Dear visitor,

pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (hereinafter "GDPR" or "Regulation") and Italian Legislative Decree no. 196 of 30 June 2003 ("Privacy Code"), as amended by Legislative Decree no. 101 of 10 August 2018, we hereby inform you that Xtranet Srl, with registered office at Via XX Settembre 40/9A - 16121 Genoa (GE), Italy, as Data Controller, will process the personal data concerning you that you voluntarily provide to us, in accordance with the principles of lawfulness, fairness, transparency, data minimisation, accuracy, storage limitation, integrity and confidentiality set out in Article 5 of the GDPR.
Personal data will be processed in compliance with the applicable legislation and under the following conditions.

a) Data Controller

The Data Controller is Xtranet Srl, with registered office at Via XX Settembre 40/9A - 16121 Genoa (GE) - Italy, who can be contacted at the e-mail address privacy@xtranet.it.

b) Purposes of processing and legal basis

Your personal data are processed for the following purposes and on the basis of the corresponding lawful grounds set out in Article 6 of the GDPR:

• to respond to requests for information and provide the services requested, as well as for activities preliminary to the conclusion of any contracts (legal basis: performance of pre-contractual/contractual measures, Art. 6.1.b GDPR);
• to comply with legal, accounting and tax obligations (legal basis: compliance with a legal obligation, Art. 6.1.c GDPR);
• to manage the operational and administrative relationship with the user (legal basis: legitimate interest of the Controller, Art. 6.1.f GDPR);
• to monitor access to and operation of the website www.xclaim.eu, also for IT security purposes (legal basis: legitimate interest of the Controller, Art. 6.1.f GDPR);
• to send information material and commercial communications, and to carry out strategic and operational marketing activities, market surveys and statistics (legal basis: specific consent of the data subject, Art. 6.1.a GDPR, which may be withdrawn at any time).

Processing for marketing purposes takes place only with your express consent, given separately from the other purposes, and does not affect the provision of the services requested, except as indicated in point d).

c) Methods of processing and security measures

Processing may consist of the collection, recording, organisation, structuring, storage, consultation, elaboration, modification, selection, retrieval, comparison, use, interconnection, restriction, erasure and destruction of data, and will be carried out both on paper and by electronic, IT and telematic means, with logic strictly related to the purposes indicated.

Xtranet Srl adopts appropriate technical and organisational measures to ensure a level of security appropriate to the risk, pursuant to Article 32 of the GDPR, in order to protect data against unauthorised access, loss, destruction or unlawful disclosure.

d) Nature of the provision of data and consequences of refusal

The provision of data is:

• mandatory for purposes connected with obligations laid down by laws, regulations or EU legislation;
• necessary to establish and continue the relationship with Xtranet Srl and to respond to your requests;
• optional for marketing and commercial communication purposes.

The fields marked as mandatory in the forms on the website are necessary to provide the information or services requested. Failure to provide mandatory data may make it impossible to follow up on your request or to continue the relationship with Xtranet Srl. Failure to provide optional data has no consequence, except that you will not receive marketing communications.

The IT systems and software procedures used to operate the website acquire, during their normal operation, certain personal data whose transmission is implicit in the use of Internet communication protocols (browsing data). This information is not collected in order to be associated with identified data subjects, but by its very nature could allow users to be identified through processing and association with data held by third parties.
This category includes the IP addresses or domain names of the computers used by users connecting to the website, the URI addresses of the resources requested, the time of the request, the method used to submit the request to the server, the size of the file obtained in response, the numerical code indicating the status of the server's response and other parameters relating to the user's operating system and IT environment. These data are processed only for the time necessary and kept for the period indicated in point f), unless needed to ascertain criminal offences.

The Controller keeps connection logs in order to respond to any requests from the Judicial Authority or other authorised public bodies.

Voluntarily sending e-mails to the addresses indicated on the website entails the acquisition of the sender's address and of the information contained in the message, which are processed solely to respond to the request.

e) Categories of recipients and communication of data

Within the limits relevant to the purposes indicated above, personal data may be communicated to parties acting as independent Data Controllers (e.g. banks, public authorities for legal obligations) or acting as Data Processors pursuant to Article 28 GDPR, specifically appointed and bound by specific contractual obligations of confidentiality and security, such as, by way of example: IT and hosting service providers, companies specialising in payment management, law firms and tax/accounting consultants, companies in charge of quality control of the logistics and sales flow, forwarders and transport service providers.

Employees, agents and collaborators of Xtranet Srl, acting within the scope of their respective duties as persons authorised to process data pursuant to Article 29 GDPR, may become aware of the data.

Personal data are not disseminated. Only with your specific and express online consent may the data be communicated to third parties for commercial information and direct marketing of our own or third-party products and services.

Transfer of data to non-EU countries

Personal data are processed within the European Economic Area (EEA). Should a transfer to countries outside the EEA become necessary for specific operational needs, it will take place in compliance with the safeguards provided for by Articles 44 et seq. of the GDPR (e.g. adequacy decisions of the European Commission or standard contractual clauses).

f) Retention period

Personal data are kept for the time strictly necessary to achieve the purposes for which they were collected, in compliance with legal deadlines (e.g. tax and accounting documents are kept for 10 years) and, for marketing purposes, until the data subject withdraws consent.

g) Rights of the data subject

As a data subject, in relation to the processing of your personal data, you may at any time exercise the rights provided for by Articles 15-22 of the GDPR, including in particular:

• the right of access to personal data (Art. 15);
• the right to rectification of inaccurate or incomplete data (Art. 16);
• the right to erasure ("right to be forgotten"), in the cases provided for by law (Art. 17);
• the right to restriction of processing (Art. 18);
• the right to data portability (Art. 20);
• the right to object to processing, in particular for direct marketing purposes (Art. 21);
• the right to withdraw consent at any time, without affecting the lawfulness of processing based on consent given before its withdrawal.

You also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, www.garanteprivacy.it) or with the supervisory authority of your EU country of residence, if you believe that your data are being processed in breach of the applicable legislation.

To exercise your rights you can send a request:

• by ordinary mail to: Xtranet Srl, Via XX Settembre 40/9A - 16121 Genoa (GE), Italy;
• by e-mail to: privacy@xtranet.it.

h) Data Controller

The Data Controller is:
Xtranet Srl
Via XX Settembre 40/9A - 16121 Genoa (GE) - Italy
E-mail: privacy@xtranet.it

For any information concerning the processing of personal data you can contact the internal privacy contact person at the e-mail address indicated above.

i) Changes to this privacy notice

This privacy notice may be amended or updated, also as a result of regulatory changes. Please check this page periodically. This privacy notice was last updated in August 2026.