Privacy notice

Introduction: what this notice covers

This notice covers the daspsrl.it website and the relationships with the customers of DASP SRL. As regards browsing the website, there are two processing operations: the data you enter in the contact and internal-audit booking forms (name, organization, email, telephone, message), used only to reply to you, and the technical data recorded by the server for security purposes (IP address, date and time, page requested). The data from the forms reach DASP SRL by email, through the hosting provider’s mail service, and are kept only for the time needed to reply to you and to manage any resulting relationship; no other party receives them. The website uses no cookies, neither its own nor third-party ones, and uses no profiling tools; visit statistics are described in the Cookies section. The other purposes described below (management of the contractual relationship, payments, fraud prevention, promotional activities) concern those who become DaSP customers and apply at the time of the contract.

Notice pursuant to Article 13 of Regulation (EU) 2016/679 («GDPR»)

DASP SRL (hereinafter «DaSP» or «the Controller») protects the confidentiality of personal data and ensures the protection they require against any event that may put them at risk of breach.

As provided by Regulation (EU) 2016/679 («GDPR»), and in particular by Article 13 thereof, the information required by law concerning the processing of their personal data is provided below to the user («Data Subject»).

Section 1 — Who we are and what data we process (Art. 13(1)(a) and Art. 15(b) GDPR)

DASP SRL, represented by its legal representative, with registered office in Milan (MI), via Andrea Costa 1A, acts as Data Controller, can be contacted at privacy@daspsrl.it and collects and/or receives information concerning the Data Subject, such as:

DaSP does not ask the Data Subject to provide so-called «special» data, that is, under the GDPR (Art. 9), personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, as well as genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or a person’s sex life or sexual orientation. Should the service requested from DaSP require the processing of such data, the Data Subject will receive a specific notice in advance and will be asked to give specific consent.

The Controller has appointed a Data Protection Officer (DPO), who can be contacted for any information and request at the email address dpo@daspsrl.it.

For any information or request, the Data Subject may contact the email address qualita@daspsrl.it.

Section 2 — Why we need the Data Subject’s data (Art. 13(1) GDPR)

The Controller needs the data to follow up on the sign-up request and on the contract for the supply of the Service chosen and/or the Product purchased, to manage and process the contact requests sent by the Data Subject, to provide support, and to comply with the legal and regulatory obligations to which the Controller is subject in connection with its business. Under no circumstances does DaSP resell the Data Subject’s personal data to third parties or use them for undeclared purposes.

In particular, the Data Subject’s data will be processed for:

1. Sign-up and requests for contact and/or information material. The Data Subject’s personal data are processed to carry out the activities preliminary and subsequent to the sign-up request, to manage requests for information and contact and/or for the sending of information material, and to fulfil any other resulting obligation. The legal basis for such processing is the performance of the services related to the request for sign-up, information and contact and/or the sending of information material, and compliance with legal obligations.

2. Management of the contractual relationship. The Data Subject’s personal data are processed to carry out the activities preliminary and subsequent to the purchase of a Service and/or a Product, the management of the related order, the provision of the Service and/or the production and/or shipping of the Product purchased, the related invoicing and payment management, the handling of complaints and/or reports to the support service and the provision of support itself, fraud prevention, and the fulfilment of any other obligation arising from the contract. The legal basis for such processing is the performance of the services related to the contractual relationship and compliance with legal obligations.

3. Promotional activities concerning Services/Products similar to those purchased by the Data Subject (Recital 47 GDPR). The Controller may, even without your explicit consent, use the contact details provided by the Data Subject for the direct marketing of its own Services/Products, limited to Services/Products similar to those sold, unless the Data Subject explicitly objects.

   Commercial promotion of Services/Products other than those purchased by the Data Subject. The Data Subject’s personal data may also be processed for commercial promotion purposes, for surveys and market research concerning Services/Products offered by the Controller, only if the Data Subject has authorized the processing and does not object to it. Such processing may be carried out, in an automated manner, by email or telephone contact, and may take place: where the Data Subject has not withdrawn consent to the use of the data; where, in the case of processing by telephone contact with an operator, the Data Subject is not registered in the public opt-out register («Registro delle opposizioni») under D.P.R. 7 settembre 2010, n. 178 (Italian Presidential Decree no. 178 of 7 September 2010), or where the Data Subject has not withdrawn consent to the use of the data. The legal basis for such processing is the consent given by the Data Subject prior to the processing itself, which the Data Subject may withdraw freely and at any time (see Section 3).

