Privacy Policy

1. Controller and Data Protection Officer contact details

For any information, clarification or further details regarding our personal data protection policies as described herein, you may contact us:

1. via email: privacy@timeflow.it;
2. or by writing to our registered office: TimeFlow S.r.l. – Via 95° Reggimento Fanteria n. 9 – 73100 Lecce, Italy;
3. at the email address of our Data Protection Officer: andrealisi@studiolegalelisi.it

2. Purposes and legal bases for the processing of your personal data

Data protection legislation permits the use of personal data only for specific and clearly stated purposes, provided there is a suitable legal basis. Below is a list of the purposes for which we process your personal data:

1. to ensure the proper functioning of the Website and the usability of its services;
2. to obtain aggregate and anonymised statistical information on the use of the Website (e.g. most visited pages, number of visitors by time band or day, geographical areas of origin, etc.);
3. to send you transactional emails;
4. to manage and respond to your requests sent to the email addresses indicated on the Website or submitted via contact forms, in relation to the services provided by TimeFlow;
5. to evaluate and respond to your appointment requests with a TimeFlow representative;
6. to send you informational newsletters and promotional communications about TimeFlow's services and initiatives;
7. to facilitate customer care activities through the live chat service (hereinafter also "Chatbot") and forward your requests to the relevant support team;
8. to collect and record information about your browsing activity in order to display commercial communications through social networks and other web contexts;
9. to improve the use of TimeFlow's services and offerings through statistical tracking systems that detect the opening of messages received at your email address and clicks on links contained therein.

The processing activities carried out for the purposes set out in points a), c), d), e) and g) are necessary for the provision of services offered through the Website.

The legal basis for processing is therefore the performance of a contract to which the data subject is party or the execution of pre-contractual measures taken at the data subject's request, pursuant to Art. 6(1)(b) GDPR. Processing for the purposes set out in points b), h) and i), namely the use of browsing tracking tools and profiling for marketing purposes, is subject to your consent, which constitutes the legal basis pursuant to Art. 6(1)(a) GDPR.

Processing for the purposes set out in point f) may have as its legal basis the performance of a service in your favour, where you have requested to subscribe to the newsletter via the relevant form on the Website, or the legitimate interest of the Controller, pursuant to Art. 6(1)(f) GDPR, to use the personal and email data you provided to TimeFlow to receive informational services through the Website.

3. Sources of collection of your personal data

Your personal data may be provided directly by you, actively and knowingly (e.g. data provided when interacting with the Chatbot, data entered in the contact form or newsletter subscription form, etc.). In other cases, your data is provided indirectly through browsing the Website or using your devices (e.g. traffic data, device-related data, etc.).

4. What personal data we collect and process

4.1 Browsing data

During your browsing of the Website, the computer systems responsible for its operation automatically acquire certain information whose transmission is implicit in the use of Internet communication protocols. This category of data includes, for example, IP addresses or domain names of the devices you use, URI/URL addresses of requested resources, the time of the request, the method used to submit the request to the server, the size of the file obtained in response, the numerical code indicating the status of the response given by the server (success, error, etc.) and other parameters relating to the operating system and computing environment in use.

You can find further information on TimeFlow's use of these technologies within the preferences management area, accessible via the relevant button located in the Website footer.

4.2 Data provided through the use of our services

TimeFlow collects personal data provided through interaction with the Website. Such data includes:

1. data provided by sending, voluntarily, email messages to the email addresses indicated on the Website (which include, in particular, the sender's email address and any other personal data contained in the message);
2. data provided by completing the newsletter subscription form (email address);
3. data provided when interacting with the Chatbot (name, email address, telephone number, reasons for contact, platform registration and any other data entered in the chat and/or in attached documents);
4. data provided by completing the contact form (first name, surname, email address, telephone number, company);
5. data provided by completing the call booking form (first name, surname, email address, telephone number, company, service requirements and time availability). You may also choose to provide the email address of one or more guests who will participate in the call. In this case, please ensure that these individuals have been previously informed about the processing purposes indicated in paragraph 2(e) and have consented to the use of their data by TimeFlow.

5. Nature of data provision and consequences of failure to provide data

The provision of personal data referred to in paragraph 4.2 is necessary for the provision of the services offered through the Website: in particular, for the completion of forms on the Website, the provision of data marked with an asterisk is necessary for managing and responding to communications.

In any case, you are free to provide the requested data, meaning you are not legally obliged to do so: however, failure to provide the data indicated as necessary will make it impossible for the Controller to provide the requested service. The collection of personal data referred to in paragraph 4.1 may be necessary to ensure the correct use of the services provided through the Website, or may serve to offer you additional but non-essential services and functionalities.

In the latter case, TimeFlow may collect and process your data after obtaining your consent, which is voluntary, or until you object to the processing. If you do not authorise us to process this data or you object to its processing, you may still benefit from the services available as a Website user.

