1. Data controller
The data controller is the company that operates this website and decides why and how your personal data is processed.
- Company
- Chimento Design S.r.l.
- Registered office
- Piazza Fulcieri Paolucci de Calboli, 1, 16161 Genova (GE), Italy
- VAT number
- 02870990997
- Privacy contact
- info@chimentodesign.com
- Phone
- +39 010 094 9314
The controller has not appointed a Data Protection Officer, as none of the conditions of Article 37 GDPR applies. For any matter concerning your personal data, use the privacy contact above.
2. Personal data we process
Data you give us
When you write to us through the contact form, by email or by phone, we process the data you choose to provide: name, company, email address, phone number (optional), the type of project and the content of your message. Please do not send special categories of data (such as health data) unless strictly necessary.
Browsing data
The systems that run this website acquire, during normal operation, some data whose transmission is implicit in the use of internet protocols: IP address, date and time of the request, pages requested, browser type and operating system. This data is not collected to identify you; it is used to deliver the site and keep it secure.
Security check on the contact form
The contact form is protected against automated abuse by Cloudflare Turnstile, a service of Cloudflare, Inc. It is loaded only when you start using the form. To tell people from bots, Cloudflare processes technical data such as your IP address, browser and device characteristics and the way the check is completed. It is not used to profile you or for advertising.
Cookies
The site uses technical cookies and, only with your consent, analytics cookies. Details are in the Cookie Policy.
3. Purposes and legal bases
| Purpose | Legal basis | Retention |
|---|---|---|
| Replying to your enquiries and requests for information or quotations | Steps taken at your request before entering into a contract, Art. 6(1)(b) GDPR; our legitimate interest in answering business correspondence, Art. 6(1)(f) GDPR | 24 months from the last contact, unless a contractual relationship begins |
| Protecting the contact form from spam and automated abuse (Cloudflare Turnstile) | Our legitimate interest in the security of the site and of our mailboxes, Art. 6(1)(f) GDPR | For the duration of the check; Cloudflare keeps the data for the time stated in its own privacy policy |
| Operating the website, keeping it secure, preventing and detecting abuse | Our legitimate interest in the security and proper functioning of the site, Art. 6(1)(f) GDPR | Server logs: up to 12 months |
| Complying with legal, tax and accounting obligations | Legal obligation, Art. 6(1)(c) GDPR | 10 years where accounting records are involved (Art. 2220 Italian Civil Code) |
| Establishing, exercising or defending legal claims | Our legitimate interest in protecting our rights, Art. 6(1)(f) GDPR | For the limitation period applicable to the claim |
| Aggregate statistics on the use of the site through analytics cookies | Your consent, Art. 6(1)(a) GDPR, given through the cookie banner | See the Cookie Policy; consent can be withdrawn at any time |
We do not use your data for newsletters or direct marketing, and we do not sell personal data.
4. Whether you must provide your data
Providing your data is voluntary. The fields of the contact form are needed to reply to you: without them we cannot handle your request. Browsing data is necessary for the site to work.
5. Who receives your data
Your data is handled by our staff, who are authorised and instructed to do so, and may be disclosed to the following categories of recipients, only as far as necessary:
- providers of hosting, email delivery, IT maintenance and website development services, acting as data processors under Article 28 GDPR;
- Cloudflare, Inc. (United States), which provides the security check on the contact form;
- professional advisers (legal, tax, accounting), bound by confidentiality;
- public authorities and courts, where the law requires it.
The up-to-date list of data processors is available on request from the privacy contact. Your data is not disseminated.
6. Transfers outside the European Economic Area
Your data is processed within the European Economic Area wherever possible. Some of our service providers may be established, or may process data, outside the EEA, in particular in the United States. In that case the transfer takes place only under the conditions of Chapter V GDPR: on the basis of a European Commission adequacy decision, including Implementing Decision (EU) 2023/1795 on the EU–US Data Privacy Framework for certified recipients, or, where no adequacy decision applies, under the Standard Contractual Clauses adopted by the European Commission (Art. 46(2)(c) GDPR). You can ask the privacy contact for a copy of the safeguards in place.
7. Your rights
Under Articles 15 to 22 GDPR you have the right to:
- obtain confirmation that we process your data and access it;
- have inaccurate data rectified and incomplete data completed;
- have your data erased, in the cases provided by law;
- obtain restriction of processing;
- receive the data you provided in a structured, commonly used, machine-readable format and transmit it to another controller (portability);
- object at any time, on grounds relating to your particular situation, to processing based on our legitimate interest;
- withdraw consent at any time, where processing is based on consent, without affecting the lawfulness of processing carried out before the withdrawal.
To exercise your rights write to info@chimentodesign.com or to our registered office. Exercising your rights is free of charge. We reply within one month of receiving the request; this period may be extended by two further months where necessary, in which case we will tell you why.
8. Right to lodge a complaint
If you believe that the processing of your data infringes the GDPR, you have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR), in particular in the Member State where you live or work or where the alleged infringement took place, and the right to an effective judicial remedy (Art. 79 GDPR). In Italy the authority is the Garante per la protezione dei dati personali, Piazza Venezia 11, 00187 Roma, www.garanteprivacy.it.
9. Automated decisions and profiling
We do not take decisions based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you (Art. 22 GDPR).
10. Minors
This website is addressed to businesses and professionals. It is not directed at minors, and we do not knowingly collect their data.
11. Security
We apply technical and organisational measures appropriate to the risk, to protect your data against loss, misuse, unauthorised access and disclosure (Art. 32 GDPR).
12. Links to other websites
This site may link to websites run by third parties. We are not responsible for how they process personal data: please read their privacy policies.
13. Changes to this policy
We may update this policy, for example when the law or our services change. The date at the top of the page shows the version in force. Where a change significantly affects how we use data already collected, we will give it appropriate notice on the site.