4. IT security. The Controller, in line with Recital 49 of the GDPR, processes, also through its suppliers (third parties and/or recipients), the Data Subject’s personal data relating to traffic to the extent strictly necessary and proportionate to ensure network and information security, that is, the ability of a network or information system to resist, at a given level of confidence, unforeseen events or unlawful or malicious acts that compromise the availability, authenticity, integrity and confidentiality of stored or transmitted personal data. The Controller will promptly inform Data Subjects where there is a particular risk of breach of their data, without prejudice to the obligations under Article 33 of the GDPR on the notification of personal data breaches. The legal basis for such processing is compliance with legal obligations and the Controller’s legitimate interest in carrying out processing aimed at protecting company assets and the security of DaSP’s premises and systems.

5. Profiling. The Data Subject’s personal data may also be processed for profiling purposes (such as analysis of the data transmitted and of the Services/Products chosen, in order to propose advertising messages and/or commercial offers in line with the choices expressed by the users themselves) exclusively where the Data Subject has given explicit and informed consent. The legal basis for such processing is the consent given by the Data Subject prior to the processing itself, which the Data Subject may withdraw freely and at any time (see Section 3).

6. Fraud prevention (Recital 47 and Art. 22 GDPR). The Data Subject’s personal data, excluding special categories of data (Art. 9 GDPR) and data relating to criminal convictions (Art. 10 GDPR), will be processed to allow checks aimed at monitoring and preventing fraudulent payments, by software systems that carry out an automated check prior to the negotiation of Services/Products. Failure to pass such checks will make it impossible to carry out the transaction; the Data Subject may in any case express their point of view, obtain an explanation or contest the decision, setting out their reasons to the Customer Service or to the email contact privacy@daspsrl.it. Personal data collected solely for anti-fraud purposes, unlike the data necessary for the correct performance of the service requested, will be deleted immediately at the end of the checking phases.

7. Protection of minors. The Services/Products offered by the Controller are reserved for persons legally capable, under the applicable national legislation, of entering into contractual obligations. In order to prevent unlawful access to its services, the Controller implements preventive measures to protect its legitimate interest, such as checking the tax code and/or other verifications, where necessary for specific Services/Products, of the correctness of the identification data of identity documents issued by the competent authorities.

Disclosure to third parties and categories of recipients (Art. 13(1) GDPR)

The Data Subject’s personal data are disclosed mainly to third parties and/or recipients whose activity is necessary to carry out the activities related to the relationship established and to comply with certain legal obligations, such as:

*The Controller requires its third-party suppliers and Processors to comply with security measures equal to those adopted towards the Data Subject, restricting the Processor’s scope of action to the processing connected with the service requested.

The Controller does not transfer your personal data to countries where the GDPR does not apply (non-EU countries), except where specifically indicated otherwise, in which case you will be informed in advance and, if necessary, your consent will be requested.

The legal basis for such processing is the performance of the services related to the relationship established, compliance with legal obligations and DaSP’s legitimate interest in carrying out the processing necessary for such purposes.

Section 3

What happens if the Data Subject does not provide the data identified as necessary to perform the service requested? (Art. 13(2)(e) GDPR)

The collection and processing of personal data is necessary to follow up on the services requested and to provide the Service and/or supply the Product requested. Should the Data Subject fail to provide the personal data expressly indicated as necessary in the order form or sign-up form, the Controller will not be able to carry out the processing related to the management of the services requested and/or of the contract and of the related Services/Products, nor the obligations that depend on them.

What happens if the Data Subject does not consent to the processing of personal data for the commercial promotion of Services/Products other than those purchased?

Should the Data Subject not consent to the processing of personal data for such purposes, no processing will take place for those purposes, without any effect on the provision of the services requested or on the purposes for which the Data Subject has already given consent, where required.

Should the Data Subject have given consent and subsequently withdraw it or object to processing for commercial promotion activities, their data will no longer be processed for such activities, without any consequence or adverse effect for the Data Subject or for the services requested.

How we process the Data Subject’s data (Art. 32 GDPR)

The Controller uses appropriate security measures to preserve the confidentiality, integrity and availability of the Data Subject’s personal data and requires its third-party suppliers and Processors to adopt similar security measures.

Where we process the Data Subject’s data

The Data Subject’s personal data are stored in paper, electronic and online archives located in the European Union or in Switzerland, a country for which the European Commission has recognized an adequate level of protection.

