Privacy Policy

1. Data Controller

The Data Controller is Linfa Tech S.r.l. (“Linfa Tech”), registered office at Via Romeo Vaj 4, 20832 Desio (MB), Italy, VAT no. IT14435250965.

For any request concerning the processing of personal data, please write to: info@linfa.tech

A Data Protection Officer (DPO) has not been appointed, as the conditions set forth in Article 37 GDPR do not apply.

2. Types of data processed

3. Purposes of processing and legal bases

Personal data collected through the Website is processed for the following purposes and on the respective legal bases:

4. Provision of data

The provision of browsing data is necessary for the use of the Website. The provision of data through the forms (contact, newsletter, Calendly) is optional, but failure to provide such data makes it impossible to respond to requests or to deliver the corresponding service.

5. Methods of processing and security

Personal data is processed by electronic means and, where necessary, on paper, in a manner strictly related to the purposes set out above and in any case in such a way as to ensure the security and confidentiality of the data.

Linfa Tech adopts technical and organisational measures appropriate to protect personal data from unauthorised access, loss, destruction or disclosure, in accordance with Articles 25 and 32 GDPR.

6. Data retention periods

Personal data is retained for the time strictly necessary to pursue the purposes for which it was collected and, in particular:

• Contact form data: up to 24 months from the last relevant contact, unless a contractual relationship arises, in which case the retention periods applicable to that relationship shall apply.
• Newsletter data: until the user withdraws consent or unsubscribes.
• Calendly booking data: for the time necessary to manage the call and subsequently for up to 24 months for commercial contact management purposes.
• Analytics data (GA4): in accordance with the retention periods set in the Google Analytics panel (typically 14 months), after which data is deleted or anonymised.
• Data processed for legal obligations (e.g. tax): for the period provided for by applicable law (typically 10 years).

7. Recipients of data and data processors

Personal data may be processed by authorised personnel of Linfa Tech, duly instructed. It may also be communicated to third parties acting as Data Processors under Article 28 GDPR, including:

• Provider of hosting/cloud infrastructure for the Website and related security services (e.g. Cloudflare, Inc.).
• Google Ireland Limited, for the Google Analytics 4 service.
• Calendly LLC, for the call booking service.
• Email marketing / newsletter service provider (to be specified, e.g. Mailchimp, Brevo, ActiveCampaign).
• Professionals and consultants (accountants, lawyers, IT consultants) for accounting, tax and technical compliance purposes.
• Public authorities, where required by law.

An updated list of Data Processors may be requested by writing to info@linfa.tech.

7-bis. Other domains of the Controller

The Controller operates, in addition to this Website, the subdomain preventivi.linfa.tech, dedicated to the collection of quote requests and equipped with its own marketing and tracking tools (including the Meta Pixel by Meta Platforms Ireland Limited, for remarketing and campaign measurement on Facebook and Instagram). That subdomain has its own privacy notice, available directly on the relevant page, to which full reference is made for further details.

8. Transfer of data outside the EU

Some service providers used by Linfa Tech (in particular Google, Calendly and Cloudflare) are based in the United States or may transfer data outside the European Economic Area. Such transfers take place in compliance with Articles 44 et seq. GDPR, on the basis of one of the following mechanisms:

• Adherence to the EU-U.S. Data Privacy Framework (European Commission adequacy decision of 10 July 2023) for certified providers.
• Standard Contractual Clauses (SCCs) approved by the European Commission by Decision 2021/914, supplemented where necessary by additional technical and organisational measures.

A copy of the safeguards in place may be requested by writing to info@linfa.tech.

9. Rights of the data subject

Pursuant to Articles 15 to 22 GDPR, the data subject has the right to:

• access their personal data (Article 15);
• obtain rectification of inaccurate data or completion of incomplete data (Article 16);
• obtain erasure of the data, where the legal requirements are met (Article 17 – “right to be forgotten”);
• obtain restriction of processing (Article 18);
• receive the data in a structured, commonly used and machine-readable format, and transmit it to another controller (Article 20 – data portability);
• object to the processing at any time (Article 21);
• not be subject to decisions based solely on automated processing (Article 22);
• withdraw consent at any time, without prejudice to the lawfulness of processing carried out before the withdrawal.

Requests may be sent to: info@linfa.tech. Linfa Tech will respond within 30 days of receipt of the request.

10. Right to lodge a complaint with the supervisory authority

If the data subject believes that the processing of personal data violates the GDPR, they have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, www.garanteprivacy.it) or with the supervisory authority of the Member State in which they habitually reside, work, or where the alleged infringement took place (Article 77 GDPR).

11. Amendments to this Privacy Policy

Linfa Tech reserves the right to amend this Policy at any time, also to reflect changes in law or regulation. Amendments will be published on this page together with the updated date. In the event of substantial changes, users who have provided their email address will be informed with a dedicated notice.