General Privacy Policy

Types of Data Collected:

The types of personal data collected by this application, either directly or through third parties, include: first name; last name; company name; email address; trackers; usage data. Full details regarding each type of personal data collected are provided in the sections of this Privacy Policy dedicated to them or through specific notices displayed prior to data collection. Personal data may be provided voluntarily by the user or, in the case of usage data, collected automatically when using this application. Unless otherwise specified, the provision of all data requested by this application is mandatory, and failure to provide such data may make it impossible for this application to provide its services. In cases where this application explicitly states that certain data is not mandatory, users are free to choose not to provide such data without this affecting the availability or functionality of the service. Users who are unsure which personal data is mandatory may contact the owner. Any use of cookies—or other tracking tools—by this application or by the owners of third-party services used by this application is intended to provide the service requested by the user, in addition to any other purposes described in this document and in the Cookie Policy, if available. Users are responsible for any third-party personal data that has been received, published, or shared through this application.

Methods of Processing and Location of Data Processing

Processing Methods:

The owner takes appropriate security measures to prevent unauthorized access, disclosure, alteration, or unauthorized destruction of the data. Data processing is carried out using computers and/or IT-based tools, in accordance with organizational procedures and methods strictly related to the specified purposes. In addition to the Owner, the data may in some cases be accessible to certain categories of data processors involved in the operation of this application (administration, sales, marketing, legal, system administration) or to external parties (such as third-party technical service providers, postal carriers, hosting providers, IT companies, and communications agencies), who, if necessary, are appointed by the Owner as data processors. An updated list of these parties may be requested from the Owner at any time.

Location:

The data is processed at the Owner’s operational offices and at all other locations where the parties involved in the processing are based. Depending on the user’s location, data transfers may involve the transmission of the user’s data to a country other than their own. For specific information regarding the personal data used for each purpose, the user may contact the Owner via email at info@luisalm.it.

Retention Period:

Unless otherwise specified in this document, personal data will be processed and stored for as long as necessary for the purpose for which it was collected and may be retained longer due to legal obligations or based on the user’s consent.

Purposes of Processing:

The user’s data is collected to enable the owner to provide its service, comply with its legal obligations, respond to law enforcement requests, protect its rights and interests (or those of its users or third parties), detect malicious or fraudulent activities, and for the following purposes: contacting the user and analytics.

For specific information about the personal data used for each purpose, the user may refer to the section “Detailed Information on the Processing of Personal Data.”

Additional Information for Users

Legal Basis for Processing:

The owner may process users’ personal data if one of the following conditions applies:

• Users have given their consent for one or more specific purposes. Note: Under certain jurisdictions, the Owner may process personal data until the user objects to such processing (“opt-out”) without having to rely on consent or any other of the following legal bases. However, this does not apply if the processing of personal data is subject to European data protection law;

• the provision of data is necessary for the performance of a contract with the user and/or for any pre-contractual obligations of the user;

• the processing is necessary to comply with a legal obligation to which the owner is subject;

• the processing is related to a task carried out in the public interest or in the exercise of official authority vested in the owner;

• the processing is necessary for the purposes of the legitimate interests pursued by the Data Controller or a third party.

In any case, the Data Controller will be happy to clarify the specific legal basis applicable to the processing, in particular whether the provision of personal data is a legal or contractual requirement or a necessary requirement to enter into a contract.

Additional information on retention periods:

Unless otherwise specified in this document, personal data will be processed and stored for as long as necessary for the purpose for which it was collected and may be retained longer due to an applicable legal obligation or based on the user’s consent.

Therefore:

• Personal data collected for purposes related to the performance of a contract between the owner and the user will be retained until the contract has been fully performed.

• Personal data collected for the purposes of the Owner’s legitimate interests will be retained for as long as necessary to fulfill those purposes. Users can find specific information regarding the legitimate interests pursued by the Owner in the relevant sections of this document or by contacting the Owner.

The owner may be permitted to retain personal data for a longer period if the user has consented to such processing, as long as that consent is not revoked. Furthermore, the owner may be required to retain personal data for a longer period if this is necessary to comply with a legal obligation or pursuant to an order from a public authority. Once the retention period has expired, the personal data will be deleted. Therefore, the right of access, the right to erasure, the right to rectification, and the right to data portability cannot be exercised after the retention period has expired.

Users’ Rights:

Users may exercise certain rights regarding their data processed by the owner. In particular, users have the right to do the following, to the extent permitted by law:

• Withdraw their consent at any time. Users have the right to withdraw their consent where they have previously given consent to the processing of their personal data.

• Object to the processing of their data. Users have the right to object to the processing of their data if the processing is based on a legal basis other than consent.

• Access their data. Users have the right to know whether data is being processed by the owner, to obtain information about specific aspects of the processing, and to receive a copy of the data currently being processed.

• To request verification and correction. Users have the right to verify the accuracy of their data and to request that it be updated or corrected.

• To restrict the processing of their data. Users have the right to restrict the processing of their data. In this case, the data controller will not process their data for any purpose other than storage.

• To have their personal data erased or otherwise removed. Users have the right to obtain the erasure of their data from the data controller.

• To receive their data and transfer it to another data controller. Users have the right to receive their data in a structured, commonly used, and machine-readable format and, where technically feasible, to transmit it to another data controller without hindrance.

• To file a complaint. Users have the right to file a complaint with their competent data protection authority.

Users also have the right to learn about the legal basis for the transfer of data abroad—including to any international organization governed by public international law or established by two or more countries, such as the UN—and about the security measures taken by the owner to protect their data.

Details regarding the right to object to processing:

If personal data is processed in the public interest, in the exercise of official authority vested in the data controller, or for the purposes of the legitimate interests pursued by the data controller, users may object to such processing by providing a reason related to their particular situation to justify the objection.

However, users should be aware that if their personal data is processed for direct marketing purposes, they may object to such processing at any time, free of charge, and without providing a reason. If the user objects to processing for direct marketing purposes, the personal data will no longer be processed for those purposes. To determine whether the Data Controller processes personal data for direct marketing purposes, users may refer to the relevant sections of this document.

How to Exercise These Rights:
Requests to exercise user rights may be directed to the Data Controller using the contact information provided in this document. These requests may be submitted free of charge and will be answered by the Data Controller as soon as possible and always within one month, providing users with the information required by law. Any correction or deletion of personal data, or restriction of processing, will be communicated by the Data Controller to any recipient, if any, to whom the personal data has been disclosed, unless this proves impossible or involves a disproportionate effort. Upon request, the Data Controller will inform users of these recipients.