Privacy Notice

1. Data controller and contact details

Data controller: Tommaso Checchi - Starlynex. VAT number: 04826850986. For privacy matters and to exercise your rights, contact: privacy@starlynex.it. Website: https://starlynex.it.

2. Data collected

Browsing. Computer systems and the hosting service may process your IP address, date and time, HTTP request and requested resource, technical information about your browser, device and operating system, country inferred from your IP address, request size, response code and time, and logs of errors, anomalies and attempted misuse.

Contact form and direct communications. We process your first name, surname, business name, phone number, email address, reason for contacting us and the information in your message, along with any data needed to handle your enquiry. We also process information provided by email, phone or other contact channels listed on the website. Do not include health information, other special categories of personal data or unnecessary information about third parties.

Newsletter, contact form consent and the 10% incentive. We process your email address, subscription choice, the date and method of consent, the version of the consent text and privacy notice presented, any email verification and withdrawal of consent. We also process the information strictly necessary to deliver and manage the promotional benefit you request. The phone number provided in the contact form is not used for promotional campaigns on the basis of consent to the email newsletter.

3. Data sources and processing methods

Contact form and newsletter data are provided directly by you; technical data are generated during browsing. Data are processed electronically and, when necessary, on paper, using appropriate security measures and limiting access to authorised persons according to their duties.

4. Separate purposes and legal bases

Website operation and security. Technical data are used to serve pages, diagnose problems, prevent abuse and protect the service. Legal basis: the controller’s legitimate interest in the availability, integrity and security of the website (Article 6(1)(f) GDPR).

Responding to enquiries and preparing quotes. Data from the form and direct communications are used to respond, discuss your project and handle the communications you request. For pre-contractual steps requested by the individual, the legal basis is Article 6(1)(b) GDPR. For general correspondence and enquiries made as a representative of a business or company, where point (b) does not apply, the legal basis is the legitimate interest in managing communications and professional relationships (Article 6(1)(f)). Marketing consent is not required to receive a response.

Newsletter and email marketing. Your email address is used to send Starlynex news, service updates, offers and promotional communications. Legal basis: freely given, specific, informed and unambiguous consent (Articles 6(1)(a) and 7 GDPR), in accordance with Article 130(1) and (2) of Italian Legislative Decree 196/2003. An enquiry alone does not subscribe you. Selecting the optional marketing checkbox on the contact form subscribes you to the same newsletter and promotional communications as subscribing through the popup.

Managing the 10% incentive. Your email address and any necessary information are used to deliver and manage the requested benefit under the offer conditions. The legal basis is Article 6(1)(b) GDPR, to the extent required to carry out the initiative you join. This purpose is separate from subsequent promotional emails, which require the consent described above. Your personal code gives you 10% off your first purchase, can be used once and is valid for 30 days from the request made using the “get the discount” button. Subscribing with the same email address does not generate new codes or extend validity. The code, request time, expiry and any use are recorded in the CRM to manage the benefit. Give the code to the team at the time of purchase, before confirming payment.

Legal obligations and protection of rights. Strictly necessary data may be processed to comply with applicable obligations (Article 6(1)(c)) and, where a specific need arises, to establish, exercise or defend legal claims (Article 6(1)(f)), including documenting consent and respecting objections.

5. Providing data and marketing consent

Necessary technical data are processed to enable browsing and security. Contacting Starlynex is optional; without contact details or essential information, we may be unable to respond. Required fields are identified when data are collected; other information is optional.

Newsletter subscription is optional and is not required to browse, request information or quotes, or purchase services on standard terms. The contact form has two separate checkboxes: a required acknowledgement that you have read the privacy notice, which is not marketing consent, and an optional consent to receive promotions and offers by email. Leaving the second box unchecked does not prevent your enquiry from being sent or handled. The popup presents the newsletter and incentive separately. Consent requires a positive, informed action through an initially unchecked box; simply providing an email address or reading the notice does not constitute marketing consent.

6. Unsubscribing and withdrawing consent

You can withdraw consent and object to marketing at any time, free of charge, using the unsubscribe link in each promotional email or by writing to privacy@starlynex.it. You do not need to give a reason. Promotional emails stop following your request. Withdrawal does not affect the lawfulness of processing carried out before withdrawal, carries no penalty and does not require repayment of a discount already used; it is not used to cancel a benefit already granted.

Unsubscribing applies to marketing: data needed to handle a separate enquiry, comply with legal obligations or protect rights continue to be processed only for those purposes and for as long as strictly necessary.

