Privacy Notice

01Data Controller

The Data Controller for the personal data collected through this website is:

Registered name

DO.G.MA. Service di Galano Marco & C. SAS

Registered office

Via Nino Bixio 18/1 — 16043 Chiavari (GE), Italy

VAT / Tax code

02280600996

REA

GE 474293

Email

galanomarco@libero.it

Telephone

+39 347 34 48 173

The Data Controller has not appointed a Data Protection Officer (DPO), as the conditions requiring one under the law are not met. Any matter concerning the processing of personal data may be raised using the contact details given above.

02Categories of data processed

Only two categories of data may be processed through this website:

• Browsing data, collected automatically by the IT systems that run the website;
• Data provided voluntarily by the user when completing the contact form, or when writing or telephoning to the contact details published here.

The website neither requests nor processes special categories of personal data (Art. 9 GDPR). Users are therefore asked not to enter health data, criminal-record data or any other information not relevant to the technical enquiry in the free-text field of the form.

03Browsing data

The IT systems and software procedures that run this website acquire, in the course of normal operation, certain data whose transmission is inherent in the use of Internet communication protocols: IP address, browser type and operating system, date and time of the request, address of the resources requested, response status code and other technical parameters relating to the user's operating system and computing environment.

These data are processed in the hosting provider's log files for the sole purpose of delivering the website, ensuring its security and obtaining aggregated statistical information on its use. They are not used to identify users, except where liability has to be established in the event of computer offences against the website.

04Data provided voluntarily

By completing the form in the contact section, the user provides: first name and surname, email address and — optionally — company and telephone number, together with the type of service requested and the free-text description entered in the message field.

The fields marked as mandatory are needed in order to reply to the enquiry: without them no reply can be given. Providing the remaining data is optional.

Likewise, sending messages to the email addresses or telephone numbers published on this website entails the acquisition of the sender's contact details and of any personal data the message may contain.

05Purposes of the processing

Personal data are processed solely for the following purposes:

• to answer requests for information, quotations or technical contact sent by the user;
• to handle the preliminary stages and any subsequent establishment of a professional relationship;
• to ensure the technical operation, stability and security of the website;
• to comply with obligations laid down by law, by regulation or by EU legislation.

06Legal bases

• Art. 6(1)(b) GDPR — performance of pre-contractual measures taken at the Data Subject's request, for handling contact and quotation enquiries;
• Art. 6(1)(f) GDPR — legitimate interest of the Data Controller in ensuring the security and correct operation of the website, for the processing of browsing data and technical logs;
• Art. 6(1)(c) GDPR — compliance with legal obligations, where applicable.

07How data are processed

Processing is carried out using IT and electronic tools, following logic strictly related to the purposes stated, and applying technical and organisational measures appropriate to ensure a level of security suited to the risk, including transmission of data over an encrypted connection (HTTPS) and access restricted to authorised persons only.

No automated decision-making and no profiling within the meaning of Art. 22 GDPR are carried out.

08Recipients and technical providers

Data are neither disseminated nor disclosed to third parties for commercial purposes. The following may have access to the data:

• the Data Controller and the persons it has authorised to carry out the processing;
• the supplier of the hosting and contact-form services, acting as Data Processor pursuant to Art. 28 GDPR;
• the supplier of the email service used to answer enquiries;
• consultants and professional advisers, solely where necessary for statutory compliance or for the establishment or defence of a legal claim.

An up-to-date list of the Data Processors is available on request by writing to the contact details given in section 01.

09Hosting — Netlify

This website is hosted on the infrastructure of Netlify (Netlify, Inc.), the supplier providing hosting, content delivery and contact-form services.

In providing the service, Netlify processes, as Data Processor, the technical browsing data contained in its server logs and the data submitted through the contact form. The supplier makes its own privacy documentation available at netlify.com/privacy↗.

No resources are loaded from third-party servers in order to run the website: the typefaces are hosted locally and there are no external analytics, advertising or social network services.

10Enquiries sent through the form

The contact form uses the Netlify Forms service. Enquiries sent are therefore recorded and stored inside the Netlify dashboard linked to the website, as well as being notified to the Data Controller by email.

