1Introduction
Condividiamo Ltd ("Condividiamo", the "Company", "we", "us" or "our") recognises the importance of protecting the privacy and personal data of everyone who uses its services.
This Privacy Policy explains how personal data are collected, used, retained, shared and protected when individuals interact with:
- the Mamify platform;
- the AiToro platform;
- websites operated by Condividiamo;
- mobile applications;
- cashback services;
- affiliate programmes;
- revenue sharing services;
- customer support;
- digital products;
- online events;
- newsletters;
- commercial communications;
- all other services provided by Condividiamo.
Condividiamo processes personal data in accordance with:
- the Gibraltar General Data Protection Regulation ("Gibraltar GDPR");
- the Data Protection Act 2004;
- where relevant, any other applicable legislation in the jurisdictions in which the Company operates.
This Privacy Policy applies to every natural person whose personal data are processed by Condividiamo.
2Data controller
The data controller for the processing of personal data is:
Condividiamo Ltd
Registered office: Gibraltar
Email: privacy@mamify.app
Website: https://www.condividiamo.club
Where required by applicable law, Condividiamo may appoint processors or authorised representatives acting on its behalf.
All processors are contractually bound to process Personal Data solely on the basis of documented instructions received from Condividiamo and to adopt appropriate technical and organisational security measures.
3Scope of application
This Privacy Policy applies whenever a person:
- creates an account;
- accesses Mamify;
- accesses AiToro;
- purchases products or services;
- receives cashback;
- joins an affiliate programme;
- takes part in revenue sharing activities;
- books appointments;
- contacts customer support;
- receives notifications;
- visits our websites;
- subscribes to newsletters;
- communicates with Condividiamo through any channel.
The Policy applies regardless of whether the Services are used through desktop computers, mobile phones, tablets, web browsers, mobile applications, APIs or future digital platforms operated by Condividiamo.
4Definitions
For the purposes of this Privacy Policy:
- Personal Data
- any information relating to an identified or identifiable natural person.
- Processing
- any operation performed on Personal Data, including collection, recording, organisation, storage, consultation, use, disclosure, restriction, erasure or destruction.
- Data Subject
- the natural person whose Personal Data are processed.
- Data Controller
- the legal entity that determines the purposes and means of the Processing of Personal Data.
- Processor
- any third party that processes Personal Data on behalf of Condividiamo.
- Services
- any website, mobile application, digital platform, software product or online service operated by Condividiamo.
- User
- any person who uses the Services.
5Principles of processing
Condividiamo processes Personal Data in accordance with the following principles:
Lawfulness
Processing takes place only where there is a legal basis under Article 6 of the Gibraltar GDPR.
Fairness
Personal Data are processed fairly in relation to Data Subjects.
Transparency
Condividiamo provides clear information on: why Personal Data are processed; which Personal Data are collected; the legal basis relied upon; retention periods; recipients; international transfers; the rights of Data Subjects.
Purpose limitation
Personal Data are collected only for specified, explicit and legitimate purposes.
Data minimisation
Only the Personal Data necessary for the relevant processing activity are collected.
Accuracy
Reasonable steps are taken to ensure that Personal Data remain accurate and up to date.
Storage limitation
Personal Data are retained only for the period necessary to fulfil the relevant purpose or to comply with applicable legal obligations.
Integrity and confidentiality
Appropriate technical and organisational measures are taken to protect Personal Data against accidental or unlawful destruction, loss, alteration, disclosure or access.
Accountability
Condividiamo maintains appropriate internal procedures to demonstrate compliance with the Gibraltar GDPR. The Company regularly reviews its processing activities, security measures and public documentation to ensure continued compliance with applicable law.
6Categories of personal data
Depending on the Services used, Condividiamo may collect and process the following categories of Personal Data. The categories of data collected vary according to the functionality used by the User and the contractual relationship established with Condividiamo.
6.1 Identification data
Condividiamo may process identification information including: first name; surname; username; profile photograph (where voluntarily provided); date of birth; nationality (where required); tax code (codice fiscale) or equivalent identifier where required by applicable law; identity documents issued by public authorities where necessary for identity verification or legal compliance. The Company processes only the identification data necessary for the specific service requested.
