This notice describes how we process the personal data of users who visit this website and use the contact form, pursuant to Article 13 of EU Regulation 2016/679 (hereinafter "GDPR") and Italian Legislative Decree 196/2003 as amended by Legislative Decree 101/2018.
This is a translation of the Italian notice. In the event of any discrepancy, the Italian version prevails.
1. Data controller
The data controller is Spinforward S.r.l., with registered office at Via Graziadio Ascoli 41, 10144 Torino, Italy, VAT no. 12356440011.
Email: info@spinforward.it — certified email (PEC):amministrazione@pec.spinforward.it — Tel.:011 1911 5949.
2. Types of data processed
- Contact data provided voluntarily through the contact form or by email/phone: first and last name, email address, company, phone number and the content of the message.
- Browsing data: technical data sent automatically by the browser (for example IP address, date and time of the request, page requested, user agent), recorded in the web server logs for the security and proper functioning of the site.
- Technical data for spam protection: on the contact page only, the Cloudflare Turnstile service collects technical signals from the browser and device (IP address, user agent, characteristics of the connection and of the interaction with the check) for the sole purpose of telling a real user apart from an automated program.
- Cookies and local storage: the site does not set cookies and does not use analytics or marketing tools. It only stores the light/dark theme preference on the device, when the user chooses it (see the Cookie policy).
3. Purposes and legal basis of processing
- Responding to requests sent through the contact form, by email or by phone — legal basis: performance of pre-contractual measures taken at the request of the data subject and/or the controller's legitimate interest in replying (Art. 6(1)(b)/(f) GDPR).
- Protecting the contact form from automated and abusive submissions — legal basis: the controller's legitimate interest in the security of the site (Art. 6(1)(f) GDPR).
- Security and proper functioning of the site (web server logs) — legal basis: legitimate interest (Art. 6(1)(f) GDPR).
- Legal obligations and the handling of any disputes — legal basis: legal obligation and legitimate interest (Art. 6(1)(c)/(f) GDPR).
4. Whether providing data is mandatory
Providing data through the form is optional, but if the mandatory data (name, email and a description of the request) are not provided, we cannot follow up on the request. Company and phone number are optional.
5. Recipients and data processors
The data may be processed by staff authorised by the controller and by external providers of technical services, appointed as data processors pursuant to Art. 28 GDPR. As of the date this notice was last updated, the data processors are:
- Trampoline Software SRL (Belgium), which runs the Formspark service: it receives the data entered in the contact form, stores it on infrastructure located in the European Union (Ireland) and forwards it to the controller by email;
- Cloudflare, Inc. (United States), which provides the Turnstile anti-spam service on the contact page;
The website and the email service the controller uses to receive and store requests are managed directly by the controller, on servers it owns, located in Italy, without using external hosting or email providers.
The site does not use traffic analytics tools: the only browsing data processed are the web server logs, recorded for the security and proper functioning of the site and kept on the controller's servers.
The complete, up-to-date list of data processors, with their names and addresses, is available on request by writing to the contacts given in section 1.
The data are not disclosed to the public.
6. Transfer of data to third countries
Browsing data (web server logs) and the emails received by the controller remain on the controller's servers in Italy, and the data entered in the contact form are stored by Formspark on infrastructure located in the European Union. Some processing may, however, involve a transfer of data to the United States:
- the technical signals collected by Cloudflare Turnstile;
- the ancillary services Formspark uses as sub-processors (for example for spam filtering and error reporting), listed in the provider's data processing agreement;
These transfers take place in compliance with Articles 44 et seq. GDPR, on the basis of the adequacy decision adopted by the European Commission for the EU-U.S. Data Privacy Framework for certified recipients or, failing that, of the Standard Contractual Clauses approved by the European Commission.
Users may request a copy of the safeguards adopted from the controller by writing to the contacts given in section 1.
7. Retention period
Data are kept only for as long as strictly necessary for the purposes stated. In particular:
- browsing data recorded in the web server logs are kept for 6 months and then deleted;
- the technical signals collected by Cloudflare Turnstileare processed by Cloudflare only for as long as the check requires, as set out in the provider's own privacy notice;
- the personal and contact data provided by the user by email and/or through the form are kept for as long as strictly necessary to follow up on the request;
- personal data needed to comply with specific legal obligations are kept in accordance with the relevant legal provisions.
The site does not collect data for sending marketing communications and does not carry out profiling: no retention periods are therefore set for these purposes.
8. Rights of the data subject
As a data subject, users may exercise at any time the rights provided for in Articles 15–22 GDPR:
Right of access
Users have the right to obtain from the controller confirmation as to whether or not personal data concerning them are being processed, to access their personal data and specific information, and to obtain a copy of it, in accordance with Art. 15 GDPR, including information about the source of the data and the recipients or categories of recipients to whom they have been or will be disclosed.
Right to rectification
Users have the right to obtain from the controller, without undue delay, the rectification of inaccurate personal data concerning them, and to have incomplete personal data completed, including by means of a supplementary statement, in accordance with Art. 16 GDPR.
Right to erasure
Users have the right to obtain from the controller the erasure of their personal data without undue delay, in the cases provided for by Art. 17 GDPR (for example withdrawal of consent, data no longer necessary, unlawful processing, legal obligation).
Right to withdraw consent
Where processing is based on consent, users have the right to withdraw it at any time, without affecting the lawfulness of processing based on consent before its withdrawal, pursuant to Art. 7(3) GDPR.
Right to restriction of processing
Users have the right to obtain from the controller the restriction of processing in the cases provided for by Art. 18 GDPR (for example when the accuracy of the data is contested, when processing is objected to, or when processing is unlawful).
Right to data portability
Users have the right to receive the personal data they have provided to the controller in a structured, commonly used and machine-readable format, and to transmit them to another controller without hindrance, as provided for by Art. 20 GDPR.
Right to object
Users have the right to object at any time, on grounds relating to their particular situation, to the processing of personal data concerning them that is based on the controller's legitimate interest, pursuant to Art. 21 GDPR.
Users may exercise the rights set out in this notice by sending their requests directly to the controller at the email address info@spinforward.it or by registered letter with return receipt to the controller's registered office given above. The controller will respond without undue delay and in any event within one month of receiving the request, a period that may be extended by a further two months where the request is particularly complex, with the reasons for the extension communicated (Art. 12 GDPR).
Users may also lodge a complaint with the Italian Data Protection Authority (Garante per la Protezione dei Dati Personali) in the manner set out on its official website, using the contact details available at garanteprivacy.it/home/footer/contatti.
9. Automated decision-making
The controller does not use automated decision-making, including profiling, within the meaning of Art. 22(1) and (4) GDPR. The Cloudflare Turnstile anti-spam check serves only to tell a real user apart from an automated program and has no legal effects on the user.
10. Changes to this notice
The controller may update this notice; any changes will be published on this page together with the date of the last update.