Privacy notice

Data controller

The data controller is Crystallis Srl. For any question about your data you can write to info@crystallis.eu.

What data we process

• Data you send us through the contact form: name, organisation, email address and message text, with any information you choose to add.
• Data you send us by writing to info@crystallis.eu: your address, the content of the message and any attachments.
• Technical browsing data: IP address, date and time, requested page and browser type, which the server records to run the site and protect it.
• Data that protects the form: to limit automated submissions, the site keeps for one hour a non-reversible fingerprint of the IP address a request comes from. Without a secret key that stays on the server, the fingerprint cannot be traced back to the address.

Your message only needs the information we need to reply: please do not include health data or other special categories of data.

Why we process it and on what basis

• To reply to your request and arrange a possible meeting. The basis is your request, which comes before a possible contract (Article 6(1)(b) GDPR), and our legitimate interest in replying to people who write to us (point f).
• To run the site, protect it and prevent abuse. The basis is our legitimate interest in the security of the site (point f).
• To comply with legal obligations and, where needed, protect our rights (points c and f).

We do not use the data for advertising or profiling, and we make no automated decisions.

If you do not give us the data

The form fields are needed to reply to you: without them the request cannot be sent. You can always write to us directly at info@crystallis.eu.

Who sees the data

• The people at Crystallis who are in charge of replying.
• The provider that hosts the website and the email service, which processes the data on our behalf as a processor (Article 28 GDPR).
• Advisers and authorities, only when a law requires it.

We do not sell the data and we do not publish it.

Where the data stays

The website and the email service are hosted on servers in the European Union. We do not transfer the data outside the European Economic Area.

How long we keep it

• Contact requests: 12 months from the last exchange. If the request leads to a contract, the data follows the retention periods of that relationship and of the law.
• IP address fingerprint used to protect the form: one hour.
• Server technical logs: for the period set by the hosting provider for the security of the service.

Your rights

At any time you can ask to access your data, correct it, erase it, restrict its processing, object to processing based on legitimate interest and receive it in a readable format (Articles 15 to 21 GDPR). Just write to info@crystallis.eu: we reply within one month.

If you believe the processing does not comply with the Regulation, you can lodge a complaint with the Italian data protection authority, the Garante per la protezione dei dati personali (www.garanteprivacy.it).

Cookies

The site uses no cookies or other tracking tools: the details are in the cookie policy.

Changes

If the way we process data changes, we update this page and the date at the top.