6.2 Contact details
Condividiamo may process: email address; mobile phone number; postal address; country of residence; preferred language; preferred method of communication. These data are used to provide the services requested and to communicate with Users.
6.3 Account data
When an account is created or managed, Condividiamo processes: User ID; username; encrypted password; login history; authentication records; account status; User preferences; notification preferences; security settings. Passwords are never stored in plain text and are protected by one-way cryptographic hashing algorithms that comply with industry standards.
6.4 Financial data
Depending on the Services used, Condividiamo may process: cashback balances; wallet balances; orders; purchases; transactions; revenue sharing records; affiliate commissions; payment confirmations; invoices; credit notes; refund information. Condividiamo does not store full payment card numbers. Payment card information is processed directly by authorised payment service providers.
6.5 Technical data
When Users access the Services, Condividiamo automatically processes certain technical information including: IP address; browser type and version; device model and identifier; operating system; screen resolution; language settings; time zone; application version; crash reports; diagnostic information; security logs; error logs. These data are processed to ensure the stability, availability and security of the Services.
6.6 Usage data
Condividiamo records information relating to the use of its Services, including: access dates and times; pages visited; features used; cashback activity; referral activity; affiliate activity; participation in revenue sharing; purchases; orders; interactions with customer support; participation in webinars; use of digital products. Usage data help to improve the quality and security of the Services.
6.7 Geolocation data
Where enabled by the User or permitted by the device settings, Condividiamo may process approximate geolocation data. Geolocation may be used for purposes such as improving the User experience; providing location-based services; fraud prevention; security monitoring; compliance with legal obligations where applicable.
Users may disable location permissions at any time through their device settings. Disabling them may limit the availability of certain features. Condividiamo does not continuously monitor the User's location, unless this is expressly required by a specific feature requested by the User.
6.8 Communications
Condividiamo processes the communications exchanged with Users, including: emails; support tickets; contact forms; live chat messages; WhatsApp messages; messages received via social media; appointment requests; webinar registrations; customer service conversations. Communications may be retained where necessary to respond to requests, demonstrate compliance, resolve disputes, improve customer support or comply with legal obligations.
6.9 Marketing data
Where permitted by applicable law, Condividiamo may process: newsletter subscriptions; marketing preferences; participation in promotional campaigns; consent records; communication preferences; opt-in and opt-out records. Marketing communications are sent only where there is a valid legal basis under Article 6 of the Gibraltar GDPR. Where consent is required, Users may withdraw it at any time.
6.10 Data collected from third parties
In limited circumstances, Condividiamo may receive Personal Data from third parties, including: payment providers; business partners; affiliate partners; identity verification providers (where applicable); fraud prevention services; regulatory authorities; public registers where permitted by law. Condividiamo processes such Personal Data only where there is a valid legal basis and only for the purposes for which the data were lawfully obtained.
6.11 Sensitive data
Condividiamo does not intentionally collect or process special categories of Personal Data within the meaning of Article 9 of the Gibraltar GDPR, unless: this is expressly required by law; it is necessary for the establishment, exercise or defence of legal claims; the Data Subject has given explicit consent where permitted by law. Where the processing of special categories of Personal Data becomes necessary, Condividiamo will adopt additional safeguards appropriate to the nature of the data.
7Processing activities and legal bases
Condividiamo processes Personal Data only where there is a valid legal basis under Article 6 of the Gibraltar General Data Protection Regulation. Each processing activity has been assessed individually and is linked to a specific legal basis. Condividiamo does not rely indiscriminately on all legal bases for every processing activity.
