How personal data is processed

01

Data controller

The data controller is RS Compositi S.r.l., whose registered office and contact details are given at the top of this page. Any request concerning personal data can be sent to info@rscompositi.com.

02

Data processed

The site processes two categories of data, neither of which includes the special categories set out in Article 9 GDPR.

• Browsing data — the systems hosting the site record the data that internet protocols transmit with every request: IP address, date and time, the address of the resource requested, browser type and operating system. They serve to deliver the page and to protect the service from abuse, not to identify the reader.
• Contact form data — name, email address, organisation, type of project and the body of the message. These are the only fields in the form: the site asks for nothing else and acquires no data from third-party sources.

The site carries out no profiling and no automated decision-making, and does not use the data collected to send unsolicited commercial communications.

03

Purposes and legal bases

• Replying to enquiries — reading the message received through the form and replying to it, including with a first technical assessment. Legal basis: steps taken at the data subject’s request prior to entering into a contract — Article 6(1)(b) GDPR.
• Running and securing the site — serving the pages, keeping technical logs and rate-limiting automated form submissions. Legal basis: the controller’s legitimate interest in a working service protected from abuse — Article 6(1)(f).
• Legal obligations — complying with obligations imposed by law or by a request from the authorities. Legal basis: Article 6(1)(c).

04

Whether data must be provided

Filling in the form is entirely voluntary, but the fields it asks for are needed in order to reply: without an address to answer and without the context of the project, no useful answer can be given. Browsing data, by contrast, is transmitted automatically by the protocol and does not depend on a choice by the visitor.

05

Who the data is disclosed to

Data is not disseminated, sold or transferred to third parties for commercial purposes. Besides the controller’s authorised staff, it is processed by the providers of the technical services the site runs on, appointed as processors under Article 28 GDPR:

• Vercel Inc. (United States) — website hosting and page delivery.
• Resend (United States) — delivery of the emails generated by the contact form: both the notification to the company and the confirmation sent to the person who wrote.
• Google Ireland Limited and Google LLC — the Google Fonts service, from which the site loads its typefaces. Loading them installs no cookies, but it does involve a connection to Google’s servers, which receive the visitor’s IP address in order to serve the file.

06

Transfers outside the European Union

Some of the providers listed are based in the United States. Those transfers rely on the safeguards set out in Chapter V GDPR: standard contractual clauses adopted by the European Commission and, for providers that have certified under it, the EU-US Data Privacy Framework. A copy of the safeguards in place can be requested from the controller at the contact details given at the top of this page.

07

Retention period

• Messages received through the form — kept for as long as needed to handle the enquiry and the exchanges that follow from it, and in any case no longer than 24 months from the last exchange — unless they become part of a contractual relationship or a legal provision requires them to be kept longer.
• Technical logs and browsing data — kept for the technical time needed for operation and security purposes, according to the hosting provider’s retention periods.

08

Your rights

Within the limits of Articles 15 to 22 GDPR, anyone who provides their data has the right to:

• access the data concerning them and obtain a copy of it (Art. 15);
• ask for it to be rectified if inaccurate or incomplete (Art. 16);
• ask for it to be erased (Art. 17) or for processing to be restricted (Art. 18);
• receive it in a structured format and transmit it to another controller (Art. 20);
• object to processing based on legitimate interest (Art. 21).

Requests can be sent to info@rscompositi.com and are answered within one month of receipt. This is without prejudice to the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali) or with the supervisory authority of the Member State where you reside.

09

Updates

This notice may be updated to reflect changes to the site or to the services behind it. The version published on this page is the one in force, with the revision date shown at the top.