INFORMATION ON THE PROCESSING OF PERSONAL DATA RELATED TO THE COMPLETION OF THE “ARCHITECTS REGISTRATION REQUEST” FORM
Last updated: October 2026
This privacy notice, provided pursuant to Article 13 of Regulation (EU) 2016/679 ("GDPR"), supplements the website privacy policy in order to explain how the Data Controller will specifically process the data entered in this form. Users are therefore invited to read the privacy notice relating to website browsing.
Identity and Contact Details of the Data Controller
Irinox S.p.A. (hereinafter also referred to as "Irinox" or the "Data Controller"), with registered office at Via Caduti nei Lager, 1 – 31015 Conegliano (TV), Italy, may be contacted by e-mail at irinox@irinox.com, by certified e-mail (PEC) at irinoxspa@legalmail.it, or by telephone at +39 0438 2020.
Contact Details of the Data Protection Officer
The Data Protection Officer (DPO) may be contacted at the following address: dpo@irinox.com.
Purposes and Legal Bases
A. Registration request management: personal data are processed to manage the registration request for the section dedicated to architects and designers, verify eligibility requirements, grant access to the related services and content, and provide the associated commercial and customer care support.
B. Marketing: contact details (e.g. first name, surname, e-mail address, telephone number) will be processed to send, by automated means (e-mail, newsletters, SMS) and traditional means (postal mail and telephone calls with an operator), advertising, informational and promotional material relating to the Data Controller’s products, services, offers, events and initiatives, as well as to carry out market research, satisfaction surveys and statistical analyses aimed at improving the quality of the services offered.
C. Measurement of interactions with promotional e-mails (tracking pixels): e-mails sent for the“Marketing ” purpose may contain tracking tools (tracking pixels and tracked links) that allow the Data Controller to monitor, with reference to the individual recipient, whether the message has been opened and which links have been clicked, in order to measure the effectiveness of communications and make them more relevant (see the dedicated section below).
D. D efence of legal claims: the Data Controller may need to process personal data for the management of disputes and out-of-court or judicial proceedings.
| Purpose | Legal Basis (ordinary personal data) | Legal Basis (special categories of personal data) |
|---|---|---|
| A | Performance of a contract or pre-contractual measures taken at the request of the data subject. | N/A |
| B | Consent (Art. 6(1)(a) GDPR and Art. 130 of Italian Legislative Decree No. 196/2003). | N/A |
| C | Consent (Art. 122 of Italian Legislative Decree No. 196/2003), included within the consent given for the “Marketing” purpose and revocable separately. | N/A |
| D | Legitimate interest of the Data Controller in establishing, exercising or defending a legal claim. | Establishment, exercise or defence of legal claims in legal proceedings (Art. 9(2)(f) GDPR). |
Measurement of Interactions with Promotional E-mails (Tracking Pixels)
Promotional communications sent by e-mail (including newsletters) may contain a tiny invisible image (a so-called tracking pixel) and tracked links that enable the Data Controller to monitor, in relation to the individual recipient, whether the message has been opened, the date and time of opening, the links clicked, the type of device and e-mail client used, and the IP address ("interaction data").
In accordance with Article 122 of Italian Legislative Decree No. 196/2003 and the Guidelines issued by the Italian Data Protection Authority on the use of tracking pixels in e-mail communications (Provision No. 284 of 17 April 2026), individual tracking takes place only with the data subject’s consent, which is included within the consent given for the“ Marketing ” purpose. Consent may be withdrawn at any time:
entirely, by unsubscribing from promotional communications;
partially, solely with regard to tracking. In this case, communications will continue to be sent, but the interactions of the individual recipient will no longer be monitored.
Withdrawal may be exercised through the dedicated link included at the bottom of each message or by writing to privacy@irinox.com.
In the absence of consent to tracking, the Data Controller may process exclusively aggregated and anonymous statistics (e.g. the overall campaign open rate), which cannot be attributed to individual recipients, and may use tools strictly necessary to ensure the security of the delivery service. Service e-mails (e.g. registration confirmations or acknowledgements of requests) do not contain individual tracking tools.