7.1 Processing activities
| Processing activity | Categories of data | Purpose | Legal basis | Retention |
|---|---|---|---|---|
| Account registration | Identification, contact and account data | Creation and management of User accounts | Art. 6(1)(b) – Performance of a contract | Until account closure and applicable statutory retention periods |
| User authentication | Account credentials, technical data | Secure access to the Services | Art. 6(1)(b) | For the duration of the account |
| User profile management | Account data and preferences | Personalisation of the Services | Art. 6(1)(b) | For the duration of the account |
| Cashback services | Transaction, wallet and order data | Administration of cashback programmes | Art. 6(1)(b) | For the duration of the contractual relationship |
| Revenue sharing services | Transaction records, affiliate data, payment records | Calculation and distribution of revenue sharing | Art. 6(1)(b) | For the duration of the contractual relationship and applicable statutory periods |
| Affiliate programme | Identification data, commissions, referral records | Management of affiliate relationships | Art. 6(1)(b) | For the duration of the contractual relationship |
| Purchase of products and services | Orders, invoices, payment confirmations | Fulfilment of customer orders | Art. 6(1)(b) | Applicable statutory retention periods |
| Payment processing | Billing data, transaction records | Processing of payments through authorised providers | Art. 6(1)(b) and 6(1)(c) where required by law | Applicable statutory retention periods |
| Customer support | Contact data, communications, support history | Responding to requests and providing support | Art. 6(1)(b) and 6(1)(f) where appropriate | 24 months from the closure of the support request |
| Webinar registration and participation | Contact data, participation data | Organisation of online events and training | Art. 6(1)(b) | 24 months, unless a longer retention period is required by law |
| Push notifications | Device identifiers, notification preferences | Sending of service-related notifications | Art. 6(1)(b) | For the duration of the account |
| Security monitoring | IP addresses, technical logs, authentication records | Protection of systems and prevention of unauthorised access | Art. 6(1)(f) – Legitimate interests | In accordance with the Data Retention Policy |
| Fraud prevention | Transaction history, technical data | Detection and prevention of fraudulent activity | Art. 6(1)(f) | For as long as necessary for fraud prevention and legal protection |
| Geolocation services | Approximate location data | Provision of location-based features and fraud prevention | Art. 6(1)(b), or 6(1)(a) where consent is required | Only for as long as necessary to provide the relevant feature |
| Marketing communications | Contact data, communication preferences | Sending of promotional communications | Art. 6(1)(a) – Consent, or 6(1)(f) where permitted | Until consent is withdrawn or the User objects |
| Newsletter | Email address | Distribution of newsletters | Art. 6(1)(a) | Until consent is withdrawn |
| Compliance with legal obligations | Financial records, identification data | Compliance with tax, accounting and regulatory obligations | Art. 6(1)(c) | As required by applicable law |
| Defence of legal claims | Relevant personal data | Establishment, exercise or defence of legal claims | Art. 6(1)(f) | Until the limitation period expires or the proceedings conclude |
| Internal audits and compliance | Processing records, operational data | Compliance monitoring and governance | Art. 6(1)(f) | As necessary for compliance purposes |
7.2 The legal bases explained
Performance of a contract – Article 6(1)(b)
Processing is necessary for the performance of a contract with the User or in order to take steps at the User's request prior to entering into a contract. This applies, for example, to: account creation; provision of the Mamify and AiToro services; cashback programmes; affiliate management; revenue sharing; fulfilment of orders; customer support directly connected with the contractual services.
Legal obligation – Article 6(1)(c)
Certain Personal Data must be processed in order to comply with legal obligations to which Condividiamo is subject, including accounting obligations; tax compliance; compliance with court orders; compliance with requests from competent public authorities. Where Personal Data are retained solely to comply with a legal obligation, such data will not be used for marketing or other incompatible purposes.
Consent – Article 6(1)(a)
Where processing is based on consent, such consent must be freely given, specific, informed and unambiguous. Users may withdraw consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal itself.
Legitimate interests – Article 6(1)(f)
Condividiamo may process Personal Data where this is necessary for its own legitimate interests or those of a third party, provided that such interests are not overridden by the rights and freedoms of the Data Subject. Legitimate interests include protecting the security of the Services; preventing fraud; preventing abuse of the platforms; maintaining the integrity of systems; defending legal claims; carrying out internal audits; improving operational efficiency. Before relying on legitimate interests, Condividiamo carries out an assessment to ensure an appropriate balance with the rights and freedoms of Data Subjects.
