Personal data protection notice

This notice is provided pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (the «GDPR») and Italian Legislative Decree 196/2003 as amended by Legislative Decree 101/2018 (the «Privacy Code»). It describes how OMBRE-1 S.r.l. processes the personal data of users who visit ombre1.com and use the services offered on it.

This notice is published in Italian and English. In the event of any discrepancy, the Italian version prevails.

1. Data controller

The data controller is OMBRE-1 S.r.l., which can be reached at the details below.

Data Protection Officer (DPO)

The controller has not appointed a Data Protection Officer, as the mandatory conditions set out in Article 37 GDPR do not apply. Any data protection request may be addressed to the contact details above.

2. What data we process, for what purposes and on what legal basis

We process personal data solely for the purposes set out below. We carry out no profiling and use no automated decision-making that produces legal effects concerning data subjects.

Nature of provision

Providing the data marked with an asterisk in the forms is necessary in order to act on the request: failure to provide it means we cannot reply or activate the service. Providing data for the newsletter is entirely optional, and refusal does not in any way affect access to the other services on the site.

3. Cookies and similar technologies

The site uses only technical cookies necessary for its operation, for which no consent is required under Article 122 of the Privacy Code. No profiling cookies and no third-party analytics or tracking tools are used. Full details are set out in the Cookie Policy.

4. Recipients of the data

Data is processed by the controller’s staff, expressly authorised and instructed pursuant to Article 29 GDPR. It may also be disclosed to the following parties, appointed as data processors pursuant to Article 28 GDPR:

• Cloudflare, Inc. — website hosting and content delivery network.
• Supabase, Inc. — database and authentication for the catalog area, the contact form and the newsletter. The instance used by the controller is hosted in the eu-central-1 (Frankfurt, Germany) region, within the European Economic Area.
• FormSubmit (formsubmit.co) — forwarding of contact-form messages to the controller by email.
• Sendinblue SAS (Brevo, Paris, France) — sending the newsletter to subscribers who have confirmed their subscription; data processed in the European Union.
• Microsoft Ireland Operations Ltd. (Microsoft 365) — company email, which receives contact-form messages.
• Dropbox International Unlimited Company — storage of the PDF catalogs downloaded by registered users.
• Consultants, professionals and providers of technical and administrative services, strictly within the limits necessary to perform their respective engagements.
• Public authorities and supervisory bodies, in the cases provided for by law.

Personal data is never disseminated, sold or transferred to third parties for their own marketing purposes.

5. Transfers to third countries

Data is stored on servers located within the European Economic Area. Some of the providers listed in section 4 are companies established in the United States and may, on a residual basis, access data for technical support purposes. In such cases the transfer is covered by the appropriate safeguards set out in Chapter V GDPR, in particular the Standard Contractual Clauses adopted by the European Commission in Implementing Decision (EU) 2021/914 and, where applicable, the provider’s certification under the EU-U.S. Data Privacy Framework.

6. Security measures

The controller implements technical and organisational measures appropriate under Article 32 GDPR, including: encryption of communications in transit via HTTPS, storage of passwords in hashed form only, row-level access controls on the database, catalog access restricted to registered users, authentication attempt limits and security headers applied at server level.

7. Data subject rights

In relation to the processing described above, data subjects may at any time exercise the rights set out in Articles 15 to 22 GDPR, and in particular the right to:

• obtain access to their personal data and a copy of it (Art. 15);
• obtain rectification of inaccurate data or completion of incomplete data (Art. 16);
• obtain erasure of the data in the cases provided for (Art. 17);
• obtain restriction of processing (Art. 18);
• receive the data in a structured, commonly used and machine-readable format and transmit it to another controller (Art. 20);
• object to processing based on legitimate interest, on grounds relating to their particular situation (Art. 21);
• withdraw consent given for the newsletter at any time, without affecting the lawfulness of processing carried out before withdrawal, using the unsubscribe link included in every communication or by writing to the contact details in section 1.

Requests should be addressed to info@ombre-1.com. The controller responds without undue delay and in any event within one month of receiving the request, a period which may be extended by a further two months where the request is particularly complex, subject to notifying the data subject.

8. Complaint to the supervisory authority

Data subjects who consider that the processing of their data infringes applicable law have the right to lodge a complaint with the Garante per la protezione dei dati personali, Piazza Venezia 11, 00187 Rome, Italy, email garante@gpdp.it, website www.garanteprivacy.it, or to seek a judicial remedy before the competent courts.

9. Changes to this notice

The controller reserves the right to update this notice to reflect legislative changes or the evolution of the services offered. The version in force is always published at this address, together with the date it was last updated. Material changes will be notified to registered data subjects with reasonable advance notice.