The information and data provided by you or otherwise acquired in the context of the use of the various services, such as the registration of names, supply of email accounts, supply of Certified Electronic Mail (PEC) accounts, supply of other ancillary services will be the subject of of treatment in compliance with the provisions of EU Regulation 2016/679 - GDPR and the confidentiality obligations that inspire the activity of Kartland srl.
According to the rules of EU Regulation 2016/679 - GDPR, the treatments carried out will be based on the principles of lawfulness, correctness, transparency, purpose and conservation limitation, data minimization, accuracy, integrity and confidentiality.
Data Controller and Data Protection Officer
Personal data being processed
Data provided voluntarily by the interested party
Purpose of the treatment
Legal basis and mandatory or optional nature of the treatment
Recipients of personal data
Transfers of personal data
Retention of personal data
Rights of the interested party
1. Owner and Data Protection Officer
The owner of the treatments carried out through the site is Kartland srl as defined above. The owner's structure is equipped with a data protection officer (" DPO "). The DPO is available for any information concerning the processing of personal data. You can contact the DPO by writing to:
2. The personal data being processed
By the processing of personal data we mean any operation or set of operations, carried out with or without the aid of automated processes and applied to personal data or sets of personal data, such as the collection, registration, organization, structuring, storage , adaptation or modification, extraction, consultation, use, communication by transmission, diffusion or any other form of making available, comparison or interconnection, limitation, cancellation or destruction.
We inform you that the personal data being processed will be constituted - also depending on your decisions on how to use the Services - by an identifier such as your name, email address, an identification number, location data, an online identification , the purchases made, and other data suitable to make it identified or identifiable, depending on the type of Services requested. In particular, the Personal Data processed through the Site are as follows:
3. Navigation data
During their normal operation, the IT systems and software procedures used to operate the Site acquire some Personal Data whose transmission is implicit in the use of Internet communication protocols. This is information that is not collected to be associated with identified interested parties, but which by its very nature could, through processing and association with data held by third parties, allow users to be identified. This category of data includes the IP addresses or domain names of the computers used by users who connect to the Site, the addresses in URI (Uniform Resource Identifier) notation of the requested resources, the time of the request, the method used in submitting the request to the server, the size of the file obtained in response, the numerical code indicating the status of the response given by the server (successful, error, etc.) and other parameters relating to the operating system and the user's IT environment. These data are used for the sole purpose of obtaining anonymous statistical information on the use of the Site. The data could be used to ascertain responsibility in the event of hypothetical computer crimes against the site or third parties: except for this eventuality, at present web contact data do not persist for more than 30 days, unless requested by the user.
4. Data provided voluntarily by the interested party
In the use of particular Services, the processing of Personal Data of third parties may be sent by you to the manager of the Service. With respect to these hypotheses, you act as an independent data controller, assuming all the obligations and responsibilities of the law. In this sense, you confer on the point the widest indemnity with respect to any dispute, claim, request for compensation for damage from treatment, etc. that it should reach Kartland srl from third parties whose Personal Data have been processed through its use of the Services in violation of the rules on the protection of applicable personal data. In any case, if you provide or otherwise process Personal Data of third parties in the use of the Service, it guarantees from now - assuming any related responsibility - that this particular treatment hypothesis is based on a suitable legal basis (for example, the consent of the interested party) pursuant to art. 6 of EU Regulation 2016/679 - GDPR which legitimizes the processing of the information in question.
5. Traffic data
As part of the e-mail service, Kartland Srl processes some data for the purpose of transmitting communications on the electronic communications network. These data are those listed in the Legislative Decree 30 May 2008, n. 109, and in particular they are:
IP address used and e-mail address and any further identification of the sender;
IP address and fully qualified domain name of the mail exchanger host, in the case of SMTP technology or any type of host relating to a different technology used for the transmission of the communication;
e-mail address, and any further identification, of the recipient of the communication;
IP address and fully qualified domain name of the mail exchanger host (in the case of SMTP technology), or of any type of host (relative to a different technology used), which provided for the delivery of the message;
IP address used for the reception or consultation of e-mail messages by the recipient regardless of the technology or protocol used;
date and time (GMT) of the connection and disconnection of the user of the Internet e-mail service and IP address used, regardless of the technology and protocol used;
the internet service used.
