Privacy policy<\/h2>\n<\/div>\n<\/div>\n
pursuant to Articles 13 and 14 of EU Regulation 2016\/679 (GDPR)<\/p>\n
Last updated: 17\/02\/2026<\/small><\/strong>[\/vc_column_text][vc_empty_space height=”25px”][vc_separator type=”small” position=”left” border_style=”solid” width=”200″ up=”0″ el_class=”border_extra”][vc_empty_space height=”25px”] <\/p>\n The Data Controller, i.e. the entity that determines the purposes and means of processing personal data, is:<\/p>\n \u2022 Name: Code0039 Societ\u00e0 Cooperativa Code0039, given the nature and scope of the processing activities carried out, is not currently required to designate a Data Protection Officer. For any matter relating to the processing of personal data, the data subject may nevertheless contact the Data Controller using the contact details provided above.<\/p>\n The processing of personal data is carried out by authorised natural persons (employees, collaborators) who operate under the direct authority of the Data Controller and who have received specific operational instructions in accordance with Article 29 GDPR.<\/p>\n <\/p>\n The following processing activities are necessary for the provision of requested services or to fulfil legal obligations. Failure to provide data indicated as mandatory prevents the corresponding service from being delivered.<\/p>\n Registration to the Client Area requires the following mandatory data: \u2022 Purpose<\/strong>: Creation and management of the customer account; access to reserved services; management of the contractual relationship with Code0039. Through the contact form on the Website, the following data are collected: \u2022 Purpose<\/strong>: Management and response to requests for information, quotes or assistance submitted by the user. \u2022 Purpose<\/strong>: Fulfilment of fiscal, accounting, social security and legal obligations required by applicable law. <\/p>\n The following processing activities are based on the free, specific, informed and unambiguous consent of the data subject. Failure to provide consent does not affect access to the mandatory services described in section 2 above. Consent may be withdrawn at any time without consequences.<\/p>\n Subject to explicit consent, personal data (name, email, and any phone number) may be used for: \u2022 Legal basis<\/strong>: Art. 6(1)(a) GDPR \u2013 consent of the data subject. Where the user decides to subscribe to the newsletter or marketing services, Code0039 adopts a double opt-in procedure to verify the actual intention to subscribe and the ownership of the email address provided. \u2022 Purpose<\/strong>: Verification of consent and protection of the user from unauthorised subscriptions made in their name. Users who subscribe to the Code0039 newsletter receive periodic communications relating to: new projects, interior design and furnishing trends, company news, events and editorial content.<\/p>\n \u2022 Data processed<\/strong>: Email address; name (optional). Navigation data and anonymous statistics: IT security and fraud prevention: <\/p>\n The processing of personal data is carried out using electronic tools (management software, web platforms, email systems) and, to a residual extent, paper-based tools, adopting technical and organisational security measures appropriate to the identified risks, in accordance with Articles 25 and 32 GDPR.<\/p>\n <\/p>\n The measures adopted include, by way of example: <\/p>\n Processing is carried out exclusively by authorised personnel or designated external processors. No automated decision-making process, including profiling, is in place that produces legal effects on or significantly affects the data subject (Art. 22 GDPR).<\/p>\n <\/p>\n In the forms on the Website, fields marked as mandatory (usually with an asterisk *) are essential for the provision of the requested service. Failure to provide such data makes it impossible to process the request. In summary: <\/p>\n Personal data is accessible exclusively to those who require it in the performance of their work duties or for the provision of the services set out in this policy. In particular, the following have access to the data: Personal data is in no way subject to indiscriminate disclosure to unidentified parties.