How long are the Data Subject’s data kept? (Art. 13(2)(a) GDPR)

For personal data, we follow a retention policy in line with legal and statutory requirements. For further information, please contact DaSP’s Data Protection Officer (DPO) at the email address dpo@daspsrl.it. We may also keep your data for the period necessary for DaSP to pursue its legitimate business interests, comply with its legal obligations, resolve disputes and enforce its agreements.

What are the Data Subject’s rights? (Arts. 15–20 GDPR)

The Data Subject has the right to obtain the following from the Controller:

1. confirmation as to whether or not personal data concerning them are being processed and, where that is the case, access to the personal data and to the following information: the purposes of the processing; the categories of personal data concerned; the recipients or categories of recipients to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organizations; where possible, the envisaged retention period for the personal data or, if not possible, the criteria used to determine that period; the existence of the Data Subject’s right to request from the Controller the rectification or erasure of personal data or the restriction of processing of personal data concerning them, or to object to such processing; the right to lodge a complaint with a supervisory authority; where the data are not collected from the Data Subject, any available information as to their source; the existence of automated decision-making, including profiling, and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the Data Subject; the appropriate safeguards provided by the third country (non-EU) or international organization to protect any data transferred;

2. the right to obtain a copy of the personal data undergoing processing, provided that this right does not adversely affect the rights and freedoms of others. For any further copies requested by the Data Subject, the Controller may charge a reasonable fee based on administrative costs;

3. the right to obtain from the Controller, without undue delay, the rectification of inaccurate personal data concerning them;

4. the right to obtain from the Controller, without undue delay, the erasure of personal data concerning them, where the grounds provided for by Article 17 of the GDPR apply, including, for example, where the data are no longer necessary for the purposes of the processing or where the processing is deemed unlawful, and always provided that the conditions laid down by law are met; and in any case where the processing is not justified by another equally legitimate ground;

5. the right to obtain from the Controller the restriction of processing in the cases provided for by Article 18 of the GDPR, for example where you have contested the accuracy of the data, for the period necessary for the Controller to verify their accuracy. The Data Subject must also be informed, within a reasonable time, when the suspension period has ended or the cause of the restriction of processing has ceased to exist, and the restriction has therefore been lifted;

6. the right to be informed by the Controller of the recipients to whom requests for any rectification, erasure or restriction of processing have been communicated, unless this proves impossible or involves disproportionate effort;

7. the right to receive the personal data concerning them in a structured, commonly used and machine-readable format, and the right to transmit those data to another controller without hindrance from the controller to which the data were provided, in the cases provided for by Article 20 of the GDPR, and the right to have the personal data transmitted directly from one controller to another, where technically feasible.

For any further information, and in any case to send your request, you must contact the Controller at the email address privacy@daspsrl.it. In order to ensure that the above rights are exercised by the Data Subject and not by unauthorized third parties, the Controller may ask the Data Subject to provide any further information necessary for this purpose.

How and when can the Data Subject object to the processing of their personal data? (Art. 21 GDPR)

On grounds relating to their particular situation, the Data Subject may object at any time to the processing of their personal data where it is based on legitimate interest or carried out for commercial promotion activities, by sending the request to the Controller at the email address privacy@daspsrl.it.

The Data Subject has the right to the erasure of their personal data if there is no overriding legitimate ground of the Controller over the one that gave rise to the request, and in any case where the Data Subject has objected to processing for commercial promotion activities.

With whom can the Data Subject lodge a complaint? (Art. 15 GDPR)

Without prejudice to any other administrative or judicial remedy, the Data Subject may lodge a complaint with the supervisory authority competent for the Italian territory, the Italian Data Protection Authority (Garante per la protezione dei dati personali), or with the authority that performs its tasks and exercises its powers in the Member State where the breach of the GDPR occurred. Any update to this Notice will be communicated promptly and by appropriate means; it will likewise be communicated, before proceeding and following the Data Subject’s consent where necessary, should the Controller process the Data Subject’s data for purposes other than those set out in this Notice.

Cookies

This site uses no cookies and no third parties. It uses no cookies of its own or of third parties, and no profiling tools. Fonts and all the site’s resources are served by servers managed by DaSP, without requests to third-party services. Should the site use cookies or similar tools in the future, this section will be updated before they are activated and, where required, consent will be requested.

The site collects aggregate visit statistics with software installed on servers managed by DaSP in the European Union, without cookies and with anonymized IP addresses; no data is shared with third parties. The browser's Do Not Track signal is respected.

Last updated: 11 October 2026. Courtesy translation: the Italian text prevails.