Privacy Policy

1. Controller

The controller responsible for the processing of personal data (the "Controller") is:

• Controller: Ricasoli Swiss SA
• Registered office: Via Giacometti 1, 6900 Lugano, Switzerland
• UID: CHE-410.717.248 (Commercial Register of the Canton of Ticino)
• Email: info@ricasoligroup.ch

The Controller has not appointed a data protection advisor under Art. 10 FADP or a data protection officer under Art. 37 GDPR. Any request relating to the processing of personal data may be sent to the email address above.

Representative in the European Union (Art. 27 GDPR)
Who can be contacted at info@ricasoligroup.ch

2. Applicable law

The processing of personal data is governed by the Federal Act on Data Protection (FADP; SR 235.1) and the related Data Protection Ordinance (DPO; SR 235.11). To the extent the Controller offers services to persons located in the European Union or the European Economic Area (EU/EEA), or monitors their behaviour, the GDPR also applies. Information specific to data subjects covered by the GDPR is included in this Privacy Policy.

3. Categories of data processed

The Controller processes the following categories of personal data:

• Contact and identification data — first name, last name, email address, telephone number and any other information voluntarily provided through the contact or enquiry forms on the Website;
• Newsletter subscription data — email address and any subscription preferences;
• Browsing data — data collected automatically while browsing (e.g. IP address, browser and device type, pages visited, date and time of access);
• Data collected through cookies and similar technologies — as described in the Cookie Policy published on the Website.

The Controller does not request, through the Website, sensitive personal data (Art. 5 let. c FADP) or special categories of data (Art. 9 GDPR). Users are asked not to enter such data in free-text fields of the forms.

4. Purposes and legal bases of processing

Personal data are processed in accordance with the principles set out in Art. 6 FADP (lawfulness, good faith, proportionality, purpose limitation, accuracy) for the purposes listed below. Where the FADP requires a justification, this consists of the data subject's consent, an overriding private or public interest, or the law (Art. 31 FADP). For data subjects covered by the GDPR, the relevant legal basis is indicated.

• Responding to enquiries — handling requests for information and contact submitted through the Website. GDPR legal basis: steps taken at the data subject's request prior to entering into a contract and the Controller's legitimate interest in responding (Art. 6(1)(b) and (f) GDPR).
• Sending the newsletter — sending informational and promotional communications about the Controller's services. Sending takes place only with prior consent, in accordance with Art. 3 para. 1 let. o of the Federal Act against Unfair Competition (UCA; SR 241); every communication contains an unsubscribe link. GDPR legal basis: consent (Art. 6(1)(a) GDPR), which may be withdrawn at any time.
• Operation and security of the Website — ensuring the technical delivery of the Website, preventing misuse and analysing security incidents using browsing data. GDPR legal basis: the Controller's legitimate interest (Art. 6(1)(f) GDPR).
• Statistics and marketing via cookies — only where the user has consented, as described in the Cookie Policy. GDPR legal basis: consent (Art. 6(1)(a) GDPR).
• Legal compliance — complying with obligations under the law, an ordinance or a decision of an authority. GDPR legal basis: legal obligation (Art. 6(1)(c) GDPR), where the obligation arises under EU or Member State law; otherwise legitimate interest (Art. 6(1)(f) GDPR).
• Protection of rights — establishing, exercising or defending legal claims, in or out of court. GDPR legal basis: the Controller's legitimate interest (Art. 6(1)(f) GDPR).

5. Whether providing data is mandatory

Browsing data are collected as described in the Cookie Policy. Providing the data requested through the Website forms is voluntary; however, failure to provide data marked as mandatory makes it impossible to handle the request or provide the service.

