Privacy policy for the EASYTM® website

In brief

• Who decides how your data is used: D.P.S. Soluzioni Informatiche S.r.l., the maker of EASYTM®. The law calls it the ‘controller’.
• What data: the details you enter in the ‘Book a meeting’ form and a small amount of technical data about your visit.
• Why: to reply to you; to email you invitations and news, but only if you choose this yourself by ticking the optional box in the form; and to count visits with Google Analytics, but only if you accept cookies.
• Cookies: a single technical cookie remembers your choice about cookies; Google Analytics cookies, for visit statistics, are used only if you accept them. The details are on the Cookie policy page.
• Your rights: you can ask us for access to your data, or to correct or erase it, and you can object to its use, by writing to our certified email address (PEC), by post or by calling our switchboard.

This privacy policy covers the website and its form, not the EASYTM® software used by our clients.

Who is the controller

D.P.S. Soluzioni Informatiche S.r.l., a software house since 2002 and the maker of EASYTM®:

• registered office: Viale Giorgio Ribotta 11, 00144 Rome, Italy;
• VAT No IT07043801005 and taxpayer identification number (codice fiscale) 07043801005;
• certified email (PEC): pecdps@pec.aruba.it;
• switchboard: +39 06 5290689.

What data we use and why

Every use of personal data must have a ‘legal basis’, that is, one of the grounds allowed by the GDPR (General Data Protection Regulation, Regulation (EU) 2016/679, Article 6). Below, for each purpose, you will find the legal basis we rely on.

Data from the ‘Book a meeting’ form

In the form you enter your first name, last name, company, email address and phone number. With your request, the website also records the date and time, the page containing the form, the button you started from and, only if you arrived from another website, the name of that website (for example www.google.com). We use this data as follows:

• To reply to you: to call you back, arrange the meeting and, if things go ahead, handle the negotiation and the contract. Legal basis: if you are asking on behalf of your company, our legitimate interests in following up the request your company has made to us (Article 6(1)(f) GDPR); if you are asking for yourself, steps taken at your request before entering into a possible contract (Article 6(1)(b)).
• To send you invitations and news: only if you tick the optional box, we email you invitations to events and trade fairs, and news about EASYTM® and other software made by D.P.S. Legal basis: your consent (Article 6(1)(a) GDPR and Section 130 of the Italian Personal Data Protection Code, Legislative Decree No 196/2003), which you can withdraw at any time.
• To understand where requests come from: the page, the button and the website you came from tell us which parts of the website work. Legal basis: our legitimate interests in improving the website (Article 6(1)(f)).

‘Legitimate interests’ means a lawful interest of ours that is not overridden by your interests and rights. You can always object to these uses: see ‘Your right to object’.

Technical data about your visit

• Server logs: as with any website, the server that hosts it receives from your device your IP address (the number that identifies your internet connection), the page requested, the date and time and other technical details of the request, and records them in its logs. They are used only to run the website and to protect it from faults and attacks.
• Rate limit: when you send the form, the website turns your IP address into a hash, that is, a code derived from the address, and uses it to count the requests coming from the same connection: at most 5 in an hour. The hash is not saved with your request, and the counter expires after an hour.

For both, the legal basis is our legitimate interests in keeping the website secure (Article 6(1)(f) and Recital 49 GDPR).

Visit statistics, only if you accept cookies

If you accept Google Analytics cookies in the notice shown on your first visit, Google Analytics records how you use the website: the pages viewed, the website you came from, the type of device and browser, the language, the approximate country and city, and when you start filling in the form and send a request, without the details you enter. We use this to see which pages are useful. Legal basis: your consent (Article 6(1)(a) GDPR and Section 122 of the Italian Personal Data Protection Code), which you can withdraw at any time via ‘Cookie settings’ at the bottom of every page. If you reject the cookies or close the notice, Google Analytics does not run.

For visits from the European Union, Google Analytics does not log or store your IP address: it uses it only to derive the approximate country and city, and then deletes it. We do not use Google’s advertising features, and we do not send Google your name, email address or any other data that identifies you. The cookies are listed on the Cookie policy page.