6. To whom your personal data may be disclosed

Your personal data may be disclosed to:

1. TimeFlow employees and authorised and instructed collaborators who need access to it in the performance of their duties;
2. providers of the services offered through the Website or connected to its operation, including in particular: HubSpot Inc. for the live chat service, web content management and sending email communications for commercial purposes; Amazon Web Services EMEA SARL for cloud storage services; Intuit Inc. for sending transactional email communications and managing support and contact requests; HubSpot Inc. and Google Ireland Limited for activities related to the planning and conducting of introductory meetings; Google Ireland Limited and Fonticons Inc. for displaying content from external platforms;
3. Google Ireland Limited, Meta Platforms Ireland Limited and LinkedIn Corporation for remarketing and behavioural targeting activities.

Outside the cases mentioned above, personal data will not be disclosed, disseminated, transferred or otherwise communicated to third parties for unlawful purposes or purposes unrelated to the collection, and in any case without providing adequate information to data subjects and obtaining their consent, where required by law.

Personal data will not be transferred abroad to countries or international organisations outside the European Union that do not guarantee an adequate level of protection, recognised pursuant to Art. 45 GDPR, on the basis of an adequacy decision by the EU Commission. Where necessary for the provision of Website services, the transfer of personal data to non-EU countries or international organisations for which the Commission has not adopted an adequacy decision pursuant to Art. 45 GDPR will take place only in the presence of adequate safeguards provided by the destination country or organisation, pursuant to Art. 46 GDPR, and provided that data subjects have enforceable rights and effective legal remedies. In the absence of an adequacy decision or adequate safeguards, including binding corporate rules, a cross-border transfer will take place only if one of the conditions set out in Art. 49 GDPR is met.

7. How long we retain your personal data

Your personal data will be retained for a period not exceeding that necessary to achieve the purposes for which it was collected and subsequently processed. In particular:

• data processed to respond to support and contact requests received via email or contact form will be retained for a maximum of 6 months from provision; additionally, personal and email data provided via the contact form will be retained for sending informational and promotional communications until you exercise your right to object;
• the data referred to in paragraph 4.2(b) will be retained until you exercise your right to object;
• data provided when interacting with the Chatbot will be retained for a maximum of 24 months; additionally, personal and email data acquired through interaction with the Chatbot will be retained for sending informational and promotional communications until you exercise your right to object;
• data processed to respond to appointment requests will be retained for a maximum of 12 months from provision; additionally, personal and email data provided via the relevant form will be retained for sending informational and promotional communications until you exercise your right to object.

After the retention periods have elapsed, TimeFlow will take measures to delete or anonymise data that does not need to be retained for specific legal obligations or other legitimate reasons (e.g. pending litigation). To learn about the retention period for browsing data, please refer to the information available in the preferences management area, accessible via the relevant button in the Website footer.

8. Your rights

As a data subject, you have the right to access your personal data, to request its rectification, updating and erasure or restriction, if incomplete, inaccurate or collected in violation of the law, as well as to object to processing on legitimate grounds or to obtain data portability. In particular, you have the right to obtain confirmation as to whether or not personal data concerning you exists, even if not yet recorded, and to receive it in an intelligible form. You also have the right to obtain information about:

1. the purposes and methods of processing;
2. the logic applied in the case of processing carried out with the aid of electronic instruments;
3. the identity of the Controller, Processors and the subjects or categories of subjects to whom personal data may be communicated or who may become aware of it as authorised processors.

You have the right to obtain:

1. the updating, rectification or integration of your data;
2. the erasure, anonymisation or blocking of data processed in violation of the law, including data whose retention is not necessary in relation to the purposes of processing;
3. the restriction of processing, where one of the conditions set out in Art. 18 GDPR applies;
4. confirmation that the operations referred to in points a), b) and c) have been brought to the attention of those to whom the data has been communicated or disseminated, except where this proves impossible or involves a disproportionate effort;
5. the transmission of your data, provided to the Controller and processed on the basis of a contract, in a structured, commonly used and machine-readable format. Pursuant to Art. 20 GDPR, you also have the right to transmit such data to another controller without hindrance and, where technically feasible, to obtain the direct transmission of personal data from one controller to another.

You have the right to object, in whole or in part:

1. on legitimate grounds, to the processing of personal data concerning you, even if relevant to the purpose of collection;
2. to the processing of personal data concerning you for the purposes of sending advertising material or direct sales or for carrying out market research or commercial communication;
3. to automated decision-making processes that significantly affect you.

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali).

9. How to exercise your rights

You may exercise your rights by sending an email to privacy@timeflow.it. We will respond within one month of your request. Should it not be possible to fulfil your request, we will provide you with the reasons why.

To exercise your rights, you may also avail yourself of non-profit bodies, organisations or associations whose statutory objectives are in the public interest and that are active in the field of protection of data subjects' rights and freedoms with regard to personal data protection, by granting them a suitable mandate. You may also choose to be assisted by a person you trust.

To learn about your rights, lodge a complaint and stay up to date on data protection regulations, you may contact the Italian Data Protection Authority (Garante per la protezione dei dati personali) by visiting www.garanteprivacy.it.