Privacy Policy

1. Data Controller

The Data Controller is:

YesUni Pro™ is a project and technology ecosystem developed within the activities of the Data Controller.

A Data Protection Officer (DPO) has not been appointed. For any matter relating to the processing of personal data, you may use the contact details provided above.

2. What data we collect

The data processed depends on how the user interacts with the website.

Data provided directly by the user

When a user requests contact or a demo, depending on the fields included in the form, we may collect:

• first and last name;
• email address;
• organisation or company;
• professional role;
• telephone number, where requested or voluntarily provided;
• country;
• language;
• product or solution of interest;
• message content;
• any other information voluntarily provided by the user.

Users are asked not to enter particularly sensitive information or special categories of personal data in free-text fields unless such information is necessary for the request.

Technical data

During normal browsing, certain technical data necessary for the operation and security of the website may be processed, such as IP address, date and time of the request, browser information and technical connection data.

This information is used to enable the operation of the website, ensure infrastructure security, prevent abuse and diagnose technical problems.

3. Information and demo requests

When a user completes a contact form or requests a demo, the information provided is used to:

• respond to the request;
• understand the needs of the interested organisation;
• arrange a presentation or demo of YesUni Pro;
• provide information about the requested products or services;
• continue communications directly related to the request;
• prepare, where requested, a commercial proposal or activities preliminary to entering into a contract.

The legal basis for processing is the performance of pre-contractual measures taken at the request of the data subject pursuant to Article 6(1)(b) GDPR.

Where a request is made by a person acting on behalf of a company, university, institution, association or other organisation, processing may also be based on the legitimate interest of the Data Controller in managing and following up the requested professional and commercial relationship pursuant to Article 6(1)(f) GDPR.

Data collected for the purpose of requesting a demo is not automatically used to subscribe the user to newsletters or promotional communications unrelated to the request.

4. Informational and commercial communications

Newsletters, commercial updates, event invitations or other promotional communications by email are sent only where an appropriate legal basis exists and, where required by applicable law, after obtaining specific consent.

Any consent:

• is optional;
• is separate from the request for a demo;
• does not affect the user's ability to receive information about the requested service;
• may be withdrawn at any time.

Each promotional email provides a simple way to withdraw consent or stop receiving communications.

Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

5. Purposes of processing and legal bases

Personal data may be processed for the following purposes.

6. Provision of data

Data marked as mandatory in the form is necessary in order to manage the request.

In particular, without an email address or another suitable contact detail, it would not be possible to respond to the request or arrange a demo.

Data marked as optional may be omitted without preventing submission of the request.

Any consent for marketing purposes is always optional and separate.

7. Processing methods and security

Data is processed using IT and electronic tools with technical and organisational measures appropriate to the level of risk.

Access to data is limited to persons who need it to carry out their activities and to providers involved in the technical management of services, within the limits of their respective functions.

YesUni Pro adopts a data-minimisation approach: only information reasonably necessary for the purposes described in this Privacy Policy is requested and retained.

8. Service providers and processors

For the management of the website and related services, the Data Controller may use technology providers that process personal data on its behalf, for example for:

• hosting and cloud infrastructure;
• databases;
• technical website management;
• transactional email delivery;
• security and technical monitoring;
• management of contact requests.

The technology services used may include Lovable, used for the development and/or infrastructure of the applications and website.

Where a provider processes personal data on behalf of the Data Controller, the relationship is governed in accordance with Article 28 GDPR.

The list of providers and processors may be updated over time as the technology infrastructure evolves.

Further information may be requested by contacting privacy@fiorerosalba.com.

9. Transfers outside the European Economic Area

Some technology providers may have companies, infrastructure or subprocessors located outside the European Economic Area.

Where processing involves an international transfer of personal data, the Data Controller verifies that the requirements of the GDPR are met and, where necessary, uses mechanisms such as European Commission adequacy decisions, Standard Contractual Clauses or other safeguards provided for by Articles 45 and following of the GDPR.

Further information on the applicable safeguards may be requested from the Data Controller.

10. How long we retain data

Data relating to an information or demo request is retained for the time necessary to manage the request and any subsequent communications.

Where the request leads to a contractual relationship, the necessary data is retained for the duration of that relationship and subsequently for the periods required by legal, administrative and accounting obligations or for the protection of the Data Controller's rights.

Data used for consent-based marketing purposes is processed until consent is withdrawn or until it is no longer necessary for the purpose for which it was collected.

Information necessary to document the granting or withdrawal of consent may be retained for the period necessary to demonstrate compliance with legal obligations.

Technical and security logs are retained for periods proportionate to operational, security, abuse-prevention and incident-management needs.

11. Cookies and similar technologies

The website may use cookies or technical technologies that are strictly necessary for its operation.

Any use of cookies, analytics tools, external services or other technologies requiring the user's consent is managed in accordance with applicable law and described in the relevant Cookie Policy.

Where required, users can choose their preferences before non-essential technologies are activated and may subsequently change those preferences.

12. Third-party links and services

YesUniPro.com may contain links to websites or services operated by third parties, such as LinkedIn or other external websites.

When users leave YesUniPro.com and access a service operated by another party, the processing of personal data is governed by that provider's privacy policy.

13. Automated decision-making and profiling

Data collected through the demo request form is not used to make decisions based solely on automated processing that produce legal effects concerning the data subject or similarly significantly affect them.

Users are not subject to advertising profiling based on information entered in the demo request form unless specific functionality is introduced in the future and appropriate information is provided in advance and, where required, consent is obtained.

14. Data subject rights

Where provided for by the GDPR, the data subject may:

• obtain confirmation as to whether personal data concerning them is being processed;
• access their personal data;
• request rectification;
• request erasure;
• request restriction of processing;
• object to processing based on legitimate interest;
• request data portability where applicable;
• withdraw any consent previously provided at any time.

The exercise of certain rights may be subject to the conditions and exceptions provided by applicable law.

Requests may be sent to:

privacy@fiorerosalba.com

Where necessary, information may be requested to verify the identity of the person making the request and prevent unauthorised access to personal data.

15. Complaint to the supervisory authority

The data subject also has the right to lodge a complaint with the competent supervisory authority.

For a Data Controller established in Italy, the relevant authority is:

Garante per la protezione dei dati personali — Italian Data Protection Authority

Information on how to exercise rights and lodge a complaint is available on the Authority's official website.

16. International users

YesUniPro.com is available in multiple languages and may be accessed by users and organisations located in different countries.

For users located in the European Economic Area, personal data is processed in accordance with the GDPR and applicable national legislation.

The different language versions of this Privacy Policy describe the same processing activities.

17. Changes to this Privacy Policy

This Privacy Policy may be updated to reflect changes to the website, services offered, providers used or applicable law.

The date of the latest update is shown at the beginning of the page.

Where significant changes are made, appropriate methods may be used to inform users.

18. Contact

For questions relating to this Privacy Policy or the processing of personal data: