1. Introduction

In compliance with the obligations arising from Regulation (EU) No. 2016/679 of the European Parliament and of the Council of 27 April 2016 (hereinafter, the “Regulation” or “GDPR”) and current national legislation, including Legislative Decree 196/2003 (Privacy Code, as amended by Legislative Decree 101/2018), DOUBLE EM SRL respects and protects the personal data of visitors and users (hereinafter, the “Data Subjects”) of the website www.ebsa2025.eu/ (hereinafter, the “Website”). This document provides information on the processing of personal data collected by DOUBLE EM SRL through the Website and therefore constitutes a privacy notice to Data Subjects pursuant to the aforementioned legislation. It does not apply to personal data collected by DOUBLE EM SRL through channels other than the Website. According to the Regulation, the processing of personal data is carried out in accordance with the principles of fairness, lawfulness, transparency, and the protection of confidentiality. The Website may contain links to other websites: this privacy notice does not apply to such other websites that Data Subjects may visit via specific links. These external websites may contain privacy notices that differ in whole or in part from this one. DOUBLE EM SRL therefore encourages Data Subjects to carefully read the privacy policies of any external websites they visit, especially before entering any personal information.

2. Data Controller Identity and Contact Information

The data controller is DOUBLE EM SRL (hereinafter, “DOUBLE EM SRL” or the “Data Controller“), VAT no. 02437180991, based in Via Eugenio Baroni 2/3 sc.DX 16129 – Genoa (GE) (tel: +39 3470597385; email: marengo@double-em.it).

3. Types of Data Processed Through the Website

The Data Controller may process the following data via the Website:

**Automatically Collected Data – Traffic and Browsing Data**
The IT systems and software procedures used to operate the Website acquire, during their normal operation, certain personal data whose transmission is implicit in the use of internet communication protocols. This category includes IP addresses or domain names of users’ computers and terminals, browser type, name of the Internet Service Provider, URI/URL (Uniform Resource Identifier/Locator) addresses of the requested resources, the date and time of the visit, the method used to submit the request to the server, the size of the file obtained in response, the numerical code indicating the response status (success, error, etc.), the referring and exit webpages, and other parameters related to the user’s operating system and IT environment. The Website does not intentionally collect special categories of personal data (e.g., health data, religious, political, or trade union beliefs), unless with specific informed consent.

4. Data Provided Voluntarily by Data Subjects

The optional, explicit, and voluntary sending of messages to the Data Controller’s contact addresses, as well as the filling out and submission of the contact forms on the Website, involve the acquisition of the sender’s contact data necessary to reply, along with all personal data included in the communications (such as, by way of example, name, surname, email address). In any case, Data Subjects must provide accurate and truthful data and promptly inform the Data Controller of any subsequent changes.

5. Cookies and Other Tracking Technologies

The Website uses cookies and similar technologies. For information about the use of cookies, please refer to our Cookie Policy.

6. Purpose and Legal Basis of the Processing

The Data Controller processes traffic and browsing data for the following purposes:
(a) manage, administer, and improve the Website; ensure correct functioning of the services provided;
(b) comply with legal and/or regulatory obligations and/or orders from the judicial authorities;
(c) prevent and/or detect fraudulent or harmful activity related to the Website;
(d) conduct analysis for technical and/or commercial purposes; gather statistical information on the use of services (e.g., most visited pages, visitor counts by time/day, geographic origin, etc.).
The processing of this data is necessary for navigating the Website.

The Data Controller processes data provided by Data Subjects for the following purposes:
(e) respond to support requests and, in general, to any inquiries and/or requests made by users;
(f) send administrative and/or technical support emails (e.g., technical notes, reminders, updates, etc.);
(g) send newsletters, commercial communications, and/or advertising materials by post and/or email regarding products and/or services offered by the Data Controller.

The processing of data provided by Data Subjects for these purposes requires their consent. This consent is always optional; however, without it, DOUBLE EM SRL cannot process the data for these specific purposes.

7. Data Disclosure

The collected personal data may be disclosed to supervisory bodies, judicial authorities, and any parties to whom disclosure is legally required and/or necessary to fulfill the above purposes.

8. Data Processing Methods and Retention Period

The collected data may be processed both in paper and electronic and/or automated formats. In any case, the Data Controller will process the personal data for as long as necessary to fulfill the purposes described in this notice, and in any case, for no longer than permitted by current legislation (including tax regulations). Data will be retained strictly for the time necessary to achieve the purposes for which it was collected, in compliance with the following terms:

• Browsing data: up to 12 months;
• Data provided voluntarily: up to 10 years for legal or administrative obligations;
• Marketing purposes: until consent is withdrawn, and in any case no longer than 24 months.

