PERSONAL DATA PROCESSING NOTICE

(pursuant to Article 13 of EU Regulation 2016/679)

This notice describes how this website is managed with regard to the processing of personal data belonging to users who visit it. It is provided pursuant to Article 13 of Regulation (EU) 2016/679 – the General Data Protection Regulation (hereinafter "GDPR") – to those who interact with the web services accessible online at: www.virtuapilot.it

This notice applies solely to this website and not to any other websites the user may visit via links found on it.

1. DATA CONTROLLER

The Controller of personal data processing is . virtua sro. Registered office: Pieskovcová VAT number / Tax code: SK2023187694 Email: info@virtuapilot.it

(hereinafter the "Controller").

2. TYPES OF DATA PROCESSED

A) Browsing data In the course of their normal operation, the computer systems and software procedures used to run this website acquire certain personal data whose transmission is implicit in the use of internet communication protocols. This information is not collected with the aim of identifying users, but by its very nature could, through processing and matching with data held by third parties, allow users to be identified. This category of data includes IP addresses or domain names of the computers used by visitors, the URI (Uniform Resource Identifier) addresses of the resources requested, the time of the request, the method used to submit the request to the server, the size of the file received in response, the numerical code indicating the status of the server's response (successful, error, etc.), and other parameters relating to the user's operating system and computing environment.

B) Data provided voluntarily by the user The optional, explicit and voluntary sending of emails to the addresses shown on this website, or the completion of contact forms to request quotes or information, results in the acquisition of the sender's address, which is necessary to reply to enquiries, as well as any other personal data included in the message (e.g. first name, surname, phone number, vehicle details).

3. PURPOSES AND LEGAL BASIS OF PROCESSING

Personal data is processed for the following purposes and on the following legal bases:

Purpose of Processing	Legal Basis
a) Managing and responding to requests for information and quotes:  to respond to enquiries received via the contact form or by email.	Performance of pre-contractual measures taken at the request of the data subject (Art. 6(1)(b) GDPR).
b) Provision of the requested services:  to manage appointments, carry out repairs and fulfil contractual obligations.	Performance of a contract to which the data subject is party (Art. 6(1)(b) GDPR).
c) Compliance with legal obligations:  for accounting, tax and administrative requirements set out by law.	Compliance with a legal obligation to which the Controller is subject (Art. 6(1)(c) GDPR).
d) Direct marketing (where applicable):  sending promotional communications, newsletters or commercial offers relating to the Controller's services.	Specific, freely given, informed and unambiguous consent of the data subject (Art. 6(1)(a) GDPR).
e) Website operation and security:  to ensure the correct functioning of the website and the security of browsing.	Legitimate interest of the Controller in ensuring the security and efficiency of its IT systems (Art. 6(1)(f) GDPR).

Providing data for purposes a), b) and c) is necessary to respond to the user's requests and to perform the contract. Failure to provide this data would make it impossible to deliver the requested services. Providing data for purpose d) is optional, and any refusal will not affect the provision of other services.

4. PROCESSING METHODS AND RETENTION PERIOD

Processing will be carried out using automated and/or manual methods, with tools and procedures designed to ensure maximum security and confidentiality. Personal data will be retained for no longer than is necessary to achieve the purposes for which it is processed (the "storage limitation principle", Art. 5 GDPR). Specifically:

• Data processed for contractual and legal purposes (points 3.b and 3.c): for 10 years from the end of the contractual relationship, in compliance with civil and tax law obligations.
• Data processed for information requests (point 3.a): for the time strictly necessary to handle the request and, in any case, no longer than 24 months in the absence of a subsequent contractual relationship.
• Data processed for marketing purposes (point 3.d): until the data subject withdraws their consent.
• Browsing data (point 3.e): for the duration of the browsing session and, for longer periods, in anonymised form for statistical analysis.

5. DISCLOSURE OF DATA

Personal data may be disclosed to:

• Internal staff of the Controller, authorised to process the data.
• External professionals or companies (e.g. accountants, legal advisers, IT service providers) acting on behalf of the Controller, appointed, where necessary, as Data Processors pursuant to Art. 28 GDPR.
• Public authorities, supervisory bodies and judicial authorities, where required by law.

Personal data will not be made publicly available. Data is stored on servers located within the European Union.

6. RIGHTS OF DATA SUBJECTS

With regard to their personal data, data subjects may exercise the rights set out in Articles 15–22 of the GDPR at any time:

• Right of access (Art. 15): to obtain confirmation of whether personal data concerning them is being processed and, if so, to access that data and all related information set out in the Article.
• Right to rectification (Art. 16): to have inaccurate personal data corrected.
• Right to erasure ("the right to be forgotten", Art. 17): to have personal data erased without undue delay, in the circumstances set out by law.
• Right to restriction of processing (Art. 18): to obtain a restriction on processing where one of the applicable conditions applies.
• Right to data portability (Art. 20): to receive their personal data in a structured, commonly used, machine-readable format and to transmit it to another controller.
• Right to object (Art. 21): to object at any time to the processing of their personal data, including profiling. Where data is processed for direct marketing purposes, the data subject has the right to object at any time.
• Right not to be subject to automated decision-making (Art. 22): not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning them or similarly significantly affects them.

Data subjects also have the right to withdraw their consent at any time, without affecting the lawfulness of processing based on consent given before its withdrawal. Requests to exercise these rights may be sent to the Controller's email address: info@virtuapilot.it.

Finally, data subjects have the right to lodge a complaint with a supervisory authority, in particular in the Member State of their habitual residence, place of work, or the place where the alleged infringement occurred (for Italy, the Data Protection Authority, www.garanteprivacy.it).

COOKIE POLICY

Cookies are small text files sent to a user's device by the websites they visit, where they are stored to be sent back to those same websites on the user's next visit.

1. TYPES OF COOKIES USED

This website uses the following types of cookies:

A) Technical cookies These cookies are essential for the website to function correctly and to allow browsing. Without them, users may not be able to view pages correctly or use certain services. Prior user consent is not required to install these cookies. This category includes:

• Browsing or session cookies: ensure normal browsing and use of the website.
• Functionality cookies: allow users to browse according to a set of selected criteria (for example, language), improving the service provided.

B) Analytics (or statistical) cookies These cookies are used to gather aggregated, anonymous information about the number of users and how they browse the website. Where tools are used that reduce the identifying power of cookies (e.g. IP address anonymisation) and the third party undertakes not to cross-reference the information collected with other data it already holds, these cookies are treated in the same way as technical cookies and do not require consent.

2. MANAGING CONSENT AND COOKIES

On first visiting the site, a banner is displayed containing a short notice, a link to this full notice, and the option to manage cookie preferences. Users can give their consent to the use of non-technical cookies by clicking the relevant accept button. Users can change or withdraw their consent at any time.

Cookie information must be clear and complete, including details of how long cookies last and whether third parties can access them.

3. HOW TO DISABLE COOKIES VIA BROWSER SETTINGS

Users can also manage their cookie preferences directly within their browser — for example, to prevent third parties from installing cookies. Below are links to the help pages of the main browsers:

• Google Chrome: https://support.google.com/chrome/answer/95647
• Mozilla Firefox: https://support.mozilla.org/it/kb/Gestione%20dei%20cookie
• Internet Explorer: https://support.microsoft.com/en-us/help/17442/windows-internet-explorer-delete-manage-cookies
• Safari: https://support.apple.com/en-gb/guide/safari/sfri11471/mac

Please note that disabling technical cookies may affect the correct functioning of the website.

Last updated: 24/06/2026