These data are processed and stored by Kartland Srl to provide the service and by law, in particular, for the purpose of ascertaining and suppressing crimes - and with stringent security measures that make them accessible only to those specifically authorized in writing, who will they only access following a request from the judicial authority accompanied by a motivated decree of a public prosecutor and in any case with particularly sophisticated authentication techniques provided for by the law. By law, the data are kept by Kartland Srl for the purpose of ascertaining and suppressing crimes for six years from their generation. The data are also processed by Kartland Srl for ordinary company processing related to the provision of the service (e.g. for the detection of fraud, to perform analyzes on behalf of customers), by virtue of the provisions of the legislation. In this case, the data are kept, with stringent security measures applied in accordance with the law, for six months from their generation, and subsequently deleted.
6. Purpose of the treatment
The treatment we intend to carry out, with your specific consent where necessary, has the following purposes:
Allow navigation and consultation of the Kartland Srl website;
respond to requests for information, which we will receive by e-mail, telephone;
fulfill legal, accounting and tax obligations;
carry out direct marketing via e-mail for services similar to those signed by you, unless you have objected to such treatment initially or on the occasion of subsequent communications, for the pursuit of the legitimate interest of Kartland Srl to promote services to which you may reasonably be concerned;
elaborate studies, research, market statistics; send you advertising, information, commercial information or surveys to improve the service via e-mail and / or through the use of the telephone with an operator and / or through the official pages of Kartland Srl on social networks;
for exclusive security purposes and prevention of fraudulent conduct, the Data Controller implements an automatic control system that involves the detection and analysis of user behavior on the site associated with the processing of Personal Data, including the IP address. The consequences of this treatment are that if a person tries to engage in fraudulent conduct on the Site, Kartland Srl reserves the right to exclude such person from the services in use to take any other appropriate measure for their own protection.
7. Legal basis and mandatory or optional nature of the treatment
The legal basis for the processing of Personal Data for the purposes referred to in section 6 (abc) is art. 6 (1) (b) of EU Regulation 2016/679 - GDPR as the treatments are necessary for the provision of the contracted services. The provision of Personal Data for these purposes is optional but any failure to provide it would make it impossible to activate the requested Services.
The purpose referred to in section 6 (d) represents a legitimate processing of Personal Data pursuant to art. 6 (1) (c) of EU Regulation 2016/679 - GDPR. Once Personal Data has been provided, the processing may indeed be necessary to fulfill legal obligations to which Kartland Srl is subject.
The treatments carried out for marketing purposes and for communication to third parties described are based on the release of your consent pursuant to art. 6 (1) (a) of EU Regulation 2016/679 - GDPR. The provision of your Personal Data for these purposes is entirely optional and does not affect the use of the Services. The treatments performed for e-mail marketing purposes similar services to those purchased by you, instead finds its legal basis, pursuant to art. 6.1.f of the EU Regulation 2016/679 - GDPR, in the legitimate interest of Kartland Srl to promote its services in a context in which the interested party can reasonably expect this type of treatment, which he can also oppose at any time. If in fact you wish to object to the processing of your data for marketing purposes, you can do so at any time by sending an email request to firstname.lastname@example.org
The profiling treatment that you can object to at any time, is based on the legitimate interest of the Owner, pursuant to article 6.1.f. of EU Regulation 2016/679 - GDPR, to personalize their commercial communications. The treatment referred to in section 6 (h) is also based on the legitimate interest of the owner to detect fraud and scams carried out against him, in accordance with art. 6.1.f of EU Regulation 2016/679 - GDPR.
8. Recipients of personal data
Your Personal Data may be shared, for the purposes referred to in section 6 above, with:
1. subjects who typically act as data processors, namely:
people, companies or professional firms that provide assistance and advice to Kartland Srl in accounting, administrative, legal, tax, financial and debt collection matters relating to the provision of the Services;
subjects with whom it is necessary to interact for the provision of the Services (for example the national and foreign registration authorities to whom to transmit the technical and administrative documentation and the Maintainer modules, the authorities that manage the WHOIS database which contains the personal data of the assignees of domain names, etc.
2. subjects, entities or authorities to whom it is mandatory to communicate your personal data pursuant to legal provisions or orders from the authorities (for example, during investigations of a criminal nature Kartland Srl can receive requests from the judicial authority of provide telematic traffic logs);
3. persons authorized by kartland Srl to process Personal Data necessary to carry out activities strictly related to the provision of the Services, who are committed to confidentiality or have an adequate legal obligation of confidentiality, such as Kartland Srl employees;
4. commercial partners for their purposes, independent and distinct, only if you have given specific consent.
