Privacy Policy

Pursuant to and for the purposes of the combined provisions of Legislative Decree No. 196/2003 (Privacy Code) and European Regulation 2016/679 (General Data Protection Regulation or GDPR), the company THIS IS PAG d.o.o. registered office in Slavka Cindrića 5B, Rijeka  in its capacity as Data Controller (hereinafter referred to as the “Controller”), hereby provides the following information.

This privacy notice is made available and applies to the website.

Art. 1. Data Controller (the individual or company that determines how and why personal data are processed).
THIS IS PAG d.o.o. | Slavka Cindrića 5B, Rijeka | VAT: 38547270200

Art. 2. Purposes (the reasons why we collect the data) and legal basis (whether the provision of data is mandatory to perform the contract, or whether the data require your specific consent to be used).

This website does not track or collect data from connected users. A contact form is available, allowing interested parties to communicate directly with the Data Controller. Data submitted through the contact form are not automatically stored in a database, and no cookie data from users’ devices are collected.
The optional, explicit, and voluntary submission via the completion of the contact form entails the subsequent acquisition of the sender’s email address, which is necessary to respond to requests, as well as any other personal data voluntarily provided by the data subject. The mandatory fields required to respond to users’ requests are: Name, Email address, and message.
Explicit consent for data processing is not required, as there is a legitimate interest of the Data Controller in using the information voluntarily provided by the data subject in order to achieve the following purposes:
– to respond to the submitted requests;
– to issue quotes and draft contract proposals;
– to comply with obligations established by law, regulation, EU legislation, or an order from the Authority;
– to exercise the rights of the Data Controller, for example, the potential right of legal defense.

Art. 3. Duration of Processing (how long we retain the data).
Subject to retention periods required by specific regulations (e.g., tax, anti-money laundering, etc.), for the entire duration of the contract and any potential litigation, the Data Controller retains the collected data for a maximum period of 3 (three) years from the end of the relationship with the data subjects, in order to respond to any requests from them.

Art. 4. Processing Methods (how we use the data).
Processing is carried out strictly to the extent necessary to achieve the purposes described above (see Art. 2), in compliance with the principle of proportionality in the selection of collection and storage methods, and with the adoption of all measures suitable to ensure the security and confidentiality of the data subjects’ personal data.

Art. 5. Where are the collected data stored?
The data are processed and stored at the Data Controller’s premises and on the company’s tools (e.g., computers). All data (both paper and digital) are protected by appropriate security systems to ensure their confidentiality and safeguarding. All data are physically stored in Italy. Some digital files may be stored in cloud systems. Providers have been selected to ensure the protection and confidentiality of the data. These devices are physically located within the European Union.

Art. 6. To whom are the data disclosed?
The data are not disclosed or shared with third parties, except as required by law. To comply with such obligations, customer data may be transmitted to third parties who process data on behalf of the Data Controller in their capacity as external Data Processors appointed pursuant to Art. 28 GDPR (for example, an accountant for billing data), to credit institutions, and to the Data Controller’s employees and/or collaborators in the course of their normal work or collaboration activities, as individuals authorized to process data. An up-to-date list of these individuals is available at the Controller’s offices.

Art. 7. Data Subject Rights (Arts. 15 et seq. of the GDPR).
Art. 15: Right of access, including the right to obtain information on the retention period of personal data, or, if this is not possible, the criteria used to determine such a period. Right to obtain information about the source of the collected data, as well as the purposes and methods of processing. Right to lodge a complaint at any time with the Supervisory Authority: Privacy Guarantor: Piazza di Monte Citorio No. 121, 00186 ROME, Tel. +39 06 696771 – PEC: protocollo@pec.gpdp.it

Art. 16: Right of the data subject to obtain the updating, correction, or completion of personal data.
Art. 17: Right to erasure and the right to be forgotten.
Art. 18: Right to restriction of processing, where applicable.
Art. 19: Obligation of the Data Controller to notify the correction, erasure, and/or restriction of processing.
Art. 20: Right to data portability, where the existing technology allows it.

Art. 8. Data Subject Requests.
Requests referred to in the preceding Art. 7 may be submitted by the data subjects to the Data Controller via registered letter or certified email (PEC) at the addresses indicated in Art. 1 above. In all cases, data subjects must attach a valid identity document to their request.