<\/p>\n <\/p>\n Personal data may be disclosed, to the strictly necessary extent, to the following categories of third parties, who will process it as independent controllers or as duly appointed data processors: The Data Controller does not sell, transfer or disclose users’ personal data to third parties for external marketing purposes, unless the data subject has given explicit consent.<\/p>\n <\/p>\n Personal data is generally stored and processed within the European Union. Where, for technical or operational reasons, it becomes necessary to transfer data to countries outside the European Economic Area (EEA), Code0039 ensures that such transfer takes place in compliance with the provisions of Chapter V of the GDPR (Arts. 44\u201349), by adopting the following appropriate safeguards: The data subject may request specific information from the Data Controller regarding any transfers carried out and the safeguards adopted, by contacting the details indicated in this policy.<\/p>\n <\/p>\n Personal data is retained for the period strictly necessary to achieve the purposes for which it was collected, in compliance with the principle of storage limitation (Art. 5(1)(e) GDPR). Once this period has elapsed, the data is deleted or irreversibly anonymised.<\/p>\n <\/p>\n Where data is required to protect rights in legal proceedings, the retention period may be extended until the conclusion of the proceedings, including any appeals.<\/p>\n <\/p>\n As a data subject, pursuant to Arts. 15\u201322 GDPR, the user has the right to:<\/p>\n \u2022 Right of access (Art. 15)<\/strong>: Obtain confirmation of whether processing concerning them is taking place and access information relating to the purposes, categories of data processed, recipients, retention period and origin of the data. <\/p>\n The data subject may exercise their rights by sending a written request to the Data Controller via one of the following channels: The Data Controller will respond to the request without undue delay and, in any case, within 30 days of receipt (Art. 12(3) GDPR). This period may be extended by a further 60 days in cases of particular complexity or a high number of requests, provided the data subject is informed of the reasons for the delay. Where the Data Controller has reasonable doubts about the identity of the applicant, it may request additional information necessary to confirm it, in compliance with the principle of data minimisation.<\/p>\n <\/p>\n The Data Controller uses third parties for the provision of services instrumental to its activities (e.g. hosting, IT management, newsletter delivery, analytics). Where such parties process personal data on behalf of the Data Controller, they are appointed as Data Processors pursuant to Art. 28 GDPR by means of a specific contractual agreement governing instructions, security measures and processing limits. An up-to-date list of Data Processors may be requested from the Data Controller using the contact details provided in this policy. <\/p>\n Code0039 reserves the right to modify or update this policy at any time, in particular following regulatory changes, technical or organisational updates that affect the methods of processing personal data. Code0039 Societ\u00e0 Cooperativa \u2013 VAT 02474030695 \u2013 info@code0039.it \u2013 www.code0039.it<\/span><\/div>[vc_empty_space height=”25px”][\/vc_column_inner][vc_column_inner width=”5\/12″][vc_empty_space height=”25px”][\/vc_column_inner][\/vc_row_inner][vc_empty_space height=”75px”][\/vc_column][\/vc_row][vc_row row_type=”row” use_row_as_full_screen_section=”no” type=”full_width” text_align=”left” background_animation=”none” css_animation=”” background_color=”#1b1b1b” css=”.vc_custom_1592401766031{background-image: url(https:\/\/code0039.it\/rev\/wp-content\/uploads\/2020\/06\/Contract_BG_lines_white2.png?id=549) !important;background-position: center !important;background-repeat: no-repeat !important;background-size: cover !important;}”][vc_column offset=”vc_hidden-sm