PRIVACY NOTICE PURSUANT TO ARTS. 13-14 EU REG. NO. 2016/679 FOR PERSONAL DATA PROCESSING

Dear user,
Studio Dentistico Quiriconi Stp Srl hereby informs you that, pursuant to articles 13 and 14 of European Regulation No. 2016/679 GDPR, the data acquired and/or provided by you will be processed in compliance with the regulations mentioned below.

This document may be updated over time. You are invited to consult it periodically.

PURPOSES OF MANDATORY DATA PROCESSING

Data Controller

The Data Controller of your personal data, pursuant to Art. 13 of EU Regulation 2016/679 (GDPR), is:

Studio Dentistico Quiriconi Stp Srl
Via Camillo Benso Conte di Cavour, 155, 55011 Altopascio LU 55011 Lucca
VAT: IT02053240475
Email: g.quiriconi@live.it
PEC:

The Data Controller is the entity that determines the purposes and means of the processing of personal data.

Purpose of processing

Personal data expressly provided by users who submit requests of any nature through direct emails or contact forms are used to fulfill such requests and are communicated only to third parties involved in processing the request.
The optional, explicit and voluntary sending of emails to the addresses indicated on this website entails the subsequent acquisition of the sender's address, necessary to respond to communications via email, as well as any other personal data voluntarily included in the email.

Legal Basis for Processing

The processing of your personal data is based on the following legal grounds provided for by Art. 6 of the GDPR:

  • Consent (Art. 6(1)(a)): You have given consent to the processing of your personal data for one or more specific purposes (e.g., newsletter, profiling, marketing).
  • Contractual performance (Art. 6(1)(b)): processing is necessary for the performance of a contract to which you are party or in order to take steps at your request prior to entering into a contract.
  • Legal obligation (Art. 6(1)(c)): processing is necessary for compliance with a legal obligation to which the Controller is subject.
  • Legitimate interest (Art. 6(1)(f)): processing is necessary for the purposes of the legitimate interests pursued by the Controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject.

For each specific processing described in this privacy notice, the applicable legal basis is indicated.

Who processes your data

Internal recipients: Only those persons who need the data for the indicated purposes can access it, whose name, role and related permissions are written in the company's GDPR compliance documentation.
External recipients: We transmit personal data only to external recipients if this is necessary for the processing or fulfillment of your request, if there is another legal authorization or obligation, or if you have given us your consent to do so. They may be:
a) Data processors such as external suppliers we use for the provision of services or contractually relevant content. Such data processors are carefully selected and regularly checked by us to ensure that your privacy is preserved. Service providers may only use the data for the purposes specified by us and in accordance with our instructions.
b) Public bodies Government authorities and institutions, such as prosecutors, courts or tax authorities to whom we must transfer personal data to fulfill legal obligations. The transfer takes place pursuant to Article 6, paragraph 1, letter c) of the GDPR.

Transfer to Third Countries

Your personal data may be transferred to countries located outside the European Economic Area. In such cases, the transfer will take place in compliance with the appropriate safeguards provided for by the GDPR, such as:
- European Commission adequacy decisions
- Standard contractual clauses approved by the European Commission
- Binding corporate rules
- Approved certifications
For more information on data transfers to third countries and the safeguards adopted, you can contact us through the indicated channels.

Important Notices

Changes to this privacy notice
This privacy notice may be subject to changes. It is advisable to regularly consult this page to be informed of any updates.

Data security
We adopt appropriate technical and organizational measures to protect your personal data against accidental loss, unauthorized access, disclosure, alteration or destruction.

Data retention
Your personal data will be kept for the time necessary to achieve the purposes for which it was collected and in any case not beyond the terms provided for by current regulations.

Data Subject Rights

As a data subject, pursuant to Articles 15-22 of the GDPR, you have the right to:

  • Right of access (Art. 15): obtain confirmation as to whether or not personal data concerning you is being processed and, where that is the case, access to the personal data.
  • Right to rectification (Art. 16): obtain the rectification of inaccurate personal data concerning you without undue delay.
  • Right to erasure (Art. 17): obtain the erasure of personal data concerning you without undue delay ("right to be forgotten").
  • Right to restriction (Art. 18): obtain restriction of processing when one of the conditions set out in Article 18 applies.
  • Right to data portability (Art. 20): receive personal data concerning you in a structured, commonly used and machine-readable format.
  • Right to object (Art. 21): object at any time to the processing of personal data concerning you.
  • Right to withdraw consent (Art. 7): withdraw consent at any time without affecting the lawfulness of processing based on consent before its withdrawal.

Right to lodge a complaint: You have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement.

To exercise your rights, you can send a request to the Data Controller contacts indicated in this privacy notice.

Data Retention Period

Your personal data will be retained for the time strictly necessary to achieve the purposes for which it was collected, in compliance with the principles of data minimization and storage limitation (Art. 5(1)(e) GDPR).

In particular:

  • Contractual data: retained for the duration of the contractual relationship and for the following 10 years for tax and accounting obligations.
  • Consent data (cookies, newsletter, marketing): retained until consent is withdrawn and in any case for a maximum of 5 years from collection.
  • Navigation and log data: retained for a maximum of 6 months, unless otherwise required by law.
  • Direct marketing data: retained until consent is withdrawn and in any case for a maximum of 24 months from the last interaction.
  • Profiling data: retained until consent is withdrawn and in any case for a maximum of 12 months.

Once the retention periods have expired, data will be deleted or irreversibly anonymized.

