Privacy Policy.

Data controller

The data controller is Abdelkbir Berrahhal (owner of the Empatix brand), based at Via Alessandro Scarlatti 8, 10154 Torino (TO), Italy, VAT no. IT13507340019.

For any request concerning your personal data, write to info@empatix.it or by certified email (PEC) to abdelkbir.berrahhal@pec.it.

What data we collect

Browsing data. In the course of their normal operation, the IT systems and software that run this site acquire certain data whose transmission is implicit in the use of internet communication protocols: IP addresses, browser type and operating system, date and time of the request, page requested. This data is used only to obtain anonymous statistics on the use of the site and to check that it works correctly.

Data you provide voluntarily. If you write to the email address published on the site, we acquire your address and any data you choose to include in the message, for the sole purpose of replying to you.

Data collected through cookies and similar technologies, only with your consent. Device and browser identifiers, pages visited, interactions with the site and, for marketing services, interactions with our ads. The services used are Google Analytics 4, Microsoft Clarity; details (provider, cookies, duration) are in the Cookie Policy.

Purposes and legal basis

• Replying to requests received by email — legal basis: pre-contractual measures taken at the data subject's request and legitimate interest (Art. 6(1)(b) and 6(1)(f) GDPR).
• Ensuring the security and proper functioning of the site — legal basis: legitimate interest (Art. 6(1)(f) GDPR).
• Complying with legal, tax and accounting obligations — legal basis: legal obligation (Art. 6(1)(c) GDPR).
• Analytics: measuring how the site is used in order to improve it (Google Analytics 4, Microsoft Clarity) — legal basis: consent (Art. 6(1)(a) GDPR and Art. 122 of the Italian Privacy Code).

Consent is optional and can be withdrawn at any time from “Cookie preferences” at the bottom of every page, without affecting the lawfulness of processing carried out before withdrawal.

How long we keep data

Technical logs are kept for as long as strictly necessary for the security of the service (normally no longer than 12 months). Email correspondence is kept for as long as needed to handle the request and, where a contract follows, for the periods required by law (10 years for tax records).

Data collected through analytics and marketing cookies is kept for the lifetime of each cookie, as stated in the Cookie Policy, and in the providers' systems for the retention period set in the service (for Google Analytics: 2 months).

Who we share data with

Data may be processed by technical service providers (hosting, email) appointed as data processors under Art. 28 GDPR. It is not disclosed to the public or sold to third parties.

Where a provider involves a transfer of data outside the European Economic Area, the transfer takes place on the basis of a European Commission adequacy decision or standard contractual clauses.

With your consent, data collected through cookies is also processed by: Google Ireland Limited (Google Analytics 4); Microsoft Ireland Operations Limited (Microsoft Clarity). These providers may transfer data to the United States on the basis of the EU-U.S. Data Privacy Framework adequacy decision and standard contractual clauses.

Your rights

You may at any time exercise the rights provided by Articles 15–22 GDPR: access, rectification, erasure, restriction, portability and objection. To do so, write to info@empatix.it.

You also have the right to lodge a complaint with the Italian Data Protection Authority, the Garante per la protezione dei dati personali (garanteprivacy.it (opens in a new tab)).

Provision of data

Providing data is voluntary. Browsing data is, however, necessary for the site to work, and the data in an email is necessary to reply to you: without it, we cannot follow up on your request.

Automated decision-making

No profiling takes place. No automated decision producing legal effects concerning you, or similarly significantly affecting you, is taken within the meaning of Art. 22 GDPR.

Security

The site is served exclusively over an encrypted connection (HTTPS), and appropriate technical and organisational measures are in place to protect data against unauthorised access, loss or disclosure, pursuant to Art. 32 GDPR.

Changes to this notice

This notice may be updated. The date of the last update is shown at the top of the page.