Extended Privacy Policy

1. Data Controller and Data Protection Officer

The Data Controller is dotFlorence Srl – with registered office at Viale Spartaco Lavagnini, 70-72 c/o The Social Hub (Collab) 50129 Florence. The Data Protection Officer can be contacted at dotFlorence, Viale Spartaco Lavagnini, 70-72 c/o The Social Hub (Collab) 50129 Florence, E-mail: info@dotflorence.com, PEC: admin@pec.dotflorence.it.

2. Purposes and legal basis of the processing

dotFlorence processes the personal data of natural persons, legal persons, sole proprietorships and/or freelancers (“Data Subjects”) for the following purposes:

the need to perform a contract to which the Data Subject is a party or to carry out pre-contractual activities at their request. This need is the legal basis for the resulting processing. Providing the data required for these purposes is, depending on the case, a contractual obligation or a requirement for entering into the contract; without them, dotFlorence would be unable to establish the relationship or to perform it;
promotion and sale of products and services of dotFlorence or of third-party companies. The legal basis for the resulting processing is the consent of the Data Subject, who is free to give it or not and may, in any case, withdraw it at any time. Providing the data required for these purposes is not mandatory and refusing to provide them has no negative consequences, except that commercial communications cannot be received;
promotion and sale of products and services of dotFlorence or of third-party companies, specifically identified through the processing and analysis, also by means of automated techniques or systems (e.g. big data), of information on preferences, habits and consumer choices, aimed at dividing data subjects into homogeneous groups by behaviour or specific characteristics (customer profiling), also carried out by enriching the data with information obtained from third parties (enrichment). The legal basis for the resulting processing is the consent of the Data Subject, who is free to give it or not and may, in any case, withdraw it at any time. Providing the data required for these purposes is not mandatory and refusing to provide them has no negative consequences, except that dedicated commercial communications cannot be received.

3. Categories of data processed

dotFlorence processes personal data collected directly from the Data Subject, or from third parties, which include, by way of example, personal details (e.g. first name, surname, address, date and place of birth), tax code/VAT number, image data (e.g. photos) and other data belonging to the categories indicated above.

dotFlorence does not request and does not process on its own initiative special categories of data of its customers (e.g. data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data – intended to uniquely identify a natural person, data concerning health or a person’s sex life or sexual orientation). Such data will be processed exclusively to fulfil the customer’s request.

4. Recipients or categories of recipients of the data

The Data Subject’s data may become known to the natural and legal persons appointed as Data Processors and to the natural persons authorised to process the data needed to carry out the tasks assigned to them: employees of dotFlorence or seconded to it, temporary workers, interns and consultants.

dotFlorence – without the Data Subject’s consent being required – may communicate the personal data in its possession: to those parties to whom such communication must be made in fulfilment of an obligation laid down by law, by a regulation or by EU legislation;

5. Rights of the Data Subjects

The data protection legislation in force grants specific rights to the Data Subject, who, in order to exercise them, may contact the Data Controller directly and at any time.

The rights that the Data Subject may exercise, described below, are:

Right of access;
Right to rectification;
Right to erasure;
Right to restriction;
Right to data portability;
Right to object.

Data Subjects and legal persons, bodies and associations may change their optional consents at any time, whenever they wish.

Right of access

The right of access allows the Data Subject to know which personal data relating to them are processed by dotFlorence and to receive a free copy of them (for any further copies requested, a fee based on the costs incurred may be charged). The information provided includes the purposes of the processing, the categories of data processed, the envisaged retention period or, if this is not possible, the criteria used to determine that period, as well as the safeguards applied in the event of data transfers to third countries and the rights that the Data Subject may exercise.

Right to rectification

The right to rectification allows the Data Subject to have inaccurate or incomplete data concerning them updated or corrected.

Right to erasure (the so-called “right to be forgotten”)

The right to erasure, or right to be forgotten, allows the Data Subject to obtain the erasure of their personal data in the following specific cases:

the personal data are no longer necessary for the purposes for which they were collected and processed;
the Data Subject withdraws the consent on which the processing is based, where there is no other legal ground that could otherwise justify it;
the Data Subject objects to the processing and there are no further legitimate grounds for the processing carried out by the controller for:
the pursuit of a legitimate interest of its own or of third parties and there are no overriding legitimate grounds of the controller for the processing,
direct marketing purposes, including related profiling;
the Data Subject’s personal data have been unlawfully processed.

This right may also be exercised after consent has been withdrawn.

Right to restriction

The right to restriction may be exercised by the Data Subject in the event of:

a breach of the conditions for the lawfulness of the processing, as an alternative to the erasure of the data;
a request for rectification of the data (pending rectification) or an objection to their processing (pending the controller’s decision).

Except for storage, any other processing of the data whose restriction is requested is prohibited.

Right to data portability

The right to data portability allows the Data Subject to use their data held by dotFlorence for other purposes. Each Data Subject may request to receive the personal data relating to them, or request their transfer to another controller, in a structured, commonly used and machine-readable format (Right to data portability).

In particular, the data that may be subject to portability are personal details (e.g. first name, surname, address, date and place of birth, residence), as well as a set of data generated by the activity that dotFlorence has defined for each macro-category of products/services (e.g. statistics, databases, access to third-party products). This right does not apply to non-automated processing (e.g. paper archives or registers).

Right to object

The right to object allows the Data Subject to object at any time, on grounds relating exclusively to their particular situation, to the processing of personal data concerning them.

5.1 Exceptions to the exercise of rights

Data protection legislation provides for specific exceptions to the rights granted to the Data Subject. dotFlorence must nevertheless continue to process the Data Subject’s personal data when one or more of the following applicable conditions occur:

fulfilment of an applicable legal obligation;
resolution of pre-litigation and/or litigation (its own or of third parties);
external investigations/inspections;
requests from Italian and/or foreign public authorities;
reasons of substantial public interest;
performance of a contract in force between dotFlorence and a third party;
any further blocking conditions/statuses of a technical nature identified by dotFlorence.

5.2 Exceptions to the exercise of rights

To exercise their rights, each Data Subject may contact dotFlorence at the e-mail address info@dotflorence.com or submit the request in writing to dotFlorence Srl, Piazza della Vittoria 6, 50129 Florence.

The deadline for the reply is one (1) month, which may be extended by two (2) months in particularly complex cases; in these cases, dotFlorence provides at least an interim communication within one (1) month.

Exercising these rights is, in principle, free of charge; dotFlorence, having assessed the complexity of processing the request and in the case of manifestly unfounded or excessive (including repetitive) requests, reserves the right to ask for a fee. dotFlorence has the right to request further information needed to identify the requester.

6. Data retention period

dotFlorence processes and stores the Data Subject’s personal data for the entire duration of the contractual relationship, for the performance of the related and resulting obligations, for compliance with applicable legal and regulatory obligations, and for its own or third parties’ defensive purposes, until the end of the data retention period. In particular, the retention period of the Data Subject’s personal data starts:

for the products / services included in the contract: from the termination of the relationship; unless their further processing is necessary for one or more of the following purposes:
resolution of pre-litigation and/or litigation initiated before the end of the retention period;
to follow up on investigations/inspections by external authorities initiated before the end of the retention period;
resolution of pre-litigation and/or litigation initiated before the end of the retention period;

8. Cookies

The Data Subjects’ consumer habits and preferences will also be analysed through the use of cookies, in compliance with the safeguards and measures required by the legislation in force.