Privacy policy
Pursuant to Article 13 of Regulation (EU) 2016/679 (General Data Protection Regulation – GDPR), also considering Italian Legislative Decree 196/2003 as amended by Legislative Decree 101/2018, the following information is provided regarding the processing of personal data.
Data Controller
The Data Controller is:
Annapurna SRLS
VAT No.: IT04366730242
REA: VI-398767
Registered office:
Via Lago Maggiore, 6
36077 Altavilla Vicentina (VI) – Italy
E-mail: info.annapurna@email.com
Certified email (PEC): annapurna@pec.studioespen.it
At present, the Data Controller has not appointed a Data Protection Officer (DPO).
Purposes of the processing and legal bases
Browsing data
The Data Controller will process certain personal data of users who interact with the computer systems and software procedures used to operate the website.
Specifically, browsing data that computer systems automatically acquire while using the website – such as IP addresses, domain names of the computers used by users, browser types, and other parameters related to the user’s operating system – may be processed.
These data are not associated with directly identifiable users and are used solely for:
- obtaining anonymous statistical information on website usage;
- monitoring the correct functioning of the website;
- verifying responsibilities in case of potential computer crimes.
Data provided voluntarily by the user
Personal data provided by users will be processed exclusively for the following purposes:
a. Contractual purposes
Conclusion and execution of contracts related to the services offered by the website, including but not limited to:
- registration and use of services
- administrative and accounting management
- invoicing
- credit protection
- protection of the rights and legitimate interests of the Data Controller
- administrative, organisational, logistical and functional services necessary for the execution of the contractual relationship
b. Legal obligations
Fulfilment of obligations required by laws, regulations, European legislation or provisions issued by Authorities and Supervisory Bodies.
Legal basis of processing
The legal basis for processing personal data is:
- the execution of a contract or pre-contractual measures requested by the data subject;
- compliance with legal obligations;
- the legitimate interest of the Data Controller.
Methods of data processing
Personal data are processed using the operations indicated in Article 4(2) of the GDPR.
Processing may take place both in paper and electronic form, through manual and automated tools, in compliance with current data protection legislation and according to the principles of:
- lawfulness
- fairness
- transparency
- data minimisation
- security and confidentiality.
Processing is carried out by:
- the Data Controller
- authorised internal personnel
- external data processors appointed pursuant to Article 28 GDPR.
Mandatory or optional nature of providing data
The provision of personal data for the purposes described above is necessary in order to:
- comply with legal obligations
- establish and manage the contractual relationship requested by the user.
Failure to provide such data may make it impossible for the Data Controller to provide the requested services.
Disclosure of data
To the extent strictly necessary for the purposes indicated above and in compliance with applicable laws, personal data may be disclosed to:
- public authorities or entities where required by law;
- consultants, professional firms, accountants, lawyers or auditors;
- suppliers, commercial partners and service providers assisting the Data Controller in carrying out its activities;
- IT service providers and hosting providers.
These subjects act as data processors pursuant to Article 28 GDPR or as independent data controllers.
Personal data will not be disseminated publicly unless expressly required by law or with explicit consent.
Data retention
Personal data will be retained for the time strictly necessary to fulfil the purposes for which they were collected, including:
- the duration of the contractual relationship;
- the time required to comply with legal and fiscal obligations;
- the retention periods required by applicable laws.
After this period, the data will be deleted or anonymised.
Data transfer
Personal data are stored on servers located within the European Union.
If necessary, the Data Controller may transfer data outside the EU in compliance with the GDPR, including through:
- Standard Contractual Clauses approved by the European Commission;
- other legally recognised safeguards.
If the user uses online payment services, data may be processed by independent data controllers such as PayPal or other payment service providers, according to their own privacy policies.
Minors
The website and services are not intended for minors.
The Data Controller does not knowingly collect personal data relating to minors.
Rights of the data subject
Pursuant to the GDPR, the data subject has the right to:
- obtain confirmation of whether personal data concerning them exist;
- access their personal data;
- obtain rectification or updating of data;
- obtain erasure of personal data (“right to be forgotten”);
- request restriction of processing;
- request data portability;
- object to the processing of personal data;
- withdraw consent where processing is based on consent;
- lodge a complaint with the Italian Data Protection Authority (Garante per la Protezione dei Dati Personali).
Exercise of rights
Data subjects may exercise their rights or request information regarding the processing of their personal data by contacting the Data Controller at: info.annapurna@email.com
or via PEC: annapurna@pec.studioespen.it