9. Transfers of personal data
Some of your Personal Data are shared with Recipients that could be found outside the European Economic Area. Kartland Srl ensures that the processing of your Personal Data by these Recipients takes place in compliance with EU Regulation 2016/679 - GDPR. Indeed, transfers can be based on an adequacy decision or on the Standard Contractual Clauses approved by the European Commission. More information is available from the owner. As part of the domain name registration services, the data are communicated to the subjects listed in section 8 of this policy: in some cases these treatments involve the transfer of the data in question outside the European Economic Area. Given that this transfer is necessary for its use of the service, according to current privacy legislation, it is justified pursuant to art. 49 (1) (b) of EU Regulation 2016/679 - GDPR.
10. Data retention
Personal Data processed for the purposes referred to in section 6 (abc) will be kept for the time strictly necessary to achieve those same purposes. In any case, since these are treatments carried out for the supply of Services, Kartland Srl will process Personal Data up to the time allowed by the Italian legislation to protect its interests (Art. 2946 cc and following).
Personal Data processed for the purposes referred to in section 3 (d) will be kept until the time provided for by the specific obligation or applicable law.
For the purposes referred to in section 6 (e) (f), your Personal Data will instead be processed until the withdrawal of your consent. The possibility for Kartland Srl to keep its Personal Data up to the time allowed by Italian law to protect its interests is reserved in any case (Art. 2947 (1) (3) cc). More information about the data retention period and the criteria used to determine this period can be requested by writing to the Data Controller or the DPO.
11. Rights of the interested parties
As an interested party you can exercise the rights referred to in art. from 16 to 22 of EU Regulation 2016/679 - GDPR.
Art. 16 - Right to rectification
You have the right to obtain from the data controller the correction of inaccurate personal data concerning you without undue delay. Taking into account the purposes of the processing, you have the right to obtain the integration of incomplete personal data, also by providing an additional declaration.
Art. 17 - Right to cancellation
You have the right to obtain from the data controller the cancellation of personal data concerning you without undue delay and the data controller has the obligation to delete personal data without undue delay, if one of the following reasons exists:
personal data are no longer necessary with respect to the purposes for which they were collected or otherwise processed; 4.5.2016 EN Official Journal of the European Union L 119/43
withdraw the consent on which the treatment is based in accordance with article 6, paragraph 1, letter a), or with article 9, paragraph 2, letter a), and if there is no other legal basis for the treatment;
you object to the processing pursuant to Article 21, paragraph 1, and there is no prevailing legitimate reason to proceed with the processing, or you object to the processing pursuant to Article 21, paragraph 2;
personal data have been unlawfully processed;
personal data must be deleted to fulfill a legal obligation under Union or Member State law to which the data controller is subject;
personal data have been collected in relation to the offer of information society services referred to in Article 8 (1).
The data controller, if he has made personal data public and is obliged, pursuant to paragraph 1, to delete it, taking into account the available technology and implementation costs, adopts reasonable measures, including technical, to inform the data controllers who are being processing the personal data of your request to delete any link, copy or reproduction of your personal data.
Paragraphs 1 and 2 do not apply to the extent that processing is necessary:
for exercising the right to freedom of expression and information;
for the assessment, exercise or defense of a right in court.
Art. 18 - Right to limit the treatment
You have the right to obtain the limitation of the processing from the data controller when one of the following hypotheses occurs:
contest the accuracy of personal data, for the period necessary for the data controller to verify the accuracy of such personal data;
the treatment is unlawful and you object to the deletion of personal data asking instead that its use be limited;
although the data controller no longer needs it for processing purposes, your personal data are necessary for the assessment, exercise or defense of a right in court;
you objected to the processing pursuant to Article 21, paragraph 1, pending verification of the possible prevalence of the legitimate reasons of the data controller with respect to those of the interested party.
If the processing is limited pursuant to paragraph 1, these personal data are processed, except for storage, only with your consent or for the assessment, exercise or defense of a right in court or to protect the rights of another natural or legal person or for reasons of significant public interest of the Union or of a Member State. L 119/44 EN Official Journal of the European Union 4.5.2016 3.
If you have obtained the limitation of treatment pursuant to paragraph 1 you are informed by the data controller before that limitation is lifted.