9. Possible Transfer of Personal Data

The data will be stored and managed on servers located within the European Union belonging to the Data Controller and/or third-party companies duly appointed as Data Processors. Currently, the servers are located in Italy. However, the Data Controller reserves the right to relocate the servers within Italy and/or the EU and/or to non-EU countries if necessary. In such cases, the Data Controller assures that any transfer of data outside the EU will be carried out in compliance with applicable legal provisions by entering into agreements that guarantee an adequate level of protection and/or adopting standard contractual clauses approved by the European Commission.

10. Security Measures

The Data Controller processes Data Subjects’ personal data lawfully and fairly, adopting appropriate security measures to prevent unauthorized access, disclosure, alteration, or destruction of data, as well as unlawful use. The data is processed using IT and/or telematic tools with organizational methods and logic strictly related to the purposes stated, and stored in secure facilities with access controls and personnel verification. Access to information is strictly limited to authorized personnel. The Website is continuously monitored for potential security breaches. Besides the Data Controller, in some cases, categories of authorized individuals involved in the organization of the Website (administrative, commercial, marketing, legal staff, system administrators) or external entities (e.g., third-party technical service providers, postal couriers, hosting providers, IT companies, communication agencies) may access the data based on specific instructions provided by the Data Controller. In any case, the Data Controller encourages Data Subjects to take appropriate safeguards against unauthorized access to their reserved areas and/or devices.

11. Data Subjects’ Rights

In accordance with Chapter III of the GDPR, Data Subjects may exercise their rights at any time, including:

– **Right of Access**: to obtain confirmation from the Controller as to whether or not personal data concerning them is being processed and, if so, to access information such as processing purposes, data categories, recipients, and storage periods (Art. 15 GDPR);
– **Right to Rectification**: to obtain without undue delay the correction of inaccurate personal data and the completion of incomplete data (Art. 16 GDPR);
– **Right to Erasure**: to obtain without undue delay the deletion of personal data under the conditions set out by the GDPR (so-called “right to be forgotten” – Art. 17 GDPR);
– **Right to Restriction of Processing**: to obtain the limitation of data processing in certain circumstances (Art. 18 GDPR);
– **Right to Data Portability**: to receive data in a structured, commonly used, machine-readable format and to request its transfer to another controller (Art. 20 GDPR);
– **Right to Object**: to object, on grounds relating to their particular situation, to the processing of personal data, including processing for direct marketing purposes (Art. 21 GDPR);
– **Right Not to Be Subject to Automated Decision-Making**: not to be subject to a decision based solely on automated processing, including profiling (Art. 22 GDPR).

Requests can be submitted to DOUBLE EM SRL by post at:
DOUBLE EM SRL, Via Eugenio Baroni 2/3 sc.DX 16129 – Genoa (GE),
or by email: marengo@double-em.it.

Likewise, consent given in relation to this privacy notice can be withdrawn at any time without affecting the lawfulness of processing based on consent before its withdrawal. Any communications and actions taken by DOUBLE EM SRL following the exercise of the rights listed above will be provided free of charge, except as provided in Article 12(5) of the GDPR. Data Subjects may also contact DOUBLE EM SRL by phone at +39 3470597385 for further information or clarification regarding the processing of personal data through the Website.

12. Right to Lodge a Complaint

Data Subjects who believe that the processing of their personal data via the Website violates the Regulation have the right to lodge a complaint with the Data Protection Authority, as provided by Article 77 of the Regulation, or to seek judicial remedy (Article 79 of the Regulation).

13. Protection of Minors

The Data Controller does not permit individuals under the age of 16 to use its services and does not intentionally collect information about them. If it becomes aware of having collected personal data from individuals under the age of 16 without verifiable parental consent, it will delete such data as quickly as possible.

14. Periodic Updates to This Privacy Notice

This privacy notice is effective from 25 May 2018 and may be subject to changes over time due to amendments or additions to the applicable law. If the Data Controller makes significant changes to this document, it will inform Data Subjects using the methods deemed most appropriate (e.g., publication on the Website’s homepage and/or sending a newsletter to the email address provided by the Data Subjects). This privacy notice was last updated on 25 May 2018.

15. AI-Generated Content

Some content on the Website (including texts, images, graphic or multimedia elements) may be partially or wholly created using generative artificial intelligence tools. The use of such technologies is in accordance with principles of fairness, transparency, and reliability, with the aim of providing up-to-date, consistent, and engaging content for users. AI-generated content does not use personal information (such as names, email addresses, preferences, or browsing behavior) of Website visitors. Artificial intelligence does not analyze or track user behavior for profiling, targeted advertising, or content customization purposes.

This privacy notice was last updated on 6 May 2025.