PURPOSES OF OPTIONAL DATA PROCESSING

Profiling

With your free and optional consent (Article 6, paragraph 1, letter a) of the GDPR), which can be expressed by selecting the appropriate consent checkbox on the website, we will process your personal data for profiling purposes, in order to send you personalized promotional communications consistent with your profile, to carry out analysis and statistical processing regarding your personal characteristics for "clustering" activities, i.e. for the creation of "target groups" for internal analysis and monitoring of market trends and consumption, for the creation of new user "clusters" based on similar browsing habits and interests.
If you do not consent to the processing of your personal data for profiling purposes, your ability to browse the website and benefit from its features will not be compromised in any way, nor will you suffer any other adverse consequence.
In any case, you may freely and free of charge revoke your consent to the processing of your personal data for profiling purposes at any time by contacting us through the appropriate contact section.

Google Fonts

This site uses the Google Fonts service to dynamically load typefaces. When you visit a page on our site, your browser establishes a connection to Google servers (fonts.googleapis.com and fonts.gstatic.com) to download the fonts needed to display the page.

During this connection, your IP address and other technical data (such as User-Agent and Referer) are transmitted to Google servers in the United States. Google may use this data for statistical analysis.

Data processed: IP address, browser User-Agent, URL of the visited page.

Purpose: correct display of site content with selected fonts.

Legal basis: user consent pursuant to Art. 6(1)(a) GDPR.

Data recipient: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA.

Extra-EU transfer: data is transferred to the United States. Google adheres to the EU-US Data Privacy Framework.

For more information: Google Privacy Policy.

Consent Database (Proof of Consent)

When you fill out a form on our website (e.g., contact form, newsletter subscription), we collect and store the following information as proof of consent given, in accordance with Art. 7.1 of the GDPR which requires the Controller to be able to demonstrate that the data subject has given consent:

  • Identification data: first name, last name, email address
  • Consent preferences: which consents have been accepted or rejected (e.g., privacy policy, marketing/newsletter)
  • Legal documents accepted: version of the privacy policy and terms of service displayed at the time of consent
  • Contextual data: IP address, browser user agent, page URL, date and time of consent
  • Form proof: HTML snapshot of the completed form (excluding any sensitive data such as passwords)

Note: We do not store in the Consent Database other data entered in the form (such as messages, phone numbers or other content) as they are not necessary for proof of consent purposes.

Retention period: Consent proofs are retained for 5 years from the date of collection, in accordance with GDPR best practices for consent proof retention. This period ensures the ability to demonstrate lawfulness of processing in case of audits or disputes.

CATEGORIES OF PERSONAL DATA PROCESSED

Browsing data

The IT systems and software procedures used to operate this site acquire, during their normal operation, certain data whose transmission is implicit in the use of Internet protocols. Such information may include, by way of example: IP addresses, domain names, request times, request methods, response file size, response status code and parameters of the user's operating system and computing environment.

This data is used to ensure the correct operation of the site, to perform aggregated statistical analysis and to improve the security and integrity of the systems. The data may be retained for a limited period and in any case for no longer than 7 days, except where necessary to ascertain computer-related offences or upon judicial request.

Data voluntarily provided by the user

The optional submission of communications via contact forms, email or other channels involves the subsequent acquisition of personal data provided by the user, including identifying data, contact details and any further information voluntarily entered. Such data is used exclusively to respond to requests and provide the requested services.

Cookies and tracking technologies

The site may use cookies and similar technologies for technical, statistical, marketing and, where applicable, profiling purposes. The use of cookies takes place in compliance with the consent expressed by the user via the appropriate banner, where required. For further information please refer to the Cookie Policy.

Further processing

Specific notices may be provided in relation to particular services activated on the site.

METHODS OF PROCESSING AND CONFIDENTIALITY OBLIGATION

Data processing is carried out by means of IT and/or paper tools, by persons bound to confidentiality, with logic related to the purposes and in such a way as to guarantee the security and confidentiality of the data. The data collected will not be subject to dissemination or disclosure to third parties except in the cases provided for by law.

With reference to the double opt-in system, in order to ensure the validity of the consent and to protect the user's identity, after completing the registration form the user will receive a confirmation email containing a link. The subscription will only be activated upon clicking that link. This process allows us to verify that the email address provided is actually the user's and that the user has indeed requested to receive communications or accepted to be profiled.

DISCLOSURE TO THIRD PARTIES

Your personal data may be disclosed to third parties solely and exclusively for the purposes set out above and, in particular, to the following categories of recipients:

Such recipients shall process personal data either as Data Processors or as autonomous Data Controllers. The updated list of external processors and persons in charge of processing is kept at the registered office of the Data Controller.

Your personal data may be processed and transferred both within and outside the European Union. Any transfer to third countries shall take place in compliance with the conditions set out in the General Data Protection Regulation, in particular:

Residually, where the relevant conditions are met, the derogations referred to in Art. 49 GDPR may apply. Your data shall not be subject to dissemination.

RETENTION PERIODS

All personal data provided is processed in compliance with the principles of lawfulness, fairness, relevance and proportionality, exclusively in the manner necessary, including by IT and electronic means, to pursue the purposes described above. In particular:

RIGHTS OF THE DATA SUBJECT

Pursuant to the applicable legislation, the data subject may exercise their rights against the Data Controller, as set out in Art. 15 et seq. of Regulation (EU) 2016/679: right of access, rectification, erasure, restriction of processing, objection and data portability. The data subject may also withdraw the consent given at any time, without affecting the lawfulness of the processing based on consent prior to its withdrawal.

In addition to these rights, the data subject may lodge a complaint with the competent Supervisory Authority in the cases provided for by law.

The user may exercise their rights at any time by contacting the Data Controller at the following email address: g.quiriconi@live.it.