7.3 No automated decision-making with legal effects
Unless otherwise indicated for a specific Service, Condividiamo does not make decisions based solely on automated processing, including profiling, that produce legal effects concerning Users or similarly significantly affect them. Should automated processing be introduced in the future, Condividiamo will provide the appropriate information pursuant to Articles 13, 14 and 22 of the Gibraltar GDPR.
8Account registration and management
8.1 Creating an account
Users may create an account to access one or more of the services offered by Condividiamo, including the Mamify and AiToro platforms. During registration, Users may be asked to provide the information necessary to create and maintain their account. Depending on the service requested, this may include: first name; surname; email address; telephone number; country of residence; username; password; preferred language; referral or affiliate information where applicable. Condividiamo collects only the information necessary to provide the Services requested.
8.2 Accuracy of information
Users are responsible for ensuring that the information provided at registration remains accurate, complete and up to date. In the event of changes, the User must update their account or inform Condividiamo without undue delay.
8.3 Account security
Users are responsible for keeping their login credentials confidential. Users must choose a strong password; keep their credentials confidential; inform Condividiamo immediately of any suspected unauthorised access; avoid sharing the account with third parties unless expressly authorised by the applicable service.
Condividiamo will never ask for a User's password by email, telephone or messaging applications.
8.4 Account suspension
Condividiamo may temporarily suspend access to an account where reasonably necessary to: investigate suspected fraud; prevent unauthorised access; comply with legal obligations; protect the security of the Services; carry out scheduled maintenance; protect the rights of Users or third parties. Where appropriate, the User will be informed of the suspension and the reasons for it.
8.5 Account closure
Users may request closure of their account at any time. Closing an account does not automatically result in the immediate deletion of all Personal Data. Some Personal Data may continue to be retained where necessary to comply with legal obligations; to establish, exercise or defend legal claims; to comply with tax or accounting legislation; to protect the security and integrity of the Services. Any Personal Data retained will be processed solely for those purposes and subject to appropriate access restrictions.
9Mamify Services
Mamify is a digital platform operated by Condividiamo that gives Users access to cashback services, digital products, promotional campaigns, training content, affiliate programmes and additional services offered through the platform.
The processing of Personal Data within Mamify is limited to what is necessary for: User authentication; account administration; cashback management; purchase of products and services; affiliate management; customer support; platform security; fraud prevention; compliance with applicable law.
Where new features are introduced within Mamify, Personal Data will be processed only where there is an adequate legal basis. If additional categories of Personal Data become necessary, this Privacy Policy will be updated accordingly, where required by law.
10AiToro Services
AiToro is a digital platform operated by Condividiamo that offers training, commercial and platform-related services. Depending on the features used, Personal Data may be processed for: User registration; access management; training content; appointment scheduling; webinars; customer support; commercial communications; account management; platform security.
Condividiamo does not provide regulated financial advice through AiToro.
Where Users access services provided by third-party financial institutions or brokers through the platform, those third parties remain independently responsible for the processing of Personal Data carried out on their own systems. Users are encouraged to consult the privacy notices of those third-party providers before using their services.
11Cashback services
Condividiamo manages cashback programmes through the Mamify platform. To administer those programmes, Condividiamo may process: account data; transaction history; purchase records; cashback balances; order history; participation in promotional campaigns.
Cashback calculations are carried out using the information necessary to determine eligibility and to calculate the applicable rewards. Cashback records may be retained where necessary to administer accounts, resolve disputes, comply with legal obligations and meet accounting and audit requirements.
12Affiliate programme
Users may participate in the affiliate programmes offered by Condividiamo, where applicable. Participation may require the processing of: affiliate identification data; referral records; commission records; network structure; qualification history; payment information.
Affiliate data are processed exclusively for the administration of the programme and the performance of contractual obligations. Participation in an affiliate programme does not entitle Users to process the Personal Data of third parties, except where permitted by applicable law and in accordance with separate contractual agreements.
13Revenue sharing services
Where Users participate in revenue sharing programmes offered by Condividiamo, the Company may process the Personal Data necessary to: record participation; administer contractual rights; calculate revenue allocations; process payments; comply with accounting obligations; resolve disputes; comply with legal and regulatory requirements.
