Pursuant to Article 13 of EU Regulation 2016/679 (GDPR) and Legislative Decree 101/2018, IRIS (hereinafter "we") informs the user ("you") how we process the personal data collected through the site.
1. Data controller
The Data Controller is IRIS, with headquarters in [Address], email: [email]. If appointed, our Data Protection Officer (DPO) is [name and contact details].
2. Processed data
We collect identifying data (e.g., name, email), technical data (e.g., IP address, cookies, browsing data), and, if provided voluntarily, additional data (e.g., newsletter). Processing is transparent and limited to the purposes communicated.
3. Purposes and legal bases
The data is processed for:
ensure the functioning, security and anonymous statistical analysis of the site;
respond to requests, send newsletters and marketing communications, always with explicit consent, demonstrable through double opt-in methods, now considered the minimum standard in Italy.
4. Conservation
The data will be retained only for the time necessary for the purposes indicated or until a request for deletion is received, except where required by law.
5. Communication and transfers
The data will not be transferred to third parties, except as required by law or as necessary for the requested services (e.g., hosting, analytics tools). We do not transfer data outside the EU/EEA.
6. Your rights
You have the right to request: access, rectification, erasure, restriction of processing, objection to processing, data portability, and withdrawal of consent. You can exercise these rights by writing to [email] or to the DPO. We will respond within one month (extendable if necessary). You also have the right to lodge a complaint with the Italian Data Protection Authority.
7. Security
We implement technical and organizational measures to ensure data confidentiality, integrity, and availability, in compliance with Article 32 of the GDPR.
8. Policy Changes
This policy may be updated; we will notify you of the new revision date. We encourage you to review it regularly.