vc_hidden-xs”][vc_empty_space height=”125px”][vc_empty_space height=”125px”][\/vc_column][\/vc_row]<\/p>\n","protected":false},"excerpt":{"rendered":" [vc_row row_type=”row” use_row_as_full_screen_section=”no” type=”full_width” text_align=”left” background_animation=”none” css_animation=”” css=”.vc_custom_1592574503774{background-image: url(https:\/\/code0039.it\/rev\/wp-content\/uploads\/2020\/06\/Azienda_header_bg.jpg?id=614) !important;background-position: center !important;background-repeat: no-repeat !important;background-size: cover…<\/p>\n","protected":false},"author":6,"featured_media":0,"parent":0,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"full_width.php","meta":{"footnotes":""},"class_list":["post-16038","page","type-page","status-publish","hentry"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t1. ROLES<\/strong><\/h3>\n
Data Controller<\/strong><\/h4>\n
\n\u2022 Lanciano Office: Largo Mario Bianco, 29 \u2013 66034 Lanciano (CH)
\n\u2022 Pescara Office: Via degli Equi, 8 \u2013 65127 Pescara (PE)
\n\u2022 VAT: 02474030695 | REA: CH-181741
\n\u2022 Email: info@code0039.it
\n\u2022 PEC: code0039@pec.it
\n\u2022 Tel: +39 0872 700592 | +39 320 8705497 | +39 329 3905656<\/p>\n<\/h4>\n
Data Protection Officer (DPO)<\/strong><\/h4>\n
<\/h4>\n
Authorised Processors<\/strong><\/h4>\n
2. PURPOSES OF MANDATORY PROCESSING<\/strong><\/h3>\n
<\/h4>\n
Processing of personal data for Client Area registration<\/strong><\/h4>\n
\n\u2022 First and last name
\n\u2022 Email address
\n\u2022 Password (stored in encrypted form)<\/p>\n
\n\u2022 Legal basis<\/strong>: Art. 6(1)(b) GDPR \u2013 performance of a contract or pre-contractual measures taken at the request of the data subject.
\n\u2022 Retention<\/strong>: For the duration of the contractual relationship and, thereafter, for 10 years to fulfil fiscal and accounting obligations.<\/p>\n<\/h4>\n
Processing of personal data for contact request management<\/strong><\/h4>\n
\n\u2022 Name (mandatory)
\n\u2022 Email address (mandatory)
\n\u2022 Subject of the request (optional)
\n\u2022 Message text (mandatory)<\/p>\n
\n\u2022 Legal basis<\/strong>: Art. 6(1)(b) GDPR \u2013 pre-contractual measures taken at the request of the data subject; Art. 6(1)(f) GDPR \u2013 legitimate interest of the Data Controller in responding to received communications.
\n\u2022 Retention<\/strong>: 24 months from receipt of the request, unless longer retention is required for the protection of rights in legal proceedings.<\/p>\n<\/h4>\n
Processing of data for fiscal, accounting and legal obligations<\/strong><\/h4>\n
\n\u2022 Legal basis<\/strong>: Art. 6(1)(c) GDPR \u2013 compliance with a legal obligation to which the Data Controller is subject.
\n\u2022 Retention<\/strong>: 10 years from the end of the relevant fiscal year, unless otherwise provided by law.<\/p>\n3. PURPOSES OF NON-MANDATORY PROCESSING<\/strong><\/h3>\n
<\/h4>\n
Processing of personal data for marketing<\/strong><\/h4>\n
\n\u2022 Sending promotional communications relating to the design, contract and furnishing services offered by Code0039
\n\u2022 Proposing special offers, events and industry news
\n\u2022 Basic profiling activities to personalise commercial communications<\/p>\n
\n\u2022 Retention<\/strong>: Until consent is withdrawn by the data subject.<\/p>\n<\/h4>\n
Processing of personal data for the double opt-in process<\/strong><\/h4>\n
\nThe procedure involves:
\n\u2022 Collection of the email address at the time of registration
\n\u2022 Sending of a confirmation email to the provided address
\n\u2022 Activation of the subscription only upon clicking the confirmation link<\/p>\n
\n\u2022 Legal basis<\/strong>: Art. 6(1)(c) and (f) GDPR \u2013 obligation to document consent (Art. 7(1) GDPR) and legitimate interest of the Data Controller.
\n\u2022 Retention<\/strong>: The confirmation log is retained for the entire duration of the subscription and for 5 years thereafter as proof of consent.<\/p>\n<\/h4>\n
Processing of personal data for the newsletter<\/strong><\/h4>\n
\n\u2022 Legal basis<\/strong>: Art. 6(1)(a) GDPR \u2013 consent of the data subject.
