Privacy policy for the EASYTM website.

In brief

• Who decides how your data is used: D.P.S. Soluzioni Informatiche S.r.l., the maker of EASYTM. The law calls it the ‘controller’. If you accept LinkedIn advertising, LinkedIn also decides on its own uses of the data.
• What data: the details you enter in the ‘Book a meeting’ form and a small amount of technical data about your visit.
• Why: to reply to you; to email you invitations and news, but only if you choose this yourself by ticking the optional box in the form; to count visits anonymously with Plausible, without cookies, and with Google Analytics, but only if you accept the statistics; and to show you our ads on LinkedIn, but only if you accept LinkedIn advertising.
• Cookies: a single technical cookie remembers your choices about cookies; Plausible’s anonymous statistics use no cookies; Google Analytics cookies, for visit statistics, and LinkedIn cookies, for LinkedIn advertising, are used only if you accept them: these are two separate choices. The details are on the Cookie policy page.
• Your rights: you can ask us for access to your data, or to correct or erase it, and you can object to its use, by writing to our certified email address (PEC), by post or by calling our switchboard.

This privacy policy covers the website and its form, not the EASYTM software used by our clients.

Who is the controller

D.P.S. Soluzioni Informatiche S.r.l., a software house since 2002 and the maker of EASYTM:

• registered office: Viale Giorgio Ribotta 11, 00144 Rome, Italy;
• VAT No IT07043801005 and taxpayer identification number (codice fiscale) 07043801005;
• certified email (PEC): pecdps@pec.aruba.it;
• switchboard: +39 06 5290689.

What data we use and why

Every use of personal data must have a ‘legal basis’, that is, one of the grounds allowed by the GDPR (General Data Protection Regulation, Regulation (EU) 2016/679, Article 6). Below, for each purpose, you will find the legal basis we rely on.

Data from the ‘Book a meeting’ form

In the form you enter your first name, last name, company, email address and phone number. With your request, the website also records the date and time, the page containing the form, the button you started from and, only if you arrived from another website, the name of that website (for example www.google.com). We use this data as follows:

• To reply to you: to call you back, arrange the meeting and, if things go ahead, handle the negotiation and the contract. Legal basis: if you are asking on behalf of your company, our legitimate interests in following up the request your company has made to us (Article 6(1)(f) GDPR); if you are asking for yourself, steps taken at your request before entering into a possible contract (Article 6(1)(b)).
• To send you invitations and news: only if you tick the optional box, we email you invitations to events and trade fairs, and news about EASYTM and other software made by DPS Legal basis: your consent (Article 6(1)(a) GDPR and Section 130 of the Italian Personal Data Protection Code, Legislative Decree No 196/2003), which you can withdraw at any time.
• To understand where requests come from: the page, the button and the website you came from tell us which parts of the website work. Legal basis: our legitimate interests in improving the website (Article 6(1)(f)).

‘Legitimate interests’ means a lawful interest of ours that is not overridden by your interests and rights. You can always object to these uses: see ‘Your right to object’.

Technical data about your visit

• Server logs: as with any website, the server that hosts it receives from your device your IP address (the number that identifies your internet connection), the page requested, the date and time and other technical details of the request, and records them in its logs. They are used only to run the website and to protect it from faults and attacks.
• Rate limit: when you send the form, the website turns your IP address into a hash, that is, a code derived from the address, and uses it to count the requests coming from the same connection: at most 5 in an hour. The hash is not saved with your request, and the counter expires after an hour.

For both, the legal basis is our legitimate interests in keeping the website secure (Article 6(1)(f) and Recital 49 GDPR).

Anonymous statistics, for every visit

To count every visit we use Plausible Analytics, a European statistics service that uses no cookies, stores nothing on your device and does not keep your IP address: it uses it only to create a code that changes every day, so that the same visit is not counted twice. It gives us only aggregate figures (pages viewed, the website you came from, country and city, the type of device and browser), which do not tell us who visited the website. Legal basis: our legitimate interests in knowing how much and how the website is used (Article 6(1)(f) GDPR); according to the Italian Data Protection Authority these statistics do not require consent (Cookie Guidelines of 10 June 2021, paragraph 7.2). The details are on the Cookie policy page.

Google Analytics statistics, only if you accept them

If you accept Google Analytics cookies in the notice shown on your first visit, Google Analytics records how you use the website: the pages viewed, the website you came from, the type of device and browser, the language, the approximate country and city, and when you start filling in the form and send a request, without the details you enter. We use this to see which pages are useful. Legal basis: your consent (Article 6(1)(a) GDPR and Section 122 of the Italian Personal Data Protection Code), which you can withdraw at any time via ‘Cookie settings’ at the bottom of every page. If you reject the cookies or close the notice, Google Analytics does not run.

For visits from the European Union, Google Analytics does not log or store your IP address: it uses it only to derive the approximate country and city, and then deletes it. We do not use Google’s advertising features, and we do not send Google your name, email address or any other data that identifies you. The cookies are listed on the Cookie policy page.

LinkedIn advertising, only if you accept it

If you accept LinkedIn advertising in the cookie notice, the pages load the LinkedIn Insight Tag, a piece of code from LinkedIn Ireland Unlimited Company. The code sends LinkedIn the address and title of the page, the website you came from, your IP address, the characteristics of your device and browser, the time of your visit, and the buttons and links you click, with their text. We use it to show our ads on LinkedIn to people who have visited this website, to measure their results and to receive from LinkedIn reports on the professional make-up of the website’s audience, which do not identify members. Legal basis: your consent (Article 6(1)(a) GDPR and Section 122 of the Italian Personal Data Protection Code), which you can withdraw at any time via ‘Cookie settings’ at the bottom of every page. If you reject it or close the notice, the LinkedIn code does not run.

