Information notice on the processing of personal data
Information provided pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (“GDPR”) and Legislative Decree 196/2003 as amended by Legislative Decree 101/2018 (“Italian Privacy Code”)
1. Data controller
The controller of the personal data collected through this website (hereinafter, the “Website”) is ADEMPIRE S.R.L.S., with registered office in Tolentino, V.le Vittorio Veneto no. 57, VAT no. 02056740430, email: info@adempireitalia.com; certified email (PEC): adempire2021@pec.it, hereinafter also “Adempire” or the “Controller”.
For any information on the processing of personal data or to exercise the rights described in section 9 below, data subjects may contact the Controller at the contact details indicated above.
2. Categories of personal data processed
In the course of browsing the Website and using the services it offers, the Controller processes the following categories of personal data:
- Browsing data: the IT systems and software procedures used to operate the Website acquire, during their normal operation, certain data whose transmission is implicit in the use of Internet communication protocols (e.g. IP addresses, browser type, operating system, domain names of the devices used, access times). These data are used solely to obtain anonymous statistical information on the use of the Website and to check that it works properly, and are normally deleted after processing, except where they are needed to investigate possible computer crimes against the Website.
- Data voluntarily provided through the contact form: first name, last name, email address, any other contact details, company/organisation, as well as the content of the message freely entered by the user in the relevant text field.
- Data collected through cookies and similar tracking tools (analytics and marketing/profiling), as described in the Cookie Policy, which forms an integral part of this notice.
3. Purposes of the processing and legal basis
Personal data collected through the Website are processed for the following purposes and on the following legal bases:
| Purpose | Legal basis | Data processed |
|---|---|---|
| Responding to requests submitted through the contact form | Performance of pre-contractual measures taken at the data subject’s request and/or legitimate interest of the Controller in responding to the requests received (Art. 6(1)(b) and (f) GDPR) | Identification and contact data, content of the message |
| Statistical analysis of the traffic and use of the Website (Google Analytics 4, Microsoft Clarity) | Consent of the data subject (Art. 6(1)(a) GDPR), obtained through the cookie banner | Browsing data, online identifiers, data on interaction with the Website |
| Measurement of advertising conversions and remarketing/retargeting activities (Meta Pixel, LinkedIn Insight Tag) | Consent of the data subject (Art. 6(1)(a) GDPR), obtained through the cookie banner | Browsing data, online identifiers, interaction with advertisements |
| Indexing of the Website on search engines (Bing Webmaster Tools / IndexNow) | Legitimate interest of the Controller (Art. 6(1)(f) GDPR); a tool that does not, as a rule, involve the processing of users’ personal data | Data relating to the URLs of the Website (not personal data of users/visitors) |
| Compliance with legal obligations (e.g. requests from the Judicial Authority or other competent Authorities) | Legal obligation (Art. 6(1)(c) GDPR) | Data that may be requested by the competent Authority |
4. Nature of the provision of data
Providing data through the contact form is optional; however, failure to provide them makes it impossible for the Controller to follow up on the request. Providing data for analytics and marketing purposes is likewise optional and subject to consent, which may be withdrawn at any time as described in the Cookie Policy.
5. Special categories of data that may be submitted through the contact form
As this is the website of a consultancy company that also operates in the healthcare sector, when describing their request in the free text field of the contact form users might spontaneously provide information falling within the special categories of data under Art. 9 GDPR (for example, data concerning their own health or that of third parties) or data relating to judicial proceedings (Art. 10 GDPR).
The Controller asks users not to enter in the contact form special categories of data or any data that are not strictly necessary for an initial assessment of the request, and to share detailed and/or sensitive information only through the confidential channels that will be indicated in reply to the first contact.
Should users nevertheless spontaneously enter special categories of data in the text of the message, the related processing is based on the explicit consent expressed by the data subject through the free and informed communication of such data (Art. 9(2)(a) GDPR), without prejudice to the above recommendation.