Interaction data are associated with non-intelligible and non-sequential identifiers and are not used for decisions based solely on automated processing pursuant to Article 22 GDPR. Interaction data are not used for profiling purposes.
Retention Period
| Purpose | Retention Period |
|---|---|
| A | 24 months from the last access to the restricted area, after which the account is blocked; if no further access occurs within an additional 24 months, the account is deleted. |
| B | 24 months from the last interaction with the user, unless consent is withdrawn earlier. |
| C | 12 months from collection, after which the data are anonymised. |
| D | 10 years from the final resolution of the dispute. |
Once the above periods have expired, the data will be deleted or anonymised; for technical and organisational reasons, deletion may take place within the following 30 days.
Nature of Data Provision and Consequences of Failure to Provide Data
| Purpose | Nature | Consequences |
|---|---|---|
| A | Necessary | Inability to register for the section and access the related services. |
| B | Optional | Inability to receive marketing communications from the Data Controller; no consequences for the other purposes. |
| C | Optional | Consent is included within the consent given for the “Marketing” purpose; if consent is withdrawn solely with regard to tracking, communications will continue to be sent without monitoring the interactions of the individual recipient. |
| D | Necessary | Inability to manage disputes. |
Scope of Communication
Data are processed by authorised internal personnel assigned to specific tasks and are disclosed externally in accordance with the following rules:
| Purpose | Categories of External Recipients |
|---|---|
| A | Companies belonging to the same corporate group, agents, distributors and retailers, external consultants, companies providing hosting and technology platform management services, companies providing authentication tools. |
| B | Companies belonging to the same corporate group, external consultants, companies providing hosting and technology platform management services and communication delivery services (e.g. e-mail marketing platforms). |
| C | Provider of the e-mail delivery platform, appointed as data processor. |
| D | Law firms, debt collection or credit assignment companies, judicial authorities. |
Recipients processing data on behalf of the Data Controller are appointed as data processors pursuant to Article 28 GDPR; the updated list is available upon request. Since data are also processed through IT systems, they may also be accessible to parties providing maintenance and support services for such systems. Personal data are not disclosed to the public.
Transfer of Data to a Third Country or International Organisation
The Data Controller does not transfer personal data outside the European Economic Area.
Data Subjects’ Rights
Data subjects are entitled to the following rights:
Access: to know whether personal data relating to them are being processed and, where this is the case, to obtain access to such data and request a copy.
Rectification: to request that personal data be updated, corrected if inaccurate, and completed if incomplete.
Erasure: to obtain the deletion of personal data where the applicable legal conditions are met.
Restriction: to request that personal data be marked so as to limit future processing where the applicable legal conditions are met.
Objection: to object to the processing of personal data, on grounds relating to the data subject’s particular situation, where the processing is based on legitimate interest; data subjects may also object at any time to the processing of personal data for direct marketing purposes, including related profiling.
Data Portability: to receive the personal data provided to the Data Controller in a structured, commonly used and machine-readable format and request that they be transmitted to another controller, where the processing is based on consent or a contract and carried out by automated means.
Withdrawal of Consent: to withdraw consent, in whole or in part, for the purposes that required it, without affecting the lawfulness of processing carried out prior to withdrawal.
Rights Exercisable in Relation to Each Processing Activity
| Purpose | Access | Rectification | Erasure | Restriction | Objection | Portability | Withdrawal of Consent |
|---|---|---|---|---|---|---|---|
| A | X | X | X | X | X | ||
| B | X | X | X | X | X | X | X |
| C | X | X | X | X | X | X | X |
| D | X | X | X | X | X |
To exercise the above rights, data subjects may use the form made available by the Italian Data Protection Authority and send it to privacy@irinox.com. Data subjects may also contact the same address to obtain further details regarding the information provided above (e.g. balancing tests relating to legitimate interest or the list of data processors).
Data subjects may lodge a complaint with a supervisory authority. In Italy, the competent authority is the Italian Data Protection Authority.