NOTICE TO NATURAL PERSONS PURSUANT TO ARTICLES 13 AND 14 OF REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL OF 27 APRIL 2016 (HEREINAFTER THE "NOTICE")

The purpose of this document is to inform the data subject about how their personal data, as described below, will be collected and processed by the Data Controller, as defined below, in compliance with the obligations set forth by Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data, as well as the free movement of such data (hereinafter the "Regulation") and other applicable laws on personal data protection.

This Notice may be modified at any time without any obligation and at the sole discretion of the Data Controller, in whole or in part, by updating it. In such cases, the Data Controller will notify users by publishing the updated version on the Website (as defined below), from which moment the modifications will become effective and binding on the Data Subject. To the extent permitted by law, if the Data Subject continues to use the Website and its services after the modifications take effect, such access and/or use of the services will be deemed as implicit acceptance of the modified Notice and the obligations arising therefrom. The modified version supersedes all previous versions of the Notice.

This Notice has been drafted based on the principle of transparency and all the elements required by the GDPR. Any terms not defined in this Notice refer to the General Terms and Conditions for the use of Devpunks services and are considered directly integrated into this document.

1. DATA CONTROLLER

The Data Controller is Devpunks S.r.l. (VAT No.: 12778070016), represented by its legal representative Giorgio Curini, with registered office at Via Vincenzo Lancia 31/20, Turin, whose details are also available on the homepage and/or other web pages of the website.

• Website: https://www.devpunks.com
• Email: info@devpunks.com
• Data Protection Officer (DPO): Lawyer Andrea De Gasperin, contactable at dpo@devpunks.com

2. PERSONAL DATA SUBJECT TO PROCESSING, PURPOSES, LEGAL BASIS, AND MANDATORY OR OPTIONAL NATURE OF PROCESSING

"Personal Data" refers to any information relating to an identified or identifiable natural person, with particular reference to an identifier such as a name, identification number, location data, online identifier, or one or more elements characteristic of their physical, physiological, psychological, economic, cultural, or social identity.

The Personal Data collected through the Website includes:

Browsing Data

The Website’s IT systems collect certain Personal Data whose transmission is implicit in the use of Internet communication protocols. These are pieces of information that are not collected to be associated with you but, by their very nature, could, through processing and association with data held by third parties, allow for your identification. These include:

• IP addresses or domain names of the devices used to connect to the Website,
• URI (Uniform Resource Identifier) addresses of requested resources,
• time of the request,
• method used to submit the request to the server,
• size of the file obtained in response,
• numerical code indicating the status of the response from the server (successful, error, etc.),
• other parameters related to your operating system and IT environment.

This data is used to obtain anonymous statistical information about the use of the Website and to verify its correct functioning; to ensure the correct delivery of the various functionalities requested by you, for security reasons, and to determine liability in case of potential cybercrimes against the Website or third parties. It is deleted after 7 days. In any case, such data is retained by the Website Owner for the strictly necessary period and in compliance with applicable legal provisions.

Data Provided Voluntarily

Through the Website, you have the option to voluntarily provide certain Personal Data such as your name, surname, email, and phone number via the "Contact Us" form or similar services, for purposes such as participation in projects proposed by the Data Controller, evaluation of the services provided, and service improvement.

You are free to provide your personal data, but failure to do so may result in the inability to obtain the requested service or information or to participate in proposed projects.

Cookies and Similar Technologies

The Data Controller collects Personal Data through cookies. To manage cookie consent, we use Cookiebot in compliance with GDPR regulations. When you access our Website, a Cookiebot banner allows you to accept or reject different categories of cookies.

More information on the use of cookies and similar technologies is available on the relevant page.

