Informative note pursuant to article 13 of Regulation (EU) 679/2016 and article 13 of Legislative Decree no. 196/2003
Drawlight S.r.l – in compliance with article 13 of Regulation (EU) 679/2016 (hereinafter, “Regulation (EU)”) and article 13 of Legislative Decree no. 196/2003 (hereinafter, the “Privacy Code”) and in relation to the personal data that the same may obtain at the time of the consultation of the Internet site https://www.drawlight.net (hereinafter, the “Site”) or following the interested party’s submission of requests for information and/or contact transmitted through the appropriate channels indicated on the site itself – provides the following information, with the clarification that the same applies only in relation to the Site and personal data through this collection. Therefore, it does not apply to other websites that the interested party can access via links or any other connection, for which the respective privacy policies will apply.
Furthermore, with regards specifically to cookies, please refer to what is explained in article 5 and to the “Extended Notice on Cookies” contained in article 6 of the present Informative note.
1. Data Controller and Data Processor
The owner of the processing of personal data is the company Drawlight S.r.l, fiscal code 04559850286, in person of the single administrator and legal representative pro tempore Odelli Michele, with registered headquarters in Noventa Padovana (PD), via Noventana 192 (hereinafter, the “Data Controller” or “Drawlight”).
The Data Controller can be contacted by registered email (PEC) at drawlight@pec.it.
The Data Controller has appointed a Data Processor, who can be contacted by registered email (PEC) at drawlight@pec.it. It should be noted that, pursuant to article 28 of the Regulation (EU), the Data Processor may, upon authorization by the Data Controller, appoint other Data Processors or be replaced. The interested party may obtain an updated list of subjects who hold the title of Data Processor at any time by means of a specific request sent to the aforementioned contact details of the Data Controller and the Data Processor.
2. Purposes of data processing
a. The processing of personal data is mainly directed at the browsing on the Site by the interested party, as well as the carrying out of any requests for information and/or contact transmitted by the same person through the appropriate channels indicated on the site.
b. It should be noted that the personal data provided may also be processed in order to fulfill specific obligations provided in the fiscal, accounting and banking fields, that is, in order to comply with other obligations imposed on the Data Controller and required by current legislation.
c. Finally, after the acquisition of specific consent by the interested party, the personal data collected can be used for sending promotional and marketing communications, including the publishing of newsletters and market research, through automated tools (SMS, MMS), e-mail, fax) and non (paper mail, telephone contacts).
3. Legal basis for data processing
With regard to the purposes referred to in Article 2, point a, of the present informative note, the legal basis of the processing of personal data will be found in article 6, co. 1, point b, of the Regulation (EU), according to which the processing of personal data is lawful in cases where it is necessary for the handling of a contract of which the interested party is a part or for the carrying out of pre-contractual measures adopted at the request of the same.
With regard to the purposes referred to in Article 2, point b, of the present informative note, the legal basis of the processing of personal data will be found in article 6, co. 1, point c, of the Regulation (EU), according to which the processing of personal data is lawful in cases where it is necessary to fulfill a legal obligation to which the Data Controller is subject.
Finally, with regard to the purposes referred to in Article 2, point c, of the present informative note, the legal basis of the processing of personal data will be found in article 6, co. 1, point a, of the Regulation (EU), according to which the processing of personal data is lawful in cases in which the interested party has given consent to the processing of their personal data for one or more specific purposes.
4. Recipients of the data and purpose of distribution
Personal data will be communicated and processed only to/from the Data Controller and to/from employees and/or collaborators and/or consultants of the Data Controller and/or third parties who maintain relationships with the Data Controller on a professional level, hold the status of Data Processors pursuant to article 4, co. 1, point g, of the Privacy Code and article 4, co. 1, point 8, and article 28 of the Regulation (EU), or they hold the status of Data Processors pursuant to article 4, co. 1, point h, of the Privacy Code and article 4, co. 1, point 10, and article 29 of the Regulation (EU), or to judicial, administrative and stock market authorities, for the fulfillment of legal obligations. The personal data may be transferred to companies with offices in European Union countries and/or third countries with respect to the European Union that maintain professional relationships with the Data Controller, but always within the scope of the purposes previously described and in the compliance with the principles and security measures summarized in the Regulation (EU), specifying that, in this case, the interested party may obtain a copy of such data by sending a request to the Data Controller or the Data Processor at the addresses and in the manner indicated in article 1 of this informative note.
