Privacy Notice

1. Data Controller

The data controller is Sopravvivenza Fuorisede S.r.l., with registered office at Via Roveredo 20/B, 33170 Pordenone (PN), Italy, VAT number and tax code 01989080930 (the “Controller”).

The Controller may be contacted by email at info@lenpr.com or by certified email (PEC) at info@pec.sopravvivenzafuorisede.it.

2. Categories of data processed

a) Data provided voluntarily by the User: first and last name, company name, email address, telephone number, where provided, and any further information contained in messages sent through the contact form or to the Controller's email address.

b) Browsing data: the computer systems operating this website collect, in the course of their normal operation, certain data whose transmission is implicit in the use of Internet communication protocols, such as the IP address, browser type, addresses of the requested resources and time of the request.

c) Data collected through cookies and tracking tools: subject to the User's consent, browsing data collected through Google Analytics 4 and Meta Pixel, as described in the Cookie Policy.

3. Purposes and legal bases of processing

a) Responding to the User's requests and preparing any proposals: the legal basis is the performance of pre-contractual measures taken at the request of the data subject (Article 6(1)(b) GDPR).

b) Operation and security of the website: the legal basis is the Controller's legitimate interest in ensuring the security and proper functioning of the website (Article 6(1)(f) GDPR).

c) Statistical analysis of the use of the website through Google Analytics 4: the legal basis is the User's consent (Article 6(1)(a) GDPR and Article 122 of the Italian Privacy Code).

d) Measuring the effectiveness of the Controller's campaigns on Facebook and Instagram and presenting the related content through Meta Pixel and the Conversions API: the legal basis is the User's consent (Article 6(1)(a) GDPR and Article 122 of the Italian Privacy Code).

e) Compliance with legal obligations and the establishment, exercise or defence of legal claims: the legal bases are, respectively, the legal obligation to which the Controller is subject and the Controller's legitimate interest (Article 6(1)(c) and (f) GDPR).

4. Transmission of data from the Controller's server

For the purposes set out in letters c) and d) of section 3, data are transmitted to Google and Meta both from the User's browser, through the scripts provided by those parties, and from the Controller's server, through the Google Analytics Measurement Protocol and the Meta Conversions API.

In both cases, data are transmitted only with the User's consent to the corresponding category (“Statistiche” (statistics) for Google Analytics 4, “Marketing” for Meta). Without consent, no data are transmitted to Google or Meta, either from the browser or from the server.

The data transmitted include the page visited, the action performed, technical data about the device, such as IP address and browser type, and the identifiers stored in Google and Meta cookies. The content of messages sent by the User is not transmitted.

5. Provision of data

Providing the data requested in the contact form is optional; however, failure to provide the requested data, with the exception of the telephone number, will prevent the Controller from responding to the request. Consent to the processing referred to in letters c) and d) of section 3 is optional, and refusing it does not affect the use of the website in any way.

6. Recipients of the data

The data are processed by persons authorised to process them pursuant to Article 29 GDPR and Article 2-quaterdecies of the Italian Privacy Code, and by the following parties, appointed as data processors pursuant to Article 28 GDPR: Vercel Inc., as provider of hosting services for the website and server (vercel.com/legal/privacy-policy); Cloudflare, Inc., as provider of content delivery, domain name resolution and website security services (cloudflare.com/privacypolicy); Resend, Inc., as provider of the service that sends messages submitted through the contact form (resend.com/legal/privacy-policy); Google Ireland Limited, as provider of the Gmail email service and the Google Analytics 4 service (policies.google.com/privacy).

For the same purposes, the Controller may use, in addition to or in place of the providers listed above, the following parties, also appointed as data processors pursuant to Article 28 GDPR: Scaleway SAS, based in France, as provider of hosting and email delivery services (scaleway.com/en/privacy-policy); Infomaniak Network SA, based in Switzerland, as provider of hosting and email services (infomaniak.com/en/legal/confidentiality-policy); BunnyWay d.o.o., based in Slovenia, as provider of hosting and content delivery services (bunny.net/privacy).

With regard to the collection and transmission of data through Meta Pixel and the Conversions API, the Controller and Meta Platforms Ireland Limited act as joint controllers pursuant to Article 26 GDPR, as provided for in Meta's Controller Addendum (facebook.com/legal/controller_addendum). For subsequent processing, Meta acts as an independent controller, in accordance with its own privacy policy (facebook.com/privacy/policy).

The data are not disseminated or transferred to third parties, except where required by law.

7. Transfer of data to third countries

Vercel Inc., Resend, Inc., Cloudflare, Inc., Google and Meta may also process the data in the United States of America. Such transfers are based on the adequacy decision adopted by the European Commission on 10 July 2023 concerning the EU-US Data Privacy Framework, for certified entities, or on the standard contractual clauses approved by the European Commission (Article 46 GDPR).

Infomaniak Network SA processes the data in Switzerland, a country recognised by the European Commission as ensuring an adequate level of protection (Decision 2000/518/EC).

The User may obtain a copy of the safeguards adopted by sending a request to info@lenpr.com.

8. Retention period

a) Data provided through the contact form or by email: 24 months from the last contact or, where the request leads to a contractual relationship, for the duration of that relationship and for the subsequent periods required by law.

b) Browsing data recorded by the server: 24 hours.

c) Data collected through Google Analytics 4: 14 months, after which they are automatically deleted.

d) Data collected through Meta Pixel and the Conversions API: in accordance with the periods set out in Meta's privacy policy.

e) Cookie preferences: 6 months, after which consent is requested again.

9. Rights of the data subject

As a data subject, the User has the right to obtain from the Controller access to their personal data, rectification, erasure, restriction of processing and data portability, and to object to processing based on the Controller's legitimate interest (Articles 15-21 GDPR).

The User also has the right to withdraw their consent at any time, through the “Preferenze cookie” (cookie preferences) link at the bottom of every page of the website, without affecting the lawfulness of processing based on consent before its withdrawal (Article 7(3) GDPR).

To exercise their rights, the User may contact the Controller at info@lenpr.com.

Finally, the User has the right to lodge a complaint with the Italian Data Protection Authority (garanteprivacy.it), pursuant to Article 77 GDPR.

10. Automated decision-making

The Controller does not take decisions based solely on automated processing, including profiling, which produce legal effects concerning the User or similarly significantly affect them (Article 22 GDPR).

11. Changes to this notice

The Controller reserves the right to amend this notice. The version in force is the one published on this page.