RISIVI LAB. S.R.L., Via della fontanella di borghese 41 - 00186, Rome (RM)
Dear User,
in compliance with the provisions of Legislative Decree No. 196/2003 and European Regulation 2016/679 (abbreviated as GDPR), RISIVI LAB S.R.L.S., in the person of its legal representative pro tempore, wishes to inform you that the personal data provided by you or acquired by us within the scope of our activity, which are necessary to implement the services offered to you, will be processed in compliance with the regulations on privacy and the principles of fairness, of lawfulness, of transparencyand of protection Of your confidentiality and your rights.
We wish, therefore, to convey the following information to you:
is the undersigned RISIVI LAB S.r.l., in the person of its legal representative pro tempore, with Registered Office at Via Della Fontanella di Borghese, 41 - 00186, Rome (RM), (P.1.14744131005) contactable at the following addresses:
tel. +393338754481
e-mail: info@risiviandco.com
DATA CONTROLLER (abbreviated DPO - Data Protection Officer)
RISIVI Rodrigo at RISIVI & Co can be contacted at the following address:
risivilab@pec.it;
2.1. The computer systems and software used to operate the RISIVI LAB site (www.risiviandco.com) acquire certain personal data that are implicit in the use of Internet information protocols (by way of example, domain names and IP addresses). These data are not accompanied by additional personal information and are used to obtain anonymous statistical information on the use of the site, to control the way the site is used and to ascertain possible responsibility in case of computer crimes. The legal basis legitimizing the processing of such data is the need to make the functionality of the corporate site usable as a result of the User's access.
2.2. The data voluntarily provided by the User, on the other hand, are those necessary for the Owner to provide the available services and are processed lawfully and in accordance with fairness, moreover, they are collected and recorded for the determined, explicit and legitimate purposes set forth below and are used in processing operations that are not incompatible with these purposes.
Personal data (personal identifying information such as, for example: first and last name, company name, tax code and VAT number, address, telephone/fax number, e-mail, bank and payment references) are collected and processed:
(a) to carry out customer relationship activities according to the pre-contractual and contractual agreements;
(b) for administrative, tax or accounting purposes internal related to the customer-supplier relationship and to fulfill the obligations in general imposed on the Controller by laws or regulations, by EU legislation, by requests from the judicial authorities or to exercise the Controller's rights (e.g., the right to defense in court);
c) In the presence of specific separate consent from the User, for the followingmarketing purposes: to send (via e-mail, mail, text message or telephone contact) newsletters, updates on the activities of the Owner, advertising material or commercial communications - possibly also personalized on the basis of the User's consumption habits (profiling) - on products or services offered by the Owner that the User may deem to be of his/her interest and to detect the degree of satisfaction with the quality of the services, including requests to participate in analyses or market research;
d) In the presence of specific separate consent from the User, for the following marketing purposes: to send (via e-mail, mail, sms or telephone contact) newsletters, updates, advertising material or commercial communications - possibly also personalized on the basis of the User's consumption habits (profiling) - about products or services offered by third parties such as, for example, business partners;
The legal basis legitimizing the processing of data under “a” (pre-contractual and contractual agreements) and “b” (administrative, accounting or tax purposes) is the performance of a contract for the provision of services to which the User is a party, or the performance of pre-contractual activities at the User's request.
In the cases expressly mentioned in “c” (marketing and profiling) and “d” (marketing and profiling by third parties), the legal basis is the consent freely given by the User.
2.3. Pursuant to Articles 9 and 10 of the GDPR, the User may provide the Data Controller with data that qualify as “special categories of personal data” (i.e., those data revealing “racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership...genetic data, biometric data intended to uniquely identify a natural person, data relating to a person's health or sex life or sexual orientation”). These categories of data may be processed by the Data Controller only with the User's consent, given in writing by signing this Notice, for contractual needs and related fulfillment of legal and tax obligations and for personnel selection needs.
The processing of the User's personal data is carried out by means of the operations of: collection, recording, organization, storage, consultation, processing, modification, selection, extraction, comparison, use, interconnection, blocking, communication, deletion and destruction of data.
The User's personal data are collected as a result of being sent directly to the Owner, by filling in forms or forms generally prepared for this purpose, also included in contractual documents, or collected by telephone by the operator as part of pre-contractual activities. Data are processed both by manual processing in paper format and by electronic or otherwise automated, computerized and telematic tools. The data collected are recorded and stored by the Data Controller in computer and paper files, as well as kept and controlled in such a way as to minimize the risks of destruction or loss, even accidental, unauthorized access and processing that is not permitted or does not conform to the purposes of collection.
The data are processed by employees or contractors of the Owner, duly trained to do so.
The provision of personal data related to the processing is optional in nature. However, the partial or total failure to provide data may result in the partial or total impossibility of establishing or continuing the relationship with the User, to the extent that such data are necessary for the execution of the same.
The provision of data for marketing purposes is also optional. The User may therefore decide not to confer any data or to deny later the possibility of processing data already provided: in this case, he/she will not be able to receive newsletters, commercial communications and advertising material in general inherent to the services offered by the Owner.
The processing of the User's data is carried out by internal staff of the Owner (employees, collaborators, System Administrators), identified and authorized for processing according to instructions that are given in compliance with the current regulations on privacy and data security.
