Privacy notice

Courtesy translation: the Italian version is the one that applies. Draft to be checked by a lawyer or privacy consultant before publication. Remove this notice after the check.

1. Data controller

[RAGIONE SOCIALE] S.r.l., with registered office at [VIA E NUMERO CIVICO], [CAP] Rimini (RN), Italy, VAT number [PARTITA IVA] (“Finish Protocol”, “we”). Privacy contacts: info@finishprotocol.it, PEC [INDIRIZZO PEC].

2. What data we process

• Browsing data: IP address, date and time of the request, page visited, browser type, collected by the systems that host the site to keep it working and secure.
• Data you send us: name, business, email, phone, sector, town and message entered in the contact form, or sent by email, phone or WhatsApp.
• Client and supplier data: contact details of the people we deal with and the data needed for invoicing.
• Cookie preferences: the choice made in the banner. See the cookie policy.

We do not ask for special categories of data (Art. 9 GDPR). Please do not enter them in the form.

3. Why we process it and on what basis

Purpose	Legal basis	Retention
Replying to requests and preparing quotes	Pre-contractual steps taken at your request (Art. 6(1)(b))	12 months from the last contact, if no contract follows
Performing contracts with clients and managing suppliers	Performance of a contract (Art. 6(1)(b))	For the duration of the contract
Meeting tax and accounting obligations	Legal obligation (Art. 6(1)(c))	10 years (Art. 2220 of the Italian Civil Code)
Protecting the site from abuse and attacks	Legitimate interest (Art. 6(1)(f))	[DURATION OF TECHNICAL LOGS]
Sending invitations to evenings and workshops, if you asked for them	Consent (Art. 6(1)(a); Art. 130 of the Italian Privacy Code)	Until withdrawn, and in any case no more than 24 months from the last contact
Defending our rights in the event of a dispute	Legitimate interest (Art. 6(1)(f))	For the duration of the dispute

Providing the data marked as required in the form is necessary for us to reply. Consent to invitations is optional: if you do not give it, we still reply to you.

4. Who we share it with

The data is processed by authorised Finish Protocol staff and, on our behalf, by suppliers appointed as data processors (Art. 28 GDPR):

• Cloudflare, Inc., which hosts and protects the site;
• [FORNITORE DELLA POSTA ELETTRONICA], for email;
• [FORNITORE DEL MODULO DI CONTATTO, SE USATO];
• our tax adviser, for accounting;
• SCALEUPGENIUSHUB LLP, Nagpur, India, a group company that carries out production work for us, only when access to the data is necessary for the service requested.

We do not sell the data and we do not pass it to third parties for marketing purposes.

5. Transfers outside the European Union

Some suppliers may process data outside the European Economic Area. For the United States we rely on the adequacy decision for the EU-U.S. Data Privacy Framework, for certified suppliers, or on standard contractual clauses. For India, which is not covered by an adequacy decision, we use the standard contractual clauses approved by the European Commission (Implementing Decision (EU) 2021/914) with supplementary measures, and we limit access to the data that is strictly necessary. You can ask for a copy of the safeguards adopted by writing to info@finishprotocol.it.

6. Your rights

You can ask us at any time for access to your data, rectification, erasure, restriction of processing and portability, and you can object to processing based on legitimate interest (Articles 15–22 GDPR). You can withdraw consent at any time, without affecting processing already carried out. Write to info@finishprotocol.it: we reply within one month.

You also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali).

7. Data we process on behalf of our clients

When we run campaigns, pages or messages for a client, the data of the people who respond to those campaigns is processed by us as a data processor, under a written agreement with the client in accordance with Art. 28 GDPR. The client is the controller of that data, and the client's privacy notice explains how it is used.

8. Changes

We may update this notice. The date of the last update is shown at the top.