Privacy information pursuant to article 13 of European Regulation 679/16 (GDPR)

Agreement

Lenake, a brand of Caracci Emanuele, ardently undertakes to keep the personal data of its customers, or of those possibly entrusted to it by third parties.
The same sole proprietorship strictly adopts safeguard policies in accordance with the regulations in force in Italy.

Holder of the treatment
Emanuele Caracci.
CF CRCMNL95C22H501Y, Telephone 06/9499752, E-mail [email protected]

DPO (Data Protection Officer)

Lenake In compliance with article 37 of the GDPR, the Data Protection Officer (DPO – Data Protection Officer) has been communicated electronically to the guarantor of privacy, who can be found at the contacts below:
E-mail: [email protected]

Via Prenestina 704, 00155, Rome (RM) Purpose of the treatment

Pursuant to article 6, paragraph b) and c) of the GDPR, the nature of Lenake’s treatment consists purely of the commercial relationship formed by the sale and provision of web services.
Your data will be used for:

1. execute the activation and maintenance / update of the subscribed service;

2. carry out the obligations established by current laws or regulations;

3. protect Lenake’s rights in court;
4. send technical, administrative or informative material

   commercial;

Lenake absolutely guarantees that data considered “special data” in the GDPR are not used.

Processing methods

The data will mainly be processed on electronic and IT media, and contextually stored on any type of medium deemed suitable.

Lenake will actively undertake to ensure that all the security measures provided for by law, in this case, ISO 27001 certification are applied in order to guarantee full execution in the operations best described and envisaged by art 4, II paragraph of the GDPR.

Consecutive refusal to treatment

In case of failure to enter one or more data considered mandatory for the purpose of providing the requested service, it will be impossible to continue with the activation of the service.

Disclosure of personal data to third parties

The personal data connected to the treatment in question may be communicated to subjects to whom the law recognizes full faculty of access to personal data, in accordance with primary, secondary and / or community regulations in force. They can also be communicated to Lenake suppliers for the sole purpose of providing the service indicated in the list below.

1. NIC – .it domain registry, for the provision of .it domain registration / transfer service;
2. EURID – .eu domain registry, for the provision of .eu domain registration / transfer service;

3. OpenSRS, ENOM and InternetBS – for the provision of the registration / transfer service for gTLD domains, SSL certificates, goMobi;
4. EPAG – for the provision of the registration / transfer service of the ccTLD and trust service domains;
5. Aruba SpA – for the provision of certified mail services;
6. Acronis – for the provision of Acronis Backup services;
7. Google Drive – for remote storage of backups extrapolated to

   agreement with GDPR policies;

8. Brixly – for the provision of server infrastructures, reseller hosting plans et

   similar to.

9. Defensive / defensive colleges – following a formal request accompanied by an act

   defensive investigations;

10. Judicial authorities – following a formal request accompanied by a decree

acquisition court issued by PM (public prosecutor).

In case of registration of new domain names, the data of the domain owner will be transmitted electronically via specific portals to the Authorities in charge of the TLD, chosen GTLD. Also for the registration of PEC mailboxes (certified electronic mail), the data of the holder of the aforementioned mailboxes will be promptly transmitted electronically by means of special portals to the accredited provider of the PEC service, Aruba SpA

Localization of data

Personal data will be processed both within the member states and outside the member states except for the data necessary for the registration of a new domain name gTLD, ccTLD, due to their nature for which the provision is expected of the aforementioned services predominantly outside the member states.

Temporal conservation

Pursuant to current “Data Retention” regulations, personal accounting / administrative data will be kept for a period not exceeding that envisaged (10 years). A cancellation request will not have any effect since the retention of fiscal documents prevails.

Personal data processed for newsletter / marketing purposes will be kept until our correspondence request for cancellation is received.

The personal data necessary for the provision of the service will be kept until we receive a cancellation request from our correspondence.

All personal data may also be saved in remote backup copies on Google Drive company accounts (Gsuite) for up to thirty days.

Profiling of data

In compliance with the guidelines provided by the GDPR and individual freedom, the data provided to us will not be included in solely automated decision-making processes, including profiling, which generate legal effects that concern you or that can significantly affect it in a similar way.

Individual rights

In relation to your personal data processed, please note that you have the senses of art 7 of the Legislative Decree 196/03, art 14 and subsequent of the GDPR you can
exercise the following rights:

a) Right to obtain access to personal data and the following information: Confirmation that the processing of personal data is in progress; The purposes of the treatment;
The categories of personal data;

The recipients or categories of recipients to whom the personal data have been or will be communicated;

If the data are not collected from the data subject, all information available on their origin;

The existence of an automated decision-making process, including profiling;

A copy of the personal data being processed.

b) Right to rectification and integration of personal data;

c) Right to erasure of data if one of the following reasons exists:

Personal data are no longer necessary with respect to the purposes for which they were collected or otherwise processed;

The interested party revokes consent to the processing of data and there is no other legal basis for the processing;

The interested party opposes the treatment and there is no prevailing legitimate reason to proceed with the treatment;

Personal data have been unlawfully processed;

Personal data must be deleted to fulfill a legal obligation under Union or Member State law to which the data controller is subject. If the data controller has made personal data public and is obliged to delete it, he must inform the other data controllers who process the personal data of the request to delete any link, copy or reproduction of his data.

d) Right to limitation of processing in the event that:

The interested party disputes the accuracy of personal data, for the period necessary for the data controller to verify the accuracy of such personal data;

The treatment is unlawful and the interested party opposes the cancellation of personal data and instead requests that their use be limited;

Although the data controller no longer needs it for processing purposes, personal data are necessary for the interested party to ascertain, exercise or defend a right in court;

The interested party opposed the treatment, pending verification of the possible prevalence of the legitimate reasons of the data controller with respect to those of the interested party.

e) Right to portability of the data concerned or the right to receive in a structured format, commonly used and readable by an automatic device, the personal data that o concern supplied to a data controller and possibly transmit them to another data controller, if the processing is based on consent or on a contract and is carried out by automated means. Where technically possible, the interested party has the right to obtain the direct transmission of data from one data controller to another;

f) Right to object at any time to the processing of personal data, including profiling, in particular in the event that: i
The processing takes place on the basis of the legitimate interest of the owner, subject to an explanation of the reasons for the opposition;

g) Right not to be subjected to a decision based solely on automated processing, including profiling, except in cases where the decision is necessary for the conclusion and execution of a contract between the interested party and a data controller, both authorized by Union or Member State law to which the data controller is subject or based on the explicit consent of the data subject;

h) Right to lodge a complaint with the Guarantor for the protection of personal data, following the procedures and indications published on the official website of the Authority;

• WHOIS domain information

In the event that a request for registration of a new domain name is generated, the applicant’s data will be transmitted electronically via portals to the competent authorities, responsible for registering new domain names. Once communicated, these data will be visible publicly within the WHOIS provided by the registering body.

• Disputes

You can lodge a complaint by contacting the Italian Guarantor for the protection of personal data through this link https://www.garanteprivacy.it/home/footer/contatti.