Courtesy translation. This is an English translation of the Italian privacy policy, provided for convenience only. The Italian version is the sole binding text and prevails in the event of any discrepancy.
1Data controller
The data controller is Andrea Bonfichi, a sole proprietorship trading under the name FiguFoto.
- Registered office
- Via Luigi Montemartini 3, 27100 Pavia (PV), Italy
- VAT number
- 03427350966
- figufoto@libero.it
- Phone
- +39 388 8040268
2Data processed, purposes and legal basis
a) Browsing data
The computer systems that run the figufoto.com website automatically collect certain data whose transmission is inherent in the use of internet communication protocols: IP address, browser type and operating system, date and time of the request, and pages visited. This data serves only to allow the site to function securely and remains in the server logs of the hosting provider.
Legal basis: the controller’s legitimate interest in ensuring the site functions and is secure (Art. 6(1)(f) GDPR).
b) Contact requests
If you email us, call us or contact us via WhatsApp, we process the data you give us (name, name of the sports club, email address, telephone number and the content of your message) in order to answer your request and discuss the project with you.
Legal basis: steps taken at the data subject’s request prior to entering into a contract (Art. 6(1)(b) GDPR).
c) Contractual relationship and legal obligations
If the project goes ahead, we process the data needed to enter into and perform the contract and to meet tax, accounting and other legal obligations, including invoicing and the retention of accounting records.
Legal basis: performance of the contract (Art. 6(1)(b) GDPR) and compliance with legal obligations (Art. 6(1)(c) GDPR).
d) Photographs of club members
Producing the albums involves processing photographs of people (registered members, athletes, coaches and committee members) supplied by the commissioning sports club. In respect of those images the commissioning sports club acts as an independent data controller and is responsible for obtaining the necessary releases and consents, including the authorisation of those holding parental responsibility in the case of minors.
FiguFoto processes those images solely on the documented instructions of the commissioning club and for the sole purpose of producing the album, acting as a data processor (Article 28 GDPR). The images are not used for promotional purposes without a written agreement with the commissioning club.
Whether providing data is mandatory
Providing the data described under (b) is optional, but without it we cannot answer your request. Providing the data described under (c) is necessary in order to conclude and perform the contract and to issue the invoice; without it, the order cannot be processed.
3Marketing communications to customers
If you are already a customer, we may use the telephone number or email address collected when we supplied you in order to send you marketing communications about products and services similar to those you have already purchased, under Article 130(4) of Italian Legislative Decree 196/2003 (D.Lgs. 196/2003).
You may object at any time, free of charge and without formality, by replying to the message you received or by writing to figufoto@libero.it. Every communication explains how to object. An objection takes effect immediately and in no way affects the existing commercial relationship.
In all other cases, marketing communications are sent only with consent that is freely given, specific and revocable at any time.
Legal basis: Article 130(4) of Italian Legislative Decree 196/2003 and the legitimate interest in direct marketing to existing customers (Art. 6(1)(f) GDPR), or the data subject’s consent (Art. 6(1)(a) GDPR).
4Who receives the data
Data may be disclosed to parties who provide services necessary to our business, appointed as data processors where required:
- IT service providers (website hosting, email, messaging platforms)
- tax and accounting advisers
- printing, packing and shipping suppliers
- public authorities, in the cases provided for by law
An up-to-date list of recipients is available on request by writing to figufoto@libero.it. Data is not disseminated publicly and is not transferred to third parties for the marketing purposes of anyone other than the controller.
5Transfers outside the European Economic Area
As a rule, data is processed within the European Economic Area. Where a supplier involves a transfer to a third country, that transfer takes place on the basis of an adequacy decision of the European Commission or of standard contractual clauses approved by the Commission, together with any supplementary safeguards that may be required.
6Cookies
The figufoto.com website does not use cookies. There are no analytics tools, profiling cookies, advertising pixels, or fonts or other resources loaded from third-party servers. For this reason the site shows no consent banner: there is nothing to consent to.
7Retention period
- Browsing data: for as long as is technically necessary to run and secure the site.
- Contact requests not followed by a contractual relationship: 24 months from the last contact.
- Contractual, tax and accounting data: 10 years, as required by Article 2220 of the Italian Civil Code.
- Images and project materials: for the duration of the project and for 12 months after delivery, unless otherwise agreed in writing with the commissioning club.
- Data used for marketing communications: until you object or withdraw consent, and in any case no longer than 24 months from the last meaningful contact.
8Your rights as a data subject
You may exercise at any time the rights set out in Articles 15 to 22 GDPR: access to your data, rectification, erasure, restriction of processing, portability, objection to processing, and withdrawal of consent where the processing is based on consent.
To exercise them, simply write to figufoto@libero.it. We reply without undue delay and in any case within one month of the request.
You also have the right to lodge a complaint with the competent supervisory authority, which for Italy is the Garante per la protezione dei dati personali, the Italian Data Protection Authority (www.garanteprivacy.it).
9Changes to this policy
This policy may be updated to reflect changes in the law or in how we work. The version in force is always the one published on this page, with the last-updated date shown at the top.