7. Retention periods and criteria

Data are not retained indiscriminately. When a purpose no longer applies, data are deleted or anonymised, subject to the specific obligations and needs described below. These criteria also apply to data held by providers.

Technical and security logs. These are kept only for the diagnosis and verification cycle relating to the website’s operation and security, using the hosting service’s log rotation. Logs linked to an incident or abuse are retained until the necessary checks and remedial work are completed; further retention is limited to information needed for requests from authorities or the protection of rights.

Enquiries and quotes. Data are retained until the enquiry and necessary discussions have been concluded. Once the enquiry is closed and no further responses are needed, data are deleted or anonymised. If a contractual relationship follows, only data needed to manage it and comply with applicable obligations are retained, under a notice relevant to that relationship.

Newsletter. Your email address and data needed for sending are retained while your subscription is active and the newsletter service continues, until withdrawal, objection or termination of the service, whichever comes first. The need to retain subscriptions is reviewed periodically; data no longer needed are deleted. Tracked opens or clicks are not used to extend retention automatically.

Incentive. Data needed to deliver and verify it are retained until management of the benefit is complete, except where needed for a contract, applicable obligations or specific disputes.

Proof of consent and objections. Minimal evidence of consent and withdrawal may be kept separately, with restricted access, for the period needed to demonstrate the lawfulness of communications, taking into account applicable limitation periods or deadlines for possible claims. After an objection, only the identifier needed in a suppression list may be retained while there is a risk of reimporting it into active lists, solely to prevent further messages.

Exceptions. Retention for legal obligations or disputes is limited to relevant data and ends when the obligation expires or the dispute and applicable periods are concluded. It does not authorise further marketing emails.

8. Recipients and providers

Data may be processed by persons authorised by Starlynex and by providers strictly necessary for hosting, databases, the contact form, email and the newsletter, within their respective roles. Tommaso Checchi - Starlynex remains the controller when external services are used.

Hostinger is used for hosting and email mailboxes. Resend is used to send automated contact form emails, discount codes and newsletter campaigns. The previously published notice identifies Hostinger International Ltd., 61 Lordou Vironos str., 6023 Larnaca, Cyprus as the hosting provider. Providers processing data on behalf of the controller act as processors under Article 28 GDPR, where applicable. Data may also be disclosed to authorities where required by law or to professionals for the protection of rights, only when necessary. Data are not made public or transferred to third parties for their own marketing.

9. Transfers outside the European Economic Area

Hostinger’s European location does not in itself rule out processing by providers or subprocessors outside the European Economic Area. Where such transfers take place, Articles 44 onwards of the GDPR apply: relevant adequacy decisions or appropriate safeguards, such as the European Commission’s Standard Contractual Clauses, with the necessary assessments and supplementary measures. Information about actual transfers, safeguards and a copy of the applicable safeguards can be requested from privacy@starlynex.it.

10. Cookies, tracking and automated decisions

According to the configuration described by Starlynex, the website does not use Google Analytics, Meta Pixel, advertising cookies or profiling tools. Technical tools strictly necessary for operation and security do not require prior consent. The newsletter described here does not involve profiling or individual tracking of opens and clicks for marketing purposes. No decisions based solely on automated processing are made that produce legal effects or similarly significantly affect individuals. If new processing is introduced, this notice will be updated and, where necessary, consent obtained before activation.

The newsletter popup uses a local browser preference (localStorage) solely to remember dismissal for 30 days or an existing subscription during later visits in the same browser. This storage does not contain your email address or discount code and is not used to profile browsing. You can remove it by clearing the website’s data in your browser; the popup may reappear on another browser or device.

Your manually selected language is saved in your browser (localStorage) to remember it on later visits. It contains no contact information and is not used for profiling. You can change it using the IT / EN selector or by clearing the website’s data.

11. Your rights

In the cases and within the limits set out in Articles 15–22 GDPR, you may request access, rectification, erasure, restriction and portability of data you provided where automated processing is based on consent or a contract. You may object to processing based on legitimate interests for reasons relating to your particular situation; you may object to direct marketing at any time without giving a reason. You may withdraw consent as described in section 6.

Write to privacy@starlynex.it. The controller normally responds within one month; for complex or numerous requests, this may be extended by two further months, with notice within the first month. You also have the right to lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it) or another competent supervisory authority, and to seek a judicial remedy.