6. Recipients and processors

For the purposes set out above, personal data may be disclosed to the following categories of recipients, who process them either as processors bound by contract (Art. 9 FADP; Art. 28 GDPR) or as independent controllers:

• technical and hosting service providers for the Website Vercel, Supabase, Github;
• email and contact-form service providers Widget ConvertKit, Google Tag Manager, Microsoft Clarity, Mailgun, Whatsapp Business Client Aissitant, Whatsapp Business Chat Widget Cloudflare, Bunny CDN, Twitter Tweet Button and Social Widgets, Cloudflare Bot management, Google Analytics, Google Fonts and Video Vimeo, Facebook Remarketing, Conversion tracking for Meta Ads, Whatsapp Business for direct marketing.
• the email marketing platform provider used for the newsletter Active campaign, Nethunt;
• website analytics providers Google Analytics subject to consent, as described in the Cookie Policy;
• group companies and business partners (e.g. accommodation providers, carriers, partner agencies), solely where necessary to handle the data subject's request;
• advisers, professionals and service providers of the Controller (e.g. accounting, tax and legal), to the extent necessary for their respective engagements;
• public authorities, where required by law or by a decision of an authority.

An up-to-date list of recipients is available on request by writing to the Controller's email address.

7. Disclosure of data abroad

Some of the recipients listed above may process personal data outside Switzerland, in particular in EU/EEA states and in the United States of America.

Disclosure to states that the Federal Council considers to provide an adequate level of data protection (Annex 1 DPO), including EU/EEA states, takes place without additional safeguards. Data may be disclosed to recipients in the United States that are certified under the Swiss-U.S. Data Privacy Framework. In all other cases, disclosure takes place only with appropriate safeguards under Art. 16 para. 2 FADP — in particular standard contractual clauses recognised by the Federal Data Protection and Information Commissioner (FDPIC) — or on the basis of an exception under Art. 17 FADP (e.g. explicit consent or performance of a contract with the data subject). For data subjects covered by the GDPR, transfers to Switzerland are based on the European Commission's adequacy decision; onward transfers take place subject to equivalent safeguards under Articles 44 et seq. GDPR.

A copy of the safeguards adopted may be requested from the Controller's email address.

8. Retention period

Personal data are retained for as long as necessary to achieve the purposes for which they were collected, in particular:

• contact data collected through the Website forms are retained for as long as necessary to handle the request and thereafter for a maximum of 24 months;
• data processed for the newsletter are retained until consent is withdrawn or the user unsubscribes;
• browsing data and server logs are retained for a maximum of 30 days, unless needed to investigate security incidents;
• data contained in accounting records and business correspondence are retained for 10 years in accordance with Art. 958f of the Swiss Code of Obligations (CO; SR 220);
• data required to establish, exercise or defend legal claims are retained for as long as necessary for that purpose, taking account of applicable limitation periods.

9. Data security

The Controller takes technical and organisational measures appropriate to the risk to protect personal data against unauthorised processing, loss or destruction (Art. 8 FADP; Art. 32 GDPR).

10. Automated individual decisions

The Controller does not take decisions based solely on automated processing that produce legal effects or similarly significant effects for the data subject (Art. 21 FADP; Art. 22 GDPR).

11. Rights of the data subject

Subject to the conditions laid down by law, data subjects have the right to:

• obtain information about their personal data and its processing (right of access, Art. 25 FADP; Art. 15 GDPR);
• have inaccurate data rectified (Art. 32 para. 1 FADP; Art. 16 GDPR);
• have data erased or destroyed and processing restricted (Art. 32 para. 2 FADP; Articles 17 and 18 GDPR);
• object to processing, in particular for direct marketing purposes (Art. 30 para. 2 let. b and Art. 32 para. 2 FADP; Art. 21 GDPR);
• receive the data they have provided in a commonly used electronic format or have it transmitted to another controller (Art. 28 FADP; Art. 20 GDPR);
• withdraw their consent at any time, without affecting the lawfulness of processing carried out before withdrawal.

These rights can be exercised by writing to the Controller's email address. The Controller may request proof of identity. Requests are normally handled free of charge within 30 days (Articles 18 and 19 DPO).

Data subjects may contact the Federal Data Protection and Information Commissioner (FDPIC), Feldeggweg 1, 3003 Bern (www.edoeb.admin.ch), and assert their claims before the civil courts. Data subjects covered by the GDPR also have the right to lodge a complaint with the supervisory authority of the Member State of their habitual residence, place of work or place of the alleged infringement.

12. Changes to this Privacy Policy

The Controller reserves the right to amend or update this Privacy Policy at any time by publishing the new version on the Website. The version in force is the one published on this page at the time of consultation. In the event of discrepancies between language versions, the Italian version prevails.