Privacy notice

Data controller

The data controller is CyberX S.r.l., registered office Via Aldo Moro 48, 25124 Brescia (BS), VAT and tax code 04722390988, entered in the Brescia Register of Companies under REA number BS-636428.

For any request about your personal data you can write to info@wedica.it or to the certified e-mail address cyberxsrl@pec.it.

The controller has appointed a Data Protection Officer (DPO) under art. 37 GDPR, who can be contacted at info@wedica.it.

Data we process

Through this site we process only the following data:

• Data you give us by writing to us: when the browser runs JavaScript, the contact form opens your mail app with the message already written and does not transmit data to our systems — so the message reaches us from your own mailbox. If the browser does not run JavaScript, the form is not shown and no data is transmitted: the page gives you the e-mail address to write to. Please do not include data the request does not need, in particular health data or other special categories of data (art. 9 GDPR).
• Browsing data: the systems that run the site record, in the web server logs, the IP address, the date and time of the request, the resource requested, the response code and browser information (user agent). We use them only to run and protect the site; we do not use them to profile you.

The site uses no cookies, analytics or tracking pixels, and while you browse your browser contacts no third-party services: see the Cookie policy.

Purposes and legal bases

We process the data for the following purposes, each with its own legal basis:

• Answering your requests — steps taken at your request prior to entering into a contract (art. 6(1)(b) GDPR) or, for requests unrelated to a possible contract, our legitimate interest in replying to the messages we receive (art. 6(1)(f) GDPR).
• Running and securing the site and preventing abuse — the controller’s legitimate interest (art. 6(1)(f) GDPR).
• Complying with legal obligations and requests from authorities — legal obligation (art. 6(1)(c) GDPR).
• Establishing, exercising or defending legal claims — the controller’s legitimate interest (art. 6(1)(f) GDPR).

We do not use your data for marketing, we do not sell it and we do not subject it to automated decision-making or profiling (art. 22 GDPR).

Providing your data

Providing data through the form is optional. The fields marked as required are, however, needed to reply: without them we cannot follow up on the request. Browsing data are needed for the site to work.

How we process and protect the data

The data are processed electronically by authorised and trained staff, with technical and organisational measures appropriate to the risk (art. 32 GDPR): encrypted connections (HTTPS/TLS), restricted and protected access, collection of the necessary data only, and deletion at the times stated below.

Retention

We keep the data only for as long as the purposes require:

• Requests sent through the form: 12 months from the last exchange. If a contractual relationship follows, the data are kept for its duration and for the periods required by law.
• Web server logs: 14 days, unless they are needed to investigate a security incident, in which case for no longer than necessary.

At the end of these periods the data are deleted or irreversibly anonymised.

Recipients

The data are processed by the controller’s authorised staff and, on its behalf, by the following provider, appointed as a processor under art. 28 GDPR:

• OVHcloud (FR), which provides the infrastructure hosting the site, with servers in the European Economic Area.

The data may be disclosed to public authorities where the law requires it. They are not published or passed to third parties for other purposes. The up-to-date list of processors is available on request.

Transfers outside the European Economic Area

This site involves no transfers of personal data outside the European Economic Area: the hosting is in the EEA and the contact form, when the browser runs JavaScript, does not transmit data to our systems. Without JavaScript the form is not shown and no data is transmitted. If you write to us, the message leaves from your own mail app: the processing it involves is described by the privacy information of the mail provider you use.

Your rights

At any time you can exercise against the controller the rights set out in arts. 15–22 GDPR, where applicable to the processing described here:

• access to your data and to information about the processing (art. 15);
• rectification of inaccurate or incomplete data (art. 16);
• erasure of the data (art. 17);
• restriction of processing (art. 18);
• portability of the data you gave us (art. 20);
• objection to processing based on legitimate interest (art. 21).

You can exercise them free of charge by writing to info@wedica.it or to cyberxsrl@pec.it; the exceptions in art. 12(5) and (6) GDPR remain unaffected: for manifestly unfounded or excessive requests, in particular repetitive ones, we may charge a reasonable fee or refuse to act, and where we have reasonable doubts we may ask you for the information needed to confirm your identity. We reply without undue delay and in any case within one month of the request, extendable by two months for complex requests (art. 12 GDPR). Articles 19 and 22 GDPR are mentioned for completeness: we notify the recipients to whom the data were disclosed of any rectification, erasure or restriction (art. 19) and we carry out no automated decision-making or profiling (art. 22), as stated in the purposes section.

Complaint to the supervisory authority

If you believe the processing of your data infringes the GDPR you can lodge a complaint with the supervisory authority (art. 77 GDPR). In Italy this is the Garante per la protezione dei dati personali, Piazza Venezia 11, 00187 Roma, www.garanteprivacy.it, protocollo@gpdp.it.

Changes to this notice

We may update this notice to reflect changes in the law or in the site. The version in force is always published on this page, with its version number and last-updated date shown at the top. Material changes are highlighted on this page.