Privacy Policy

R&D Communication S.r.l., with registered office at Via dei Castagni, 9, 37141 Montorio Veronese (VR) (hereinafter the “Data Controller”), owner of the website Home – rdcom (the “Website”) and the inTouch platform (together with the Website, the “System”), in its capacity as Data Controller of the personal data of Users of the System (the “Users”), provides this Privacy Policy pursuant to Article 13 of EU Regulation 2016/679 of 27 April 2016 (the “Regulation” and, together with Legislative Decree 196/2003 and subsequent amendments, the “Applicable Law”).

The Data Controller values the privacy and data protection rights of its Users.

Users may contact the Data Controller at any time by:

• Sending a registered letter with return receipt to the Data Controller’s registered office;
• Sending an email to privacy@rdcom.com;

Users may also contact the Data Protection Officer (DPO) at dpo@rdcom.com.

By browsing the Website, Users may register on the System (the “Service”) and request to receive commercial communications and updates regarding the System and other products and services offered by the Data Controller. The Data Controller collects personal data in connection with activities carried out via the System.

The System and the services available through the Website are reserved for individuals aged 18 or older. The Data Controller does not intentionally collect personal data from minors. On request, the Data Controller will promptly delete any personal data inadvertently collected from minors.

User personal data will be lawfully processed for the following purposes:

1.  Provision of the Service: to (i) enable browsing of the Website; (ii) execute the terms and conditions accepted upon registration; (iii) respond to specific User requests; (iv) communicate with the User via automated or telephone means about strictly technical or informative matters regarding the Service (e.g., service interruptions, bug fixes) to support them during registration and proper use of the Service. Collected data may include personal details, contact information, login credentials, billing information, and any additional personal data voluntarily provided by the User. Unless otherwise stated below, personal data will be used exclusively to verify User identity (e.g., email validation), prevent fraud or abuse, and contact the User for service purposes. Personal data will not be disclosed to other Users or third parties.
2. Administrative and accounting purposes: for internal organizational, administrative, financial, and accounting activities related to contractual and pre‑contractual obligations.
3. Legal obligations: to comply with legal or regulatory requirements.

Provision of data for these purposes is optional but required to process the User’s request. Required fields are marked with an asterisk in the request form.

The provision of personal data for the processing purposes indicated above is optional but necessary, as failure to provide such data will make it impossible for the User to submit their request to the Controller.

The personal data required for the purposes described in this paragraph 3 are marked with an asterisk in the request form.

• Marketing (advertising, direct sales, commercial communications)

Some personal data (such as name and contact details) may be used for marketing purposes, allowing the Data Controller to contact Users via email, phone (including automated systems), SMS, or messaging apps to offer products or services from the Data Controller or its partners, including promotions and offers.

Refusal of consent does not affect the User’s ability to use the System. Consent may be revoked at any time via the methods described in Section 8, or by clicking the unsubscribe link in promotional emails. If consent is revoked via one channel and not others, Users may specify their preference using the methods in Section 8.

The User may also easily object to further promotional communications via email by clicking on the appropriate link to withdraw consent, which is included in each promotional email. Once consent has been withdrawn, this will be confirmed via a dedicated thank you page. If the User wishes to withdraw their consent to receiving promotional communications through one specific channel while continuing to receive them through others, they are asked to submit a request to the Controller using the methods indicated in paragraph 8 below.

The Controller informs the User that, following the exercise of the right to object to receiving promotional communications, it is possible that, for technical and operational reasons (e.g., contact lists having been finalized shortly before the Controller receives the objection request), the User may continue to receive some additional promotional messages. Should the User continue to receive promotional messages more than 24 hours after exercising the right to object, they are requested to report the issue to the Controller using the contact details provided in paragraph 8 below.

• Soft spam

Users who have purchased products or services—or requested a “Free Trial”—may receive information or promotions related to similar products or services without prior consent, within legal limits (Article 130(4), Legislative Decree 196/2003). Users may opt out at any time via the unsubscribe links or methods in Section 8.

Provision of the Service (as described in paragraph 3, letter a)): the legal basis is Article 6(1)(b) of the Regulation, i.e., the processing is necessary for the performance of a contract to which the User is a party or in order to take steps at the request of the User prior to entering into a contract.

Administrative and accounting purposes (as described in paragraph 3, letter b)): the legal basis is Article 6(1)(b) of the Regulation, since the processing is necessary for the performance of a contract and/or to take steps at the request of the User prior to entering into a contract.