\n\u2022 Retention<\/strong>: Until unsubscription or withdrawal of consent. Unsubscription is possible at any time via the link included in every email.<\/p>\n<\/h4>\n
Other processing activities<\/strong><\/h4>\n
\n\u2022 Purpose<\/strong>: Analysis of user behaviour on the Website in order to improve the browsing experience and published content.
\n\u2022 Legal basis<\/strong>: Art. 6(1)(f) GDPR \u2013 legitimate interest of the Data Controller in improving its digital services.
\n\u2022 Data processed<\/strong>: Anonymised IP address, pages visited, session duration, browser and device used.
\n\u2022 Retention<\/strong>: 13 months from collection, in line with the recommendations of the Italian Data Protection Authority.<\/p>\n
\n\u2022 Purpose<\/strong>: Detection of unauthorised access attempts, fraudulent activities or security breaches on the Website.
\n\u2022 Legal basis<\/strong>: Art. 6(1)(f) GDPR \u2013 legitimate interest of the Data Controller in the security of its IT systems.
\n\u2022 Retention<\/strong>: 6 months from collection, unless required by ongoing investigations.<\/p>\n4. PROCESSING METHODS<\/strong><\/h3>\n
\n\u2022 Encryption of data in transit via HTTPS\/TLS protocol
\n\u2022 Access control to IT systems via personal credentials
\n\u2022 Data backup and recovery procedures
\n\u2022 Periodic training of staff authorised to process data
\n\u2022 Pseudonymisation and data minimisation where technically feasible<\/p>\n5. NATURE OF DATA PROVISION AND CONSEQUENCES OF REFUSAL<\/strong><\/h3>\n
\nOptional fields allow for an improved quality of response or service but are not required; failure to complete them does not preclude access to the requested service.<\/p>\n
\n\u2022 Mandatory data (basic services)<\/strong>: refusal prevents the provision of the requested service.
\n\u2022 Marketing and newsletter data<\/strong>: refusal has no consequence on the use of the main services; it only results in not receiving commercial or informational communications.
\n\u2022 Navigation data<\/strong>: collected automatically; the user may limit their collection through browser settings or cookie preferences.<\/p>\n6. ACCESS TO DATA<\/strong><\/h3>\n
\n\u2022 Internal staff<\/strong>: employees and collaborators of Code0039 expressly authorised and appointed as data processors, limited to the data necessary for their functions (minimisation and need-to-know principles).
\n\u2022 External processors<\/strong>: third parties appointed as Data Processors pursuant to Art. 28 GDPR (e.g. IT providers, cloud services, email platforms) who act on the instructions of the Data Controller and in compliance with the security measures contractually agreed.
\n\u2022 Public authorities<\/strong>: only in cases provided for by law (e.g. requests from the Judicial Authority, the Financial Police, the Revenue Agency).<\/p>\n7. DISCLOSURE OF DATA<\/strong><\/h3>\n
\n\u2022 Consultants and professionals: accountants, lawyers, labour consultants and other professionals who assist Code0039 in carrying out its activities.
\n\u2022 Banking and financial institutions: for the management of payments and financial obligations connected to contracts entered into.
\n\u2022 IT service providers: hosting providers, cloud services, CRM and email marketing platforms, acting as Data Processors pursuant to Art. 28 GDPR.