Revenue sharing calculations are based on the contractual agreements applicable to the relevant programme. Financial records relating to revenue sharing may be retained for the period required by applicable accounting, tax and legal obligations.
14Orders and payment processing
14.1 Purchase of products and services
Condividiamo allows Users to purchase products and services through the Mamify and AiToro platforms. To process an order, Condividiamo may collect and process: customer identification data; billing data; order details; products or services purchased; payment status; invoice data; cashback information where applicable. The processing is necessary for the performance of the contract entered into with the User.
14.2 Order management
Personal Data are processed for purposes such as order confirmation; order fulfilment; customer support; invoicing; refunds; accounting; fraud prevention; dispute resolution. Only authorised personnel may access order information, where necessary to perform their duties.
14.3 Invoicing
Where required by applicable law, Condividiamo processes the Personal Data necessary to issue invoices; issue credit notes; comply with accounting obligations; comply with tax legislation. Accounting documentation is retained for the period required by applicable law.
15Stripe payment services
Condividiamo uses Stripe to process electronic payments made through its Services. Stripe acts as an independent payment service provider and processes payment information in accordance with its own privacy notice and applicable financial regulations.
Condividiamo does not receive or store full payment card numbers, CVV codes or other sensitive card authentication data.
The information received from Stripe is limited to what is necessary to confirm successful payments; process refunds; prevent fraud; reconcile transactions; comply with accounting obligations. Users are encouraged to consult Stripe's privacy notice for further information on Stripe's processing of payment data.
16Wise payment services
Where applicable, Condividiamo may use Wise for the processing of international payments and financial settlements. In that case, the Personal Data necessary to complete the transaction may be transmitted to Wise in accordance with applicable law. Such information may include: name; payment amount; destination country; payment reference; information necessary to comply with anti-money laundering and financial legislation.
Wise processes Personal Data independently, in accordance with its own privacy notice.
17Amazon Web Services (AWS)
Condividiamo hosts most of its production infrastructure using Amazon Web Services (AWS). AWS provides the cloud infrastructure supporting: application hosting; databases; storage; backup infrastructure; computing resources; network infrastructure; security services.
AWS acts as a processor for the infrastructure services provided on behalf of Condividiamo. Condividiamo selects AWS because it provides internationally recognised security standards and technical measures designed to protect Personal Data. The Company regularly reviews its cloud infrastructure to ensure that appropriate security measures remain in place.
17.1 Security measures implemented on AWS
Depending on operational requirements, Condividiamo may implement security measures including encrypted communications; access control mechanisms; User authentication; network security controls; logging and monitoring; regular software updates; secure backup procedures; disaster recovery planning; business continuity measures. Access to production environments is restricted to authorised personnel whose access is necessary to carry out their responsibilities.
18Domain registration and DNS services
Condividiamo uses GoDaddy exclusively for domain registration; DNS management; administration of internet domains. GoDaddy is not used to host customer databases or store application data. The Company's operational data are hosted separately using AWS infrastructure.
19Push notification services
Condividiamo sends push notifications through the Mamify and AiToro applications. The technical delivery of push notifications takes place through Firebase Cloud Messaging (FCM) for Android devices and Apple Push Notification Service (APNs) for Apple devices. These services are used exclusively to deliver notifications generated by Condividiamo. The content, scheduling and management of notifications remain under the control of Condividiamo.
19.1 Types of notification
Users may receive notifications relating to account security; cashback activity; purchases; service updates; appointments; webinars; customer support; operational communications. Marketing notifications are sent only where permitted by applicable law. Users may disable push notifications at any time through their device settings. Disabling push notifications may limit some functionality of the Services.
20Geolocation services
Certain features of the Services may use approximate geolocation data, where permission has been granted by the User. Geolocation may be processed for purposes such as improving the User experience; providing location-related features; fraud prevention; security; compliance with legal obligations where applicable.
Location information is collected only where necessary for the relevant feature. Condividiamo does not continuously monitor the location of Users, unless that feature has been expressly activated by the User. Users may withdraw location permissions at any time through the settings of their mobile device. Withdrawal may affect the availability of certain features.
