Privacy notice

This notice explains how Druido Eventi S.r.l., through its business unit MPSH, processes the personal data collected through the TARGA website and service, in accordance with Regulation (EU) 2016/679 ("GDPR") and the Italian Personal Data Protection Code (Legislative Decree 196/2003, as amended by Legislative Decree 101/2018).

1. Controller

The controller is Druido Eventi S.r.l., VAT and tax code 04137511202, registered office at Via Rizzoli 4, 40125 Bologna (BO), Italy (the "Provider"). For any request about personal data you can write to info@mattiazucchini.com or by certified email (PEC) to druidoeventisrl@pecconfesercentibo.it.

The Provider has not appointed a Data Protection Officer, because the conditions of Art. 37 GDPR do not apply: it does not carry out regular and systematic monitoring of data subjects on a large scale, nor does it process special categories of data. Requests are handled directly by the controller at the contacts above.

2. Scope: when we are controller and when processor

The Provider is the controller of the processing relating to website visitors, people who contact us, customers and their users for the management of the account, invoicing and support.

For the personal data that customers (manufacturers) enter into the service or collect through the public pages of their serial numbers, for example the data of people who request a paper copy of the instructions or the data of their customers linked to serial numbers, the controller is the manufacturer customer and the Provider acts as processor under Art. 28 GDPR, according to the data processing agreement. For this processing, data subjects can contact the manufacturer shown on the serial number page directly.

3. Data processed

• Browsing data: IP address, date and time of the request, page visited, browser type, recorded in the server's technical logs for security and operation.
• Website visit statistics: we use Umami, a statistics tool installed on our own servers, which uses no cookies, does not store the IP address and does not follow users across websites. It records in aggregate form the pages visited, referring site, country, device type and browser, to understand which pages are useful. No data is shared with third parties.
• Google Search Console: we use Google's tool to check how the site appears in search results. Google only gives us aggregate search data (queries, impressions, clicks); the site does not send visitor data to Google or set Google cookies.
• Contact and partner application forms: name, email, company, phone and the content of the message.
• Account data: name, email, password (stored only as a hash), role, company, access data and the log of activities performed in the service.
• Data for managing the relationship: aggregate and billing data of the customer (company data, plan, subscription status, usage counts) and the strictly necessary user data (name, email, role, date of last access). The Provider does not access the content uploaded by customers without their authorisation (see section 6).
• Billing data: company name, VAT number, address, e-invoicing recipient code or PEC, payment data. Payment card data is processed directly by Stripe and is not stored by the Provider. Stripe Payments Europe, Ltd. (Ireland) acts as an independent controller under its own privacy notice, including for its own legal obligations (anti-money laundering and fraud prevention).
• Public page data: for each opening of a public page and each PDF download we record only the serial number, the language, the approximate country (derived from browser settings or the network provider) and the time, to provide statistics to the customer. The IP address and user agent are not kept for statistics; the IP address is used only temporarily to limit abuse of the forms. People who confirm receipt of the instructions may leave their name and company if they wish: this data is processed on behalf of the manufacturer as proof of delivery of the instructions. People who subscribe to safety notices and updates for a machine leave their email address, which is used only after confirmation through the link received (double opt-in) and only to send the notices published by the manufacturer for that machine; every email contains an unsubscribe link. For notices we record the sending of the emails and, if the recipient gives it, the read confirmation with date and time. People who report a safety problem may leave a contact if they want to be called back. This data is processed on behalf of the manufacturer, to manage safety notices and reports about its products.
• Machine owner area: the company using a machine can register it to keep the maintenance log, the inspection schedule and the inspection file. We process the company name, address, the contacts of the health and safety officer, the email addresses of the people with access (who log in with a link by email, without a password) and the records entered. This data is processed on behalf of the owner company and only to provide the service: access, email reminders of deadlines and generation of the file. The machine manufacturer only sees the company name, registration date, the location given and the next deadlines, not the maintenance log. Operations are recorded in the audit log with the email address of the person who performs them. The company can ask at any time for its data to be deleted by writing to info@mattiazucchini.com.

