Pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (the “Regulation”), the Controller (as defined below)( provides its customers, including potential ones, as well as third parties in general (e.g. proxies, legal representatives, etc., jointly the “Data Subjects”), who interact with the website https://theumbriaedit.com (the “Website”), with the information required by the Regulation regarding the processing of their personal data (“Personal Data”).

1. DATA CONTROLLER 
   Tagged S.r.l., with registered office at Via del Mercato Vecchio n. 4, 05100, Terni (Italy), e-mail info@taggedservizi.it, is the entity that processes the data of the Data Subjects and, for the purposes of Article 4, no, 7, of the Regulation, is considered the “Data Controller” of the Personal Data (hereinafter, the “Controller”). 
2. METHODS OF PERSONAL DATA COLLECTION
   The Personal Data subject to processing activities by the Controller are collected from the Data Subjects, including through the remote communication techniques used by the Controller (e.g. websites, apps for smartphones and tablets, call centres, etc.).
3. CATEGORIES OF PERSONAL DATA PROCESSED
   The Personal Data processed by the Data Controller include, by way of example:
   • browsing data (e.g. IP addresses or domain names of the computers used by users who connect to the site, the time of the request, the method used to submit the request to the server, the numerical code indicating the status of the response given by the server and other parameters relating to the operating system and browser used by the user, logs);
   • identification data (e.g. first name, surname, tax code, address, date and place of birth, nationality);
   • contact data (e.g. telephone numbers, landline and/or mobile, email address) 
   • other data belonging to the above categories.
4. PURPOSE AND LEGAL BASES OF THE PROCESSING
   Personal Data, under the conditions specified, will be processed for the purposes and on the legal bases set out below:
   • Management of requests for contact and/or informative material and follow-ups. The processing of the Data Subject’s Personal Data is carried out in order to perform the activities preliminary and consequent to the request for registration to the Website, as well as for the management of requests for information and contact and/or the sending of informative material, and for the fulfilment of any other obligation deriving therefrom. 
     The legal basis for such processing is the fulfilment of a Data Subjects’ request, under Article 6, paragraph 1, let. B of the Regulation. The provision of the data is optional, however, any refusal by the interested party to provide the data shall make it impossible for the Controller to carry out the service requested.
   • Execution of the contract
     Personal Data will be processed for the management of the contractual relationship (by way of example, for the invoicing of fees, for the management of payments or complaints that the Data Subjects may forward to us) and for the provision of the requested services usable through the Website.
     The legal basis for such processing is the fulfilment of services inherent to the contractual relationship and compliance with legal obligations, under Article 6, paragraph 1, let. B and let. C of the Regulation.
     The provision of data is optional, however, any refusal on the part of the data subject to provide such data will make it impossible for the Controller to carry out the requested service.
   • Fulfilment of legal obligations, 
     Personal Data shall be processed for the fulfilment of legal obligations. In particular, the Controller may process Personal Data for the fulfilment of accounting and tax obligations and for the fulfilment of judicial authority orders aimed at preventing and repressing crimes.
     The legal basis for such processing is ensuring compliance with legal obligations, under Article 6, paragraph 1, let. C of the Regulation.
   • Defending a right in or out of court and fraud prevention 
     Personal Data shall be processed to ascertain, exercise or defend a right of the Controller and/or defend against the claims of others, in or out of court.
     The legal basis of such processing is the pursuit of the legitimate interest of the Controller, taking into account the balancing of the rights of the latter and of the Data Subject, under Article 6, paragraph 1, let. F of the Regulation.
   • Promotional activities on services/products like those purchased by the Data Subject
     The processing of the Data Subject’s Personal Data is carried out for the purpose of sending communications relating to promotions and offers of the Controller’s services/products that are identical and/or similar to those covered by the current agreement with the Data Subject, unless the same has objected to such processing initially or on the occasion of subsequent communications.
     The legal basis for such processing is the legitimate interest of the Controller to promote products or services to which the customer may reasonably be interested, taking into account the balancing of the rights of the latter and the Controller, under Article 6, paragraph 1, let. F of the Regulation.
     The Data Subject has the right to object at any time to the processing of personal data concerning him/her for the purposes in question, by selecting the “unsubscribe” option available at any communication received..

5. RECIPIENTS OF PERSONAL DATA
   The Personal Data collected may be communicated to subjects who will act as autonomous data controllers or data processors for the purposes set out above,.
   Personal Data may be made available to:

   • recipients in charge of the execution of activities connected and instrumental to the services offered by the Controller through the Website (including but not limited to IT service companies, law firms, tac consultants, social media management service companies, marketing companies, insurance companies, banking institutions, etc.);
   • commercial partners of the Controller;
   • public administrations, authorities and other entities in fulfilment of legal obligations.

   Personal Data will not be disseminated (made available to undetermined parties).

6. DATA TRANSFER TO THIRD COUNTRIES
   If necessary for the pursuit of the stated purposes, the Data Subject’s Personal Data may be transferred abroad, to countries/organisations outside the European Union that guarantee a level of protection of personal data deemed adequate by the European Commission by its own decision, or on the basis of appropriate safeguards under Chapter V of the Regulation. 
7. PERSONAL DATA RETENTION PERIOD
   Personal Data shall be kept in a form that enables the identification of the Data Subjects for a period not exceeding that necessary to achieve the purposes for which it was collected, taking into account the laws applicable to the activities and sectors in which the Controller operates. 
   Once the terms thus established have elapsed, Personal Data will be deleted or transformed into anonymous form, unless their further storage is necessary to fulfil obligations (e.g. tax and accounting) or to comply with orders issued by Public Authorities.
   The duration of cookies used on the site can be found in the relevant Cookie Policy: https://theumbriaedit.com/cookie-policy
   In the event of litigation, the storage period indicated above may be extended for the entire duration of the same.
8.  METHOD OF PROCESSING
   Processing will be carried out by authorised personnel in the performance of their activities, with the aid of electronic instruments, in accordance with principles of lawfulness and accuracy, so as to protect the confidentiality and rights of the Data Subjects at all times, in compliance with the provisions of current legislation.
9. RIGHTS OF THE DATA SUBJECTS
   The Data Subjects have the right to request from the Controller:
   • confirmation as to whether or not his or her Personal Data is being processed and, if so, to obtain access to it (right of access);
   • the rectification of inaccurate Personal Data or the integration of incomplete Personal Data (right of rectification);
   • the deletion of Personal Data if one of the reasons provided for in the Regulation applies (right to be forgotten);
   • the limitation of the processing of Personal Data when one of the cases provided for by the Regulation occurs (right of restriction);
   • to receive in a structured, commonly used and machine-readable format the Personal Data to be provided to the Controller and to transmit such data to another Controller (right to portability), where this is permitted under the Regulation;
   • to object at any time in whole or in part to the processing carried out in pursuit of a legitimate interest of the Controller (right to object);
   • to withdraw their consents to the processing of Personal Data, at any time, without prejudice to the lawfulness of the processing based on the consent given before such withdrawal.