Computer Systems and Navigation Data

The computer systems and software procedures responsible for the operation of this website collect, during their normal use, certain personal data whose transmission is implicit in the use of Internet communication protocols.

These are pieces of information not collected to be associated with identified data subjects but which, by their nature, could, through processing and association with data held by third parties, allow users to be identified.

This category of data includes IP addresses or domain names of the computers used by users connecting to the site, the URI (Uniform Resource Identifier) addresses of the requested resources, the time of the request, the method used to submit the request to the server, the size of the file obtained in response, the numerical code indicating the status of the server’s response (success, error, etc.), and other parameters related to the user’s operating system and IT environment.

These data are used solely to obtain anonymous statistical information on the website’s use and to ensure its proper functioning and are deleted immediately after processing.

The data may be used to ascertain responsibility in case of hypothetical IT crimes against the website.

Refusal to Provide Data

Apart from what is specified for navigation data, users/visitors are free to provide their personal data. Providing such data is sometimes necessary because failure to do so might prevent the conclusion or proper execution of a contract involving the data subject and/or compliance with legal obligations to which the Data Controller is subject.

Providing data for processing activities that require consent is optional, and refusal will not prevent users from accessing the products/services offered by the Data Controller. Even after giving consent, the data subject retains the right to object, in whole or in part, to the processing of their personal data for the purposes outlined above by simply contacting the Data Controller at the addresses provided.

Source of Data

Data will be provided by the data subject or collected from third parties.

Processing Methods

In compliance with Article 5 of the Regulation, Personal Data will be:

• Processed lawfully, fairly, and transparently in relation to the data subject;
• Collected and recorded for specific, explicit, and legitimate purposes and processed in ways compatible with those purposes;
• Adequate, relevant, and limited to what is necessary in relation to the purposes for which they are processed;
• Accurate and, where necessary, kept up to date;
• Processed in a manner ensuring appropriate security;
• Stored in a form that allows identification of the data subject for no longer than necessary to achieve the purposes for which they are processed.

Processing will be carried out using manual and/or computerized and telematic tools, strictly related to the stated purposes, and ensuring the data’s security, integrity, and confidentiality in compliance with organizational, physical, and logical measures required by current regulations.

Data Disclosure

Personal data may be disclosed to authorized personnel and external data processors appointed by the Data Controller (a full list of external processors is available from the Data Controller). With prior consent, data may also be disclosed to third-party sponsors and/or commercial partners of the Data Controller, who may use them for the purposes outlined in point 3 of the “Processing Purposes” section. For the above purposes, data may also be disclosed to other parties acting as independent controllers.

Data Dissemination

Personal data will not be disseminated.

Data Transfer Abroad

For the above purposes, personal data will be processed within the European Economic Area (EEA). If transferred to non-EEA countries, in the absence of an adequacy decision by the European Commission, applicable regulations on transferring personal data to third countries will be respected, such as using the European Commission’s Standard Contractual Clauses.

Data Retention

In general, personal data will be retained for as long as necessary to fulfill the purposes for which they were collected and processed, including the retention period required by applicable laws. In any case, data will be retained for a maximum of 10 years after the end of the relationship with the Data Controller and for a maximum of 2 years for purposes requiring consent, unless the Data Controller needs to defend a legal claim.

Rights of the Data Subject

Pursuant to Articles 15–21 of Regulation (EU) 2016/679 and applicable national law, the data subject may exercise the following rights within the limits and in accordance with current regulations:

• Request confirmation of the existence of personal data concerning them (right of access);
• Know their origin;
• Receive comprehensible communication of the data;
• Obtain information on the logic, methods, and purposes of processing;
• Request the updating, rectification, integration, deletion, anonymization, or blocking of data processed in violation of the law, including data no longer necessary for the purposes they were collected for;
• File a complaint with the supervisory authority (Data Protection Authority);
• Exercise all other rights recognized by applicable laws.

Requests to exercise these rights can be made informally to the Data Controller using the contact details provided above.