1. Categories of Processed Personal Data

   The Controller processes the following types of Personal Data voluntarily provided by the Data Subject:

   • Contact information: name, surname, address, email, phone number, images, authentication credentials, any additional information provided by the Data Subject, etc.

   The Controller processes the following types of Personal Data collected automatically:

   • Technical data: Personal Data produced by the devices, applications, tools, and protocols used, such as information about the device used, IP addresses, browser type, Internet service provider (ISP). Such Personal Data may leave traces that, particularly if combined with unique identifiers and other information received from servers, may be used to create profiles of individuals.
   • Navigation and usage data of the Application: such as visited pages, number of clicks, actions performed, session duration, etc.

   The failure to provide the Personal Data for which there is a legal or contractual obligation, or when they are a necessary requirement for the conclusion of a contract with the Controller, will result in the impossibility for the Controller to establish or continue the relationship with the Data Subject.

   The Data Subject who communicates Personal Data of third parties to the Controller is directly and solely responsible for their origin, collection, processing, communication, or disclosure.

2. Cookies and Similar Technologies

   The Application uses cookies, web beacons, unique identifiers, and other similar technologies to collect Personal Data of the Data Subject on the pages, links visited, and other actions performed when the Data Subject uses the Application. They are stored to be transmitted on the Data Subject's next visit. The complete Cookie Policy can be found at the following address: https://lubeteam.it/cookie-policy

3. Legal basis and purposes of the processing

   The processing of Personal Data is necessary:

   1. for the performance of the contract with the Data Subject, specifically:
      1. fulfillment of any obligation arising from the pre-contractual or contractual relationship with the Data Subject
      2. support and contact with the Data Subject: to respond to the Data Subject's requests
   2. due to a legal obligation, specifically:
      1. compliance with any obligations under applicable laws and regulations, particularly in tax and fiscal matters
   3. based on the legitimate interests pursued by the Controller, for:
      1. email marketing purposes of the Controller's products and/or services to directly sell the Controller's products or services using the email provided by the Data Subject in the context of selling a product or service similar to the one being sold
      2. management, optimization, and monitoring of the technical infrastructure: to identify and resolve any technical issues, improve the performance of the Application, manage and organize information in an IT system (e.g., servers, databases, etc.)
      3. statistical analysis with anonymous data: to conduct statistical analysis on aggregated and anonymous data to analyze the behaviors of the Data Subject, improve the products and/or services provided by the Controller, and better meet the expectations of the Data Subject
   4. based on the Data Subject's consent, for:
      1. profiling of the Data Subject for marketing purposes: to provide the Data Subject with information about the products and/or services of the Controller through automated processing aimed at collecting personal information in order to predict or assess their preferences or behaviors
      2. retargeting and remarketing: to reach the Data Subject who has already visited or shown interest in the products and/or services offered by the Application using their Personal Data. The Data Subject can opt-out by visiting the page of the Network Advertising Initiative
      3. marketing purposes of the Controller's products and/or services: to send commercial and/or promotional information or materials, carry out direct sales activities of the Controller's products and/or services, or conduct market research through automated and traditional methods

   Based on the legitimate interests of the Controller, the Application allows interactions with external platforms or social networks whose processing of Personal Data is governed by their respective privacy policies, to which reference should be made. The interactions and information acquired by this Application are always subject to the privacy settings chosen by the Data Subject on such platforms or social networks. This information - in the absence of specific consent for further purposes - is used solely to allow the use of the Application and provide the requested information and services.

   The Data Subject's Personal Data may also be used by the Controller to defend its rights in court.

4. Methods of processing and recipients of Personal Data

   The processing of Personal Data is carried out using both paper and electronic tools with organizational methods strictly related to the indicated purposes and by adopting adequate security measures.

   Personal Data is processed exclusively by:

   • persons authorized by the Data Controller who have committed to confidentiality or have an adequate legal obligation of confidentiality;
   • entities that operate autonomously as separate data controllers or are designated as data processors by the Controller to carry out all necessary processing activities to achieve the purposes set out in this notice (e.g., business partners, consultants, IT companies, service providers, hosting providers);
   • subjects or entities to whom the Personal Data must be communicated by law or by order of the authorities.

   The above-mentioned subjects are required to use appropriate safeguards to protect Personal Data and may only access the data necessary to perform their assigned tasks.

   Personal Data will not be indiscriminately disclosed in any way.

5. Location

   Personal Data will not be transferred outside the territory of the European Economic Area (EEA).

6. Retention period of Personal Data

   Personal Data will be kept for the period of time necessary to fulfill the purposes for which they were collected, in particular:

   • for purposes related to the performance of the contract between the Controller and the Data Subject, they will be retained for the entire duration of the contractual relationship and, after termination, for the ordinary statutory limitation period of 10 years. In the case of judicial disputes, they will be retained for the entire duration of the dispute, until the expiry of the terms for challenging actions.
   • for purposes related to the legitimate interests of the Controller, they will be retained until such interests are fulfilled.
   • for compliance with a legal obligation, by order of an authority, or for legal protection, they will be retained in compliance with the time limits provided by said obligations, regulations, and in any case until the expiry of the statutory limitation period provided by the applicable laws.
   • for purposes based on the Data Subject's consent, they will be retained until the withdrawal of consent.

   At the end of the retention period, all Personal Data will be deleted or kept in a form that does not allow the identification of the Data Subject.

7. Data Subject's Rights

   Data Subjects can exercise certain rights regarding the Personal Data processed by the Controller. In particular, the Data Subject has the right to:

   • be informed about the processing of their Personal Data
   • withdraw consent at any time
   • limit the processing of their Personal Data
   • object to the processing of their Personal Data
   • access their Personal Data
   • verify and request the rectification of their Personal Data
   • obtain the restriction of the processing of their Personal Data
   • obtain the erasure of their Personal Data
   • transfer their Personal Data to another controller
   • lodge a complaint with the data protection authority and/or take legal action.

   To exercise their rights, Data Subjects can submit a request to the following email address: info@lubeteam.it. The requests will be promptly handled by the Controller and processed as soon as possible, in any case within 30 days.

Last updated: 24/05/2023