PRIVACY NOTICE
This Website collects certain Personal Data from its Users.
The Data Controller, as identified below, pursuant to Article 13 of EU Regulation No. 679/16 on the protection of natural persons with regard to the processing of personal data (hereinafter the “Regulation”), hereby informs that personal data will be processed for the purposes and in the manner described below.
1. TYPES OF PERSONAL DATA PROCESSED
The personal data processed by the Data Controller are:
1.1. Identifying personal data:
1 ☒ first name;
2 ☒ last name;
3 ☐ date of birth;
4 ☐ place of birth;
5 ☐ tax code;
6 ☒ address/city;
7 ☐ IBAN;
8 ☐ credentials;
9 ☒ telephone number;
10 ☒ email address;
11 ☐ economic data;
12 ☐ financial data;
13 ☐ images;
14 ☐ audio;
15 ☒ IP address;
16 ☐ identification document number;
17 ☐ vehicle license plate;
18 ☐ social media account;
19 ☒ VAT number;
1.2. Special categories of personal data:
1 ☐ biometric;
2 ☐ genetic;
3 ☐ health;
4 ☐ sexual orientation;
5 ☐ political opinions;
6 ☐ trade union membership;
7 ☐ racial origin;
8 ☐ religious or philosophical beliefs;
1.3. Judicial personal data:
1 ☐ criminal convictions/offences;
1.4. Possible profiling categories:
1 ☐ professional performance;
2 ☐ economic situation;
3 ☐ health;
4 ☐ personal preferences;
5 ☐ interests;
6 ☐ reliability;
7 ☐ behavior;
8 ☐ location/movements.
Data processing will be carried out in compliance with the Regulation as specified below.
2. SOURCE OF THE PERSONAL DATA PROCESSED
The personal data processed are those collected directly from the data subject.
3. PURPOSES OF DATA COLLECTION, RETENTION PERIOD AND LEGAL BASIS
(Art. 13(1)(c) of the Regulation)
3.1. (IP Address)
This purpose concerns the processing of data released during normal website navigation, for technical purposes only and to ensure safe and proper use of the website. Data will be retained for the strictly necessary period, not exceeding 3 years (plus 6 months for deletion). Consent is not required pursuant to Art. 6(1)(f) of the Regulation (legitimate interest). The data used for this purpose are those listed under point 1.1 no. 15.
For all other data collected via contact forms (if present on the website), please refer to the specific privacy notices available through the links included in each form.
3.2. (Technical Cookies)
This purpose concerns the processing of data related to website access solely to ensure proper website functionality and improve navigation. Data will be retained for the strictly necessary period, not exceeding 3 years (plus 6 months for deletion). Consent is not required pursuant to Art. 6(1)(f) of the Regulation (legitimate interest).
Analytical cookies do not require consent only if anonymized. For all other cookies requiring consent (e.g. profiling, marketing), please refer to the cookie policy available in the banner, where preferences can be customized.
3.3. (General Statistics)
This purpose is to inform you about how your data are processed to produce anonymous and/or aggregated general statistics, solely to improve the quality of services/products offered. Data will be retained for the strictly necessary period, not exceeding 3 years (plus 6 months for deletion). Consent is not required pursuant to Art. 6(1)(f) of the Regulation (legitimate interest). The data used for this purpose are those listed under point 1.1 no. 15.
4. LEGAL BASIS FOR PROCESSING
(Art. 13(1)(c) of the Regulation)
The legal basis is specified for each purpose described in section 3.
5. NATURE OF DATA PROVISION – CONSEQUENCES OF REFUSAL
(Art. 13(2)(e) of the Regulation)
In compliance with Art. 13(2)(e) of the Regulation, please refer to the specific purposes to determine whether data provision is mandatory by law, contract, or a requirement to enter into a contract. Failure to provide the aforementioned personal data would result in the impossibility of establishing or continuing the relationship between the parties.
6. RECIPIENTS OF THE PERSONAL DATA
(Art. 13(1)(e) of the Regulation)
Recipients of personal data may include: authorized persons (employees), data processors (suppliers), recipients (clients), the DPO if appointed, supervisory bodies, and public authorities responsible for inspections or legal obligations.
7. TRANSFER OF PERSONAL DATA
(Art. 13(1)(f) of the Regulation)
7.1. Data may be transferred to EU Member States ☒ YES ☐ NO.
For further information, contact the Data Controller.
7.2. Data may be transferred to non-EU countries ☐ YES ☒ NO.
If data are transferred outside the EU, the Data Controller guarantees compliance with Articles 44 et seq. of the GDPR and applicable laws, including, where necessary, appropriate safeguards.
8. PROCESSING METHODS
Processing is carried out electronically using computerized tools.
9. RIGHTS OF THE DATA SUBJECT
(Art. 13(1)(b) of the Regulation)
Articles 12–23 of the Regulation grant the data subject specific rights, including:
-
Art. 12 – Transparent information and communication
-
Art. 13 – Information where data are collected from the data subject
-
Art. 14 – Information where data are not collected from the data subject
-
Art. 15 – Right of access
-
Art. 16 – Right to rectification
-
Art. 17 – Right to erasure (“right to be forgotten”)
-
Art. 18 – Right to restriction of processing
-
Art. 19 – Notification obligation regarding rectification or erasure
-
Art. 20 – Right to data portability
-
Art. 21 – Right to object
-
Art. 22 – Automated decision-making, including profiling
-
Art. 23 – Restrictions
Documents are available at the operational headquarters of the Data Controller (Box A). The data subject may lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it).
Rights may be exercised personally or via written delegation to a natural person or association. Requests may be sent to the Data Controller or the DPO, if appointed, using the email addresses provided in Boxes A and B.
10. DATA RETENTION PERIOD
(Art. 13(2)(a) of the Regulation)
Data will be processed for the duration specified for each purpose, with an additional 180 days for technical reasons. Longer retention is permitted for legal defense purposes for the entire duration of litigation.
11. DATA CONTROLLER
(Art. 13(1)(a) of the Regulation)
SCUOLA METALMECCANICA ITAFORMA – ITAFORMA SRL – P.IVA 12466190969
Data Controller email: info@itaforma.com
12. DATA PROTECTION OFFICER (DPO)
(Art. 13(1)(b) of the Regulation)
Details of the DPO, if appointed, are provided in Box B.