5. Types of data processed and the duration of retention of the same
The types of personal data that can be acquired and processed following the consultation of the Site or the sending of requests for information/contact by the interested party are as follows:
a. Data spontaneously provided by the interested party
The optional, explicit and voluntary sending of communications by the interested party to the addresses and channels indicated on the Site will entail the subsequent acquisition of the sender’s address, which is necessary in order to be able to satisfy requests, as well as any other personal data included in the correspondence.
In this case, the acquired data will be processed exclusively to respond to requests received from the interested party and will be kept for the time necessary to satisfy the requests received, not exceeding 24 months. In the case of the establishment of specific relationships with the interested party that entails the need to extend the retention period of personal data, the interested party upon submission of the specific information will acquire a specific and further consent.
b. Cookies
The interested party must know that the Cookies, according to the definition provided by the Privacy Guarantor, are “small text files that sites visited by users send to their terminals, and are stored to be re-transmitted to the same sites at the next visit”. Two macro categories of cookies have been identified:
i) so-called “technical cookies”, which are used for the sole purpose of transmitting a communication over an electronic communications network, or as strictly necessary for the provider of an information society service explicitly requested by the subscriber or user who provides this service. They serve to simplify and facilitate the navigation on the Site and the full use of its features. In turn, technical cookies can be divided into a. “navigation cookies”, which guarantee the normal navigation and use of the Site (allowing, for example, to make a purchase or authenticate to access restricted areas) and in b. “functionality cookies”, which allows for navigating according to a series of selected criteria (for example, the language, the products selected for purchases) in order to improve the rendered service.
Finally, from a regulatory point of view, the category of technical cookies are assimilated to so-called “Analytics cookies”, used to analyze accesses or visits to the site solely for statistical purposes without the possibility of identifying the individual user. These can be installed directly by the owner of the Site or by third-party sites (so-called “third party cookies”);
ii) so-called “Profiling cookies”, which are designed to create profiles relating to the user of the Site and are used in order to send the same user advertising messages in line with the preferences expressed by the same in the context of navigating the net. They serve, to simplify, to achieve purposes of analysis of the behaviors of the interested party for marketing purposes. Even in this case, they can be installed directly from the Site or from third parties (so-called “third-party cookies”).
6. Extended information on cookies
Consultation of the Drawlight Site may involve the installation of the following categories of cookies:
i) web browsing cookies, which serve to guarantee the normal navigation and use of the Site and the services made available by the same (allowing, for example, authenticating access to restricted areas and remembering the preferences that may have been set by the user during use of the Site itself). This data is not collected for the purpose of associating them with identified subjects and are kept for the time necessary to carry out the purposes related to them, not exceeding 24 months.
ii) functional cookies, which allow navigation on the Site according to a series of selected criteria (for example, the language or country you are located in) in order to improve its usability. Therefore, this data is not collected for the purpose of associating them with identified subjects and are stored for the time necessary to carry out the purposes related to them, not exceeding 24 months.
For both cookies, pertaining to the category of technical cookies, the express consent of the interested party is not required for their use, for it is sufficient to inform them of their presence, as this present document does, pursuant to article 13 of the Privacy Code and article 13 of the Regulation (EU);
iii) cookie analytics, which are used for statistical purposes to collect information, in an aggregate and anonymous form, on the number of users accessing the Site and on the manners with which they use it. This data is therefore not collected for the purpose of associating them with identified subjects, but for mere statistical purposes, and are stored for the time necessary for carrying out analytical and comparative statistical computations, not exceeding 24 months.
These cookies do not require the express consent of the interested party to be used if they are created and used directly by the data controller or if they are created or made available by third parties on the condition, in this case, that appropriate tools are adopted to reduce the identifying power of the cookie analytics themselves (for example, by masking significant portions of the IP address) and that the use of these cookies is subject to express contractual agreements between the Site and the third parties, which refer to the commitment of the third party to use them exclusively for the provision of the service, not to cross the information contained in the cookies with others already available and to store them in an appropriate manner.
In this regard, it should be noted that the Site uses cookie analytics services provided by third parties and specifically by Google (please refer to www.google.com/analytics/learn/privacy.html?hl=it where you can view the information on the principles of security and privacy of Google Analytics to protect user data).
