Privacy Policy

Premise

Why this document? National and international data protection regulations require that the data subject be informed about which personal data are processed and by whom, to ensure that the processing is fair and transparent.

Below you will clearly see who will process your data, which personal data will be processed, the purposes of the processing, how long the data will be kept, what your rights are and how to exercise them.

This policy is provided in accordance with the combined provisions of the following regulations:

• Legislative Decree 196/2003 (hereinafter "Privacy Code");
• Regulation (EU) 2016/679 on the protection of personal data (hereinafter "Regulation");
• European Directive 2002/58/EC, known as "e-Privacy".

This policy covers the website and the social media pages. The personal data that the Customer processes within the Platform in the course of their loss adjusting activity — the data contained in the reports, the scans and the attachments — are processed by the Provider on the Customer's behalf and are governed by the agreement entered into with the Customer pursuant to Article 28 of the Regulation.

1. Data controller

Replate S.r.l. — Viale Maria Ceccarini Bormann 195, 47838 Riccione (RN), Italy — VAT and tax code 04691470407 — email [email protected] — PEC [email protected] (hereinafter "Controller").

2. Purpose, legal basis, retention period and nature of the processing

Depending on the actions taken by the data subject, personal data will be processed for the following purposes:

a. Responding to contact requests (e.g. information requests received via email, demo requests, requests to activate an account)

the legal basis for this processing is the necessity to carry out pre-contractual measures adopted at the data subject's request; the retention period for data processed for this purpose is the time necessary to fulfil the request; personal data are necessary to process the request, and refusal will result in the inability to contact the data subject.

b. Responding to requests received through social platforms (direct messages or on the wall)

the legal basis for this processing is the necessity to carry out pre-contractual or contractual measures requested by the data subject (e.g. responding to a question about a service on the company's social pages via private messages), using their name or username and other data provided to respond; the retention period is the time necessary to fulfil the request; the requested personal data are necessary to process the request, and refusal will result in the inability to respond to the data subject.

c. Administrative and managerial tasks and compliance with legal obligations, regulations or orders from authorities (e.g. accounting, tax formalities, administrative and accounting management)

the legal basis derives from the necessity to fulfil a legal obligation to which the data controller is subject; the retention period is tied to the specific legal obligations regulated by the respective laws; providing personal data is mandatory, as the controller must comply with a legal obligation or requests from competent authorities.

d. Preventing, detecting and prosecuting illegal conduct

the legal basis for this processing is the Controller's legitimate interest in preventing, detecting and prosecuting illegal activities or violations of intellectual/industrial property rights (including third-party rights) or computer crimes or crimes committed through telematic networks, defamation or other similar offences committed on the website or during interaction with the respective social media communities managed by the Controller (e.g. posting a comment, liking or sharing a post); the retention period is the time reasonably necessary to assert the controller's rights from the moment the offence or its potential commission is discovered.

3. Personal data processed

By processing of personal data we mean any operation or set of operations, carried out with or without automated processes and applied to personal data or sets of personal data, such as collection, recording, organisation, structuring, storage, adaptation or modification, retrieval, consultation, use, communication by transmission, dissemination or any other form of availability, comparison or interconnection, restriction, deletion or destruction.

Data qualifying as "special categories of personal data" under Article 9 of the Regulation — revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership, data concerning health, sex life or sexual orientation — may also be sent by the data subject to the Controller (e.g. in the message field of a contact form). This category of data will be processed to fulfil the request received. Additional processing of special categories of data by the Controller will only be carried out with prior explicit consent.

Additional personal data processed by the Controller:

Browsing data

the computer systems and software procedures responsible for the operation of this site acquire, during their normal activity, certain personal data whose transmission is implicit in Internet communication protocols. This category includes IP addresses or domain names of the computers and terminals used, the URI/URL addresses of the requested resources, the time of the request, the method used to submit the request to the server, the size of the response file, the numeric code indicating the response status from the server (successful, error, etc.) and other parameters related to the user's operating system and IT environment. These data, necessary to use the web services, are also processed to obtain statistical information on service usage (e.g. most visited pages, number of visitors per time slot or day, geographic areas of origin) and to monitor the correct functioning of the services offered. Browsing data are retained for no more than seven days and are deleted immediately after aggregation (except in cases where judicial authorities need them to investigate criminal offences).

Data provided by the user

the voluntary, explicit and optional sending of messages to the Controller's contact addresses involves acquiring the sender's contact information, necessary for responding, as well as any other personal data included in the communications.

Social media platforms

using the Controller's social pages entails additional personal data processing by the respective social platform provider, not necessarily limited to interactions with us. The processing of user data is subject to the privacy policies in place on the platforms used; we therefore refer to the privacy notices of the social platform operators we use. Data shared by users through private messages sent directly to the managers of the channels will be processed in compliance with current personal data protection laws and this privacy policy.

Cookies and other tracking systems

the site uses technical cookies only, necessary for the pages to work and to keep the reader's preferences (language, theme, sign-in session), for which no consent is required.

4. Recipients of personal data

Depending on the actions taken by the data subject, personal data will be processed for the purposes above by:

• entities acting typically as "Data Processors", pursuant to Article 28 of the Regulation, i.e. individuals, companies or professionals providing assistance and consultancy services to the Controller regarding the provision of services and products;
• entities, bodies or Authorities to whom disclosure of personal data is mandatory by legal provisions or orders from Authorities;
• entities necessary for interacting in order to provide the services and products, as independent data controllers;
• personnel expressly authorised by the Controller to perform activities strictly related to the provision of the services and products, bound by confidentiality or an adequate legal confidentiality obligation, and who have received suitable operational instructions under Article 29 of the Regulation or Article 2-quaterdecies of Legislative Decree 196/2003.

The complete list of Data Processors is available by sending a written request to the Controller.

5. Transfer of personal data

Some of your personal data are shared with recipients who may be located outside the European Economic Area (EEA). The Controller ensures that the processing of your personal data by these recipients complies with the Regulation. Transfers may be based on an adequacy decision or on Standard Contractual Clauses approved by the European Commission. More information is available from the Controller.

6. Existence of automated decision-making, including profiling

The Controller does not adopt automated decision-making processes on personal data processing, including profiling, as per Article 22 of the Regulation. More information is available from the Controller.

7. Data relating to minors under 18 years

Minors under 18 years cannot provide personal data. The Controller shall not be held responsible for any collection of personal data or false declarations provided by a minor and, in any case, if detected, the Controller will facilitate the right of access and deletion as requested by the guardian, trustee or whoever exercises parental responsibility.

8. Data subject's rights

The data subject has the right to obtain from the Controller, in the cases provided for, access to personal data and rectification or deletion thereof or restriction of the processing concerning them, or to object to the processing (Articles 15 et seq. of the Regulation). The specific request is presented by contacting the Controller at the email address dedicated to responses to data subjects.

9. Right to complain

If the data subject believes that the processing of personal data relating to them is in violation of the Regulation, they have the right to file a complaint with the Italian Data Protection Authority (www.gpdp.it), as provided by Article 77 of the Regulation, or to seek judicial remedies (Article 79 of the Regulation).

10. Exercising rights

To exercise the above rights, please contact: Replate S.r.l. — Viale Maria Ceccarini Bormann 195, 47838 Riccione (RN), Italy — VAT and tax code 04691470407 — email [email protected] — PEC [email protected].

11. Changes

The Controller reserves the right to modify and/or supplement this privacy policy at any time and commits to publish the changes on the website under the Privacy section. Data subjects are invited to review its contents periodically.