We place the LinkedIn code on our pages and let it run only with your consent. If you are a LinkedIn member, LinkedIn can recognise you outside LinkedIn too, for advertising. LinkedIn also uses this data for its own purposes, for example to show ads on and off LinkedIn, as a controller: this is explained in the LinkedIn privacy policy, which also tells you how to exercise your rights with LinkedIn. LinkedIn does not give us members’ personal data, only reports and alerts that do not identify them. We do not send LinkedIn your name, email address or any other details you enter in the form. The cookies are listed on the Cookie policy page.

If you do not give us your data

Your first name, last name, company, email address and phone number are needed to reply to you: without them, the form cannot be sent. The invitations box is optional: if you do not tick it, you only receive the reply to your request.

Who sees your data

Within DPS, your data is seen only by the people who handle your request or the invitations, who are authorised by us and bound by confidentiality.

Some service providers also process your data on our behalf, bound by a contract that requires them to use it only for the service they provide to us and to protect it. The law calls them ‘processors’ (Article 28 GDPR). They are:

• the provider of the server that hosts the website, a company based in Italy;
• the email provider, where the requests sent through the form arrive, which is part of a group headquartered in the United States;
• the providers of the software we use to manage contacts and to send the invitation and news emails;
• Plausible Analytics, for anonymous visit statistics, with the data in the European Union;
• Google Ireland Limited, for visit statistics with Google Analytics, only if you accept them.

Only if you accept LinkedIn advertising does the data collected by the LinkedIn code also reach LinkedIn Ireland Unlimited Company, which does not process it only on our behalf: it also uses it for its own purposes, as a controller (see ‘LinkedIn advertising, only if you accept it’).

We do not sell your data. We do not give it to other companies for their own purposes, except to LinkedIn if you accept LinkedIn advertising. If you would like to know the names of the providers listed above, ask for them using the controller’s contact details.

Data outside the European Union

The email provider is part of a group headquartered in the United States: for this reason, the data in the requests may also be processed there. The GDPR allows transfers of personal data to third countries, outside the European Union, only with specific safeguards (Articles 44 to 49): a decision of the European Commission recognising that the country ensures an adequate level of protection (an adequacy decision, Article 45), or the standard contractual clauses (SCCs) approved by the Commission (Article 46). We transfer data only with one of these safeguards: using the controller’s contact details, you can ask us which one applies and obtain a copy of it.

If you accept Google Analytics cookies, the statistics data may also be processed by Google LLC in the United States. Google LLC has certified its compliance with the EU-US Data Privacy Framework, for which the European Commission adopted an adequacy decision on 10 July 2023 (Article 45); where needed, the standard contractual clauses (Article 46), which Google includes in its contracts with users of its measurement services, also apply.

If you accept LinkedIn advertising, LinkedIn may also process the data outside the European Union. LinkedIn states that it relies on legally provided mechanisms for these transfers, which are described in the LinkedIn privacy policy.

How long we keep your data

Your rights

You can ask us at any time:

• to tell you whether we hold data about you and to give you a copy of the data we hold (right of access, Article 15 GDPR);
• to correct or complete it (right to rectification, Article 16);
• to erase it (right to erasure, Article 17);
• to restrict its use, meaning that we keep it without using it, for example while we check a point you have contested (right to restriction of processing, Article 18);
• to give it to you in a commonly used format, or to transmit it to another company, where we use it on the basis of your consent or of a request you made before a contract (right to data portability, Article 20).

You can also withdraw your consent to the invitations at any time, using the link at the bottom of every email or by writing to us, and your consent to visit statistics and to LinkedIn advertising via ‘Cookie settings’ at the bottom of every page. Withdrawing your consent does not affect the lawfulness of what was done before you withdrew it (Article 7(3)).

How to make a request

Write to our certified email address (PEC) pecdps@pec.aruba.it. PEC is an Italian certified email system, and messages to a PEC address are sent from another PEC mailbox: if you do not have one, write to us by post at D.P.S. Soluzioni Informatiche S.r.l., Viale Giorgio Ribotta 11, 00144 Rome, Italy, or call our switchboard on +39 06 5290689.

We reply without undue delay and at the latest within 1 month. If your request is complex, or we receive a large number of requests, this may extend to 3 months in total, but we will tell you why within the first month (Article 12(3) GDPR). It is free of charge, unless requests are manifestly unfounded or excessive (Article 12(5)). If we are not sure that the request comes from you, we may ask you for some information to confirm your identity (Article 12(6)).

Your right to object

Invitations and news: you can object at any time and without giving reasons, using the link at the bottom of every email or by writing to us. From that moment, we no longer use your data for this purpose (Article 21(2) and (3) GDPR).

Uses based on our legitimate interests (replying to your company’s request, the website you came from, anonymous statistics, website security): you can object on grounds relating to your particular situation. We will stop, unless we can demonstrate compelling legitimate grounds that override your interests and rights, or we need the data for the defence of legal claims (Article 21(1)).

Complaint to a supervisory authority

If you believe that we process your data unlawfully, you can lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, www.garanteprivacy.it) or with the supervisory authority of the EU Member State where you live, where you work or where the alleged infringement took place (Article 77 GDPR).

If this privacy policy changes

When something changes, we update this page and the date at the top. If we intend to use data you have already given us for a new purpose, we will tell you beforehand (Article 13(3) GDPR).