A – Data Controller, Managers, and Authorized Persons for the Processing of Personal Data

Droplet S.r.l. (hereinafter referred to as “Company,” “Organization,” or “Data Controller”), with its registered office at Via Bogino, 13 – 10042 Moncalieri (To) and operational office at Via San Secondo 31, 10128 Torino, email: info@droplet.it, informs you that the data you provide in relation to existing and/or future legal relationships (as a user/data subject) will be subject to processing in compliance with the aforementioned regulations.

This processing will be carried out lawfully and according to the principles set forth in Article 5 of EU Regulation 2016/679 (GDPR). Further communications may be provided at a later time, even verbally.

The updated list of external data processing managers and authorized persons for data processing is kept in the Company’s archives at the registered office.

B – Data Subject to Processing

“Processing of personal data” refers to any operation or set of operations performed with or without the aid of automated processes and applied to personal data or sets of personal data, such as collection, registration, organization, structuring, storage, adaptation or alteration, extraction, consultation, use, communication by transmission, dissemination, or any other form of provision, comparison, or interconnection, limitation, deletion, or destruction. Specifically, this refers to data voluntarily provided by you for the execution of existing legal relationships with the Data Controller of personal data.

A “personal data” is any information relating to an identified or identifiable natural person (“data subject”); an identifiable natural person is one who can be identified, directly or indirectly, by reference to an identifier such as a name, identification number, location data, online identifier, or one or more specific elements of their physical, physiological, genetic, mental, economic, cultural, or social identity.

The data subject to processing, listed below in a non-exhaustive manner, will be voluntarily provided by you for the execution of existing and/or future legal relationships:

• First name and last name, registered residence or tax domicile, phone number, fax number, mobile phone number, email address, PEC address, VAT number.

Additionally, navigation data, the information systems, and the software procedures employed for the operation of this website, which may acquire, during their normal operation, your personal data, the transmission of which is implicit in using Internet communication protocols. These are, however, information not collected to be associated with identified data subjects, but which by their nature could, through processing and associations with data held by third parties, allow for the identification of users. This category of data includes IP addresses or domain names of computers used by users connecting to the site, URIs (Uniform Resource Identifiers) of requested resources, request time, the method used to submit the request to the server, the size of the file obtained in response, the numerical code indicating the status of the response given by the server (success, error, etc.), and other parameters regarding the operating system and the user’s IT environment. This data is used solely for deriving anonymous statistical information about the use of the site and for monitoring its correct functioning and is deleted immediately after processing. The data may also be used to establish liability in cases of alleged cybercrimes against the site or requests from authorities.

C – Purposes of Processing

The personal data provided by you will be processed for the following purposes:

1. management of existing and/or future legal relationships;
2. fulfillment of obligations arising from the legal relationships mentioned above;
3. organizational management of any legal relationship in place or under definition;
4. fulfillment of legal, accounting, and/or tax obligations;
5. protection of contractual rights;
6. purposes related to conducting statistical analyses;
7. promotion of marketing activities and commercial communications via email or phone regarding the services provided by the Data Controller, also through partners. Should you give your consent, your personal data will be visible and stored in a customer relationship management database (Customer Relationship Management – CRM), and possibly retained in one or more specific archives or databases of the company that may be accessed by other related companies.

D – Legal Basis for Processing

Regarding the purposes specified in points 1 to 6 of paragraph C, the processing is necessary for the execution of a legal relationship that you are or may be a party to, or for the execution of pre-contractual measures adopted at your request. The processing is therefore lawful (Article 6, para. 1, lett. b, GDPR).

Regarding the purpose specified in point 7 of paragraph C, the processing is optional and therefore subject to your consent in order to be lawful (Article 6, para. 1, lett. a, GDPR).

E – Duration of Processing

The personal data collected for the purposes specified in points 1 to 6 of paragraph C will be processed for a period not exceeding the achievement of the purposes for which they are processed and for the subsequent ten (10) years for legal requirements.

The data related to the purpose specified in point 7 will be processed for two (2) years from the date of acquisition, unless a request is made by the data subject. These data, upon expiration of this term, will be destroyed.

The personal data contained in documents relevant for administrative-accounting purposes will be kept in compliance with legal obligations.

