of a contract to which the data subject is party, pursuant to art 6 para. 1 lett. b), for the processing referred to in points 1, 2, 3, 6;
   • the pursuit of the data controller’s legitimate interests, pursuant to Article 6 para. 1 lett. f), in relation to the processing referred to in point 7, and the exercise of a right in court, pursuant to Article 9 para. 2 lett. f), for the processing referred to in point 5;
   • with regard to special categories of data (e.g. data that reveal health status), the processing is lawful insofar as it concerns members, ex-members or persons who are in regular contact with FasiOpen, and is carried out, within the scope of its legitimate activities and with the appropriate safeguards, by FasiOpen as a non-profit organisation pursuing trade union objectives, pursuant to Article 9 para. 2 lett. d), for the processing referred to in point 2;
   • Explicit consent, pursuant to Article 6 para. 1 lett. a), for the processing referred to in point 4;
4. Categories and types of data processed

   Personal data processed are of both a common and special nature:

   • common data: for example, surname and first name, date of birth, place of residence, domicile, taxpayer number, contact details, mobile phone number, type of membership; bank details; surname and first name, taxpayer number, relationship, gender, place and date of birth of family members covered by the Fund;
   • special data: health-related data suitable for detecting state of health (medical certificates)
5. Method of processing

   Your personal data is processed using manual and/or computerised and/or devices using an organisational and processing logic strictly related to the stated purposes and, in all cases, in such a way as to guarantee the security, integrity and confidentiality of the data itself in compliance with the organisational, physical and logical measures required by current regulations, in order to minimise the risk of their destruction, loss, modification unauthorised access, and unauthorised disclosure.

6. Storage Period

   Personal data will be stored in full compliance with the security measures provided for by personal data protection legislation. They will be stored for the entire duration of Fund membership and also after the termination of membership, for the time needed to fulfil all applicable legal obligations and/or administrative requirements connected with or deriving from the membership.

7. Recipients of personal data and Data Processors

   Your personal data will only be made accessible to those, within FasiOpen, who need it for the duty they perform or the hierarchical position they hold and who are specifically authorised by the Data Controller. In order to carry out its activities, FasiOpen also needs to communicate certain client data to trusted external companies or individuals who may use it, also in their capacity as data processors, to carry out procedures that are needed to provide the services requested, or to carry out activities to support the operation and organisation of the office work needed for refund procedures in general.

   Common and special personal data, so far as they relate to their respective remit, are communicated to the following parties:

   1. the IT and healthcare support company used by Fund to manage enrolments and the settlement of refund claims and related support;
   2. banks that are required to process payment of the amount due for the service;
   3. companies managing computerised postal services;
   4. the Fund’s medical, legal, fiscal, accounting, actuarial and tax consultants;
   5. individuals/organisations for whom the right to access your data is recognised by law (e.g. inland revenue, judicial bodies).
   6. heirs.

   A detailed list of Data Processors, if required, may be requested directly from the Data Controller.

   Additionally, if you have given a mandate and/or authorisation to a third-party organisation to manage and process refund requests for healthcare services that you or your family members have received, FasiOpen will process the data provided by these organisations, together with those already in its possession, to issue the above-mentioned refund should the relevant conditions apply.

   It is therefore understood that FasiOpen does not and cannot assume any liability for any data breaches by the above-mentioned organisations, which should be solely ascribed to the third party organisation authorised by you.

   The data provided are not disseminated.

8. Transfer outside the EU

   Your personal data will not be transferred by FasiOpen to any countries external to the EU. Should this prove necessary, it will be done in accordance with the law.

9. Rights of the data subjects

   Pursuant to Articles 15 et seq. of the GDPR, in your capacity as data subject, you will have:

   • Right of access, which gives you the opportunity to:
     1. obtain confirmation of the existence or otherwise of personal data relating to you, even if not yet recorded;
     2. obtain information on:
        1. the origin of the personal data;
        2. the purposes and methods of processing;
        3. the logic applied should processing be performed with the aid of telematic devices;
        4. the identity of the data controller, of the data processors and of the representative designated pursuant to Art. 3, paragraph 1, GDPR;
        5. parties or categories of parties to whom the personal data may be communicated or who may become aware of it in their capacity as designated representatives of data processors or appointees.
   • Right of rectification, which gives you the possibility to update or rectify your personal data if you feel they are not up-to-date or sufficiently accurate
   • Right to be forgotten, which gives you the possibility to ask for your data to be deleted. With regard to this, FasiOpen clarifies that data will be deleted when the conditions are met as set out in art.17 comma 1 lett. a): “personal data are no longer necessary for the purposes for which they were collected or otherwise processed”, and that the Fund will no longer be subject to the obligations set out in the subsequent para 3 letters b): “fulfilment of legal obligations” and e) “defence in court”.
   • Right of restriction, which enables you to request that your personal data be marked to restrict their future processing; the data should therefore become inaccessible and no longer able to be processed.
   • Right to data portability, which enables you to request data that relates to you in a structured, commonly-used and machine-readable format, or the direct transmission of the data to a new Data Controller if technically feasible.
   • Right of objection, which enables you to object, wholly or in part and for legitimate reasons, to the processing of personal data relating to you, even if they are relevant to the purpose of collection.

   We inform you that operations of updating, rectification, restriction, and deletion will be brought to the attention, also as regards their contents, of those to whom the data was communicated or disseminated, unless this requirement proves impossible or involves a clearly disproportionate use of resources in relation to the right being protected.

   You may assert your rights under Articles 15 et seq. of the GDPR, as detailed above, by contacting the Data Controller by email at dpo@fasiopen.it.

10. Complaints

    Furthermore, FasiOpen informs you that you have the right to make a complaint to the Data Protection Authority according to the procedures described at www.gpdp.it.