Legal obligations (as described in paragraph 3, letter c)): the legal basis is Article 6(1)(c) of the Regulation, as the processing is necessary for compliance with a legal obligation to which the Data Controller is subject.

Additional processing purposes: regarding the processing related to marketing and soft spam activities (as described in paragraphs 4.1 and 4.2 above):

• (i) the legal basis for marketing is Article 6(1)(a) of the Regulation, i.e., the data subject’s consent to the processing of their personal data for one or more specific purposes. For this reason, the Controller requests the User to provide specific, freely given, and optional consent in order to pursue this processing purpose;
• (ii) for the specific case of soft spam, this processing purpose will be pursued by the Controller without requiring the User’s consent, in accordance with the exemption provided by Article 130(4) of Legislative Decree no. 196/2003, without prejudice to the aforementioned possibility for the User to easily object.

The Data Controller will process Users’ personal data using both manual and electronic tools, with logic strictly related to the purposes outlined above and, in any case, in a manner that ensures the security and confidentiality of the data.

The personal data of Users of the System will be retained for the time strictly necessary to fulfill the primary purposes described in paragraph 3 above, or in any case as required for the legal protection of the interests of both the Users and the Data Controller (up to a maximum of 10 years from the termination of use of the Service).

In the case referred to in paragraph 4.1, Users’ personal data will be retained for the time strictly necessary to achieve the purposes described therein and, in any case, until the User withdraws their consent or deletes their account on the System.

In the case referred to in paragraph 4.2, Users’ personal data will be retained for the time strictly necessary to achieve the purposes described therein and, in any case, until the User objects to the processing or deletes their account on the System.

In any case, any retention periods provided for by applicable laws or regulations remain unaffected.

The User’s personal data may be transferred outside the European Union. In such cases, the Controller shall ensure that the transfer is carried out in compliance with the Applicable Regulations and, in particular, in accordance with Articles 45 (Transfer based on an adequacy decision) and 46 (Transfer subject to appropriate safeguards) of the Regulation.

Employees and/or collaborators of the Controller who are responsible for managing the System and User requests may become aware of Users’ personal data. These individuals have been appropriately instructed by the Controller pursuant to Article 29 of the Regulation and will process Users’ data exclusively for the purposes stated in this privacy notice and in compliance with the Applicable Regulations.

Additionally, third parties may become aware of Users’ personal data, acting as Data Processors on behalf of the Controller, such as providers of IT and logistical services necessary for the operation of the System, providers of outsourcing or cloud computing services, professionals, and consultants.

Users have the right to obtain a list of any data processors appointed by the Controller by making a request to the Controller using the methods indicated in the following paragraph 8.

Users may exercise the rights granted to them by the Applicable Regulations by contacting the Controller and/or the DPO using the contact details provided above.

Pursuant to the Applicable Regulations, the Controller informs Users that they have the right to obtain the following information: (i) the origin of their personal data; (ii) the purposes and methods of processing; (iii) the logic applied in case of processing carried out with the aid of electronic instruments; (iv) the identification details of the data controller and data processors;
(v) the entities or categories of entities to whom the personal data may be disclosed or who may become aware of them as data processors or persons in charge.

Moreover, Users have the right to obtain:
a) access to, updates, rectification, or, when interested, integration of their data;
b) the erasure, anonymization, or restriction of processing of data that is processed unlawfully, including data that does not need to be retained for the purposes for which it was collected or subsequently processed;
c) certification that the operations referred to in letters a) and b) have been notified, also in terms of their content, to those to whom the data has been communicated or disseminated, unless this proves impossible or involves a manifestly disproportionate effort compared to the protected right.

In addition, Users have:
a) the right to withdraw consent at any time, where processing is based on their consent;
b) the right (where applicable) to data portability (the right to receive all personal data concerning them in a structured, commonly used, and machine-readable format);
c) the right to object:

• i) in whole or in part, for legitimate reasons to the processing of personal data concerning them, even if relevant to the purpose of collection;
• ii) in whole or in part, to the processing of personal data concerning them for the purpose of sending advertising materials or direct sales or for carrying out market research or commercial communication;
• iii) if personal data is processed for direct marketing purposes, to object at any time to the processing of their data for such purposes, including profiling to the extent that it is related to such direct marketing.

d) If they believe that the processing of their data violates the Regulation, the right to lodge a complaint with a supervisory authority (in the Member State where they habitually reside, where they work, or where the alleged violation occurred).
The Italian supervisory authority is the Garante per la protezione dei dati personali, located at Piazza Venezia no. 11, 00187 – Rome (http://www.garanteprivacy.it/).