Privacy Notice pursuant to Article 13 of the General Data Protection Regulation of the European Union (EU Regulation 2016/679)
Pursuant to Article 13 of the General Data Protection Regulation (EU) 2016/679, PALACE SETTE s.r.l. (hereinafter “PALACE SETTE” or the “Data Controller”) will collect and process the personal data received following a request for assistance (hereinafter the “Data”) and therefore wishes to inform Data Subjects of the following:
1. Data Controller
The Data Controller is PALACE SETTE s.r.l., VAT No. 05834140013, with registered office in Turin (TO), Via XX Settembre 5, 10121.
The Data Controller may be contacted at:
Phone: +39 011 533688
Email: info@logerconfort.it
Certified Email (PEC): palacesette@pec.it
2. Data Processors
The processing of Data may be carried out on behalf of and under the authority of the Data Controller by:
a) Directors and employees of PALACE SETTE (authorized personnel);
b) External consultants responsible for accounting, IT support and maintenance of hardware, software, and the website.
PALACE SETTE will appoint only individuals or entities that provide adequate guarantees regarding confidentiality and the adoption of appropriate technical and organizational measures to ensure a level of data protection equivalent to that implemented by the Data Controller.
The Company also continuously trains its personnel in personal data protection and cybersecurity awareness.
3. Categories of Data Processed
The following categories of data may be processed:
a) Identification data;
b) Contact details;
c) Biometric data (photographs, audio, and video recordings);
d) Tax and financial data.
4. Purposes of Processing
The Data will be processed for the following purposes:
a) Fulfillment of contractual obligations;
b) Consultancy activities;
c) Training activities;
d) General and financial management of the company;
e) Accounting and tax compliance;
f) Statistical analysis;
g) Sending advertising communications related to similar products or services (soft spam);
h) Sending newsletters and promotional communications.
5. Legal Basis for Processing
The processing of voluntarily provided Data is lawful and necessary to achieve the purposes described above.
For soft spam communications, the legal basis is the legitimate interest of the Data Controller (Art. 6(1)(f) GDPR), balanced against the Data Subject’s right to object at any time.
For newsletters and promotional communications, the legal basis is the Data Subject’s prior consent.
For contractual obligations, the legal basis is the performance of a contract.
For statistical activities, the legal basis is the legitimate interest of the Data Controller in analyzing customer needs to improve services.
6. Mandatory or Optional Nature of Data Provision
The provision of Data required for the purposes listed from points (a) to (e) is necessary to perform the services requested and to comply with legal, contractual, and tax obligations.
Failure to provide such Data, or a subsequent refusal to allow processing, may prevent the Data Controller from fulfilling contractual obligations.
7. Methods of Data Processing
PALACE SETTE applies a data minimization policy, collecting and using only the Data strictly necessary for the performance of its activities.
Where possible, Data will be pseudonymized to reduce direct identification of Data Subjects.
The Data Controller adopts appropriate technical and organizational measures, both digital and physical, to protect all collected Data.
Employees are properly trained on applicable regulations and process Data only when formally authorized.
The Data Controller does not conduct profiling and does not use automated decision-making processes.
8. Disclosure of Data
Data will be disclosed to third parties only where necessary to provide services or where required by law.
Data may therefore be disclosed to:
a) External processors and authorized personnel referred to in Section 2;
b) Public authorities and third parties entitled by law to access the Data;
c) Persons authorized under Article 29 GDPR whose activities are strictly related to the provision of requested services and who are subject to confidentiality obligations.
Data will not be publicly disclosed, and any additional communication will occur only with the Data Subject’s express consent.
9. Public Disclosure of Data
Data will not be disclosed to parties other than those specified above.
10. Transfer of Data Abroad
Data will not be transferred to countries outside the European Union.
11. Data Retention Period
Personal Data, whether in paper or electronic form, will be retained for ten (10) years from the termination of the relationship.
After this period:
Paper documents will be securely destroyed;
Electronic files will be erased from servers and backup systems through wiping or shredding techniques, or anonymized and retained solely for statistical purposes.
12. Rights of the Data Subject
Each Data Subject has the right to:
a) Obtain confirmation as to whether their Data is being processed and receive it in an intelligible form;
b) Access their Data;
c) Request rectification, deletion, or restriction of processing;
d) Object to processing (see Section 14);
e) Request data portability in a structured, commonly used, machine-readable format;
f) Withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal;
g) Lodge a complaint with a supervisory authority.
13. Exercising Rights
Data Subjects may exercise their rights at any time by submitting a request via registered mail or certified email (PEC) to the contact details provided in Section 1.
14. RIGHT TO OBJECT
a. Where processing is based on the legitimate interest of the Data Controller, the Data Subject has the right to object at any time where their interests, rights, or freedoms override such legitimate interest.
b. The Data Subject shall in any case have the right to object at any time to the processing of personal data for direct marketing purposes.
c. The right to object may be exercised in writing using the contact details set out in Section 1.
As indicated in Section 6, an objection to processing may make it impossible to continue the contractual relationship between the parties.
Turin, 26 October 2026
The Data Controller
PALACE SETTE s.r.l.PALACE SETTE s.r.l.
