GDPR & Cookie Guidelines

Ruoli GDPR

Regulation (EU) 2016/679 (GDPR) defines the parties involved in the processing of personal data. Facility Solution operates in different roles depending on the context:

Data Controller (Art. 4 no. 7 GDPR)

The Controller is the natural or legal person who determines the purposes and means of processing personal data. For the Facility Solution website and the company's own activities, Facility Solution L.R. Ltd is the Data Controller.

For SMS messaging campaigns sent by clients (Client/Company), the Client/Company is the Controller of their own end clients' data, while Facility Solution acts as Processor.

Data Processor (Art. 4 no. 8 GDPR)

The Processor processes data on behalf of the Controller based on a contract (DPA — Data Processing Agreement). Facility Solution acts as Processor for end client data provided by clients/companies as part of SMS services.

Data Protection Officer (DPO)

The contact point for data protection issues can be reached at: controller@facilityltd.com.

Classificazione dei cookie

Pursuant to the Provision of the Italian Data Protection Authority (Garante) of 10 June 2021 ("Cookie guidelines and other tracking tools"), cookies are classified as follows:

Requisiti del cookie banner

The Garante Provision 10/6/2021 establishes that the cookie banner must:

• Essere immediatamente visibile all'accesso al sito, senza scorrimento;
• Contain an "Accept" button and a "Decline" button with equal graphic prominence;
• Not use dark patterns to steer consent (e.g., pre-checked, continue = accept);
• Allow consent to be revoked as easily as it is given;
• Not impose a so-called "cookie wall" (access conditional on consent) without alternatives;
• Clearly identify the Controller and the categories of cookies used.

Fingerprinting e tracciamento senza cookie

The Garante Provision 10/6/2021 extends the same rules provided for cookies also to fingerprinting techniques and other equivalent tracking tools (local storage, pixel tracking, etc.).

Any technique that allows tracking user behavior across multiple sites or over time, even without using cookies, is subject to the same information and consent obligations as non-technical cookies.

Trasferimento dati extra-SEE

The transfer of personal data to non-EEA (European Economic Area) countries is permitted only if adequate safeguards are in place. Following the Schrems II judgment (C-311/18, 16/07/2020) and the subsequent decision of the Italian Garante on the use of Google Analytics (June 2022), the following rules apply:

Standard Contractual Clauses (SCC)

In the absence of an adequacy decision, transfers to the USA and other third countries take place via Standard Contractual Clauses (SCC — EU Decision 2021/914). The SCC must be supplemented by a Transfer Impact Assessment (TIA) that assesses the actual risk to the rights of data subjects in the destination country.

Google Analytics e IP anonimizzazione

The use of Google Analytics with IP not fully anonymized constitutes a transfer of data to the USA in violation of the GDPR. For compliance, it is necessary to:

• Attivare l'anonimizzazione completa dell'IP (anonymize_ip: true in GA4);
• Set data retention to the minimum;
• Sign the DPA with Google Ireland Ltd;
• Check data sharing settings with Google.

Modello Cookie Policy

The Cookie Policy of Facility Solution L.R. Ltd identifies the following categories of cookies and tracking tools used on the website facilityltd.com:

Cookie tecnici (senza consenso)

• Session cookies — temporarily store preferences during navigation;
• Consent cookies — store the user's choice regarding the cookie banner (localStorage);
• CSRF security cookies — protect forms from Cross-Site Request Forgery attacks.

Cookie analitici (con consenso)

• Google Analytics 4 — aggregated web traffic analysis. Provider: Google Ireland Ltd (DPA signed). IP anonymized. Retention: 2 months. Non-EEA transfer covered by SCC.

Diritti degli interessati

Website users may exercise the following rights under Articles 15-22 GDPR:

• Accesso ai dati (Art. 15);
• Rectification (Art. 16);
• Erasure ("right to be forgotten", Art. 17);
• Restriction of processing (Art. 18);
• Data portability (Art. 20);
• Objection to processing (Art. 21);
• Withdrawal of consent at any time (Art. 7 para. 3).

Per esercitare i diritti: controller@facilityltd.com. È possibile proporre reclamo all'autorità di controllo competente (Garante per la protezione dei dati personali, garanteprivacy.it).

To exercise your rights: controller@facilityltd.com. You may also lodge a complaint with the competent supervisory authority (Italian Data Protection Authority, garanteprivacy.it).