Information pursuant to art. 13 of the Regulation (EU) 2016/679 on the protection of personal data (GDPR).

Pursuant to the GDPR, this information describes the methods of processing the personal data of users who consult Level7 website (www.level7.it) or send emails containing personal data to info@level7.it

Data Controller
The Data Controller of the data relating to an identified or identifiable person who access this website (www.level7.it), possibly by registering on the same, if foreseen, is:

Level7 s.r.l., with registered office in Largo Montalto, 5 – 90144, Palermo (Italy)
(Tel: +39 091 877 64 32 ; e-mail: privacy@level7.it).

The Data Protection Officer (DPO) can be reached through this email address: dpo@level7.it.

In compliance with the GDPR, the website user may address his requests relating to the exercise of his/her rights in relation to personal data to the Data Controller or DPO via the contact details indicated above.

Purpose and legal basis of the processing
The personal data of the user of the website such as his/her contact details (name, email, telephone numbers or other contact details) and other personal data included in communications (e.g. provided by email or via form), will be processed for the following purposes:

a) respond to any requests for information or assistance;
b) sending any newsletters (concerning services and promotions) in the event of the user’s voluntary registration to the service;
c) provide registration to the site, if required;
d) fulfill any obligations required by law or EU regulations or legislation.

These purposes do not require a request for consent to data processing.
The processing of personal data referred to in letters a), b) and c) is necessary to respond to the requests of the interested party. The provision of personal data for these purposes is optional and voluntary, but failure to provide such data would make it impossible to activate/provide the services provided by the website.
The processing referred to in letter d) is necessary to comply with a legal obligation to which Level7 is subject pursuant to art. 6(1)(c) of the Regulation (GDPR).

Recipients of personal data
Within the scope of the above-mentioned purposes, the personal data of the website user will be shared only to authorized employees of Level7 s.r.l. and to subjects/authorities to whom it is mandatory to communicate such personal data according to the legal provisions.

No data deriving from access and navigation to this website is communicated or disclosed to third parties. Any personal data provided by those who access the reserved area, contacts and/or requests of any nature are used solely for the request sent and are communicated to third parties only if this is necessary to carry out the requested service.

Data transfer to third countries
The data controller will not transfer your personal data to third countries.

Data retention period
The personal data processed will be kept for the time that is strictly necessary to achieve the purposes indicated above, specifically:

• For the purposes referred to in letter a), for the time strictly necessary to satisfy the requests of the interested party.
• For the purposes referred to in letter b), the storage time is strictly connected to the needs of the interested party who has the possibility to unsubscribe from the service by clicking the link at the bottom of all newsletters. For these reasons, the data will be kept exclusively for the period in which the service will be active.
• For the purposes referred to in letter c), personal data relating to registered users will be kept for the entire registration period; if an account has remained inactive or unused for a period of 12 consecutive months it will be deactivated and subsequently deleted.
• For the purposes referred to in letter d), personal data will be kept until the time provided for by the specific obligation or applicable law.

Processed data
The types of processed data include the following:

Browsing data
This information is not collected specifically to be associated with identified users, but by its nature could allow you, through processing and association with data held by third parties, to identify users.
This category of data includes IP addresses or domain names of the computers used by users connecting to this website, the URI (Uniform Resource Identifier) ​​addresses of requested resources, the time of the request and other parameters related to the operating system and the user’s IT environment.

Data provided voluntarily by the user
when using certain services on the website, the personal data that the user of the website has voluntarily sent to Level7 may end up being processed by third parties. With respect to such hypotheses, the user acts as an independent data controller, assuming all the obligations and responsibilities of the law. In this sense, Leve7 cannot be held responsible in any way for any damage from processing by third parties. This particular reason for data processing has a suitable legal basis pursuant to Article 6 of the Regulation that legitimises the processing of the information in question.

Cookies and other related technologies
Level7 collects personal data through cookies. More information on the use of cookies and other similar technologies can be found here.

Rights of the interested party
The interested party may, at any time, exercise the following rights:

Pursuant to Articles 15 et seq. of the GDPR, the interested party has the right, at any time, to ask Level7 for access to his/her personal data, the correction or deletion of this data as well as to object to its processing, he/she has the right, pursuant to Article 18 of the Regulation, to request a restriction of processing of your data, as well as to obtain this data in a structured, commonly-used and machine-readable form as outlined in Article 20 of the Regulation.

In any case, the interested party has the right to lodge a complaint with the relevant Supervisory Authority (Personal Data Protection Authority), pursuant to Article 77 of the Regulation, if he/she believes that the processing of his/her personal data is in violation of existing legislation.

The aforementioned rights may be exercised by sending a specific request to the Data Controller through the contact channels indicated at the beginning of this privacy informative.
Requests relating to the exercise of the rights of the interested party will be processed without undue delay.