1. Introduction

IDPOST S.R.L. (or instead of IdPost) is committed to protecting the privacy of users and declares itself responsible for the security of customer data. This disclosure establishes the following:

• What personal data is collected and processed from the user regarding to the relationship with us and through the use of our website,
• Where we get the data;
• What we do with such data;
• How we store data;
• To whom we transfer/disclose such data;
• How we treat your data protection rights;
• And how we comply with data protection regulations.

2. Owner and person in charge of the data processing

The Data Controller (i.e. the person, who is responsible for the decisions regarding the purposes, methods of processing personal data and the tools used) is IdPost S.r.l. with registered office in Cagliari 090126 in Via M. Malpighi, 4 As part of its activities and for the purposes set out above, IdPost may use services rendered by third parties that operate on behalf of IdPost and according to its instructions, such as Data Processors. These are subjects that provide IdPost with processing or instrumental services (e.g. technical maintenance, IT assistance for the operation of services, etc.). The complete list is available by writing to privacy@idpostbox.com. In any case, the processing takes place in such a way as to guarantee the security and confidentiality of the data, by adopting the measures provided for by art. 32 of the Regulations to preserve the data processed and prevent access to the same by unauthorized parties.

3. What data do we collect:

Personal data means all information related to the user that allows us to identify him, such as name and surname, contact details, email address, payment details and information accessing to our website. We may collect your personal information when you create an idPostbox account, use our website and/or application, or when you contact us. Specifically, we could collect the following categories of information:

1. Name and surname, date and place of birth, residential address, e-mail address, telephone number or other payment details;
2. Information through the use of our website and/or app;
3. Communications exchanged with us or addressed to us via letters, e-mail, chat service, telephone calls and social media.
4. The geographical location in real time of the computer or device via the IP address.

4. For what purpose do we process your data:

Your data can be used for the following purposes:

1. We use your information provided for us to carry out the services in the idPostBox platform, how to display the pdf files relating to documents and utilities (e.g. telephone, electrical, gas, water, etc.), perform payment transactions, monitor expenditure trends and consumption and remember your deadlines;
2. We may send you communications about the services you have requested and any changes to these services. These communications cannot be deactivated;
3. (*) We use your data for statistical analysis and marketing, system testing, customer surveys, maintenance and development, or to respond to a dispute or complaint. We may perform data profiling based on the information we collect from you to use in statistical and marketing analysis. Any profiling activity will be performed only with your consent and making every effort to ensure that all data is based on which is accurate. By providing any personal data you explicitly agree that we may use to perform profiling activities in accordance with this Privacy Policy;
4. we can also communicate your data to government authorities; and bodies in compliance with legal requirements.
5. manages the relationship with the customer in order to improve and customize the services and performance offered by idPostBox
6. (*) conducting market research relating to IdPost products/services;
7. process satisfaction ratings, or preferences and habits of the customer regarding the use of the web portal, as well as any consumption choices, supplies also in the context of any questionnaires;
8. (*) carries out promotional and/or marketing activities, also on behalf of third parties.

We will only process your personal data if we have a legal basis to do so. The legal basis will depend on the reasons for which we have collected, and we must use your personal data. Only persons aged 16 or over can provide their consent. For children under this age, consent from parents or legal guardians is required.

5. How long do we process your data

The data acquired by IdPost are kept for the time strictly necessary to achieve the purposes for which they were collected and processed, or normally for the entire duration of the contractual relationship between IdPost and its client, Data Controller. In addition, the requested data for registration or creation of the idPostbox account will be collected and processed for the entire duration of validity and in any case up to its cancellation at the request of the user or by order of the judicial authorities. IdPost may retain personal data for longer periods to comply with legal or judicial obligations, or to investigate complaints and/or further requests. When we no longer need your personal information, we will delete it or erasure it securely.

6. International data transfer

IDPOSTBOX shares some of the collected data with services located outside the European Union area, in particular with Google, and the Google Analytics Service. The transfer is authorized based on specific decisions of the European Union and the Guarantor for the protection of personal data, Decision 1250/2016 (Privacy Shield - here the information page of the Italian Data Protection Authority), for that no further consent is required. The companies mentioned above guarantee their adherence to the Privacy Shield.

7. Sharing of personal data

We may also share your personal information with the following third parties:

1. Companies connected with IDPOST that remain responsible for using the user's personal data in accordance with current regulatory provisions;
2. Legal advisors and other professionals, courts and law enforcement agencies in all the countries in which we operate to protect our legal rights related to our contract with the user.

8. Creating idPostbox account

All collected data at the time of registration in the specified section will be processed in accordance with Regulation E.U. 679/2016 (GDPR). We understand the importance of taking additional measures to protect the privacy and safety of children. As a result, children under the age of 16 will not be allowed to open an idPostBox account. We will delete any idPostBox account created by a child under 16 as soon as we are aware of it. Our use of your personal data is based on your consent, namely:

1. you have the possibility to revoke your consent to our processing and delete your personal data at any time. To do so, the user must send a request via our online form (see the section on the rights related to the protection of their data).
2. We keep the personal information contained in the idPostbox account if the account is retained.
3. You can change your personal idPostbox account information directly in your account.

9. Cookies and Site tracking (Cookie Policy)

I cookie sono stringhe di testo di piccole dimensioni che i siti visitati dall’utente come, ad esempio, IDPOSTBOX inviano all’utente e memorizzati nel suo computer all’interno della cache del browser. Un sito può avere integrati al suo interno diversi sottoservizi ed ognuno di loro può elaborare un proprio cookie che l’utente riceve nel browser. Ogni cookie contiene dati dome ad esempio indirizzo IP, nazionalità, città, data e orario, tipo di dispositivo, ecc...