6. Processing methods and security measures
Personal data are processed with automated tools for the time strictly necessary to achieve the purposes for which they were collected, in compliance with the principles of lawfulness, fairness, transparency, data minimisation, accuracy, storage limitation, integrity and confidentiality set out in Art. 5 GDPR, through the adoption of technical and organisational measures appropriate to the risk of the processing.
7. Recipients and transfer of data to non-EU countries
Personal data may be disclosed to:
- staff and collaborators of the Controller authorised to process the data, within the scope of their respective duties, to whom the request received through the form may be forwarded for handling
- Amazon Web Services EMEA SARL, provider of the hosting service of the Website, with servers located in the European Union (Frankfurt, Germany), as data processor pursuant to Art. 28 GDPR;
- Omnes S.r.l.s., the company responsible for the development, maintenance and technical support of the Website, which may access the systems where the data are stored in order to carry out these activities, as data processor pursuant to Art. 28 GDPR;
- Google Ireland Limited (Google Workspace), provider of the email service used to send and manage communications relating to requests submitted through the contact form, as data processor pursuant to Art. 28 GDPR;
- Google Ireland Limited (Google Analytics 4), Meta Platforms Ireland Limited (Meta Pixel), LinkedIn Ireland Unlimited Company (LinkedIn Insight Tag) and Microsoft Ireland Operations Limited (Microsoft Clarity), as independent controllers and/or processors depending on their respective contractual terms, for the analytics and marketing purposes described in the Cookie Policy.
Amazon Web Services, Google, Meta, LinkedIn and Microsoft belong to US corporate groups and the processing may involve the transfer of personal data to the United States of America. As at the date of the latest update of this notice, such transfers are based, according to the statements of the individual providers, on the adequacy decision of the European Commission of 10 July 2023 on the EU-US Data Privacy Framework (for self-certified entities) and/or on the Standard Contractual Clauses approved by the European Commission, together with any necessary supplementary measures. It is recommended to periodically check the individual providers’ participation in the Data Privacy Framework through the public list maintained by the US Department of Commerce (dataprivacyframework.gov), as these self-certifications can be withdrawn.
8. Retention period
- Contact form data: kept for the time needed to handle the request and, if no subsequent professional/contractual relationship is established, for a maximum of 12 months from the date of the last contact, after which the data are deleted or anonymised, unless they need to be kept for a longer period to establish, exercise or defend a legal claim. If a professional relationship is established, the data are kept in accordance with the terms set out by the applicable contractual, tax and professional rules.
- Data collected through cookies and similar tools: in accordance with the terms indicated in the Cookie Policy and in any case for no longer than necessary for the purposes for which they were collected.
- Browsing data (system logs): kept for a maximum of 6 months.
9. Rights of the data subject
As a data subject, the user has the right to ask the Controller, in the cases provided for by the applicable legislation, for access to their personal data (Art. 15 GDPR), rectification (Art. 16 GDPR), erasure (Art. 17 GDPR), restriction of processing (Art. 18 GDPR) and data portability (Art. 20 GDPR); the user also has the right to object to the processing (Art. 21 GDPR) and to withdraw any consent given at any time, without affecting the lawfulness of processing based on consent before its withdrawal (Art. 7(3) GDPR).
Requests may be sent to the contact details of the Controller indicated in section 1.
10. Right to lodge a complaint
Without prejudice to any other administrative or judicial remedy, data subjects who consider that the processing of their personal data infringes the applicable legislation have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali) pursuant to Art. 77 GDPR, or to bring proceedings before the competent judicial authority pursuant to Art. 79 GDPR. The Italian Data Protection Authority has its offices in Piazza Venezia no. 11, 00187 Rome, and can be reached through the website www.garanteprivacy.it
11. Minors
The Website is not intended for persons under 18 years of age and the Controller does not knowingly collect personal data of minors through the contact form.
12. Changes to this notice
The Controller reserves the right to amend or update this notice, in whole or in part, including as a result of legislative changes. Changes will be published on the Website and will be binding from the time of their publication.