Privacy Policy

pursuant to Article 13 of Regulation (EU) 679/2016 - GDPR

General Information

In compliance with the obligations deriving from national legislation - Legislative Decree June 30, 2003 no. 196, coordinated with the text of Legislative Decree 101/2018, and the obligations deriving from EU legislation - GDPR Regulation EU no. 679/2016 – the User is required to read this information to understand the methods of processing personal data.
The document provides evidence of the nature of the personal data collected and the purposes of processing, indicating the rights of the user in relation to the data processed. This information is provided only for the Site www.plottybot.com and not for third-party websites that may be accessible through hyperlinks (links) contained on the Site.

Data Controller

The data controller is Surf Publishing S.r.l. (hereinafter “Controller”), with its registered office at Via Rignano 17/B - 52011 - Bibbiena (AR) – VAT 02485200519 - REA AR 220177 - Share Capital €10,000 - Email: (insert company email address) -

Types of Data Processed

Only the personal data necessary for the use of the Website and its functionalities will be processed and collected. In particular, the following will be processed:
Browsing data: the set of data from the computer systems and software procedures necessary for the operation of the Website, used to gather anonymous statistical information about the use of the site and to manage the proper functioning of the Website, expressly excluding any profiling activity;
Data voluntarily provided by the User: First name, Last name, residence address, Tax Code, Email address as well as any other information entered in the contact or registration forms present on the Site. The data provided by the user may be acquired and stored by the Controller, even electronically, for the purposes related to their collection through the Site and will not be used for profiling or direct marketing activities.
No special categories of personal data (such as those revealing racial, ethnic origin, political opinions, religious beliefs) will be processed through our services. Our services are not aimed at minors, and the collection or storage of such data is not part of our policies.

Purpose of Processing

The user's personal data is collected and processed for the following purposes:
Respond to requests sent via the contact forms.
Manage and improve the operation of the site.
Fulfill any contractual obligations.
Customize the user experience and provide relevant content.
Comply with legal obligations.

Legal Basis for Processing

The processing of personal data is based on the following legal bases:
The execution of a contract or pre-contractual measures.
The legitimate interest of the Controller.

Processing Methods

In compliance with what is provided for by GDPR Regulation EU no. 679/2016 - art. 4 no. 2), the processing of personal data is carried out through electronic or manual tools, in accordance with the principles of fairness, legality, transparency, and protection of confidentiality. Security measures are adopted to prevent data loss, unlawful or improper use, and unauthorized access.

Data Retention Period and Deletion of Information

The data controller will retain and process personal information for no longer than is necessary to achieve the purposes for which they were collected and in accordance with the periods provided by applicable laws and related regulations.
Personal data will, in any case, be processed lawfully, fairly, and transparently, protecting the confidentiality and rights of the user.
The information and personal data collected will be deleted when they are no longer necessary for the purposes for which they were originally collected.
Compliance with applicable legal provisions at the time of deletion will be ensured.
In any case, the user can send a request to the Controller to have their data deleted, either by registered letter or certified email.

Access, Sharing, and Communication of Data

Personal data will not be published, disclosed, exhibited, or made available to and/or consulted by unspecified subjects, transferred, or otherwise provided to third parties for unlawful purposes or unrelated to the purposes of collection and, in any case, without providing suitable information to the interested parties and obtaining their consent, where required by law.
The data collected may be made accessible, for the purposes referred to in point 3 of this Privacy Policy, to:
Employees and/or collaborators of the Controller, in their capacity as persons in charge and/or external processors and/or system administrators;
Compliance with legal obligations.
Technical or cloud service providers.
The data will not be shared with third parties for marketing purposes without the explicit consent of the user.

Data Transfer

The Data Controller undertakes not to transfer the data to non-EU countries. In the event that it becomes necessary to transfer data to non-EU countries, the data transfer will be carried out in accordance with applicable laws, after signing contractual clauses and performing the standard checks provided by the European Commission.

Rights of the Data Subject and Methods of Exercise

In relation to personal data, the user has the right to:
-Obtain confirmation of the processing of personal data and request a copy thereof;
-Request the updating, integration, or correction of personal data considered inaccurate or incomplete;
-Request the deletion of personal data or limit its use;
-Revoke consent to the processing of personal data (to the extent that the processing is based on consent);
-Receive a copy of your personal data in a structured, commonly used format and transmit it to a third party (to the extent that the processing is based on consent or a contract);
-Object to the processing of personal data;
-Data portability, i.e., to receive a copy of personal data processed based on the user's consent and to obtain the transmission of personal data to another controller, if technically feasible;
-File a complaint with the data protection authority or legal action before the judicial authority.
In the event of the transfer of personal data to a third country or an international organization, the data subject/user has the right to be informed of the existence of adequate guarantees pursuant to Article 46 of the EU Regulation regarding the transfer.
The data subject has the right to request a copy of the personal data being processed, subject to a request addressed to the Data Controller.
In case of requests for additional copies, the Data Controller may charge a fee based on administrative costs. If the access request is made by electronic means, unless otherwise indicated by the data subject, the requested information will be provided in a commonly used electronic format. In any case, the right to obtain a copy of the personal data being processed must not affect the rights and freedoms of others.
The User may, at any time, exercise the right to revoke any consent already given without affecting the lawfulness of the processing based on the consent given before the revocation.
The User, at any time, including for the purpose of exercising all the rights listed above, may contact the Data Controller by sending communication via email to: “Insert company email address”.

Changes to the Privacy Policy

The introduction of new sector regulations and the constant review and updating of the services offered may necessitate changes to the methods of processing personal data. This privacy policy, therefore, may be subject to changes over time. It is the responsibility of the User to periodically consult this page and check the date of revision of the policy. The new modified or updated policy will apply from the date of revision.

Forms and Useful Links

Code regarding personal data protection

General Data Protection Regulation – Reg. EU 2016/679 (GDPR)

Form for exercising rights in matters of personal data protection

Complaint form and how to submit it to the authority

FAQs on exercising rights of appeal