21Cookies and similar technologies
21.1 Use of cookies
Condividiamo uses cookies and similar technologies to ensure the proper functioning, security and performance of its websites and digital services. Cookies are small text files stored on the User's device that allow the device to be recognised on subsequent visits. Cookies are used to improve the User experience, strengthen security and support the delivery of the services requested. Where required by applicable law, cookies that are not strictly necessary are used only with the User's prior consent. Further details are available in the Company's Cookie Policy.
21.2 Categories of cookies
Strictly necessary cookies
Essential for the operation of the Services. They enable functions such as User authentication; session management; security; fraud prevention; load balancing. These cookies cannot normally be disabled, as they are necessary to provide the service requested.
Functional cookies
They store User preferences to improve the browsing experience, including language selection; display preferences; login preferences where permitted.
Analytics cookies
They may be used to understand how Users interact with the Services. Analytics information is used exclusively to improve usability; performance; stability; navigation. Where required by law, analytics cookies are activated only with the User's prior consent.
Marketing cookies
They may be used to provide Users with personalised communications and promotional content. Where required by applicable law, such cookies are used only with valid prior consent.
21.3 Managing cookies
Users may manage their cookie preferences through the cookie banner displayed on the website; browser settings; device settings where applicable. Disabling certain cookies may affect the functionality of some Services.
22Marketing communications
Condividiamo may send commercial or promotional communications relating to its products, services and activities. Such communications may concern Mamify services; AiToro services; cashback programmes; affiliate programmes; training events; webinars; platform updates; promotional campaigns; new services. Marketing communications are sent only where there is a legal basis under Article 6 of the Gibraltar GDPR.
22.1 Consent-based marketing
Where consent is required, Condividiamo will obtain it from the User before sending marketing communications. Consent records are retained to demonstrate compliance with applicable law. Users may withdraw consent at any time. Withdrawal does not affect communications necessary for the performance of the contract or for compliance with legal obligations.
22.2 Marketing based on legitimate interests
Where permitted by applicable law, Condividiamo may send communications relating to products or services similar to those previously requested by the User, relying on its legitimate interests. Users always have the right to object to such processing.
22.3 Opt-out
Every marketing email includes a mechanism allowing the User to unsubscribe. Users may also object to marketing communications by contacting Condividiamo through any of the channels described in this Privacy Policy. Opt-out requests are processed without undue delay.
23Automated decision-making and profiling
Condividiamo does not use automated decision-making processes that produce legal effects concerning Users or similarly significantly affect them within the meaning of Article 22 of the Gibraltar GDPR.
Certain automated processes may be used for operational purposes, including fraud detection; security monitoring; technical diagnostics; system performance optimisation; cashback calculation; notification management. These processes support the operation of the Services but do not replace human decision-making where decisions with legal or similarly significant effects are involved.
Should Condividiamo introduce automated decision-making or profiling subject to Article 22 of the Gibraltar GDPR in the future, Users will be informed in advance and will receive all information required by applicable law.
24International data transfers
Condividiamo may transfer Personal Data outside Gibraltar, the United Kingdom or the European Economic Area where necessary to provide its Services. Whenever an international transfer takes place, Condividiamo ensures that appropriate safeguards are in place in accordance with the Gibraltar GDPR.
Such safeguards may include adequacy decisions; Standard Contractual Clauses approved under applicable law; contractual commitments; recognised international transfer mechanisms; additional technical and organisational security measures where appropriate.
Before relying on service providers located outside Gibraltar or the United Kingdom, Condividiamo assesses whether the proposed transfer complies with applicable data protection law. Where required by law, Users may request further information on the safeguards applicable to international transfers.
25Data retention
25.1 General principle
Condividiamo retains Personal Data only for the period necessary to fulfil the purposes for which they were collected, to comply with applicable legal obligations, to resolve disputes, to enforce contractual rights and to protect the Company's legitimate interests where permitted by law. At the end of the applicable retention period, Personal Data are securely deleted or irreversibly anonymised, unless continued retention is required by law.
