PRIVACY POLICY

Information on the processing of personal data (provided pursuant to Articles 13 and 14 of Regulation EU 2016/679 — “GDPR”)

Data Controller Alfaproject.net S.r.l., Viale Sarca 336/F, Milan — PEC: alfaproject.net@pec.it

Types of data processed and purposes The site processes personal data in the following cases:

a) Data provided voluntarily through the contact form When the user fills in the form on the site, the data they provide (e.g. name, email address, and any other data entered in the message) are processed in order to respond to requests for information or assistance. Legal basis: response to a request from the data subject / performance of pre-contractual measures (Art. 6(1)(b) GDPR).

b) Browsing data The IT systems and software procedures of the site acquire, during their normal operation, certain data whose transmission is implicit in the use of Internet communication protocols (e.g. IP addresses, access logs). Such data are used for security purposes and the correct functioning of the infrastructure. Legal basis: legitimate interest of the Controller in the security of the site (Art. 6(1)(f) GDPR).

c) Analytics cookies For data collected through Google Analytics 4, please refer to the [Cookie Policy]. Legal basis: user’s consent (Art. 6(1)(a) GDPR).

Method of processing Processing is carried out using suitable paper, electronic and/or telematic tools, with logic strictly related to the stated purposes and in such a way as to guarantee the security and confidentiality of the data.

Disclosure of data and recipients The data may be processed by parties acting as data processors on behalf of the Controller, including:

• the site’s hosting provider [TO CONFIRM: hosting provider name];
• Google Ireland Limited, for the Google Analytics 4 service (analytics cookies, subject to consent). [TO CONFIRM: the email provider used to manage the form emails, if different from the hosting provider]

Transfer of data outside the EU The use of Google Analytics 4 may involve the transfer of data to third countries. Google adheres to mechanisms that guarantee an adequate level of data protection in accordance with the GDPR. [TO CONFIRM: keep this section if GA4 remains active in production]

Retention period Data are kept for the time strictly necessary to achieve the purposes for which they were collected. In particular: the contact form data are kept [TO CONFIRM: indicate duration, e.g. “for the time necessary to handle the request and for subsequent obligations”]; analytics data according to the Google Analytics retention settings.

Rights of the data subject The data subject may at any time exercise, by writing to alfaproject.net@pec.it, the rights provided for by Articles 15-22 of the GDPR: access, rectification, erasure (“right to be forgotten”), restriction of processing, objection to processing and data portability. They also have the right to lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it) if they believe their rights have been infringed.