PRIVACY NOTICE
PURSUANT TO REGULATION (EU) 2016/679 (“GDPR”)
AND NATIONAL REFERENCE LAWS

This document (“Notice”) is intended to provide you with information regarding the processing of information, as specified below, that will be provided by you or otherwise available at our facility and that will be processed by the same and/or by other entities identified for the purposes indicated below. The Notice, in particular, is provided pursuant to EU Regulation no. 679/2016 (“GDPR”) and national reference laws (jointly with the GDPR hereinafter “Applicable Law”).

1. Identity and contact details of the Data Controller
The Data Controller, pursuant to articles. 4 and 24 of Regulation (EU) 2016/679, is LORETA S.R.L., with registered office in Via Elpidiense Nord, 150 - 63812 MONTEGRANARO (FM), VAT number 02345040444, Tel. 0734) 443555, e-mail: faustoricambi@gmail.com, in the person of the legal representative pro-tempore (hereinafter “Data Controller”).

2. Contact details of the Data Protection Officer (so-called “RPD-DPO”)
The Data Controller does not carry out activities that require the designation of the figure of the Data Protection Officer.

3. Purpose and legal basis of the processing
The Personal Data collected will be processed for the purposes and under the legal bases set out below:

4. Categories of personal data processed
The online chat platform involves the collection of personal data, provided on a voluntary basis by the user. The data processed are provided by the interested party when accessing the chat and are the telephone number and the content of the messages in the chat. The processing takes place through the use of the Whatsapp Business application, whose terms and conditions, relating to the processing of personal data, can be consulted here.

5. Recipients and categories of recipients
The personal data will not be disclosed, or will not be disclosed to unspecified subjects. They may instead be communicated to well-defined subjects, in full compliance with the provisions of the law, for purposes strictly related to those previously indicated. Any access to your personal data is limited to the subjects authorized by the Data Controller. Communication to the identified recipients, only if involved and functional, is linked to the achievement of the purposes referred to in the previous point 3, therefore the personal data collected and processed may be:

used anonymously for statistical purposes;
communicated, to the extent strictly necessary, to those who, for the purpose of fulfilling orders or other requests or providing services relating to the transaction or contractual relationship with the Data Controller, must provide goods and/or perform services or tasks on behalf of the Data Controller;
made available to the Data Controller's collaborators, as Data Processors or persons authorized to process personal data;
communicated to third parties, whether natural or legal, Public Administrations, professionals, law enforcement agencies, government bodies, regulatory bodies, courts or other public authorities authorized by law;
if necessary, transferred to another Data Controller in accordance with the provisions of the GDPR, also with regard to the right to data portability.

The information may also be communicated whenever communication may be necessary to comply with requests from the Judicial Authority or Public Security. The data collected will not be disclosed under any circumstances.

The list of Data Processors is available at the Data Controller's headquarters.

6. Transfer of data abroad
In no case does the Data Controller transfer personal data to third countries or to international organizations. However, given that the data will be processed within the scope of Whatsapp services, please refer to the terms and conditions of service available here.

7. Data retention period (determination criteria)
Below is a table containing the indications of the retention periods (or the determination criteria) of Personal Data:

8. Data processing methods
The processing of Personal Data will be carried out using manual, computerized or telematic tools, suitable to guarantee their security and confidentiality and will be carried out by personnel duly trained in compliance with the Applicable Regulations. There is no automated decision-making process, the Data Controller carries out processing only following an express request made by the interested party when accessing the online chat systems. All data will be stored and processed by the Company, adopting all measures necessary for their protection, in compliance with all applicable regulations (and therefore also in compliance with the principles of correctness, lawfulness and transparency and protection of the confidentiality and rights of the interested parties) and with logics strictly related to the purposes indicated in this information notice. Only the operations necessary to pursue the purposes indicated in this information notice will be carried out on the data. The data will be stored at the Data Controller's offices and at the data processors appointed by the Data Controller (as well as at the third parties indicated in this information notice to whom the data are communicated and who process them as independent controllers).

9. Rights that are recognized to you
We inform you that you may exercise the rights recognized by the Applicable Regulations including, by way of example, the right:
to access your Personal Data and know its origin, the purposes and purposes of the processing, the data of the subjects to whom they are communicated, the data retention period or the criteria useful for determining it (art.15);
to request rectification (art.16);
the cancellation (“oblivion”), if no longer necessary, incomplete, erroneous or collected in violation of the law (art.17);
to request that the processing be limited to a part of the information concerning you (art.18);
to know the recipients to whom the personal data are transmitted (art.19);
to the extent that it is technically possible, to receive in a structured format or to transmit to you or to third parties indicated by you the information concerning you (so-called “portability”) or that which has been voluntarily provided by you (art.20);
to object to their processing based on legitimate interest (art. 21);
as well as to withdraw your consent at any time, in the event that this constitutes the basis of the processing (the withdrawal of consent, however, does not affect the lawfulness of the processing based on consent carried out before the withdrawal itself).

The aforementioned rights may be exercised by means of a written request addressed without formalities to the Data Controller at the contacts indicated above.

The Data Controller must proceed in this sense without delay and, in any case, at the latest within one month of receiving the request. The deadline may be extended by two months, if necessary, taking into account the complexity and number of requests received by the Data Controller. In such cases, the Data Controller will inform you and make you aware of the reasons for the extension within one month of receiving your request.

We remind you that, if the response to your requests has not been satisfactory in your opinion, you may contact and lodge a complaint with the Personal Data Protection Authority (http://www.garanteprivacy.it/) in the ways provided for by the Applicable Regulations.

This Policy may be modified or simply updated, in whole or in part, also in consideration of the modification of the laws or regulations that govern the protection of personal data. The modifications and updates will be notified to the interested parties as soon as they are adopted.

Montegranaro, 20/09/24
The Data Controller