Privacy policy

Courtesy translation. The Italian text is the legally binding version.

Who we are

The address of our website is: https://studioolisticoyun.it.

Yun di Cristina Monti, based in Bologna – 40122 (BO), at Via San Rocco 4/c, in its capacity as Data Controller of personal data¹ pursuant to Article 4 of Regulation (EU) 2016/679, informs you, pursuant to Article 13 of the Regulation, that it will process your personal data manually and/or with the support of electronic means for the purposes indicated below.

Purposes of the processing

The personal data you provide will be processed for purposes connected with the performance of the contract, including any pre-contractual phase, and specifically for: compiling registers of personal details, keeping the accounts, invoicing, communicating by both paper and electronic means, tax obligations, organisational management of the services requested and the conclusion of contracts, scheduling appointments, order processing, deliveries, and administrative formalities relating to the services requested.
Your data may be used to send, on paper or by email, commercial and/or promotional communications relating to products and services similar to those covered by the contractual relationship between us, unless you object.
Your data may be processed for internal statistical purposes.
Failure to provide your personal data will make it impossible for us to give effect to contracts and carry out other related obligations, as well as to manage our mutual business relations properly.

Legal basis

Your personal data will be processed for the performance of a contract concluded with you or for the performance of pre-contractual measures taken at your request.
The sending of commercial and/or promotional communications relating to products and services similar to those covered by the contractual relationship between us takes place on the basis of the Data Controller’s legitimate interest.

Recipients of the data

Your data may also be disclosed to third parties, for technical and operational needs strictly connected with the purposes set out above, and in particular to the following categories of recipients:

• a) bodies, professionals, companies or other organisations appointed by us to carry out the processing connected with the fulfilment of the administrative, accounting and management obligations linked to the ordinary conduct of our business, including for debt recovery purposes;
• b) public authorities and administrations for purposes connected with compliance with legal obligations, or persons entitled to access the data by virtue of laws, regulations or European Union legislation;
• c) banks, financial institutions or other parties to whom the transfer of the above data is necessary for the conduct of our business in relation to the fulfilment of the contractual obligations we have undertaken towards you;
• d) providers of installation, support and maintenance services for IT and telecommunications systems and equipment, and of all services functionally connected with and necessary for the performance of the services covered by the Contract.
• The list of data processors is available on request.

Data retention periods

Your personal data will be kept for the time strictly necessary to carry out the purposes described above and to comply with the obligations laid down by law.

Transfer of data

The Data Controller does not transfer personal data to third countries or international organisations.
However, the Data Controller reserves the possibility of using cloud services; in that case, the service providers will be selected from among those that offer appropriate safeguards, as provided for by Article 46 of Regulation (EU) 2016/679 (GDPR).

Rights of the data subject

Pursuant to Articles 13(2) and 15 to 21 of the Regulation, we inform you that, with regard to the processing of your personal data, you may exercise the following rights:

a) The right to obtain access to your personal data and to the following information:
confirmation as to whether or not your personal data are being processed;
the purposes of the processing;
the categories of personal data;
the recipients or categories of recipients to whom the personal data have been or will be disclosed;
where the data are not collected from the data subject, all available information on their source;
the existence of automated decision-making, including profiling;
a copy of the personal data undergoing processing.
b) The right to rectification and completion of your personal data;
c) The right to erasure of your data (“right to be forgotten”) if one of the following grounds applies:
the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;
the data subject withdraws consent to the processing and there is no other legal ground for the processing;
the data subject objects to the processing and there are no overriding legitimate grounds for the processing;
the personal data have been unlawfully processed;
the personal data must be erased for compliance with a legal obligation under Union or Member State law to which the controller is subject.
If the controller has made personal data public and is obliged to erase them, it must inform the other controllers processing the personal data of the request to erase any link to, or copy or replication of, those data.
d) The right to restriction of processing where:
the data subject contests the accuracy of the personal data, for a period enabling the controller to verify the accuracy of those personal data;
the processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of their use instead;
although the controller no longer needs the personal data for the purposes of the processing, they are required by the data subject for the establishment, exercise or defence of legal claims;
the data subject has objected to the processing, pending verification of whether the legitimate grounds of the controller override those of the data subject.
e) The right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali), following the procedures and instructions published on the Authority’s official website www.garanteprivacy.it.
f) The right to data portability, that is, the right to receive the personal data concerning you that you have provided to a controller in a structured, commonly used and machine-readable format and to transmit them to another controller, where the processing is based on consent or on a contract and is carried out by automated means. Where technically feasible, the data subject has the right to have the data transmitted directly from one controller to another.
g) The right to object at any time to the processing of personal data, including profiling, in particular where:
the processing is based on the legitimate interest of the controller, stating the grounds for the objection;
the personal data are processed for direct marketing purposes.
h) The right not to be subject to a decision based solely on automated processing, including profiling, except where the decision: is necessary for entering into, or the performance of, a contract between the data subject and a controller; is authorised by Union or Member State law to which the controller is subject; or is based on the data subject’s explicit consent.
i) The right to withdraw consent at any time; where the data do not rest on another legal basis (including compliance with a legal obligation or the performance of a contract), they must be erased by the controller.
The exercise of these rights is not subject to any formal requirement and is free of charge.

How to exercise your rights

The data subject may exercise these rights at any time by sending:
a registered letter with acknowledgement of receipt to Yun di Cristina Monti – Via San Rocco 4/c – 40122 Bologna (BO);
an email to cristinamonti@virgilio.it.

Data Controller

The Data Controller is Yun di Cristina Monti – Via San Rocco 4/c – 40122 Bologna (BO).
Contact details: tel. 339 332 0050 – email: cristinamonti@virgilio.it

¹ By processing of personal data we mean any operation or set of operations, performed whether or not by automated means and applied to personal data or sets of personal data, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

This website

The website studioolisticoyun.it is an information-only showcase: it has no restricted areas, does not store personal data and does not use analytics or profiling tools.

The forms to request an appointment or a gift voucher are sent only after you have accepted this notice. With “Send on WhatsApp”, your WhatsApp app opens with the message ready, and it is up to you to decide whether to send it. With “Send by email”, the data you write in the form (name, email or phone number, treatment, message) are received through Netlify Forms, the service of the website’s hosting provider: it forwards them as an email to the Data Controller and keeps them in the website’s dashboard until the Data Controller deletes them. The data are used only to reply to your request and are processed in accordance with this notice.

The links to Treatwell, WhatsApp, Instagram, Facebook and Google lead to external services, which process data in accordance with their own notices. The map of the studio is a drawing hosted on this website (data © OpenStreetMap): it does not load third-party services.

As with any website, the hosting provider may record in its technical logs the IP address and the pages requested, for the time strictly necessary to ensure the security and operation of the service. For cookies, see the cookie policy.