Purposes of Processing Personal Data

The Personal Data you provide through the Website will be processed by the Data Controller for the following purposes:

a) Responding to your contact or information requests received via email or through the "Contact Us" form. The legal basis for this is responding to your request or executing related service obligations. Providing this data is optional, but without filling in the required fields, the Data Controller will not be able to respond to your request.

b) Statistical research/analysis on aggregated or anonymous data, which does not allow the identification of the user, for the purpose of measuring the Website’s performance, analyzing traffic, evaluating usability and interest, and enabling navigation through the Website and its sections. This purpose does not involve the processing of personal data as it does not allow for identification.

c) Compliance with legal obligations to which the Data Controller may be subject and/or purposes necessary to establish, exercise, or defend a legal claim in court or whenever judicial authorities exercise their jurisdictional functions. The legal basis for this is the Data Controller's legitimate interest.

d) Purposes related to displaying content from external platforms, spam protection, tag management, performance testing (A/B testing), data collection management, online surveys, remarketing and behavioral targeting, advertising, collection of privacy preferences, and website creation and management.

For detailed information on processing purposes and the specific Personal Data processed for each purpose, the User may refer to the "Details on the Processing of Personal Data" section.

3. DETAILS ON THE PROCESSING OF PERSONAL DATA

Personal Data is collected for the following purposes and using the following services:

• Contacting the User

Contact Form (“Contact Us” form)

By filling out the contact form with your Data, you consent to its use for responding to information requests or any other requests indicated in the form's header.

Processed Personal Data: last name; email; first name; phone number; various types of Data.

Mailing List or Newsletter

By subscribing to the mailing list or newsletter, your email address is automatically added to a contact list that may receive email messages containing information, including commercial and promotional content related to the Website.

Your email address may also be added to this list as a result of signing up for the Website or after participating in an event.

Processed Personal Data: last name; email; first name; Tracking Tools.

• Research/Statistical Analysis

The services in this section allow the Data Controller to monitor and analyze traffic data and track User behavior.

Google Analytics (Universal Analytics) (Google Ireland Limited)

Google Analytics (Universal Analytics) is a web analytics service provided by Google Ireland Limited ("Google"). Google uses the collected Personal Data to track and analyze Website usage, compile reports, and share them with other Google services.

Google may use the collected Personal Data to contextualize and personalize ads in its advertising network.

For details on Google's data usage, please review Google's Partner Policies.

Processed Personal Data: Usage Data; Tracking Tool.

Processing Location: Ireland – Privacy Policy – Opt Out.

Directly Collected Statistics on the Website

Devpunks uses an internal statistics system that does not involve third parties.

Processed Personal Data: Usage Data; Tracking Tool.

Advertising Reporting Features in Google Analytics (Google Ireland Limited)

Google Analytics on the Website has enabled advertising reporting features, which collect additional information from the DoubleClick cookie (web activity) and device advertising IDs (app activity). This allows the Data Controller to analyze specific User behavior and interests (traffic data and User interactions with ads) and, if enabled, demographic data (age and gender).

Users can opt out of Google's cookies by visiting Google Ad Settings.

Processed Personal Data: unique device identifiers for advertising (such as Google Advertiser ID or IDFA); Tracking Tool; various types of Data as specified in the service's privacy policy.
Processing Location: Ireland – Privacy Policy – Opt Out.

Google Analytics Demographics and Interests Reports (Google Ireland Limited)
This is an advertising reporting feature that provides demographic and interest data within Google Analytics for Devpunks (demographic data includes age and gender).

Users can opt out of Google's cookies by visiting Google Ad Settings.

Processed Personal Data: unique device identifiers for advertising (Google Advertiser ID or IDFA);

Tracking Tool.

Processing Location: Ireland – Privacy Policy – Opt Out.

• Displaying Content from External Platforms

These services allow the display of content hosted on external platforms directly from the Website’s pages and interaction with such content.

Even if Users do not use these services, they may still collect web traffic data for the pages on which they are installed.

Google Fonts (Google Ireland Limited)

Google Fonts is a font display service managed by Google Ireland Limited that enables Devpunks to integrate such content into its pages.

Processed Personal Data: Usage Data; Tracking Tool.

Processing Location: Ireland – Privacy Policy.