Art. 19 - Right to obtain notification from the data controller in cases of rectification or cancellation of personal data or cancellation of the same
The data controller informs each of the recipients to whom the personal data have been transmitted of any corrections or cancellations or limitations of the processing carried out pursuant to Article 16, Article 17, paragraph 1, and Article 18, unless this proves impossible or involves a disproportionate effort. The data controller informs you of these recipients if you request it.
Art. 20 - Right to portability
You have the right to receive in a structured format, commonly used and readable by an automatic device, the personal data concerning you provided to a data controller and you have the right to transmit these data to another data controller without impediments by the holder of the treatment to which you provided them if:
the processing is based on consent pursuant to article 6, paragraph 1, letter a), or to article 9, paragraph 2, letter a), or on a contract pursuant to article 6, paragraph 1, letter b) ;
the treatment is carried out by automated means.
In exercising your rights regarding data portability pursuant to paragraph 1, you have the right to obtain the direct transmission of personal data from one data controller to another, if technically feasible.
The exercise of the right referred to in paragraph 1 of this article is without prejudice to article 17.
The right referred to in paragraph 1 must not infringe the rights and freedoms of others.
Art. 21 - Right to object
You have the right to object at any time, for reasons related to your particular situation, to the processing of your personal data pursuant to Article 6, paragraph 1, letters e) or f), including profiling on the basis of these provisions. The data controller refrains from further processing personal data unless he demonstrates the existence of binding legitimate reasons to proceed with the processing that prevail over your interests, rights and freedoms or for the assessment, exercise or defense of a right in court. If personal data are processed for direct marketing purposes, you have the right to object at any time to the processing of personal data concerning you carried out for these purposes, including profiling to the extent that it is connected to such direct marketing. If you object to the processing for direct marketing purposes, personal data will no longer be processed for these purposes. 4.5.2016 EN Official Journal of the European Union L 119/45 4. The right referred to in paragraphs 1 and 2 is explicitly brought to your attention and is presented clearly and separately from any other information at the latest at the time of the first communication with you. In the context of the use of information society services and without prejudice to Directive 2002/58 / EC, you can exercise your right of opposition with automated means that use technical specifications. If personal data are processed for scientific or historical research purposes or for statistical purposes pursuant to article 89, paragraph 1, you, for reasons connected to your particular situation, have the right to object to the processing of personal data concerning you, unless processing is necessary for the performance of a public interest task.
Art. 22 - Right to refuse the automated process
You have the right not to be subjected to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or which similarly significantly affects your person. Paragraph 1 does not apply if the decision:
is necessary for the conclusion or execution of a contract between you and a data controller;
is authorized by Union or Member State law to which the data controller is subject, which also specifies appropriate measures to protect your rights, freedoms and legitimate interests;
is based on your explicit consent.
In the cases referred to in paragraph 2, letters a) and c), the data controller implements appropriate measures to protect your rights, freedoms and legitimate interests, at least the right to obtain human intervention by the data controller , to express their opinion and contest the decision.
The decisions referred to in paragraph 2 are not based on the particular categories of personal data referred to in Article 9 (1), unless Article 9 (2) (a) or (g) applies, and does not adequate measures are in place to protect your rights, freedoms and legitimate interests.
In this sense you will be able to access your data to:
Check its veracity
Change them if they become inaccurate
Also integrate them with a supplementary declaration
Limit its treatment
Oppose to treatment
The data controller is obliged to respond without unjustified reason.
12. Deletion of data
Kartland Srl in compliance with the corresponding right of access to the interested party, has prepared procedures for which you can request the cancellation without undue delay of your personal data or the limitation of the processing of personal data concerning you for the following reasons:
Because the data are no longer necessary for the purposes for which they were collected
Because you have revoked your consent
Because you object to the treatment
Because the data are treated illegally.
Requests should be sent to email@example.com
In any case, you always have the right to lodge a complaint with the competent supervisory authority (Guarantor for the Protection of Personal Data), pursuant to art. 77 of EU Regulation 2016/679 - GDPR, if you believe that the processing of your data is contrary to the legislation in force.
This privacy statement has been in force since 25.05.2018 and Kartland Srl may modify or update its content.
To this end, please visit the Privacy section to check the updated version.
© Kartland Srl. All Rights Reserved | VAT IT04356430233