Privacy Policy

LEAFYX Imaging di Lorenzo Pampaloni, sole proprietorship (ditta individuale)
Via Alberto Arnoldi 30
50143 Firenze (FI), Italy

Email: info@leafyximaging.com
VAT no.: 07549820483

The site processes only the following data:

• Data that users send us through the contact form, by email or by telephone: first name and surname, email address, subject and text of the message, and any other data that the user chooses to provide.
• Browsing data: like any web server, the hosting provider's systems record some technical data about requests (IP address, date and time, page requested, type of browser and operating system).
• Technical data of the contact form: to block automated submissions, the IP address of the person submitting the form is kept only as a non-reversible fingerprint (hash) and for a very short time.

The site does not use profiling cookies or statistics tools and does not load resources from third-party servers: fonts and libraries are hosted on the same server as the site. Details of the technical tools used in the browser are given in the Cookie Policy.

We ask you not to include in your messages medical data or other special categories of personal data: they are not needed to reply to your requests.

Personal data are processed exclusively for the following purposes, each with its own legal basis:

• Replying to requests for information or demos sent through the form, by email or by telephone. Legal basis: steps taken at the request of the data subject prior to entering into a contract (Article 6(1)(b) GDPR) and the legitimate interests of the controller in replying to the communications received (Article 6(1)(f) GDPR).
• Ensuring the operation and security of the site and of the contact form, including against automated submissions and abuse. Legal basis: the legitimate interests of the controller (Article 6(1)(f) GDPR).
• Complying with legal obligations and, where necessary, establishing, exercising or defending legal claims. Legal basis: legal obligation (Article 6(1)(c) GDPR) and the legitimate interests of the controller (Article 6(1)(f) GDPR).

The data are not used for marketing purposes or for profiling and are not subject to decisions based solely on automated processing.

The provision of data is optional. However, name, email address, subject and message are necessary to submit the contact form and receive a reply: without these data the request cannot be handled.

• Contact requests: up to 24 months from the last contact. If the request leads to a contractual relationship, the data necessary are kept for the duration of the relationship and, afterwards, for the period required by law (for example 10 years for accounting and tax records).
• Technical data of the contact form: 24 hours at most.
• Browsing data recorded by the server: for the time necessary for the technical security of the service, unless they are needed to establish computer crimes at the request of the authorities.

After these periods, the data are erased or anonymised.

The data are not made public (disseminated) or transferred to third parties. They may be disclosed, to the extent necessary, to:

• the provider of the website's hosting and of the domain mailbox, which acts as processor pursuant to Article 28 GDPR;
• Google, provider of the Gmail service to which incoming messages are forwarded;
• the controller's advisers, for example for accounting and tax obligations, if the request leads to a contractual relationship;
• public authorities, where disclosure is required by law.

The website and the domain mailbox are hosted on servers in the European Union. Incoming messages are, however, forwarded to Google’s Gmail service, which may also process them in the United States. The transfer is based on the European Commission’s adequacy decision of 10 July 2023 on the EU-U.S. Data Privacy Framework (Article 45 GDPR), in which Google LLC participates.

At any time the data subject may exercise the rights provided for in Articles 15 to 22 GDPR:

• access to their personal data (Article 15);
• rectification (Article 16) and erasure (Article 17);
• restriction of processing (Article 18);
• data portability (Article 20);
• objection to processing based on the legitimate interests of the controller (Article 21).

Requests should be sent to the email address info@leafyximaging.com; a reply will be given without undue delay and in any event within one month (Article 12 GDPR).

The data subject also has the right to lodge a complaint with the supervisory authority (Article 77 GDPR): in Italy, the Garante per la protezione dei dati personali, the Italian Data Protection Authority - www.garanteprivacy.it.

This Privacy Policy may be updated at any time. Changes will be published on this page with the relevant update date.