Privacy & Cookie Policy EN - Mattia Loy

Data Controller

Who processes the data

Dr. Mattia Loy
VAT No. 03763690926
Phone: +39 393 307 1931

For privacy-related communications or to exercise your rights,
you may use the
dedicated contact page.

This notice covers processing connected with use of the website.
Any subsequent professional relationship may involve additional processing
necessary to manage the engagement and comply with contractual,
administrative, tax or legal obligations.

Data processed

What information may be collected

The collection of personal data through mattialoy.it is limited to
information necessary for the operation and security of the website and
information that the user voluntarily chooses to provide.

technical browsing data and server logs;
data provided through contact forms or other contact channels;
professional and business information that may be included in the enquiry;
CVs and educational information in the case of applications or internship requests;
statistical browsing data, where the relevant processing has been permitted by the user;
information connected with preferences expressed through the cookie and consent management system.

Purposes and legal bases

Why data is processed

Website operation and security

IP address, connection date and time, requested resource, browser,
operating system and other technical information necessary for the
provision, maintenance and security of the website may be processed.

Legal basis:
technical necessity for providing the service and the Controller’s legitimate
interest in the security and proper functioning of the infrastructure.

Contact enquiries

If the user contacts the Controller, name, contact details, company or organization,
professional role and any additional information voluntarily provided may be processed.

The data is used to respond to the enquiry, provide information, assess a proposal,
quotation, collaboration or potential professional engagement.

Legal basis:
pre-contractual measures taken at the request of the data subject or,
in other cases, the Controller’s legitimate interest in managing
communications received.

Applications and internships

In the event of an application, contact details, CV, education,
professional experience, university, degree program and information
relating to the requested internship may be processed.

Purpose and legal basis:
assessment of the application and, in the case of a university TPV,
verification of requirements and the possibility of activating the internship,
within the measures requested by the data subject and the legitimate
activities involved in evaluating the application.

Professional relationships

When an engagement results from the initial contact, the necessary data is
subsequently processed to perform the professional relationship,
manage administrative and accounting matters, comply with tax obligations
and protect the Controller’s rights.

Legal basis:
performance of the contract, compliance with legal obligations and,
where necessary, legitimate interest in protecting legal rights.

Provision of data

What information is necessary

Browsing informational pages does not require the voluntary submission
of personal data, except for the processing of technical data necessary
for the website to function.

When the user submits a form or enquiry, fields marked as mandatory
are necessary in order to receive and properly manage the communication.
Failure to provide such information may make it impossible to respond.

Other data is optional and should be provided only when relevant to the enquiry.

The website does not use solely automated decision-making processes
that produce legal or similarly significant effects on the user.

Cookies and tracking technologies

How cookies and similar technologies are managed

The website may use cookies and similar technologies to ensure its operation,
measure use of the pages and, when expressly authorized by the user,
support statistical, advertising or conversion-measurement activities.

Preferences are managed through the consent management system available
on the website. Tools that are not strictly necessary are subject to
the choices expressed by the user through that system.

Rejecting statistical or marketing cookies does not prevent normal browsing
of the pages or use of the website’s essential functions.

Recipients

Who may have access to the data

Personal data is neither sold nor publicly disclosed. Where necessary, it may be
processed, within the scope of their respective functions, by parties involved
in the technical operation of the website, management of communications or
provision of the services used.

hosting and technical infrastructure providers;
providers responsible for website or IT-system maintenance;
providers of form-management and communication services;
Google, in relation to Analytics or other Google services actually used;
advertising or measurement platforms, only when the relevant tools are actually enabled and used in accordance with the preferences expressed by the user;
professionals and consultants where necessary to manage the relationship or comply with legal obligations;
public authorities where required by law.

International transfers

Processing outside the European Economic Area

Some technology providers used by the website may belong to international groups
and may involve processing data outside the European Economic Area.

Where applicable, such transfers must take place in accordance with Chapter V
of the GDPR, on the basis of an adequacy decision by the European Commission
or through other safeguards provided by applicable law, including,
where relevant, Standard Contractual Clauses.

Retention

How long data is retained

Data is retained for the period necessary for the purpose for which it was collected,
taking into account any legal obligations and the need to protect the Controller’s rights.

enquiries that do not proceed:
normally up to 12 months from the last relevant communication;
applications and internship requests:
normally up to 12 months if the relationship is not activated;
professional relationships:
for the duration of the relationship and subsequently for the periods required
by civil, tax and accounting law;
technical data and logs:
for the period necessary for infrastructure security and maintenance;
data processed on the basis of consent:
until consent is withdrawn or the relevant purpose is achieved, subject to any
additional retention periods required by law;
cookie preferences:
for the period necessary to document and respect the choice expressed by the user,
according to the configuration of the consent management system.

Data subject rights

Rights under the GDPR

In the cases and within the limits provided by law, the data subject may request:

access to their personal data;
rectification of inaccurate data;
erasure of data where the conditions are met;
restriction of processing;
objection to processing based on legitimate interests;
data portability where that right applies;
withdrawal of previously given consent, without affecting the lawfulness
of processing carried out before withdrawal.

To exercise these rights, you may use the

dedicated contact page
.

The data subject also has the right to lodge a complaint with the

Italian Data Protection Authority
.

Security

Data protection

The Controller adopts reasonable and proportionate technical and organizational
measures to reduce the risks of loss, misuse, unauthorized access,
disclosure or alteration of personal data.

Users are asked not to provide, through ordinary contact channels, unnecessary data,
particularly sensitive information or third-party personal data that is not relevant to the enquiry.

External websites and services

Links to third-party services

Pages on mattialoy.it may contain links to websites, social networks, videos,
platforms or other services managed by third parties. When the user chooses
to open those links, subsequent data processing is governed by the terms
and privacy notices of the external provider.

Information on the processing of personal data.