It is important for the interested party to know that, by browsing the Site, in any case they give their consent and therefore consent to the use of the various cookies, being able, at any time, to change the preferences regarding cookies, even denying the consent to the use of some or all types of cookies described above, configuring in this sense the specific browser used for navigation following the specific instructions made available by the specific browser manufacturer to the dedicated internet address (hereinafter referred to as links to the dedicated pages of the most used browsers, in any case, with Drawlight not assuming any responsibility in case of their modification by the manufacturer: Apple Safari, Google Chrome, Mozilla Firefox, Microsoft Edge, Microsoft Internet Explorer, Opera Browser). Once again, therefore, it should be noted that in the event that the interested party uses the Site without changing any browser settings, the same accepts to receive all the cookies used by the Site in order to use all the functionalities of the same.
7. Methods of data processing
The processing of personal data is carried out by means of operations or set of operations indicated in article 4, co. 1, point a, of the Privacy Code and of article 4, co. 1, point 2, of the Regulation (EU), namely, through the collection, registration, organization, structuring, conservation, adaptation or modification, extraction, consultation, processing, selection, comparison, use, interconnection, block, communication by transmission, distribution or any other form of processing available, limiting, canceling and destroying of data. The processing operations can be carried out both by paper and computerized archives and with or without the aid of electronic and telematic tools or, in any case, automated.
The processing of personal data collected is based on compliance with the principles of correctness, lawfulness, transparency, data minimization, accuracy, limitation of conservation, integrity, and confidentiality, as well as the principle of accountability, summarized in article 5 of the Regulation (EU) and in article 11 of the Privacy Code. The compliance with the security measures and protection of personal data required by current legislation is also guaranteed.
8. Provision of data and refusal to provide them
The consent of the interested party to the processing of personal data is optional for the purposes of consultation of the Site and for marketing purposes, while it is considered and configured as indispensable in the case of the formulation by the interested party of requests for information and/or contact, within the limits necessary in order to allow Drawlight to fulfill the requests. Any refusal by the interested party to provide personal data will not, therefore, affect the possibility of consulting the Site, but it will make it impossible for Drawlight to process any requests for information and/or contact carried out by it.
As for the consent related to the types of cookies that may be installed on the terminal of the interested party and the processing of personal data thus acquired, please refer to the Extended Information note on cookies, referred to in the previous article 6 of this informative note.
9. Rights of the interested party
Article 7 of the Privacy Code and articles 15 to 21 of the Regulation (EU) confer the interested party the right to exercise specific rights, including:
a) the right to obtain from the Data Controller confirmation of the existence or otherwise of their personal data, access to them and information relating thereto;
b) the right to obtain the provision of personal data in a structured and readable form by automatic device, also in order to communicate such data to another data controller (so-called right to the portability of personal data), in summarized cases in article 20 of the Regulation (EU);
c) the right to obtain adequate Information pursuant to article 13 of the Privacy Code and article 13 of the Regulation (EU);
d) the right to obtain an update, correction of inaccurate data and the integration of incomplete data, the cancellation, transformation into an anonymous form or blocking of processed data in violation of the law, as well as the limitation of the processing of the personal data for cases summarized in article 18 of the Regulation (EU);
e) the right to object, for legitimate reasons, to the processing of personal data;
f) the right to withdraw consent to the processing of personal data at any time, limited to the cases in which the processing is based on its consent for one or more specific purposes and concerns common personal data, or particular categories of data, for example, sensitive data, in any case without prejudice to the lawfulness of the treatment based on the consent given before the revocation;
The aforementioned rights may be exercised by sending a request to the Data Controller or the Data Processor at the aforementioned addresses and in accordance with the methods indicated in article 1 of this Informative note.
It is also the right of the interested party, pursuant to article 77 of the Regulation (EU), to propose a complaint to the supervisory authority (an authority for the protection of personal data, which can be reached at www.garanteprivacy.it ) if they consider that the processing of personal data is carried out in violation of the regulations in force .
10. Modifications
The Data Controller reserves the express right to make modifications, additions and/or updates, in whole or in part, to the content of this Informative note. Therefore, it is a necessity that each interested party regularly review this information in order to obtain full knowledge of the most recent and updated version of the Privacy and Cookie Policy of Drawlight and its contents.