1. Data controller
The data controller is PANTA RAY S.r.l., with registered office at Viale Angelo Filippetti 26, 20122 Milan, Italy, tax code and VAT number 06451450966 (hereinafter “PANTA RAY” or the “Controller”).
For any questions about this notice or to exercise your rights, you can write to info@pantaray.eu.
The Controller has not appointed a Data Protection Officer (DPO), as the conditions of Article 37 GDPR do not apply.
2. What data we process
- Browsing data. The systems that run the website automatically collect certain data whose transmission is implicit in the use of Internet protocols: IP address, browser type and operating system, address of the requested page, date and time of the request, server response code. This data is not collected to identify you.
- Data you provide through the contact form. Name, email address and the content of your message.
- Data you send us by email. If you write to us directly, we process your email address and any data you choose to include in the message and any attachments.
- Newsletter subscription. The email address entered in the subscription forms is sent directly to Substack, the platform that manages the “Tutto Scorre” newsletter.
- Reports. If you submit a report under our Code of Ethics or our Anti-Corruption Policy, we process the data contained in the report, which may also concern other people.
Please do not include special categories of data in your messages (for example data concerning health, political opinions or religious beliefs) unless strictly necessary. If you do, we will process them only to the extent essential to respond to your request.
3. Why we process it and on what legal basis
- To run the website and keep it secure, including to detect and prevent abuse or cyber attacks. Legal basis: the Controller’s legitimate interest (Article 6(1)(f) GDPR).
- To respond to your requests sent through the contact form or by email. Legal basis: steps taken at your request prior to entering into a contract (Article 6(1)(b) GDPR) or, for general enquiries, the Controller’s legitimate interest in replying to those who contact it (Article 6(1)(f) GDPR).
- To send you the newsletter. Legal basis: your consent (Article 6(1)(a) GDPR), which you can withdraw at any time using the link in every email, without affecting the lawfulness of processing carried out before withdrawal.
- To handle reports of breaches of the Code of Ethics or the Anti-Corruption Policy, protecting the confidentiality of the person reporting. Legal basis: the Controller’s legitimate interest in preventing and combating unlawful conduct (Article 6(1)(f) GDPR).
- To comply with legal obligations or requests from the competent authorities. Legal basis: legal obligation (Article 6(1)(c) GDPR).
- To establish, exercise or defend legal claims, including in the event of improper use of the website. Legal basis: the Controller’s legitimate interest (Article 6(1)(f) GDPR).
4. How we process it
Data is processed electronically, in accordance with the principles of lawfulness, fairness, transparency, data minimisation and storage limitation, and with appropriate technical and organisational measures to protect it from unauthorised access, loss or disclosure.
We do not make decisions based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you.
5. How long we keep it
- Browsing data: for limited periods, according to the hosting provider’s technical settings, unless needed to investigate offences or abuse.
- Contact requests and correspondence: for as long as needed to handle them and up to 24 months from the last exchange. If the request leads to a contractual relationship, data is kept for the duration of the relationship and for the following 10 years, as required by Italian civil and tax law.
- Newsletter: until you unsubscribe.
- Reports: for as long as needed to handle them and in any case no longer than 5 years from notification of the final outcome.
- In the event of a dispute, data may be kept for the entire duration of the proceedings and until the deadlines for appeal have expired.
6. Who we share it with
Data is not disseminated. Within PANTA RAY it is accessible only to personnel authorised to process it who need it for their duties (administration, sales, legal, systems administration), and who are bound by confidentiality.
It may also be processed on behalf of the Controller by the providers that help us run the website and related services, appointed as data processors under Article 28 GDPR:
- Vercel Inc.: website hosting;
- Resend: delivery to PANTA RAY of the emails generated by the contact form;
- Microsoft (Microsoft 365): management of the company mailbox that receives the messages;
- Behold: display of the latest posts from our Instagram profile on the home page. To load the images, your browser shares your IP address with Behold’s servers.
Substack Inc., which manages the newsletter, also processes subscribers’ data as an independent controller, under its own privacy policy.
Finally, data may be disclosed to advisers and professionals (for example legal and tax advisers) bound by professional secrecy, and to authorities that make a lawful request.
The up-to-date list of data processors can be requested at any time by writing to info@pantaray.eu.
7. Transfers of data outside the European Union
Some of the providers listed are based, or use infrastructure, outside the European Economic Area, in particular in the United States. In these cases data is transferred only with the safeguards required by the GDPR: an adequacy decision of the European Commission, such as the EU-US Data Privacy Framework for providers certified under it (Article 45 GDPR), or the Standard Contractual Clauses approved by the Commission (Article 46 GDPR).
You can request information on the safeguards adopted by writing to info@pantaray.eu.
8. Your rights
You can exercise the rights provided by Articles 15–22 GDPR at any time:
- access to your data and to information about its processing;
- rectification of inaccurate or incomplete data;
- erasure of data, in the cases provided by law;
- restriction of processing;
- portability of the data you have provided to us, where applicable;
- objection to processing based on legitimate interest, on grounds relating to your particular situation;
- withdrawal of consent, without affecting the lawfulness of processing based on consent before its withdrawal.
To exercise them, write to info@pantaray.eu. Requests are free of charge and will be answered without undue delay and in any case within one month, which may be extended by two months for more complex cases. To protect your data, we may ask you to confirm your identity.
If you believe that the processing breaches the law, you have the right to lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it) or to bring legal proceedings.
9. Provision of data
Providing data in the contact form is optional, but without it we cannot respond to your request. Alternatively, you can write to us directly at info@pantaray.eu. Browsing data is necessary for the website to function.
10. Minors
The website is aimed at organisations and professionals and is not intended for people under 18. We do not knowingly collect data from minors.
11. “Do Not Track” requests
This website does not respond to “Do Not Track” requests sent by browsers. To find out whether the connected third-party services honour them, please see their respective policies.
12. Cookies
For information on cookies and similar technologies, please see the Cookie Policy.
13. Changes to this notice
This notice may be updated, for example following changes in the law or the introduction of new services. The version in force is always published on this page, with the date of the last update shown at the top.
This English version is provided for convenience. In the event of any discrepancy, the Italian version prevails.