Privacy Policy

GDPR PRIVACY NOTICE (pursuant to Arts. 13 and 14 of EU Reg. 2016/679 – GDPR)
In compliance with Articles 13 (for data collected from the data subject) and 14 (for data not collected from the data subject) of Regulation (EU) 2016/679 (GDPR), the following information is provided to the Users of this Website, in their capacity as Data Subjects. This notice refers exclusively to the processing carried out through this Website and not through other websites that may be visited via links, for which Users are invited to consult the respective privacy notices provided by their respective Data Controllers.

Data Controller and Contact Details
The Data Controller is IMSYSTEM di Ignazio Mascia, with registered office at Via Aosta n. 4/A, 09126 Cagliari (CA), Italy, VAT No. 02604950929, e-mail: [email protected], Phone: +39 070 402252.
Categories of Processed Data and Sources of Origin
The Data Controller may process, primarily, general browsing data and cookies, for which Users are invited to read the specific Cookie Policy linked in the footer.
The Data Controller may also process personal data voluntarily provided by the user—for example, through the contact form or by sending communications via e-mail—including common personal data (identification, biographical, tax, and similar data). Data may originate from automatic sources, voluntary sources, or public sources. For example, data may derive from the user’s navigation, which may carry information regarding previous visits to other sites, including specifically cookies and other similar technologies (please refer again to the specific Cookie Policy in the footer). Furthermore, data may be voluntarily provided by the user or related parties. Other data may come from public sources, such as data processed as part of searches in public registers, company registration excerpts, certificates, public records, and similar.
In all cases, the standards of maximum confidentiality and professional secrecy regarding user information subject to legal and ethical obligations are scrupulously observed.

Purposes of Processing
The personal data of Website Users, as described above, will be processed in the manners and forms prescribed by the GDPR, generally for the performance of the Website's functionalities, the consultation of its contents, and the utilization of its services.
Specifically, the processing of personal data pursues the following purposes:

1. To allow the visit to the Website, the consultation of published information, and the use of related services, including e-commerce services and related activities such as the sale of goods and services offered on the Website, delivery, and similar;
2. For the management of browsing data and for functional or technical reasons that allow the use of content, including through technical cookies; for aggregate statistical measurement purposes, including through analytics cookies; for the delivery of personalized content or services, including through profiling cookies, where provided and subject to consent; in any case, under the conditions set out in the Cookie Policy linked in the footer, which refers to the Italian Data Protection Authority (Garante) Guidelines of June 10, 2021, published on July 9, 2021;
3. To respond to requests made by the User through the Website and its communication tools (contact forms, information request forms, and similar) and for every subsequent, related, connected, or consequential communication and processing for the best management of the request itself;
4. For potential subscription to the newsletter, where provided, and the consequent sending of various informative communications concerning the sector in which the Data Controller operates;
5. For compliance with legal obligations and other mandatory purposes, such as billing or anti-money laundering (AML) profiles;
6. For other purposes ancillary, related, or consequential to those indicated above and falling within the Website's activities;
7. For the processing of the e-mail address provided by the User in the context of a previous sale (in any sense of supply, provision, and similar) of goods or services, also aimed at sending—without further consent—communications for subsequent similar information, pursuant to and within the limits of Art. 130, paragraph 4 of the Italian Privacy Code (Legislative Decree 196/2003); the data subject may, in any case, express their refusal and object to such processing, both initially and subsequently, easily and free of charge, by following the instructions in each such subsequent communication;
8. For the potential receipt of Curricula Vitae from candidates intending to apply for positions with the Data Controller.

Legal Bases for Processing
For all personal data, processing is based on the following lawfulness conditions (legal bases):

• Art. 6 par. 1 (a) GDPR – Consent: for the management of profiling cookies referred to in purpose no. 2 and for other processing subject to consent, including ancillary purposes not falling under other legal bases, as per purpose no. 6; for subscription to the newsletter referred to in purpose no. 4, if ancillary or additional to other processing.
• Art. 6 par. 1 (b) GDPR – Contractual or Pre-contractual Obligation: for the visit to the Website or access to services (including informative ones) published on the Website and for the processing of related browsing information; for all e-commerce services and related sales activities for goods and services as offered on the Website, delivery, and similar, as per purpose no. 1; for the management of cookies referred to in purpose no. 2 other than profiling cookies; for the processing of requests made by the Data Subject and related responses as per purpose no. 3; for newsletter subscription when this is the sole or primary purpose of providing personal data (specifically the e-mail address), as per purpose no. 4; for other connected, functional, and consequential processing, as per purpose no. 6; for the management of Curricula Vitae and related requests, as per purpose no. 8.
• Art. 6 par. 1 (c) GDPR – Compliance with a Legal Obligation: for the processing of all data necessary to fulfill legal obligations, including tax data related to billing or other mandatory processing such as anti-money laundering, as per purpose no. 5; for other connected, functional, and consequential processing, as per purpose no. 6.
• Art. 6 par. 1 (f) GDPR – Legitimate Interest: for all processing included in information society services, as well as for the Data Controller's informative purposes. In this regard, the Data Controller invokes legitimate interest for further communications sent to the Data Subject's e-mail address pursuant to Art. 130, paragraph 4 of the Italian Privacy Code as per purpose no. 7, without prejudice to the Data Subject's right to object free of charge as described therein.