25.2 Retention periods
| Category of personal data | Retention period |
|---|---|
| User account data | Until account closure and any applicable statutory retention period |
| Customer support records | 24 months from the closure of the support request |
| Orders and transactions | As required by applicable accounting and tax legislation |
| Invoices | As required by applicable accounting and tax legislation |
| Cashback records | For the duration of the contractual relationship and applicable statutory periods |
| Affiliate programme records | For the duration of the contractual relationship and applicable statutory periods |
| Revenue sharing records | For the duration of the contractual relationship and applicable statutory periods |
| Security logs | Only for the period reasonably necessary to ensure the security of systems and to investigate incidents |
| Marketing preferences | Until consent is withdrawn or the User objects to the processing |
| Consent records | For the period necessary to demonstrate compliance with applicable law |
| Geolocation data | Only for the period necessary to provide the relevant feature |
| Push notification preferences | Until the User disables them or the account is closed |
Where legal proceedings, investigations or regulatory obligations require a longer retention period, Personal Data may be retained for the period necessary to comply with those obligations.
26Security measures
Condividiamo adopts appropriate technical and organisational measures to protect Personal Data against accidental or unlawful destruction, loss, alteration, disclosure or access. The security measures include, where appropriate:
- encryption of data in transit via TLS/SSL;
- secure password hashing;
- role-based access control;
- the principle of least privilege;
- authentication procedures for authorised personnel;
- network protection and firewalls;
- monitoring and logging of security events;
- regular software updates and patch management;
- backup and disaster recovery procedures;
- periodic review of security controls.
Access to Personal Data is restricted to authorised personnel who need such access to carry out their duties. Condividiamo regularly reviews and updates its security measures to address technological developments and evolving risks.
27Exercise of data subject rights
Within the limits provided for by the Gibraltar GDPR, Data Subjects may exercise the following rights: right of access; right to rectification; right to erasure; right to restriction of processing; right to data portability; right to object to processing; right to withdraw consent where processing is based on it; rights relating to automated decision-making where applicable. Condividiamo is committed to facilitating the effective exercise of those rights.
27.1 How to submit a request
The Data Subject may submit a request through any channel reasonably suited to identifying the request as such, including email; website contact forms; customer support; written correspondence; messaging services used by Condividiamo for communications with customers, including WhatsApp where applicable. Condividiamo will assess requests on the basis of their content and not solely on the basis of the channel used. Where necessary, Condividiamo may request additional information for the sole purpose of verifying the identity of the requester.
27.2 Response times
Condividiamo will respond to requests without undue delay and, in any case, within the time limits set by the Gibraltar GDPR. Where an extension is permitted because of the complexity or number of requests, the User will be informed within the statutory time limit, together with the reasons for it.
28Erasure requests
On receipt of a valid erasure request, Condividiamo will assess whether the conditions laid down in Article 17 of the Gibraltar GDPR are met. Where erasure is due, Condividiamo will take reasonable steps to erase the relevant Personal Data without undue delay.
Where certain Personal Data cannot be erased because retention is required by law or is necessary for the establishment, exercise or defence of legal claims, such data will be retained solely for those purposes and access to them will be appropriately restricted. Condividiamo maintains internal procedures designed to identify and process erasure requests in the relevant operational systems.
29Complaints
If a User believes that their Personal Data have been processed in breach of applicable data protection law, they are encouraged to contact Condividiamo first, so that the matter can be examined and, where possible, resolved.
Users also have the right to lodge a complaint with the Gibraltar Regulatory Authority, which acts through the Information Commissioner, or with another competent supervisory authority where permitted by applicable law. Nothing in this Privacy Policy limits the rights granted to Data Subjects by the Gibraltar GDPR.
30Contact
For any questions about this Privacy Policy or the processing of Personal Data, Users may contact:
Condividiamo will use reasonable endeavours to respond promptly and within the time limits set by the Gibraltar GDPR.
Final provision
This Privacy Policy supersedes any previous privacy notice relating to the Services covered by this document and applies from its effective date. Condividiamo may amend this Privacy Policy from time to time to reflect changes in applicable law, regulatory guidance, technology or business operations. Where required by law, Users will be notified of material changes before they take effect.