\n\u2022 Public authorities: the Revenue Agency, Chambers of Commerce, social security bodies, the Judicial Authority, in cases provided for by law.<\/p>\n8. TRANSFER OF DATA TO THIRD COUNTRIES<\/strong><\/h3>\n
\n\u2022 Adequacy decisions by the European Commission (Art. 45 GDPR)
\n\u2022 Standard Contractual Clauses approved by the European Commission (Art. 46(2)(c) GDPR)
\n\u2022 Other appropriate safeguards pursuant to Art. 46 GDPR<\/p>\n9. DATA RETENTION<\/strong><\/h3>\n
\n\n
\n \nType of data \/ processing<\/th>\n Retention period<\/th>\n<\/tr>\n<\/thead>\n \n Contact requests<\/td>\n 24 months from receipt<\/td>\n<\/tr>\n \n Client Area account<\/td>\n Duration of relationship + 10 years (fiscal obligations)<\/td>\n<\/tr>\n \n Contracts and client documentation<\/td>\n 10 years from end of relationship<\/td>\n<\/tr>\n \n Marketing and profiling<\/td>\n Until consent is withdrawn<\/td>\n<\/tr>\n \n Newsletter<\/td>\n Until unsubscription<\/td>\n<\/tr>\n \n Double opt-in log<\/td>\n Duration of subscription + 5 years (proof of consent)<\/td>\n<\/tr>\n \n Navigation data<\/td>\n 13 months from collection<\/td>\n<\/tr>\n \n Security logs<\/td>\n 6 months, unless required by ongoing investigations<\/td>\n<\/tr>\n \n Invoices and accounting documents<\/td>\n 10 years pursuant to Art. 2220 of the Italian Civil Code<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n 10. DATA SUBJECT RIGHTS<\/strong><\/h3>\n
\n\u2022 Right to rectification (Art. 16)<\/strong>: Obtain the correction of inaccurate or incomplete personal data concerning them.
\n\u2022 Right to erasure \/ “right to be forgotten” (Art. 17)<\/strong>: Obtain the deletion of personal data in cases provided for by law (e.g. data no longer necessary, withdrawal of consent, unlawful processing).
\n\u2022 Right to restriction of processing (Art. 18)<\/strong>: Obtain the restriction of processing in the cases provided for by law (e.g. contestation of data accuracy, unlawful processing, objection pending verification).
\n\u2022 Right to data portability (Art. 20)<\/strong>: Receive personal data in a structured, commonly used and machine-readable format, and transmit it to another controller, where technically feasible.
\n\u2022 Right to object (Art. 21)<\/strong>: Object at any time to the processing of personal data based on legitimate interest or public interest, as well as to processing for direct marketing purposes.
\n\u2022 Right to withdraw consent (Art. 7(3))<\/strong>: Withdraw consent previously given at any time, without affecting the lawfulness of processing carried out prior to withdrawal.
\n\u2022 Right to lodge a complaint (Art. 77)<\/strong>: Lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it) if they believe that processing violates the GDPR.<\/p>\n11. HOW TO EXERCISE YOUR RIGHTS<\/strong><\/h3>\n
\n\u2022 Email: info@code0039.it
\n\u2022 PEC: code0039@pec.it
\n\u2022 Post: Code0039 Societ\u00e0 Cooperativa, Largo Mario Bianco, 29 \u2013 66034 Lanciano (CH)<\/p>\n
\nThe exercise of rights is free of charge. Where requests are manifestly unfounded or excessive, the Data Controller may charge a reasonable fee or refuse to fulfil the request, stating the reasons for doing so.<\/p>\n12. EXTERNAL PROCESSORS AND AUTHORISED STAFF<\/strong><\/h3>\n
\nThe main categories of external processors currently engaged include:
\n\u2022 Hosting and web infrastructure providers: management of the servers and systems on which the Website operates.
\n\u2022 Email and CRM platforms: delivery of newsletters, transactional communications and contact management.
\n\u2022 Web traffic analytics services: collection of anonymous or aggregated statistical data on browsing.
\n\u2022 Technical and IT consultants: maintenance and development of the Website.<\/p>\n
\nAuthorised processors are the natural persons (employees and collaborators) authorised by the Data Controller to carry out processing operations, pursuant to Art. 29 GDPR and Recital 81 GDPR.<\/p>\n13. CHANGES TO THIS POLICY<\/strong><\/h3>\n
\nAny changes will be published on this page with an updated date in the header. In the event of substantial changes that significantly affect the rights of data subjects, Code0039 undertakes to provide adequate notice via an announcement on the Website or direct communication to registered users.
\nWe recommend consulting this page periodically to stay informed about the personal data processing methods adopted by Code0039. The version currently in force is always the one published on the Website.<\/p>\n