Privacy and Cookie Policy - GEMSTONE CHARTER

Cookie Policy

Effective Date: 28-Feb-2025
Last Updated: 28-Feb-2025

What are cookies?

How do we use cookies?

Types of Cookies we use

Manage cookie preferences

You can change your cookie preferences any time by clicking the above button. This will let you revisit the cookie consent banner and change your preferences or withdraw your consent right away.

In addition to this, different browsers provide different methods to block and delete cookies used by websites. You can change the settings of your browser to block/delete the cookies. Listed below are the links to the support documents on how to manage and delete cookies from the major web browsers.

Chrome: https://support.google.com/accounts/answer/32050

Safari: https://support.apple.com/en-in/guide/safari/sfri11471/mac

Firefox: https://support.mozilla.org/en-US/kb/clear-cookies-and-site-data-firefox?redirectslug=delete-cookies-remove-info-websites-stored&redirectlocale=en-US

Internet Explorer: https://support.microsoft.com/en-us/topic/how-to-delete-cookie-files-in-internet-explorer-bca9446f-d873-78de-77ba-d42645fa52fc

If you are using any other web browser, please visit your browser’s official support documents.

Privacy Policy

Privacy Policy under Article 13 of Regulation (EU) 2016/679

This Privacy Policy explains how we collect, use, and protect your personal data under Regulation (EU) 2016/679 (“GDPR”). It also outlines your rights regarding your data. We may update this policy if you request additional services or require further processing.

Data Controller

Duepuntozero Charter S.r.l., based at Via Argine Destro Annunziata 43 – Reggio Calabria (RC) 89122, is responsible for processing your data. You can contact us at e-mail: gemstone@duepuntozero.ne.

What data we collect

We may process the following types of personal data:

Personal details (e.g., name, surname, date of birth, address);
Contact information (e.g., phone number, e-mail address);
Technical and browsing data (e.g., IP addresses, domain names);
Cookie data (if you consent to cookies beyond those necessary for website operation).

Who this policy applies to

This policy applies to: Website visitors and users, Potential clients, Clients

Why We Process Your Data and How Long We Keep It

Purposes, Legal Basis, and Retention Periods

Purposes	Legal Basis	Retention Period
Processing is essential to ensure the proper functioning and usability of the website for users. This includes, but is not limited to, session management, traffic monitoring to optimize site performance, ensuring appropriate response times, and resolving system errors.	Legitimate interest of the data controller (Article 6(1)(f) GDPR).	Until the end of the browsing session or for the period strictly necessary to achieve this purpose, except where required for legal investigations by judicial authorities.
Processing is necessary for the use of cookies and similar technologies. See the Cookie Policy available in the website footer for further details.	For cookies other than those strictly necessary for the website’s operation, processing is based on consent (Article 6(1)(a) GDPR).	See the Cookie Policy for details on the use of these technologies and cookie preference management.

Additional Processing Activities Beyond Website Navigation:

Purposes	Legal Basis	Retention Period
Managing and responding to user inquiries submitted via contact forms or other available channels.	Performance of a contract in which the data subject is a party or pre-contractual measures taken at the data subject’s request (Article 6(1)(b) GDPR).	Until the request is processed, and in any case, no longer than 6 months, unless a dispute arises. The retention period may vary based on the content and complexity of the request.
Processing is necessary for establishing, exercising, or defending the data controller’s legal claims, including debt recovery actions against the data subject.	Legitimate interest of the data controller (Article 6(1)(f) GDPR).	Until the conclusion of legal proceedings and the expiration of appeal periods.
Processing is necessary for managing requests related to data subject rights under Articles 15 et seq. of the GDPR.	Legal obligation of the data controller (Article 6(1)(c) GDPR).	Data will be retained for a maximum of 5 years from the request, unless a dispute arises.

Personal and contact details are still considered personal data under Regulation (EU) 2016/679, even though they are not classified as “special categories of data” under Article 9 of the Regulation.

How we process your data

We process your data electronically.

International Data Transfers

No transfers of personal data occur outside the European Union or the European Economic Area.

If necessary, transfers will occur only:

- To countries with an adequacy decision by the European Commission;

- Under Standard Contractual Clauses or other safeguards under Article 46 GDPR, unless exceptions under Article 49 GDPR apply.

Data recipients

Personal data may be shared with service providers operating as data processors under Article 28 GDPR. A full list of processors is available upon request.

Data subject rights - complaint to the supervisory authority

Under GDPR, you have the right to:

Access your data (Article 15) – Obtain confirmation of data processing and access personal data.
Correct inaccurate data (Article 16) – Request correction of inaccurate or incomplete data.
Request deletion (Article 17) – Request deletion of personal data, subject to legal obligations.
Restrict processing (Article 18) – Request processing limitations in specific circumstances, such as when contesting data accuracy or objecting to unlawful processing.
Request data portability (Article 20) – Receive data in a structured format and transfer it to another controller where technically feasible.
Object to processing (Article 21) – Object to processing based on legitimate interest, unless compelling legal grounds exist.
Not be subject to automated decisions (Article 22) – Not be subject to decisions based solely on automated processing that significantly affect them. When automated decisions are necessary for a contract or made with consent, individuals have the right to express their views and request human intervention.
Right to withdraw consent – Withdraw consent at any time with the same ease with which it was given, without affecting the lawfulness of prior processing.
Right to lodge a complaint – File a complaint with the Italian Data Protection Authority: http://www.garanteprivacy.it.
Requests can be submitted to the contact email above. The exercise of rights is free, except where requests are excessive or unfounded.

You may exercise the above rights by contacting the Data Controller using the details provided above. Exercising your rights as a data subject is free of charge under Article 12 of the GDPR. However, if requests are manifestly unfounded or excessive, including due to their repetitive nature, the Data Controller may charge a reasonable fee based on the administrative costs incurred in handling your request or refuse to fulfill it. Finally, please note that the Data Controller may request additional information necessary to verify the identity of the data subject.