1. Data controller

The data controller is Trepuntodue S.r.l., registered office at Galleria S. Lucia 1, 35100 Padua (PD), Italy — VAT no. 05231990283.

For any request concerning personal data you may use the following contact details:

• E-mail: info@trepuntodue.com
• Phone: +39 049 261 00 98

2. Personal data processed

Browsing data. The IT systems and software procedures required to operate this website acquire, during their normal operation, certain data whose transmission is implicit in the use of Internet communication protocols: IP address, browser and operating system type, date and time of the request, pages visited and server response codes. This data is used to obtain aggregate statistical information and to ensure the correct operation and security of the site.

Data provided voluntarily by the user. Through the contact form we collect name, e-mail address, telephone number (optional) and the content of the message. Sending messages to our published e-mail addresses or phone numbers entails the acquisition of the sender's contact details and of any personal data contained in the communication.

Cookies and similar technologies. The site uses technical cookies and, subject to consent, statistical and marketing cookies: full details are set out in the Cookie Policy.

3. Purposes and legal bases

Personal data is processed for the purposes listed below, each with its own legal basis:

• Responding to requests for information, quotes and consultancy sent via the form or the published contact details — pre-contractual measures taken at the data subject's request (Art. 6.1.b GDPR).
• Managing the contractual relationship with clients, suppliers and collaborators — performance of a contract (Art. 6.1.b GDPR).
• Ensuring the security, diagnostics and correct operation of the site and preventing abuse — legitimate interest of the controller (Art. 6.1.f GDPR).
• Statistical analysis of site usage through third-party analytics cookies — consent of the data subject (Art. 6.1.a GDPR).
• Marketing, campaign measurement and personalised content through profiling cookies — consent of the data subject (Art. 6.1.a GDPR).
• Compliance with legal, tax and accounting obligations and defence of legal claims — legal obligation and legitimate interest (Art. 6.1.c and 6.1.f GDPR).

4. Nature of the provision of data

Providing the data marked as mandatory in the contact form (name, e-mail and message) is necessary in order to reply to your request: without it we cannot respond. The telephone number is optional and only serves to make contact easier.

Consent to non-technical cookies is always optional, does not restrict access to the content of the site and may be withdrawn at any time.

5. Recipients of the data

Data is processed by staff authorised and instructed by the controller and may be disclosed to service providers acting as processors pursuant to Art. 28 GDPR:

• Netsons S.r.l. (Italy) — website hosting.
• Web3Forms (United States) — delivery to the controller of messages sent through the contact form.
• Google Ireland Ltd. (Ireland) — Google Tag Manager and Google Analytics 4, subject to consent, as well as delivery of web fonts (Google Fonts) and playback of embedded videos (YouTube).
• Vercel Inc. (United States) — hosting of the blog content management platform.
• Consultants, professionals and public authorities, within the limits of legal obligations.

An up-to-date list of data processors is available on request by writing to info@trepuntodue.com. Personal data is not disseminated and is not transferred to third parties for their own purposes.

6. Transfers outside the European Union

Some providers are established in, or use infrastructure located in, the United States. In such cases the transfer takes place on the basis of the Standard Contractual Clauses adopted by the European Commission with implementing decision (EU) 2021/914 and, where the provider has certified to it, of the adequacy decision of 10 July 2023 on the EU-U.S. Data Privacy Framework, together with supplementary security measures.

7. Retention period

Data is kept for as long as strictly necessary for the purposes for which it was collected:

• Contact requests not followed by a contractual relationship: 24 months from the last contact.
• Contractual, tax and accounting data: 10 years, as required by law.
• Server system logs: as a rule no longer than 12 months, unless required to investigate unlawful conduct.
• Cookies and identifiers: for the duration indicated in the Cookie Policy.
• Record of the cookie choice expressed: 6 months, after which the banner is shown again.

8. Rights of the data subject

Data subjects have the rights set out in Articles 15-22 GDPR: access to their data, rectification, erasure, restriction of processing, portability, objection to processing based on legitimate interest, and withdrawal of consent at any time, without affecting the lawfulness of processing carried out before the withdrawal.

Requests may be sent to info@trepuntodue.com: the controller replies within one month of receipt. You also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, Piazza Venezia 11, 00187 Rome — www.garanteprivacy.it) or with the supervisory authority of your country of residence.

9. Minors

The site is not directed at children under 14 and does not knowingly collect their personal data. Should data relating to minors be transmitted unintentionally, it will be deleted upon notice.

10. Automated decision-making

The controller does not carry out processing based on automated decision-making, including profiling, producing legal effects or similarly significantly affecting data subjects within the meaning of Art. 22 GDPR.

11. Changes to this notice

The controller reserves the right to update this notice to reflect regulatory or organisational changes. The version in force is always published on this page together with the date of the last update.