INTRODUCTION
TrustMaster Ltd, with registered office at 27 Old Gloucester Street, London, England, WC1N 3AX, operational headquarters at 27 Old Gloucester Street, London, England, WC1N 3AX, VAT Number GB322770516, acting as the Data Controller (hereinafter, “Data Controller”), informs you, pursuant to Articles 13 and 14 of EU Regulation No. 2016/679 (hereinafter, “GDPR”) and in compliance with Legislative Decree No. 196/03 (hereinafter, “Privacy Code” as amended by Legislative Decree 101/18), that your data will be processed in the following manner and for the following purposes:
1. Object of Processing
Given the services and products offered by our organization, the Data Controller processes personal, identifying, and non-sensitive data (for example: name, surname, tax code/VAT number, email, telephone number, hereinafter, “personal data” or simply “data”) communicated by you when requesting services/products from our organization and/or upon defining contractual agreements and/or promotional initiatives, and for the purposes outlined below.
This website uses log files in which information collected in an automated manner during user visits is stored. The collected information may include the following:
Internet Protocol (IP) address;
Browser type and parameters of the device used to connect to the site;
Name of the Internet Service Provider (ISP);
Date and time of visit;
Visitor’s referral and exit web pages;
Possibly the number of clicks.
The aforementioned information is processed in an automated manner and collected exclusively in aggregated form, to verify the correct functioning of the site and for security reasons. Such data is never used for user identification or profiling, but only for the protection of the site and its users; the legal basis for the related processing is the legitimate interest of the Data Controller.
2. Purposes and Legal Basis of Processing
Your personal data is processed:
A. Without your express consent, as they derive from legal and/or contractual obligations or relate to legitimate interests (Privacy Code and Art. 6 – GDPR), for the following purposes:
To manage and maintain the services/products requested by the data subject and to contact the data subject to organize the requested services/products;
To fulfill pre-contractual, contractual, and tax obligations deriving from existing relationships with you;
To fulfill the obligations established by law, a regulation, community legislation, or an order of the Authority, including accounting and tax aspects;
To prevent or discover fraudulent activities or harmful abuses and/or for the purposes provided by the current anti-money laundering legislation;
Mandatory fulfillments deriving from requirements of organizational and management models based on specific recognized standards (e.g., ISO, UNI standards, etc.) required by law and/or specific contractual requirements requested by the data subject and/or explicitly stated as a service requirement;
To exercise the rights of the Data Controller, such as the right of defense in court;
Availability of the data subject for information relating to the requested services and their management;
To allow registration for services and enable the sending of useful information to the data subject according to the requested services;
Processing of special categories of data for the requested services falling under the cases listed in Art. 9, paragraph 2, from letter “b” to “j”;
For legitimate interest related to commercial communications updating you on our organization’s initiatives.
Regarding data collected by the WEBSITE:
To allow registration on the website (only when available);
To allow us to respond to your queries submitted via the contact form;
To manage and maintain the website;
To prevent or discover fraudulent activities or harmful abuses for the website;
For legitimate interest relating to communications (including commercial ones) updating you on our organization’s initiatives and/or deriving from applicable regulatory/legislative requirements.
B. Only subject to your specific and distinct consent given by accepting the receipt of the newsletter via our website interface (Art. 7 GDPR and pursuant to Legislative Decree 196/03), for the following Purposes:
B.1 Marketing and/or commercial purposes: Commercial communications and/or advertising material regarding products or services falling under legitimate interest. Please note that if you are already a customer, we may send you commercial communications relating to services and products similar to those you have already used, unless you disagree (Privacy Code).
For other purposes, the Data Controller will define specific privacy notices and relative consent needs and/or additions for processing.
This privacy policy does not include any processing by other entities accessible through any links on the site, for which you must refer to their specific privacy policies.
3. Modalities and Duration of Processing
The processing of your personal data is carried out by means of the operations indicated in Legislative Decree 196/03 and Art. 4 No. 2) GDPR, specifically: collection, recording, organization, storage, consultation, elaboration, modification, selection, extraction, comparison, use, interconnection, blocking, communication, erasure, and destruction of data. Your personal data is subjected to both paper and electronic/automated processing.
The Data Controller will process personal data for the time necessary to fulfill the aforementioned purposes and in any case for no longer than 10 years from the termination of the relationship for the Purposes referred to in point 2.A (except for other legislative requirements). For the purposes referred to in point 2.B, however, the data will be processed until the consent is revoked or after 5 years from the interruption of the relationships/communications with the data subject from the first collection.
Profiling: No data profiling is carried out.
4. Access to Data
You may have access to your data at any time by making a simple request to the addresses indicated in this policy.
5. Communication of Data
Your data may be made accessible and/or communicated for the purposes referred to in Art. 2.A) and 2.B):
Without prejudice to communications and disseminations carried out in compliance with legal obligations, the Data Controller may communicate your data, in Italy and/or abroad (as indicated in the following points) to:
Employees and collaborators of the Data Controller, in their capacity as authorized persons and/or data processors and/or system administrators;
Technicians and/or collaborators for administrative, tax, and accounting management and/or to fulfill specific legal obligations or for whom external suppliers have been identified;
Our network of agents; factoring companies; credit institutions; debt collection companies; credit insurance companies; commercial information companies for the requested services; professionals and consultants; companies operating in the transport sector; technicians and collaborators responsible for providing the requested services/products, to Supervisory Bodies, judicial authorities, as well as to all other subjects to whom communication is mandatory by law for the accomplishment of the aforementioned purposes. To legal entities entrusted with services under this policy;
Companies or other legal entities, qualified and appointed pursuant to Art. 28 of Regulation 679/16, for support activities including: management and development of communication, management and development of business processes and projects, communication and promotion systems, for personal data storage. Access may be granted to third parties and affiliated companies providing services deemed necessary and/or useful by the Data Controller for managing the company’s activities and related support processes or those requested by you. Suppliers include IT system maintenance companies; credit institutions, professional firms, companies providing services on IT systems/platforms deemed useful by the Data Controller, companies performing outsourcing activities on behalf of the Data Controller, in their capacity as external data processors.
