Website Privacy Policy

1. INFORMATION ABOUT THE WEBSITE’S PRIVACY POLICY

This section contains information regarding the management of the website https://bibodal1969.it/ (the “Website”), offered to you (the “User”) by IRIS SRL, VAT no. 0132306100 and Tax ID no. 04896130582, with registered office in Rome, Piazza Dei Sant’ Apostoli, 58 (“IRIS”).

This notice is provided in accordance with Art. 13 of Legislative Decree no. 196/2003, Code regarding the protection of personal data, and Art. 13 of EU Regulation no. 2016/679 (“GDPR”), concerning the protection of individuals with regard to the processing of personal data, as well as the free movement of such data, for those interacting with IRIS, and is accessible at the address corresponding to the homepage: [https://bibodal1969.it/privacy-policy/]

This notice is valid only for IRIS’s Website and not for other websites possibly accessed by the User via links contained within.

The purpose of this notice is to enable the User to know exactly how, when, and the type of information that the data controller, in accordance with national and EU law, processes, and if the User is under sixteen years old, in compliance with Art. 8, par. 1 of the GDPR, the User’s consent must be legitimized by parental authorization or that of their guardian.

2. DATA PROCESSING

2.1. Data Controller

The Data Controller is the individual or legal entity, public authority, agency, or other body which, alone or jointly with others, determines the purposes and means of processing personal data. The Data Controller also oversees security matters.

For this Website, the Data Controller is IRIS S.r.l., VAT no. 0132306100 and Tax ID no. 04896130582, with headquarters in Rome, Piazza Dei Sant’ Apostoli, 58, represented by the legal representative Roberto Vanzo. For any clarification or to exercise your rights, the User can contact him via email at: [bibodal1969@gmail.com]

2.2. Data Protection Officer (DPO)

The Data Protection Officer is the individual or legal entity, public authority, agency, or other body that processes personal data on behalf of the Data Controller.

Pursuant to Article 28 of the GDPR, due to the characteristics of IRIS, the Data Protection Officer for the website has not currently been appointed.

Any subjects who may access our data in the future will be designated as data processors and will receive detailed instructions on how to process data and on the security standards to adopt to best ensure the User’s privacy.

2.3. Location of Data Processing

The processing of data generated by the use of the Website takes place at IRIS, at its headquarters in Piazza Dei Sant’ Apostoli, 58, Rome.

3. DATA PROCESSED

3.1. Methods of Data Processing

Like all websites, this Website makes use of log files in which information collected in an automated manner during user visits is stored. The information collected may include:

• Internet protocol (IP) address;
• Browser type and parameters of the device used to connect to the website;
• Name of the internet service provider (ISP);
• Date and time of visit;
• Web page of origin of the visitor (referral) and exit page;
• Number of clicks, if applicable.

This information is processed automatically and collected in aggregated form solely to verify the correct functioning of the website and for security purposes. This information is processed based on the legitimate interests of the Data Controller.

For security purposes (spam filters, firewalls, virus detection), automatically recorded data may also include personal data such as the IP address, which could be used, in accordance with applicable laws, to block attempts to damage the Website or cause harm to other users, or to engage in harmful or criminal activities. These data are never used for User identification or profiling, but only to protect the website and its users; such information is processed based on the legitimate interests of the Data Controller.

If the Website allows comments, or in the case of specific services requested by the User (including the ability to send personal data and/or a CV for a possible collaboration), the Website automatically records some identification data of the User, including the email address. These data are voluntarily provided by the User when requesting the service. By submitting a comment or other information, the User expressly accepts the privacy policy and, in particular, consents to the dissemination of the content to third parties. The data received will be used exclusively to provide the requested service and only for the time necessary to deliver the service.

The information that the User chooses to make public through the services and tools provided by the Website is knowingly and voluntarily provided by the User, exempting this Website from any liability for any violations of the law. It is the User’s responsibility to ensure they have permission to input third-party personal data or content protected by national or international laws.

3.2. Purpose of Data Processing

The data collected by the Website during its operation is used exclusively for the purposes indicated in this notice and stored for the time strictly necessary to perform the activities described, and in any case, no longer than 2 years.

Data used for security purposes (blocking attempts to damage the website) are stored only for the time necessary to achieve the aforementioned purpose.

3.3. Data Provided by the User

As mentioned above, the voluntary, explicit, and optional sending of emails to the addresses indicated on this website entails the subsequent acquisition of the sender’s address, necessary to respond to booking requests, as well as any other personal data included in the communication.

Specific summary information will be progressively displayed or shown on the website pages prepared for particular on-demand services.

4. USER RIGHTS

4.1. Notification of Rights

We inform the User of the existence of the rights listed in Art. 13, par. 2 of the GDPR. These are:

• The right to request access to personal data (Art. 15 EU Regulation), its update (Art. 7, par. 3, lett. a of Legislative Decree 196/2003), correction (Art. 16 EU Regulation), integration (Art. 7, par. 3, lett. a of Legislative Decree 196/2003), restriction of processing concerning the data subject (Art. 18 EU Regulation) or to object, for legitimate reasons, to its processing (Art. 21 EU Regulation), in addition to the right to data portability (Art. 20 EU Regulation);
• The right to request deletion (Art. 17 EU Regulation), transformation into anonymous form, or blocking of data processed in violation of the law, including data that does not need to be retained for the purposes for which it was collected or subsequently processed (Art. 7, par. 3, lett. b of Legislative Decree 196/2003);
• The right to obtain certification that the operations of updating, rectification, integration, deletion, or blocking of data have been brought to the attention of those to whom the data was communicated or disseminated, unless this proves impossible or involves a disproportionate effort relative to the right being protected (Art. 7, par. 3, lett. c of Legislative Decree 196/2003).

4.2. Requests to the Data Controller

The requests referred to in the previous paragraph 4.1 can be addressed to the Data Controller at the email address mentioned above (without formalities) or by using the model provided by the Data Protection Authority.

4.4. Special Categories of Personal Data

If the processing is based on Art. 6, paragraph 1, letter a – express consent to use – or on Art. 9, paragraph 2, letter a – express consent to use genetic, biometric data, health data, or data revealing religious, philosophical, or union membership, or revealing racial or ethnic origin, political opinions – the User has the right to withdraw consent at any time without affecting the lawfulness of processing based on consent before withdrawal.

4.5. Complaint

In case of a violation of the law, the User has the right to lodge a complaint with the Data Protection Authority, the supervisory authority for the protection of personal data in Italy.

For a more detailed examination of the rights that apply, see Arts. 15 et seq. of EU Regulation 2016/679 and Art. 7 of Legislative Decree 196/2003.

5. OBLIGATIONS

The Data Controller must notify the Authority about the processing of personal data if the processing concerns:

• Genetic, biometric data, or data that indicate the geographic location of people or objects via an electronic communication network;
• Data revealing health status or sexual life, processed for assisted reproduction, telemedicine services related to databases or goods supply, epidemiological surveys, mental or infectious diseases, HIV status, organ and tissue transplants, and monitoring of health expenditure;
• Data revealing sexual life or mental state, processed by political, philosophical, religious, or union organizations;
• Data processed using electronic tools aimed at profiling or analyzing consumption habits and choices or monitoring the use of electronic communication services, excluding processing technically essential for providing these services to users;
• Sensitive data recorded in databases for third-party personnel selection, as well as sensitive data used for opinion polls, market research, and other sample surveys;
• Data recorded in databases managed using electronic tools relating to financial solvency, property status, proper fulfillment of obligations, illegal or fraudulent behavior.