This notice explains how we process the personal data of users visiting https://www.deorinteriordesign.it/en (the “Website”) and of anyone who contacts us, in accordance with Articles 13 and 14 of Regulation (EU) 2016/679 (“GDPR”) and Italian Legislative Decree 196/2003 (“Italian Privacy Code”), as amended by Legislative Decree 101/2018.
1. Data controller
The data controller is Artarreda di Sinelli Debora e C. S.a.s., registered office at Via Roma, 159 – 18016 San Bartolomeo al Mare (IM), Italia, VAT no. 01397150085 (“De.or” or the “Controller”).
Email: info@deorinteriordesign.it · Phone: 0184 638920
The Controller has not appointed a Data Protection Officer (DPO), as this is not mandatory under Article 37 GDPR.
2. What data we process
a) Browsing data
The IT systems running the Website collect, in the normal course of operation, certain data whose transmission is implicit in the use of Internet protocols: IP address, date and time of the request, page requested, server response code, browser type and operating system. This data is used only to ensure that the Website works properly and securely and is not used to identify users.
b) Data you provide voluntarily
When you fill in the contact form or write to us by email or phone, we process the data you give us: full name, email address, phone number (optional), project type and the content of your message. Please do not include special categories of data (such as health data) within the meaning of Article 9 GDPR in your message.
c) Abuse prevention
To prevent spam and misuse of the contact form, the Website keeps for one hour a non-reversible cryptographic fingerprint (hash) of the IP address from which the form was sent, solely to limit the number of submissions. The fingerprint cannot be traced back to the IP address and is deleted automatically.
d) Third-party content
The Google Maps map on the Contact page is loaded only if you explicitly request it by clicking the relevant button. Details are set out in our cookie policy.
3. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Replying to your enquiries, arranging appointments, preparing quotes and handling the pre-contractual steps you request | Steps taken at the request of the data subject prior to entering into a contract (Art. 6(1)(b) GDPR) |
| Managing any contractual relationship and the related administrative, accounting and tax obligations | Performance of a contract and compliance with legal obligations (Art. 6(1)(b) and (c) GDPR) |
| Ensuring the security of the Website and preventing spam, fraud and abuse | The Controller's legitimate interest in the security of its systems (Art. 6(1)(f) GDPR and Recital 49) |
| Establishing, exercising or defending legal claims | The Controller's legitimate interest (Art. 6(1)(f) GDPR) |
| Loading the Google Maps map | Consent, given by clicking the “Load map” button (Art. 6(1)(a) GDPR and Art. 122 of the Italian Privacy Code) |
Your data is not used for marketing or profiling, is not sold or passed on to third parties and is not subject to automated decision-making within the meaning of Article 22 GDPR.
4. Whether providing data is mandatory
Providing data through the contact form is optional. However, without the fields marked as required (name, email and message) we cannot reply to your request.
5. How data is processed and kept secure
Data is processed electronically and, where necessary, on paper by authorised and trained staff, using appropriate technical and organisational measures under Article 32 GDPR, including encrypted connections (HTTPS), restricted access and system protection.
6. Recipients
Data may be processed on behalf of the Controller by:
- staff and collaborators of the Controller authorised to process data under Article 29 GDPR and Article 2-quaterdecies of the Italian Privacy Code;
- IT service providers, including the Website hosting provider and the email service provider, appointed as processors under Article 28 GDPR;
- advisers and professionals (such as the accountant), if a contractual relationship is established;
- public authorities, where required by law.
Data is not published or disclosed to the public. An up-to-date list of processors is available from the Controller on request.
7. Transfers outside the European Union
Data collected through the Website is normally processed within the European Economic Area (EEA). If one of the Controller's providers (for example the email service) involves a transfer outside the EEA, this only takes place to countries covered by a European Commission adequacy decision (Art. 45 GDPR) or on the basis of standard contractual clauses approved by the Commission (Art. 46 GDPR).
If you choose to load the Google Maps map, Google may also process some data (such as your IP address) in the United States. Google LLC participates in the EU-U.S. Data Privacy Framework, recognised as adequate by the European Commission in its decision of 10 July 2023 (Art. 45 GDPR).
8. Retention periods
- Contact requests: for as long as needed to handle the request and, if no contractual relationship follows, for a maximum of 24 months from the last contact.
- Contract-related data: for the duration of the relationship and then for 10 years, as required by Article 2220 of the Italian Civil Code for accounting records.
- Browsing data (server logs): for as long as strictly necessary for the security of the Website, normally no longer than 30 days, unless needed to investigate offences.
- Anti-spam IP fingerprint: 1 hour.
9. Your rights
You may at any time exercise the rights granted by Articles 15 to 22 GDPR: access to your data, rectification, erasure, restriction of processing, data portability and objection to processing based on legitimate interest. Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal (Art. 7(3) GDPR).
To exercise your rights, write to info@deorinteriordesign.it. We will reply without undue delay and in any case within one month of receiving your request (Art. 12(3) GDPR).
10. Right to lodge a complaint
If you believe that the processing of your data infringes the GDPR, you may lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, Piazza Venezia 11, 00187 Rome – www.garanteprivacy.it) or with the supervisory authority of the EU Member State where you live or work or where the alleged infringement took place (Art. 77 GDPR), such as the CNIL in France.
11. Children
The Website is not intended for children under 14 and the Controller does not knowingly collect data relating to children under that age (Art. 2-quinquies of the Italian Privacy Code).
12. Changes to this notice
The Controller may update this notice, including following changes in the law. The date of the latest update is shown at the top of the page.