4. Purposes and legal bases

We do not carry out profiling or send promotional communications without consent. We do not sell personal data to third parties.

5. Whether providing data is mandatory

Providing the data marked as mandatory in the forms is necessary to reply to the request or provide the service. Without it we cannot follow up the request.

6. How data is processed and security

Data is processed electronically with appropriate technical and organisational measures: encrypted communications (HTTPS), passwords stored as hashes, role-based access control, audit log, regular backups, servers located in the European Union.

Support access. The Provider does not access the content uploaded by the Customer (manuals, text blocks, models, serial numbers and related documents), except as set out below. The Provider's support staff access the Customer's content only with the Customer's express authorisation, granted by a user with the owner or administrator role from Settings > Support, or by approving a specific, reasoned request from the Provider. The authorisation is time-limited (4, 24 or 72 hours), can be revoked at any time with immediate effect and allows viewing only, without the possibility of modifying, publishing or deleting data.

Every support access (grant, start of session, each page viewed, closing and revocation) is recorded, with date, time and the name of the operator, in the Customer's activity log, which the Customer can consult and which cannot be modified, and in an internal log of the Provider that also cannot be modified. The Provider's administration accounts are protected by mandatory two-factor authentication and each of their actions is recorded in a log chained with cryptographic fingerprints, kept for the duration of the contract and the following 10 years.

7. Recipients and processors

Data may be disclosed to providers acting as processors on behalf of the Provider, bound by contract under Art. 28 GDPR, to advisers (accountant, lawyer) and to the authorities when required by law. The main providers are:

Service emails (invitations, notifications, notices, receipts of paper requests) are sent from a mail server run directly by the Provider, without third-party providers. Visit statistics (Umami) also run on the Provider's servers.

The data necessary for payments is disclosed to Stripe Payments Europe, Ltd., which processes it as an independent controller. For customers working through a partner firm, account data may be visible to the partner firm authorised by the customer.

8. Transfers outside the European Union

Machine translation and completeness checks of the manual texts are performed through the APIs of Anthropic, PBC, based in the United States. The texts sent are technical content of the manuals; the service is designed not to send personal data, but a text entered by the customer might contain some. The transfer is based on the Standard Contractual Clauses adopted by the European Commission (Art. 46 GDPR), included in Anthropic's data processing agreement. Under Anthropic's commercial terms, data sent through the API is not used to train the models and is kept only for a limited period, normally no longer than 30 days, for security and abuse prevention. Stripe, as an independent controller, carries out any transfers to the United States with the safeguards set out in its own privacy notice (EU-US Data Privacy Framework and Standard Contractual Clauses).

9. Retention period

• Contact requests not followed by a contract: 24 months from the last contact.
• Account data: for the duration of the contract and for 12 months after it ends, except as set out below.
• Accounting and tax documents: 10 years, as required by law.
• Server technical logs: 6 months, unless needed to investigate wrongdoing.
• Visit statistics (Umami): 24 months, in aggregate form.
• Backups: deleted data remains in the backups until they rotate, at most 30 days.
• Audit log: for the retention period of the published documents it refers to.
• Log of the actions of the Provider's administrators and of support accesses: duration of the contract plus 10 years.

10. Your rights

You can ask at any time for access to your data, rectification, erasure, restriction of processing, portability, and object to processing based on legitimate interest (Arts. 15-22 GDPR), by writing to info@mattiazucchini.com. We reply within one month of the request.

You also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, www.garanteprivacy.it) or with the supervisory authority of the Member State where you live or work.

11. Cookies

The site uses only technical cookies: the session cookie needed to access the reserved area and the machine owner area, and a cookie that remembers the language you chose. Visit statistics are collected without cookies. Details in the cookie policy.

12. Changes

We may update this notice. The version in force is always published on this page with the date of update. In case of significant changes we inform customers by email.