Where necessary for the purposes listed in Article 2, the User's personal data may be processed by third parties appointed as Data Processors (pursuant to Article 28 of the GDPR) or “autonomous” Data Controllers, namely:
1. by professionals, companies, associations or professional firms that provide the Holder with assistance or advice for administrative, accounting, tax, or legal protection or personnel selection purposes;
2. by all Public Institutions established by law and more generally by all Entities established by current accounting and tax regulations as recipients of mandatory communications;
3. by banking institutions for collections and payments as well as by any professionals - in individual, associated or corporate form - for market analysis and research services, for the management of payments through credit cards or electronic payment instruments in general, postal couriers, for possible debt collection or for the financial statement certification activities of the Holder.
The updated list of Data Processors and Data Trustees is kept at the registered office of the Data Controller.
In any case, the User's personal data are not subject to dissemination.
As part of the management of the contractual relationship, no transfer of the User's data to third countries outside the EU or to international organizations is planned.
For the purposes referred to in letters “a” (pre-contractual and contractual agreements) and “b” (management of administrative, accounting or tax obligations) of Article 2.2. the User's personal data will be processed and stored by the Controller for the entire duration of the contractual relationship between the User and the Controller and, upon its termination for whatever reason, will be kept for the time provided for - for each category of data - by the current accounting, tax, civil and procedural regulations.
For the purposes of “c” (marketing and profiling) and “d” (marketing and profiling by third parties) the User's personal data will be processed and stored by the Data Controller until the User's consent is revoked or until the User exercises the right to object to the processing or the right to delete the personal data.
In your capacity as a Data Subject and in relation to the processing described in this Notice, you have the rights set forth in Articles 7, 15 to 21 and 77 of the GDPR and, in particular, the:
• right of access - Article 15 GDPR: the right to obtain confirmation as to whether or not personal data concerning the User is being processed and, if so, to obtain access to such personal data, including a copy thereof;
• right of rectification - Article 16 GDPR: the right to obtain, without undue delay, the rectification of inaccurate personal data concerning the User and/or the supplementation of incomplete personal data;
•right to cancellation (right to be forgotten) - Article 17 GDPR: right to obtain, without undue delay, the deletion of personal data concerning the User;
• right to limitation of processing - Article 18 GDPR: the right to obtain the restriction of processing, when: the Data Subject disputes the accuracy of personal data, for the period necessary for the Data Controller to verify the accuracy of such data; the processing is unlawful and the Data Subject objects to the deletion of personal data and instead requests that its use be restricted; the personal data is necessary for the Data Subject to establish, exercise or defend a right in court; the Data Subject has objected to the processing pursuant to Art. 21 GDPR, during the period pending verification as to whether the Data Controller's legitimate reasons prevail over those of the Data Subject;
• right to data portability - Article 20 GDPR: the right to receive, in a structured, commonly used and machine-readable format, personal data concerning the User provided to the Data Controller and the right to transmit it to another Data Controller without hindrance, if the processing is based on consent and is carried out by automated means. In addition, the right to have the User's personal data transmitted directly to another Data Controller if this is technically feasible;
• right of objection - Article 21 GDPR: the right to object at any time on grounds relating to your particular situation to the processing of personal data concerning you based on the lawful condition of legitimate interest or the performance of a task carried out in the public interest or in the exercise of official authority, including profiling, unless there are legitimate grounds for the Controller to continue processing that override the interests, rights and freedoms of the Data Subject or for the establishment, exercise or defense of a legal claim. In addition, the right to object at any time to the processing if personal data are processed for direct marketing purposes, including profiling, insofar as it is related to such direct marketing;
• right of revocation - Article 7 GDPR: You have the right to revoke your consent at any time. Revocation of consent does not affect the lawfulness of the processing based on the consent before revocation;
• right of complaint - Article 77 GDPR: The User has the right to lodge a complaint with the Italian Data Protection Authority, Piazza di Montecitorio 121, 00186, Rome (RM).
The User may at any time exercise his or her rights by sending a registered letter with return receipt to:
RISIVI LAB -Via Capo di Ferro, 27, 00186 Rome (RM) or at the email address: info@risiviandco.com.
In order to exercise the rights as set forth in this Notice as well as to receive any information related to the same, the User may contact the Data Controller or the DPO who, also through the designated facilities, will take charge of the request and provide the User, without undue delay and in any case, at the latest, within one month from the receipt of the same, with the information related to the action taken regarding the request.
The exercise of rights by the User is free of charge in accordance with Article 12 GDPR. However, in the case of requests that are manifestly unfounded or excessive, including due to their repetitiveness, the Data Controller may charge the User a reasonable fee in light of the administrative costs incurred in handling his/her request, or deny satisfaction of his/her request.
When the User participates in the game available on the Website and requests the discount code, the Data Controller collects:
Purpose. Name and email address are required to send the User the email confirming their address and, once confirmed, the discount code: without them, it would not be possible to deliver the requested reward. The IP address is processed for anti-abuse control.
Retention period. The IP address is deleted after 30 days. Name, email address, score, and discount code are deleted after 12 months.
Commercial communications. The «I want to receive news and offers» box is optional and separate from the prize: if left unchecked, the email address is used exclusively for sending the discount code. Consent, if given, may be revoked at any time via the unsubscribe link in each communication.
Recipients. Communications are sent via the email service used by the Data Controller, who acts as a data processor and processes the data solely for the purpose of delivering the messages.
User Rights. The User may at any time request access to, rectification or deletion of data by writing to info@risiviandco.com.
The latest modification to this Privacy Policy was made on August 27, 2026.
Italian Italian 
English
