a. Browsing data. The computer systems and software procedures used to operate the Site acquire, during their normal operation, some Personal Data whose transmission is implicit in the use of Internet communication protocols. This information is not collected to be associated with identified data subjects, but by its very nature could, through processing and association with data held by third parties, allow users to be identified. This category of data includes the IP addresses or domain names of computers used by users connecting to the Site, the URI (Uniform Resource Identifier) ​​addresses of requested resources, the time of the request, the method used to submit the request to the server, the size of the file obtained in response, the numerical code indicating the status of the server response (successful, error, etc.), and other parameters relating to the user's operating system and IT environment. This data is used solely to obtain anonymous statistical information on the use of the Site and to verify its proper functioning, and to identify anomalies and/or abuse. The data may be used to ascertain responsibility in the event of hypothetical cybercrimes against the site or third parties. Except for this possibility, web contact data is currently not retained for more than 365 days. Data provided voluntarily by the user. Except as otherwise provided in specific information, this Privacy Policy also applies to the processing of data voluntarily entered in the various forms on the Site. With regard to the latter, we ask the user not to enter information that may fall within the category of special categories of personal data pursuant to Article 9 of the Regulation ([…] personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, genetic data, biometric data intended to uniquely identify a natural person, data concerning health or data concerning a natural person's sex life or sexual orientation). Furthermore, if the user decides to leave a review relating to products for sale on the Site, we ask that the user do not enter Personal Data in the review form. c. Data of third parties voluntarily provided by the user. When using some of the Site's Services, the Personal Data of third parties provided by the user to Easy school srl may be processed. In such cases, the user assumes the role of independent data controller, assuming all legal obligations and responsibilities. In this regard, the user fully indemnifies Easy school srl against any dispute, claim, request for compensation for damages resulting from processing, etc., that may be received by Easy school srl from third parties whose Personal Data has been processed through the use of the Site's functions in violation of applicable data protection laws. In any case, if the user provides or otherwise processes third-party Personal Data while using the Site, the user hereby guarantees—assuming all related liability—that such processing is based on an appropriate legal basis pursuant to Article 6 of the Regulation, which legitimises the processing of the information in question. If such third-party data is provided, Easy school srl undertakes to process it to provide the requested Services. d. Personal data relating to tax benefits. If the user requests to benefit from the tax benefits provided by Legislative Decree no. 669/1996 converted into Law no. 30 of 28 February 1997 (Urgent provisions on tax, financial, and accounting matters to complete the 1997 public finance plan), the processing of Personal Data pursuant to Article 9 of the Regulation may occur, and in particular, data relating to your health, in order to assess whether you meet the requirements of the relevant legislation to benefit from the 4% VAT tax relief.. Data processed in interaction with other portals. In addition to completing forms on the Site, users may request certain services and provide Personal Data through their Facebook, Google, and PayPal profiles, for example, for registration on the Site. In these cases, Facebook, Google, and PayPal will automatically send the Personal Data they hold to Easy school srl without the user having to enter it.f. Cookies. Users can block or delete (in whole or in part) technical and functional cookies through their browser's specific settings. However, we inform you that not authorizing technical cookies may make it impossible to use the Site, view its content, and use its services. Disabling functional cookies may result in some services or certain Site features being unavailable or not functioning properly, and users may be forced to modify or manually enter certain information or preferences each time they visit the Site.

Choices made regarding Site cookies will be stored in a dedicated cookie. However, in some circumstances, this cookie may not function correctly: in such cases, we recommend deleting unwanted cookies and blocking their use through your browser's functions.

4. Legal basis and mandatory or optional nature of processing

The legal basis for the processing of Personal Data for the purposes referred to in Sections 3 a, 3 b, and 3 c is Art. 6(1)(b) of the Regulation ("[…] processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract"), as the processing is necessary for the provision of the Services or to respond to your requests. Providing Personal Data for these purposes is optional, but failure to provide it would make it impossible to provide the Services provided through the Site or respond to your requests.

