Art. 2 - Subject of the Processing

1. The Controller processes identifying personal data (such as: name, surname, company name, address, phone number, email, bank and payment details, tax code) – (hereinafter, “personal data” or “data”) provided by you during the establishment and/or execution of contractual relationships with the Controller.

Art. 3 - Purpose and Legal Basis of Processinga

Your personal data is processed::

1. Without your express consent (Art. 6 (b), (e) GDPR), for the following purposes::
   
   1. To conclude contracts with the Controller;
   2. To fulfill pre-contractual, contractual, and fiscal obligations deriving from existing relationships with you;
   3. For the protection of credit rights and better management of our rights related to the specific contractual relationship with you;
   4. To comply with legal obligations, regulations, community law, or orders of authorities (such as anti-money laundering regulations);
   5. To exercise the Controller's rights (such as the right to defense in legal proceedings).
2. Only with your express consent (Art. 7 GDPR), for the following purposes:
   
   1. Via email, postal mail, and/or SMS, and/or WhatsApp, and/or phone contacts, to send or communicate to you:
      
      1. Newsletters, commercial communications, and/or advertising material on products or services offered by the Controller and feedback surveys on the quality of products and services;
      2. Emails, postal mail, SMS, WhatsApp, or phone contacts for conducting market analysis, statistics, quality control, marketing operations, and information about future business initiatives, new products, and services;
      3. To share data with third parties for purposes not related to contractual obligations.
3. Please note that if you are already our customer or supplier, we may send you commercial communications regarding services and products similar to those you have already used, unless you object.

Art. 4 - Methods of Processing and Security

I suoi dati personali sono trattati:

1. The processing will be carried out in both analog (paper) and digital (using computer tools) formats, in compliance with the provisions of Art. 32 GDPR on security measures, by the Controller and/or specifically authorized parties in accordance with Art. 29 GDPR. In compliance with the principles of lawfulness, purpose limitation, and data minimization, as provided by Art. 5 GDPR 2016/679, your data will be processed and stored for the time necessary to achieve the purposes for which it was collected and, in any case, for the time required by law.
2. We have adopted extensive technical and operational security precautions to protect your data from the risk of manipulation, loss, destruction, or unauthorized access, whether accidental or intentional. Our security measures are periodically reviewed and updated to keep up with technological advancements.
3. In this regard, we inform you that the Controller takes every reasonable measure to protect your personal data from loss, misuse, or unauthorized access, dissemination, alteration, or destruction. Please note that no Internet transmission is ever completely secure or error-free.

Art. 5 - Data Recipients

1. Within the limits related to the purposes of processing (both implicit and explicit), your data may be communicated to:
   
   1. Employees and collaborators of the Controller;
   2. Business partners;
   3. Credit institutions;
   4. Debt collection companies;
   5. ‍
   6. External professionals and consultants;
   7. Any subcontractors or sub-suppliers engaged in activities related to our contractual relationships;
   8. Parties specifically appointed and/or authorized by the Controller who provide data processing services, consultancy, financial statement certifications, or who carry out activities that are instrumental, complementary, and functional to the Controller in executing activities related to the existing contractual relationship;
   9. All subjects to whom communication is mandatory due to legal obligations..
2. Without the need for express consent (Art. 6 (b) and (c) GDPR), the Controller may communicate your data for the purposes outlined in point 3.1 to supervisory bodies, judicial authorities, insurance companies for the provision of insurance services, as well as to those subjects to whom communication is obligatory by law to fulfill the mentioned purposes. These subjects will process the data as independent data controllers. Your data will not be disseminated.

Art. 6 - Data Transfer Abroad

1. The data will be processed at the Controller's headquarters and at all the locations of the parties involved in the processing (such as recipients/third parties, exclusively within the scope of the purposes indicated above).
2. Please note that the use of Cloud services (such as Google Drive or OneDrive) may involve the transfer of data outside the European Union, always in compliance with current legislation and with the guarantee of an adequate level of personal data protection based on an adequacy decision, standard clauses defined by the European Commission, or Binding Corporate Rules (Articles 46, 47, and 49 GDPR).

Art. 7 - Retention Period of Personal Data

1. The collected data will be retained for no longer than necessary to achieve the purposes for which they are processed ("principle of storage limitation", Art. 5 GDPR) or based on the deadlines required by law.
2. The Controller will therefore process your personal data for the time necessary to fulfill the purposes mentioned above, subject to the five-year or ten-year retention periods for civil, accounting, and tax documents as provided by the applicable laws for the purposes of point 3 (a), and for no longer than 5 years after the termination of the contractual relationship, except in cases of legal and/or administrative/accounting obligations, in which case the retention period will be longer.
3. A periodic review of the obsolescence of stored data, in relation to the purposes for which it was collected, is carried out.

Art. 8 - Data Subject's Righto

1. As the data subject, you have the rights outlined in Articles 15-22 of Regulation (EU) No. 2016/679, specifically the rights to: right of access, right to rectification, right to erasure (“right to be forgotten”), right to restriction of processing, right to data portability, right to object, as well as the right to lodge a complaint with the Supervisory Authority.

Art. 9 - Newsletter
‍

1. With your consent, as provided by Article 6(1)(a) of the GDPR, you can subscribe to our newsletter, which will keep you updated on our initiatives.
2. The only required information for sending the newsletter is your email address. Additional data may be provided voluntarily and will be used to contact you personally. After your confirmation, we will save your email address for the purpose of sending you the newsletter. The legal basis for this is Article 6(1)(a) of the GDPR.
3. You can withdraw your consent to receive the newsletter at any time by clicking the link provided in each newsletter or by contacting our Data Protection Officer.

Art. 10 - Response Time to Requests

1. In case of a request concerning processed data, the Controller will respond as soon as possible—unless this proves impossible or entails a disproportionate organizational burden—and in any case, no later than 30 days from the request. Any impossibility or delays in fulfilling requests by the Controller will be justified.

Art. 11 - Complaints
‍

1. If you wish to lodge a complaint regarding how we have handled your personal data, you can contact our officer at the following email address: hello@clhub.art. The Controller and the Officer will then review the complaint and work to resolve the issue.
2. If you believe your personal data has not been handled appropriately in accordance with the law, you may file a complaint, pursuant to Article 77 of EU Regulation 679/2016, with the Data Protection Authority at the following email address: garante@gpdp.it.

The data subject signs for acknowledgment and express acceptance of the above, pursuant to and for the purposes of Article 7 of EU Regulation 679/2016.