Google Maps Widget (Google Ireland Limited)

Google Maps is a map display service managed by Google Ireland Limited that allows Devpunks to integrate such content into its pages.

Processed Personal Data: Usage Data; Tracking Tool.

Processing Location: Ireland – Privacy Policy.

YouTube Video Widget (Google Ireland Limited)

YouTube is a video content display service managed by Google Ireland Limited that allows Devpunks

to integrate such content into its pages.

Processed Personal Data: Usage Data; Tracking Tool.

Processing Location: Ireland – Privacy Policy.

• SPAM Protection

These services analyze Website traffic, which may include Users' Personal Data, to filter it from parts of traffic, messages, and content recognized as SPAM.

Google reCAPTCHA (Google Ireland Limited)

Google reCAPTCHA is an anti-SPAM service provided by Google Ireland Limited.

The use of reCAPTCHA is subject to Google’s privacy policy and terms of use.

For more details on Google's data usage, please review Google's Partner Policies.

Processed Personal Data: clicks; Usage Data; keypress events; motion sensor events; touch events; mouse movements; scrolling position; responses to questions; Tracking Tool.
Processing Location: Ireland – Privacy Policy.

• Tag Management

These services allow for the centralized management of tags or scripts used on the Website.

Using such services results in User Data flowing through them and, where applicable, being retained.

Google Tag Manager (Google Ireland Limited)

Google Tag Manager is a tag management service provided by Google Ireland Limited.

Processed Personal Data: Usage Data; Tracking Tool.

Processing Location: Ireland – Privacy Policy.

• A/B Testing and Content Performance Testing

These services allow the Data Controller to track and analyze User response, in terms of traffic or behavior, to changes in the Website’s structure, text, or other components.

Google Optimize (Google Ireland Limited)

Google Optimize is an A/B testing service provided by Google Ireland Limited ("Google").

Google may use Personal Data to contextualize and personalize ads in its advertising network.

Processed Personal Data: Usage Data; Tracking Tool.

Processing Location: Ireland – Privacy Policy.

Data Collection and Online Survey Management

This type of service allows Devpunks to manage the creation, implementation, administration, distribution, and analysis of online forms and surveys to collect, store, and reuse User Data from respondents.
The Personal Data collected depends on the information requested and provided by Users in the corresponding online form.

These services can be integrated with a wide range of third-party services to enable the Owner to take further actions with the processed Data—such as contact management, messaging, statistics, advertising, and payment processing.

Facebook-Instagram Lead Ads (Meta Platforms Ireland Limited)

Lead Ads is an advertising and data collection service provided by Meta Platforms Ireland Limited that allows Users to be shown advertisements in the form of pre-populated forms containing Personal Data from their Facebook profiles, such as names and email addresses. Depending on the type of ad, Users may be required to provide additional information.

Submitting the form results in the collection and processing of this Data by the Owner in accordance with this privacy policy and solely for the specific purpose indicated in the form and/or within this privacy policy, where applicable.

Users can exercise their rights at any time, including the right to withdraw consent for their Data processing, as specified in the section containing User rights information in this privacy policy.

Processed Personal Data: last name, email, first name, phone number.

Processing location: Ireland – Privacy Policy – Opt-out.

Remarketing and Behavioral Targeting

This type of service allows Devpunks and its partners to communicate, optimize, and serve ads based on the User’s past use of the Site.

This activity is facilitated by tracking Usage Data and using Tracking Tools to collect information that is then transferred to partners managing remarketing and behavioral targeting activities.
Some services offer a remarketing option based on email address lists.

Generally, these services provide the option to disable tracking via the opt-out function provided by any of the services listed in this document.

Google Ads Remarketing (Google LLC)

Google Ads is a remarketing and behavioral targeting service provided by Google LLC that connects Devpunks’ activity with the Google advertising network.

Users can opt out of Google Ads Tracking Tools for ad personalization by visiting this opt-out page.

Processed Personal Data: email, Tracking Tool.

Processing location: Ireland – Privacy Policy – Opt-out.

