P-LAB S.r.l., with registered office in Viale del Lavoro, 33, 37135 Verona (VR), Tax Code and VAT No. 03111620237 (hereinafter, the “Data Controller” or “P-LAB”), as Data Controller, informs you pursuant to Articles 13 and 14 of EU Regulation no. 2016/679 (hereinafter, the “GDPR”) that the Data of natural persons residing in the European Union (hereinafter the “Customer” or “Data Subject”), which the company has come into possession of during the performance of its business, will be processed in the manner and for the purposes set out below.

The Data Controller processes personal data (e.g., name, surname, tax code, email address, telephone number, etc., hereinafter, "personal data" or "data") acquired verbally or communicated by the Data Subject during registration on the website and/or when subscribing to the Data Controller's newsletter service, or during the execution of a contract to which the Data Subject is a party.

Personal data are processed without the express consent of the Data Subject, pursuant to Art. 6, paragraph 1, letter b) of the GDPR, to pursue the Data Controller's corporate purpose and, in particular, to:

fulfill pre-contractual, contractual, and tax obligations arising from existing relationships with the Customer;

fulfill obligations established by law, regulations, EU legislation, or provisions of the Authority;

enable subscription to the Data Controller's newsletter service and the provision of any additional services requested;

exercise the Data Controller's rights.

Personal data are also processed with the Data Subject's specific consent, pursuant to Art. 6, paragraph 1, letter a) of the GDPR, on the basis of a separate and specific privacy notice, exclusively for the purposes indicated therein.

The processing of the Customer's personal data is carried out through the operations indicated in Article 4, paragraph 2 of the GDPR, namely: collection, recording, organization, storage, consultation, processing, modification, selection, extraction, comparison, use, interconnection, blocking, communication, erasure, and destruction of data. Personal data is subject to both paper and electronic processing.

The Data Controller will process personal data for the time necessary to fulfill the purposes set out in Article 3 of this privacy policy and, in any case, for no longer than 10 years after the termination of the relationship with the Customer. Data collected and not subject to retention requirements established by law will be retained for no longer than 2 years after the termination of the relationship with the Data Subject.

The data will also be processed in compliance with the principles of confidentiality and security. Specifically, all technical, IT, organizational, and procedural security measures will be adopted to ensure an adequate level of data protection, as indicated in Article 32 of the GDPR.

Customer data may be made accessible for the purposes set out in Articles 3.A) and 3.B) of this Privacy Policy:

to employees and collaborators of the Data Controller, in their capacity as persons authorized to process data and/or internal data processors and/or system administrators;

to third parties (e.g., website management and maintenance providers, suppliers, credit institutions, professional firms, etc.) who perform outsourced activities on behalf of the Data Controller, in their capacity as external data processors.

Without the Customer's express consent (Article 6, letters b) and c) of the GDPR), the Data Controller may communicate the data for the purposes referred to in Article 3.A) of this privacy policy to supervisory bodies, judicial authorities, and all other entities to whom communication is required by law or necessary for the fulfillment of the indicated purposes.

Personal data will be managed and stored on the Data Controller's servers located within the European Union and/or on third-party companies duly appointed as Data Processors. The data will not be transferred outside the European Union. In any case, it is understood that the Data Controller, if necessary, will have the right to relocate the servers to Italy and/or the European Union and/or non-EU countries. In this case, the Data Controller hereby ensures that the transfer of data outside the EU will be in compliance with applicable legal provisions, stipulating, where necessary, agreements that guarantee an adequate level of protection and/or adopting the standard contractual clauses provided by the European Commission.

Providing data for the purposes set out in Article 3.A) of this privacy policy is mandatory. Failure to provide such data will make it impossible for P-LAB to continue with the existing relationship with the interested party.

As a data subject, the Customer may exercise the rights provided for in Articles 15–21 of Regulation (EU) 2016/679 (GDPR) and, in particular, has the right to:

1. Access to data
obtain confirmation of the existence or otherwise of personal data concerning him or her, even if not yet recorded, and receive communication of such data in a clear and comprehensible form.

2. Information on processing
obtain information regarding:

the source of the personal data;

the purposes and methods of processing;

the logic applied in the event of processing carried out with electronic means;

the identification details of the Data Controller, the Data Processors, and any designated representative;

the persons or categories of persons to whom the personal data may be communicated or who may become aware of it in their capacity as Data Processors or Persons in Charge of Processing.

3. Rectification and Erasure
obtain:

the updating, rectification, or, where interested therein, the integration of personal data;

the erasure, anonymization, or blocking of data processed unlawfully, including data whose retention is unnecessary for the purposes for which it was collected or subsequently processed;

certification that the aforementioned operations have been brought to the attention of those to whom the data was communicated or disseminated, unless this requirement proves impossible or involves a manifestly disproportionate effort.

4. Objection to Processing
object, in whole or in part:

for legitimate reasons, to the processing of personal data concerning him or her, even if pertinent to the purpose of its collection;

to the processing of personal data concerning them for the purpose of sending advertising or direct sales materials or for market research or commercial communications, through the use of automated calling systems without the intervention of an operator, by email and/or through traditional marketing methods such as telephone and/or postal mail. Please note that the data subject's right to object, set out in point b) above, for direct marketing purposes via automated means extends to traditional means, and that the data subject remains free to exercise the right to object even partially. Therefore, the data subject may decide to receive communications only via traditional means, only automated communications, or neither type of communication.

Where applicable, the Customer therefore has the rights set forth in Articles 15-21 of the GDPR, namely the right of access, the right to rectification, the right to be forgotten, the right to restriction of processing, the right to data portability, the right to object, and the right to lodge a complaint with a Supervisory Authority.

The Customer may exercise their rights at any time by sending:

a registered letter with return receipt to P-LAB S.r.l., Viale del Lavoro 33, 37135 Verona (VR);

an email to dpo@p-lab.it

a certified email to p-lab@registerpec.it

The Data Controller's Services are not intended for minors under 18, and the Data Controller does not intentionally collect personal information from minors. If information about minors is unintentionally recorded, the Data Controller will promptly delete it upon request.

The Data Controller is P-LAB S.r.l., acting on behalf of its legal representative.

The updated list of data processors and persons authorized to process data is kept at the Data Controller's headquarters.

This Policy may be subject to change. We therefore recommend that you regularly check this Policy, including on our website, and refer to the most up-to-date version.