This means that the data contained in the form (name, company, email, telephone, type of service and text of the enquiry) are stored on the supplier's systems until they are deleted by the Data Controller.

The form also includes a hidden anti-spam field (honeypot): it collects no personal data and serves solely to detect automated submissions. No verification systems relying on external services, such as reCAPTCHA, are used.

11Transfers to third countries

The supplier of the hosting and form services is a company established in the United States of America: the processing may therefore involve a transfer of personal data outside the European Economic Area.

Such transfers take place on the basis of the safeguards laid down in Chapter V of the GDPR: in particular the Standard Contractual Clauses adopted by the European Commission, incorporated into the data processing agreement signed with the supplier, and the supplier's adherence to the EU-U.S. Data Privacy Framework, as stated in its contractual and privacy documentation.

The data collected through this website are not disclosed to any third parties other than the technical suppliers listed in section 08, and are not sold, disseminated or used for the commercial purposes of third parties.

12Data retention

Data are retained only for as long as is strictly necessary for the purposes for which they were collected, according to the following criteria:

• Contact enquiries with no follow-up — deleted within one month of the reply;
• Enquiries leading to an assignment — deleted at the end of the assignment and in any case within one month of delivery of the final reports;
• Contractual and tax documentation — retained for the duration of the relationship and thereafter for the periods laid down by the applicable civil and tax legislation, irrespective of the channel through which contact was made;
• Technical browsing logs — for the period set by the hosting provider as part of the technical and security management of the infrastructure.

No historical archive of the enquiries received through the website is kept. At the end of the periods indicated, the data are deleted or anonymised, save for other legal obligations or the need to defend a legal claim.

13Rights of the Data Subject

In relation to the processing described above, the Data Subject may exercise at any time the rights set out in Articles 15 to 22 of the GDPR:

• access to their personal data and to information about the processing;
• rectification of inaccurate data and completion of incomplete data;
• erasure of the data, in the cases provided for by law;
• restriction of processing;
• portability of the data provided, in a structured, machine-readable format;
• objection to processing based on the legitimate interest of the Data Controller.

14Complaint to the supervisory authority

A Data Subject who considers that the processing of their personal data infringes the legislation in force has the right to lodge a complaint with the competent supervisory authority.

For Italy: the Italian Data Protection Authority (Garante per la protezione dei dati personali), Piazza Venezia 11, 00187 Rome — garanteprivacy.it↗. The right to bring proceedings before the courts remains unaffected.

15How to exercise your rights

These rights may be exercised by sending a written request to the Data Controller:

Email

galanomarco@libero.it

Post

Via Nino Bixio 18/1 — 16043 Chiavari (GE)

The request must make it possible to identify the Data Subject and must clearly state the right to be exercised. A reply is given without undue delay and in any event within one month of receipt of the request, a period which may be extended by a further two months in cases of particular complexity.

16Updates to this notice

This notice may be amended following changes to the services offered, to the technical tools used or to the applicable legislation. Amendments take effect once published on this page: readers are invited to consult it periodically and to check the last-updated date shown at the top.

17Cookies and storage technologies

This is a static website and it does not install cookies on the user’s device: neither its own technical cookies nor third-party cookies. It does not use localStorage, sessionStorage or any other storage technology, and there are no analytics tools, advertising systems, maps, videos or social widgets.

The typefaces and all other assets are hosted on the site itself: while browsing, the browser communicates only with the site’s own domain. The conditions that would require prior consent, or a separate cookie policy, therefore do not arise.

Submitting the contact form does not install any cookie: the anti-spam control is a hidden field contained in the page, with no recourse to external services. The connection data recorded in the hosting provider’s logs is described in points 6 and 10 and does not constitute a cookie.

Should tools subject to consent be introduced in future — third-party analytics, embedded content, advertising systems — a preference collection and management system will be implemented and this notice will be updated accordingly.

18Prevailing language

This is an English translation provided for convenience. The Data Controller is established in Italy and the processing is governed by Italian law: in the event of any discrepancy, the Italian version of this notice prevails.