Tipologie di cookie
Classifichiamo i cookie nelle seguenti categorie:

• Cookie necessari: sono i cookie necessari al regolare funzionamento di un sito web come, ad esempio, la navigazione della pagina o l’accesso all’area protetta del sito. Il sito web non può funzionare senza questi cookie.
• Cookie di preferenza: consentono qualora l’interessato abbia espresso esplicito e informato consenso a raccogliere le informazioni come ad esempio la lingua preferita. Questi cookie modificano il comportamento del sito e sono raccolti in forma anonima e memorizzati nel computer dell’utente finale.
• Cookie Marketing: sono i cookie utilizzati per monitorare gli utenti dei siti web e sono attivi solo se l’utente ha fornito un consenso esplicito e informato. Lo scopo è far visualizzare o inviare annunci pertinenti.

In IDPOSTBOX sono presenti esclusivamente “cookie necessari” e la loro disattivazione comporta l’irregolare funzionamento del sito. Non sarà possibile perciò effettuare il login.
IDPOST, inoltre, integra al suo interno alcuni servizi esterni resi disponibili dai nostri partner per cui si prega di visitare i loro siti per ottenere le informazioni sulla loro politica applicata all’uso dei cookie e sulla privacy.
L’utente in qualunque momento può richiedere la disattivazione generale o la cancellazione dei cookie modificando le impostazioni del proprio browser infatti la maggior parte dei browser web accetta automaticamente i cookie, ma, se lo si desidera, è possibile modificare queste impostazioni del browser accettando, rifiutando ed eliminando i cookie.
Il menu “aiuto” della barra degli strumenti sulla maggior parte dei browser spiega come evitare che il browser accetti nuovi cookie, come fare in modo che il browser notifichi quando si riceve un nuovo cookie o come disabilitare completamente i cookie. Se si sceglie di modificare queste impostazioni, è possibile che determinate funzioni e funzionalità non operino come previsto.

10. Log files

Come tutti i siti web anche IDPOSTBOX fa uso di log files nei quali vengono conservate informazioni raccolte in maniera automatizzata durante le visite degli utenti. Le informazioni raccolte potrebbero essere le seguenti:

• indirizzo internet protocol (IP);
• tipo di browser e parametri del dispositivo usato per connettersi al sito;
• nome dell'internet service provider (ISP);
• data e orario di visita;
• pagina web di provenienza del visitatore (referral) e di uscita;
• eventualmente il numero di click.

Le suddette informazioni sono trattate in forma automatizzata e raccolte in forma esclusivamente aggregata al fine di verificare il corretto funzionamento del sito, e per motivi di sicurezza (dal 25 maggio 2018 tali informazioni saranno trattate in base ai legittimi interessi del titolare). A fini di sicurezza (filtri antispam, firewall, rilevazione virus), i dati registrati automaticamente possono eventualmente comprendere anche dati personali come l'indirizzo Ip, che potrebbe essere utilizzato, conformemente alle leggi vigenti in materia, al fine di bloccare tentativi di danneggiamento al sito medesimo o di recare danno ad altri utenti, o comunque attività dannose o costituenti reato. Tali dati non sono mai utilizzati per l'identificazione o la profilazione dell'utente, ma solo a fini di tutela del sito e dei suoi utenti (dal 25 maggio 2018 tali informazioni saranno trattate in base ai legittimi interessi del titolare).

11. Data Protection Officer (DPO)

IdPost has appointed a Data Protection Officer (DPO) to verify compliance with this statement. Furthermore, you have the right to file a complaint with a supervisory authority at any time. The DPO is called to:

• inform and provide advice to the Data Controller, the Joint Data Controllers, the Data Processor and the employees who perform the processing regarding the obligations arising from the Regulation as well as other provisions of the Union or the Member States relating to the protection of Personal Data;
• monitor and ensure compliance with the regulations, the rules applicable to the protection of personal data and the policies and procedures adopted by the Data Controller and the contact holders of the treatment;
• provide support in the feedback to the interested party to cooperate with the competent Data Protection Authority.

You can contact the DPO for all matters related the processing of your Personal Data and/or if you wish to exercise your rights as provided for in Section 1 of this Privacy Policy, by sending a written notice to this e-mail address, dpo@idpostbox.com.

12. Data protection rights

Under certain circumstances you can:

1. Ask us if we own your personal information and, if so, what such information is and why we treat/use it;
2. Request access to your personal information
3. Request the updating, modification or rectification of your personal data in our possession;
4. Request the cancellation, the processing anonymously the data processed in violation of the law or the limitation of the treatment;
5. Oppose for legitimate reasons for treatment, including profiling;
6. Revoke the consent previously provided without prejudice to the lawfulness of the treatment based on the consent at the time lent;
7. Receive a copy of the data provided by you at the time of registration to the idPostBox portal and request that such data be transmitted to another controller;
8. Revoke the consent.

If you wish to exercise any of these rights, please complete and send an enquiry form via email to our DPO at DPO@idpostbox.com. You will not incur any fees to access your personal information (or to exercise any of the other rights). However, if the access request is clearly unfounded or excessive, we may charge the applicant a reasonable cost. Alternatively, we may refuse to comply with the request under such circumstances.

13. Changes to the privacy notice

Our Privacy Policy may change from time to time and any changes will be communicated to you via an email or a notice on our website.

(*) optional consent for the registration of the service.