If you do not give us your data

Your first name, last name, company, email address and phone number are needed to reply to you: without them, the form cannot be sent. The invitations box is optional: if you do not tick it, you only receive the reply to your request.

Who sees your data

Within D.P.S., your data is seen only by the people who handle your request or the invitations, who are authorised by us and bound by confidentiality.

Some service providers also process your data on our behalf, bound by a contract that requires them to use it only for the service they provide to us and to protect it. The law calls them ‘processors’ (Article 28 GDPR). They are:

• the provider of the server that hosts the website, a company based in Italy;
• the email provider, where the requests sent through the form arrive, which is part of a group headquartered in the United States;
• the providers of the software we use to manage contacts and to send the invitation and news emails;
• Google Ireland Limited, for visit statistics with Google Analytics, only if you accept cookies.

We do not sell your data and we do not give it to other companies for their own purposes. If you would like to know the names of these providers, ask for them using the controller’s contact details.

Data outside the European Union

The email provider is part of a group headquartered in the United States: for this reason, the data in the requests may also be processed there. The GDPR allows transfers of personal data to third countries, outside the European Union, only with specific safeguards (Articles 44 to 49): a decision of the European Commission recognising that the country ensures an adequate level of protection (an adequacy decision, Article 45), or the standard contractual clauses (SCCs) approved by the Commission (Article 46). We transfer data only with one of these safeguards: using the controller’s contact details, you can ask us which one applies and obtain a copy of it.

If you accept Google Analytics cookies, the statistics data may also be processed by Google LLC in the United States. Google LLC has certified its compliance with the EU-US Data Privacy Framework, for which the European Commission adopted an adequacy decision on 10 July 2023 (Article 45); where needed, the standard contractual clauses (Article 46), which Google includes in its contracts with users of its measurement services, also apply.

How long we keep your data

Your rights

You can ask us at any time:

• to tell you whether we hold data about you and to give you a copy of the data we hold (right of access, Article 15 GDPR);
• to correct or complete it (right to rectification, Article 16);
• to erase it (right to erasure, Article 17);
• to restrict its use, meaning that we keep it without using it, for example while we check a point you have contested (right to restriction of processing, Article 18);
• to give it to you in a commonly used format, or to transmit it to another company, where we use it on the basis of your consent or of a request you made before a contract (right to data portability, Article 20).

You can also withdraw your consent to the invitations at any time, using the link at the bottom of every email or by writing to us, and your consent to visit statistics via ‘Cookie settings’ at the bottom of every page. Withdrawing your consent does not affect the lawfulness of what was done before you withdrew it (Article 7(3)).

How to make a request

Write to our certified email address (PEC) pecdps@pec.aruba.it. PEC is an Italian certified email system, and messages to a PEC address are sent from another PEC mailbox: if you do not have one, write to us by post at D.P.S. Soluzioni Informatiche S.r.l., Viale Giorgio Ribotta 11, 00144 Rome, Italy, or call our switchboard on +39 06 5290689.

We reply without undue delay and at the latest within 1 month. If your request is complex, or we receive a large number of requests, this may extend to 3 months in total, but we will tell you why within the first month (Article 12(3) GDPR). It is free of charge, unless requests are manifestly unfounded or excessive (Article 12(5)). If we are not sure that the request comes from you, we may ask you for some information to confirm your identity (Article 12(6)).

Your right to object

Invitations and news: you can object at any time and without giving reasons, using the link at the bottom of every email or by writing to us. From that moment, we no longer use your data for this purpose (Article 21(2) and (3) GDPR).

Uses based on our legitimate interests (replying to your company’s request, the website you came from, website security): you can object on grounds relating to your particular situation. We will stop, unless we can demonstrate compelling legitimate grounds that override your interests and rights, or we need the data for the defence of legal claims (Article 21(1)).

Complaint to a supervisory authority

If you believe that we process your data unlawfully, you can lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, www.garanteprivacy.it) or with the supervisory authority of the EU Member State where you live, where you work or where the alleged infringement took place (Article 77 GDPR).

If this privacy policy changes

When something changes, we update this page and the date at the top. If we intend to use data you have already given us for a new purpose, we will tell you beforehand (Article 13(3) GDPR).