The processing of Personal Data for the purposes described in Section 3 d. constitutes legitimate processing under applicable data protection legislation, which does not require your consent, given the existing relationship with the Data Controller and the fact that the Data Controller is our client. The user may object to the processing of their Personal Data for this purpose both when requesting products and services available on the Site and in subsequent communications from the Data Controller by writing to the contact details indicated in the "Contacts" section of this policy.

The processing carried out for the marketing and profiling purposes described in sections 3 e. and 3 f. is based on the user's consent pursuant to Art. 6(1)(a) ("[...] the data subject has given consent to the processing of his or her personal data for one or more specific purposes"). The provision of Personal Data for these purposes is therefore entirely optional and does not affect the use of the Services. If the user wishes to object to the processing of his or her data for marketing and profiling purposes, he or she may do so at any time by contacting the Data Controller at the contact details indicated in the "Contacts" section of this policy or, where available, via the "User Area" section of the user's reserved area of ​​the Site.

It should also be noted that the processing referred to in section 3 g. It is not performed on Personal Data and therefore can be freely performed by Easy School Srl.

5. Recipients of Personal Data

Personal Data may be shared, for the purposes set out in Section 3 above, with:

a. Parties who typically act as data processors, namely: i) individuals, companies, or professional firms that provide assistance and consultancy to Easy School Srl in accounting, administrative, legal, tax, financial, and debt collection matters relating to the provision of the Services; ii) parties with whom it is necessary to interact for the provision of the Services (e.g., hosting providers); iii) parties delegated to perform technical maintenance activities (including maintenance of network equipment and electronic communications networks); iv) parties delegated to organize and carry out the shipment, delivery, and return of products purchased on the Site (collectively, "Recipients");

b. Persons, entities, or authorities to whom your personal data must be disclosed pursuant to legal provisions or official orders, or to whom your personal data must be disclosed to prevent and/or identify any fraudulent activity or abuse in the use of the Site and the services offered by the Data Controller;

c. Persons authorized by Easy School Srl to process personal data necessary to carry out activities strictly related to the provision of the Services, who have committed to confidentiality or are under an appropriate legal obligation of confidentiality (e.g., Easy School Srl employees); d. Companies operating in the review and/or price comparison sector.

6. Transfer of personal data

The data collected may also be transferred abroad, including outside the European Union, in the forms and ways established by current legislation, ensuring an adequate level of protection in any case. Further information is available from the Data Controller by writing to the contact details indicated in the "Contacts" section of this policy.

7. Data retention

Personal data processed for the purposes referred to in section 3.a. They will be retained for the time strictly necessary to achieve those same purposes. In any case, since the processing is carried out to provide Services, Easy school srl will process the Personal Data for the period permitted by Italian law to protect its interests (Article 2946 et seq. of the Civil Code).

Personal Data processed for the purposes referred to in section 3.b. they will be kept until the time required by the specific obligation or applicable law.

For the purposes referred to in section 3.c., Personal Data will be processed until the user objects to the processing.

For the purposes referred to in section 3.d. and 3.e. your Personal Data will instead be processed, as a general rule, until your consent is revoked. If the user withdraws from the Easy school srl services without having revoked such consent, the data may also be processed after his withdrawal. In any case, this is without prejudice to the possibility for Easy school srl to retain Personal Data for the period of time established and permitted by Italian law to protect its interests (Art. 2947(1)(3) c.c.).

8. Rights of the interested party

The interested party has the right to exercise the rights referred to in the articles. 15-22 of the European Reg. 679/2016. In particular, you have the right to revoke your consent at any time and, upon simple request to the Data Controller, you may request access to the personal data concerning you, receive the personal data provided to the Data Controller and transmit them to another Data Controller without impediments (so-called portability), obtain the updating, the limitation of the processing, the rectification of the data and the cancellation of those processed in breach of current legislation. Requests must be sent in writing to the contact details indicated in the "Contacts" section of this information. In any case, the user always has the right to lodge a complaint with the competent Supervisory Authority (Guarantor for the Protection of Personal Data), pursuant to art. 77 of the Regulation, if you believe that the processing of your Personal Data is contrary to the legislation in force.

9. Contacts

To exercise the above rights or for any other request the user can write to the Data Controller at: privacy@mithos.it.