PrivacyPolicy

Privacy Notice – Personal Data Processing

Pursuant to Article 13 of Regulation (EU) 2016/679 (GDPR)

Website: isidorosystem.com

Last updated: 27/04/2026

1. Data Controller

The data controller for personal data collected through the website isidorosystem.com is:

• Name:Luca Storchi
• Address:Via Lucania n. 22 – 41012 Carpi (MO), Italy
• VAT / Tax ID:03344390368
• Email:info@isidorosystem.com

2. Types of Data Collected and Purposes of Processing

2.1 Browsing data

The systems responsible for operating the website automatically collect certain data whose transmission is implicit in the use of Internet protocols: IP addresses, browser type, operating system, provider name (ISP), date and time of visit, referring and exit pages.

• Purpose:website security, detection of unauthorised access attempts, aggregate statistics.
• Legal basis:legitimate interest of the controller (Art. 6(1)(f) GDPR).
• Retention:no longer than 12 months from collection.

2.2 Data provided via contact form

Sending a message through the contact form results in the acquisition of the data entered by the user (name, email address, subject and message text).

• Purpose:responding to user requests.
• Legal basis:performance of pre-contractual measures at the request of the data subject (Art. 6(1)(b) GDPR).
• Retention:24 months from the last contact, unless required by law.

2.3 Newsletter subscription data

Users who subscribe to the newsletter provide their email address. The service is managed throughMailchimp(The Rocket Science Group LLC, USA). Data transfer is governed by the Data Processing Agreement with Mailchimp and the EU–US Data Privacy Framework.

• Purpose:sending commercial and informational communications about products and services.
• Legal basis:explicit consent of the data subject (Art. 6(1)(a) GDPR).
• Retention:until consent is withdrawn.

Users may unsubscribe at any time via the link in each email or by writing to info@isidorosystem.com.

2.4 E-commerce data(section active upon service launch)

Upon activation of online sales, the website will collect the data necessary for order fulfilment: first name, last name, shipping/billing address, email address, phone number. Payment data will be handled exclusively by the chosen payment provider (e.g. Stripe, PayPal) and will never be stored by the controller.

• Purpose:execution of the sales contract, order management, tax compliance.
• Legal basis:performance of contract (Art. 6(1)(b) GDPR) and legal obligation (Art. 6(1)(c) GDPR).
• Retention:10 years for tax documents; 2 years for customer account data.

This section will be updated with full details of data processors (payment providers, couriers, etc.) before the e-commerce launch.

3. Cookies and Tracking Tools

3.1 Technical cookies

These cookies are necessary for website operation and navigation. They do not require consent. They include session cookies (deleted when the browser is closed) and persistent cookies to save user preferences.

3.2 Analytical cookies – Google Analytics 4

The website usesGoogle Analytics 4(Google Ireland Ltd / Google LLC, USA) to collect aggregate information about website usage (pages visited, session duration, geographic origin). Data may be transferred to the USA in compliance with the EU–US Data Privacy Framework and Standard Contractual Clauses.

• Legal basis:user consent (Art. 6(1)(a) GDPR).
• Opt-out:tools.google.com/dlpage/gaoptout
• Google Privacy:policies.google.com/privacy

3.3 Profiling cookies – Meta Pixel (Facebook/Instagram)

The website uses theMeta Pixel(Meta Platforms Ireland Ltd / Meta Platforms Inc., USA) to measure the effectiveness of advertising campaigns and, subject to consent, to show personalised ads on Meta platforms. Data may be transferred to the USA in compliance with the EU–US Data Privacy Framework.

• Legal basis:explicit consent of the user (Art. 6(1)(a) GDPR).
• Manage Meta preferences:facebook.com/ads/preferences
• Meta Privacy:facebook.com/privacy/policy

3.4 Tracking cookies – Google Ads / Google Tag Manager

The website usesGoogle Tag ManagerandGoogle Ads(Google Ireland Ltd / Google LLC, USA) for conversion tracking and centralised tag management. Data may be transferred to the USA in compliance with the EU–US Data Privacy Framework.

• Legal basis:explicit consent of the user (Art. 6(1)(a) GDPR).
• Manage Google Ads:adssettings.google.com

3.5 Cookie consent management

On first access to the website, a banner is shown through which the user can accept, reject or customise the use of non-technical cookies. Consent can be withdrawn or modified at any time via the dedicated tool in the website footer.

To manage cookies directly from your browser:

• Chrome
• Firefox
• Safari
• Internet Explorer / Edge
• Opera

3.6 Social network plugins

The website may contain sharing buttons for Facebook/Instagram and WhatsApp. Plugins are configured not to set cookies before the user’s explicit consent. For the respective social media privacy policies:

• Facebook – Cookie Policy
• WhatsApp – Cookie Policy

4. Data Processors (Art. 28 GDPR)

The controller uses external data processors for the provision of certain services. The main ones are:

• Mailchimp(The Rocket Science Group LLC, USA) – newsletter service
• Google Ireland Ltd– Google Analytics 4, Google Ads, Google Tag Manager
• Meta Platforms Ireland Ltd– Meta Pixel
• Hosting provider– [insert provider name and registered address]

A data processing agreement pursuant to Art. 28 GDPR has been signed with each processor. The full list of processors is available upon request by writing to info@isidorosystem.com.

5. Transfer of Data to Third Countries

Some service providers used (Google, Meta, Mailchimp) are based in the United States. Data transfers are carried out in compliance with Regulation (EU) 2016/679, on the basis of the EU–US Data Privacy Framework (European Commission adequacy decision of 10 July 2023) and/or Standard Contractual Clauses (SCC) approved by the European Commission.

6. Rights of the Data Subject (Arts. 15–22 GDPR)

Users have the right to:

• Access(Art. 15): obtain confirmation of processing and a copy of their data.
• Rectification(Art. 16): correct inaccurate or incomplete data.
• Erasure(Art. 17): obtain deletion of data (right to be forgotten), where applicable.
• Restriction(Art. 18): request restriction of processing in certain cases.
• Portability(Art. 20): receive data in a structured, machine-readable format.
• Objection(Art. 21): object to processing based on legitimate interest or for direct marketing purposes.
• Withdrawal of consent(Art. 7): withdraw consent at any time, without affecting the lawfulness of processing carried out prior to withdrawal.

Requests may be sent to:info@isidorosystem.com

If the response is considered unsatisfactory, users have the right to lodge a complaint with the competent supervisory authority. For users in Italy:Garante per la Protezione dei Dati Personali(www.garanteprivacy.it).

7. Minors

This website is not intended for children under 14 years of age. Pursuant to Art. 8 GDPR, the processing of data of children under 14 requires the consent of their parents or legal guardians.

8. Data Security

The controller implements appropriate technical and organisational measures to ensure the security of personal data, protecting it from unauthorised access, disclosure, accidental modification or destruction, in accordance with Art. 32 GDPR.

9. Changes to This Notice

This privacy notice may be updated following regulatory changes or the introduction of new services. Previous versions will remain available on this page. Users are encouraged to check periodically for any updates.

This notice is published at:https://www.isidorosystem.com/en/privacy-policy/