It may be necessary to communicate data to recipient subjects due to legislative obligations and/or deriving from the Data Controller’s organizational structures which involve the presence of independent subjects with the possibility of being data recipients to fulfill legislative obligations deriving from their role. These recipients may include supervisory bodies, third-party entity inspectors, people performing AUDITS on our organization, subjects and/or entities performing checks at our organization.
The Data Controller’s Partners are not authorized to process data for purposes other than those indicated in this policy. If this becomes necessary, the processing of the data subject’s personal data must refer to another specific privacy policy and specific consents detailing the different Data Controller and relevant purposes.
6. Data Transfer
The management and storage of personal data will take place on servers located within the European Union owned by the Data Controller and/or third-party companies appointed and duly named as Data Processors. Currently, our internal servers are located in Europe. The data will not be transferred outside the European Union. In any case, it is understood that the Data Controller, if necessary, will have the right to move the server location to non-EU countries. In this case, the Data Controller guarantees from now on that the transfer of non-EU data will take place in accordance with applicable legal provisions by stipulating, if necessary, agreements guaranteeing an adequate level of protection and/or adopting standard contractual clauses provided by the European Commission. For some mailing or “storage” services, we rely on “cloud” platforms, which may have servers in non-EU countries, but the data is only deposited temporarily for the requested service.
7. Mandatory or Optional Nature of Data Provision and Consequences of Refusal
The provision of data for the purposes referred to in Art. 2.A) is mandatory. Without them, we could not guarantee the services referred to in point 2.A). The provision of data for the purposes referred to in point 2.B) is, however, optional.
You can therefore decide not to provide any data or subsequently deny the possibility of processing data already provided: in this case, you will not receive commercial communications and advertising material relating to the Services offered by the Data Controller. In any case, you will continue to be entitled to the Services referred to in Art. 2.A).
8. Rights of the Data Subject
In your capacity as a data subject, you have the rights set out in Legislative Decree 196/03 and Art. 15-22 GDPR, and specifically the rights to:
Obtain confirmation of the existence or otherwise of personal data concerning you, even if not yet recorded, and their communication in an intelligible form;
Obtain the indication of: the origin of the personal data; the purposes and methods of processing; the logic applied in case of processing carried out with the aid of electronic instruments; the identifying details of the Data Controller, the data processors, and the designated representative pursuant to the Privacy Code and Art. 3, paragraph 1, GDPR; and the subjects or categories of subjects to whom the personal data may be communicated or who can learn about them as designated representative in the State’s territory, data processors, or authorized persons;
Obtain: the update, rectification, or, when interested, integration of data; the erasure, anonymization, or blocking of data processed in violation of the law, including those whose retention is unnecessary for the purposes for which the data were collected or subsequently processed; certification that the operations referred to in Art. 8.A) and B) have been brought to the attention, also as regards their content, of those to whom the data have been communicated or disseminated, except in the case where this fulfillment proves impossible or involves a manifestly disproportionate use of means compared to the protected right;
Object, in whole or in part: for legitimate reasons to the processing of personal data concerning you, even if pertinent to the purpose of collection; to the processing of personal data concerning you for the purpose of sending advertising materials or direct selling or for carrying out market research or commercial communication, through the use of automated call systems without the intervention of an operator by email and/or through traditional marketing methods by telephone and/or paper mail. Please note that the data subject’s right to object, set out in point B) above, for direct marketing purposes via automated methods extends to traditional ones, and that in any case, the possibility remains for the data subject to exercise the right to object even only partially. Therefore, the data subject can decide to receive only communications using traditional methods or only automated communications or neither of the two types of communication. Where applicable, you also have the rights pursuant to Articles 16-21 GDPR (Right of rectification, right to be forgotten, right to restriction of processing, right to data portability, right to object), as well as the right to lodge a complaint with the Guarantor Authority.
9. How to Exercise Your Rights
You may exercise your rights at any time by sending:
A registered letter with return receipt addressed to: TrustMaster Ltd, with registered office at 27 Old Gloucester Street, London, England, WC1N 3AX
An email to the address info@trustmaster.it
10. Minors
The Data Controller’s services are not intended for minors under 14 years of age, and the Data Controller does not intentionally collect personal information relating to minors. Should information on minors be involuntarily recorded, the Data Controller will delete it promptly upon request by the users.
11. Data Controller, Data Processor, and Authorized Persons
The Data Controller is TrustMaster Ltd, legally represented by Bruno Benvenuti (pro-tempore legal representative). The Data Controller can be contacted at the addresses listed above. The updated list of data processors and authorized persons processing the data is kept at the Data Controller’s headquarters.
12. Data Protection Officer (DPO)
The Data Protection Officer (DPO) is not applicable to our organization.
13. Changes to this Policy
This Privacy Policy may undergo changes. It is therefore advisable to check this Policy regularly and refer to the most updated version.
Do you need help creating the Cookie Policy or the accompanying website consent banner text as well? I can draft those to align with this translation if you tell me:
What types of cookies the site runs (e.g., Google Analytics, Facebook Pixel, or just essential cookies)
Whether you want the consent banner text to be short and punchy or highly detailed.