F – Nature of Data Provision

Providing data is mandatory for the purposes from 1 to 6 of paragraph C, i.e., to meet legal obligations relating to an established legal relationship and for any other purpose related to legal requirements, regulations, and EU directives. Refusal to provide data will prevent the Data Controller from fulfilling these obligations and consequently lead to the inability to provide the services and/or performances requested by you.

Providing your data and consenting to processing for the purposes indicated in point 7 of paragraph C are entirely optional. Withholding your consent to processing or failing to provide your personal data for this purpose will result in the inability to engage in marketing activities and commercial communication via email or phone regarding the services provided by the Data Controller, even through partners.

G – Processing Methods

Your data will be processed and archived exclusively for the aforementioned purposes using both paper and electronic supports, inserted into relevant databases and processed with tools suitable to ensure the integrity, security, and confidentiality of the data, in accordance with GDPR provisions. All necessary technical and organizational measures will be taken to ensure a level of data protection compliant with GDPR requirements. Access will only be granted to individuals authorized in writing to process personal data. Data may also be communicated and/or collected to/from third parties (as in cases of data acquisition from processing centers or other Companies). They will be properly designated as Data Processing Managers and will be involved in fulfilling the obligations required by the existing legal relationship and applicable legal obligations.

H – Social Platforms

The website may offer access to services and platforms of social networks.

Droplet S.r.l. advises exercising caution regarding the sharing of personal information on thematic channels through “comments” or “public posts” while using the aforementioned platforms. The terms of use and the privacy policies applicable to each of these social communication tools, published on their respective sites, govern the information provided. Droplet S.r.l. does not exercise any form of control over the use of personal information communicated in a public forum, comment area, bulletin board, making the user solely responsible for any disclosure. For more specific information regarding the above, we invite you to visit the social policy section of the site at the web address https://www.droplet.it/social/

I – Cookies

The website https://www.droplet.it/ uses exclusively technical cookies, which are necessary and functional for its operation, and third-party cookies, which do not allow the collection of information about visitors (profiling). For more specific information regarding this, we invite you to visit the cookie policy section of the site at the web address https://www.droplet.it/cookie/

L – Communication to Third Parties and/or Data Dissemination

For the purposes specified in points 1 to 6, Droplet S.r.l. informs you that your data may be communicated to external parties, designated in writing, should this be necessary to fulfill an obligation prescribed by law, to execute obligations arising from a contract to which you are/or will be a party, as well as to comply with specific requests you may have before the conclusion of the contract.

The recipients of communications of the personal data of the data subject can also be identified within the following categories of recipients:

• supervisory bodies, judicial authorities, entities, professionals, companies, public administrations, or other structures designated for carrying out processing related to fulfilling administrative, accounting, and management obligations linked to the ordinary conduct of the economic activity of the Data Controller (legal obligations);
• banks, financial institutions, independent professionals, professional firms, and consultants to whom the communication of said data is necessary for the performance of the Data Controller’s activity and, in particular, in relation to the fulfillment of contractual obligations undertaken towards the data subject (contractual obligations);

The collected data will not be disseminated in any way.

M – Intent to Transfer Data Abroad

The data will be transmitted exclusively within Italy and within the European Union.

N – Rights Under EU Regulation 2016/679

The data subject may at any time exercise the rights set forth in Article 7, paragraph 3, and Articles 15 et seq. of EU Regulation 2016/679:

1. the right of access to personal data;
2. the right to obtain rectification or deletion of the same or limitation of processing;
3. the right to object to processing;
4. the right to data portability;
5. the right to withdraw consent, where applicable (withdrawal of consent does not affect the lawfulness of the processing based on consent before the withdrawal);
6. the right to lodge a complaint with the supervisory authority (Data Protection Supervisor).

O – Identifying Information of the Data Controller

The Data Controller of personal data is Droplet S.r.l. (hereinafter referred to as “Company,” “Organization,” or “Data Controller”), with its registered office at Via Bogino, 13 – 10042 Moncalieri (To) and operational office at Via San Secondo 31, 10128 Torino.

The data subject can exercise the rights mentioned above by sending an email to: info@droplet.it

Additional information regarding the processing of personal data may also be communicated verbally at the time of data collection.

Moncalieri, May 30, 2024

The Data Controller

Droplet S.r.l.