For special categories of data pursuant to Art. 9 GDPR potentially provided spontaneously by data subjects through browsing or contact forms, the Data Controller indicates the following additional conditions of lawfulness:

• Art. 9 par. 2 (a) GDPR – Consent: for processing where consent has been expressly provided.
• Art. 9 par. 2 (e) GDPR – Data manifestly made public by the data subject: for data autonomously communicated or disclosed by the Data Subject.

Legitimate Interest
The processing of personal data is also based on the legitimate interest of the Data Controller pursuant to Art. 6 par. 1 (f) GDPR, such as the exercise of its rights to information in the context of the information society, the execution of services indicated on the Website, or the potential performance of direct marketing operations pursuant to Recital 47 of the GDPR.
The Data Controller also invokes the right to use the Data Subject's e-mail address provided during a sale of goods and services for sending further communications regarding similar goods or services pursuant to Art. 130, paragraph 4 of the Privacy Code, always subject to the Data Subject’s right to object free of charge, as per purpose no. 7.

Mandatory or Optional Nature of Data Provision
The provision of browsing data by Users for the purposes above depends on the privacy level the User has enabled or disabled through their browser, or managed through the specific controls of the Cookie Banner regarding cookie management. For technical cookies, disabling them may impair the navigation of the Website.
Provision of certain data is, in any case, necessary for the structure of the Website and the provision of some services. For example:

• For registration, placing orders in the Website’s e-commerce, sending messages via contact forms, or subscribing to the newsletter, the minimum requested data are mandatory (e.g., name/surname and/or e-mail address and/or other sender identification data and/or USERNAME). The contact form indicates which data are mandatory (with an asterisk "*") and which are not.
• The provision of all other data is optional.

Consequences of Failure to Provide Data
Failure to provide mandatory personal data prevents the Data Controller from registering the User on the Site, receiving orders, sending requested information, executing further processing requested by the User, or generally providing the services offered by the Website.
Failure to provide optional data does not produce these consequences but may affect the processing of the User's request or the navigability of the Website.

Recipients of Communications and Data Transfers
Data may be communicated to companies, professionals, and other consultants operating in relation to the purposes indicated in this notice or related purposes, both within the EU and outside the EU. In the latter case, data will only be transferred to subjects for whom an adequacy decision exists, or for whom adequate safeguards are in place (including Standard Contractual Clauses), or where consent has been obtained, or under further derogations pursuant to Art. 49 GDPR, following the requirements of the Schrems II judgment of the Court of Justice of July 16, 2020.
In any case, data may be communicated to data processors and persons authorized to process data, always for the same purposes of the Website or purposes related to services offered by the Website, as well as to any further independent Data Controllers within the limits of related purposes.
Recipients specifically include: the Data Controller's operators as authorized persons, its Data Processors and related authorized persons for related purposes (e.g., management or tax-related), Google Ireland for Google Analytics, and Google Ireland Ltd for Google Ads, for the management of this Website and related services.
No generalized communication of data for further purposes or dissemination of personal data will be carried out.
Browsing data and similar, as well as third-party profiling cookies (refer to the Cookie Policy), will be communicated to the respective third parties involved, where they do not already manage them directly as independent Data Controllers, within the limits of the consents provided.

Retention Period
Data voluntarily provided by the Data Subject will be kept until the withdrawal of consent expressed by the Data Subject, or until actions the Data Subject may perform on their browser (such as clearing cookies).
Browsing data and technical cookies will be kept for the technical time necessary to fulfill the functions for which they were collected.
For cookie retention periods in general, please refer to the specific policy accessible via the Cookie Banner.
For all other personal data, the retention period is limited to the statute of limitations of the relative rights or the term of relative legal or contractual obligations, including those related to billing and similar.

Rights of the Data Subject
The Data Subject has the right of access, rectification, erasure (right to be forgotten), restriction, notification in case of rectification, erasure or restriction, portability, objection, and the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning them or similarly significantly affects them, pursuant to Articles 15 to 22 of the GDPR.
These rights may be exercised in the forms and terms set out in Art. 12 GDPR, by written communication sent to the Data Controller via e-mail at the address provided above.
The Data Controller will provide an adequate response as soon as possible and in any case within 1 month of receipt of the request, except for cases of extension or justified refusal as per Art. 12 GDPR.

Right to Withdraw Consent
Where processing is based on consent, the Data Subject may withdraw it at any time by sending an e-mail to the Data Controller's address above, or through the specific controls on the Website (particularly for profiling cookies), or by express communication at the Data Controller's office.

Right to Lodge a Complaint
The Data Subject has the right to lodge a complaint pursuant to Articles 77 et seq. of the GDPR with a supervisory authority, which for the Italian state is the Garante per la protezione dei dati personali.
The forms, methods, and terms for lodging complaints are provided and governed by current national legislation (in Italy, by the Garante's specific regulations). The complaint is without prejudice to any other administrative or judicial remedy; for judicial actions for damages in Italy, the action is brought before the competent local Court.
​
Profiling
Personal data provided through browsing on this website may be subject to profiling by third-party providers via third-party profiling cookies, subject to the User's consent expressed through the Cookie Banner controls.
For more information, Users are invited to read the Cookie Policy linked in the footer.