Facebook Custom Audiences (Meta Platforms Ireland Limited)

Facebook Custom Audiences is a remarketing and behavioral targeting service provided by Meta Platforms Ireland Limited that connects Devpunks’ activity with the Facebook advertising network.

Users can opt out of Facebook Tracking Tools for ad personalization by visiting this opt-out page.

Processed Personal Data: email, Tracking Tool.

Processing location: Ireland – Privacy Policy – Opt-out.

Advertising

This type of service allows User Data to be used for commercial communication purposes. These communications appear on the Site in the form of banners and other advertisements, also based on the User’s interests.

This does not mean that all Personal Data is used for this purpose. Data and usage conditions are indicated below.

Some of the services listed below may use Tracking Tools to identify Users or use behavioral retargeting techniques, meaning they display personalized ads based on the User’s interests and behavior, including outside the Site.

For more details, we recommend checking the privacy policies of the respective services.

Generally, these services provide the option to disable tracking via the opt-out function offered by any of the services listed in this document.

Facebook Lookalike Audiences (Meta Platforms Ireland Limited)

Facebook Lookalike Audiences is an advertising and behavioral targeting service provided by Meta Platforms Ireland Limited. It uses Data collected through Facebook Custom Audiences to display ads to Users with behaviors similar to those already included in a Custom Audience list, based on their past use of the Site or interaction with relevant content through Facebook applications and services.

Based on this Data, personalized ads will be shown to Users suggested by Facebook Lookalike Audiences.

Users can opt out of Facebook Tracking Tools for ad personalization by visiting this opt-out page.

Processed Personal Data: Usage Data, Tracking Tool.

Processing location: Ireland – Privacy Policy – Opt-out.

Direct Email Marketing (DEM)

Devpunks uses User Data to send commercial offers related to services and products provided by third parties or unrelated to the products or services provided by Devpunks.

Processed Personal Data: last name, email, first name.

• Privacy Preference Collection

These services allow Devpunks to collect and store User preferences regarding the collection, use, and processing of their personal information, as required by applicable privacy laws.

Cookiebot (Usercentrics)

Cookiebot allows the Data Controller to collect and store User preferences regarding the processing of personal data, particularly the use of Cookies and other Tracking Tools on the Website.

Processed Personal Data: Tracking Tool.

Processing Location: Germany – Privacy Policy.

Typeform Consent Management

Consent Management allows the Data Controller to collect and store User preferences regarding personal data processing.

Processed Personal Data: Tracking Tool.

Processing Location: Spain – Privacy Policy.

4. METHODS

1. Tools and Logic

In relation to the purposes mentioned above, processing is carried out using IT and telematic tools with logic strictly related to these purposes. It is also done in a way that ensures the security and confidentiality of the data, with your commitment to promptly inform us of any corrections, modifications, or updates. Such processing may be carried out on behalf of the Data Controller for the purposes and in the manner described above, in compliance with criteria suitable for ensuring security and confidentiality, by companies, firms, entities, and external collaborators appointed as Processors, but only concerning the processing activities they perform. The server hosting this website is located within the European Union.

2. Special Categories of Data

None of your personal data held by the Data Controller falls under the definition of "Special Categories of Data" as outlined in Article 9 of the EU Regulation 2016/679. If you transmit such data to us, we will ensure its immediate deletion in the absence of your explicit written consent.

5. THIRD PARTIES TO WHOM YOUR DATA MAY BE DISCLOSED

Your Personal Data may be shared, for the purposes specified in Section 2, with:

Entities necessary for the provision of services offered by the Website (including, for example, the company that created and manages the website from a technical perspective), acting either as independent data controllers or external processors. The Controller has selected these partners based on their compliance with applicable data protection laws

Individuals authorized by the Controller to process Personal Data, who are bound by confidentiality obligations or have an appropriate legal obligation of confidentiality (e.g., employees and collaborators of the Controller), appointed as authorized personnel or external processors.

Judicial authorities in the exercise of their functions, when required by applicable law.

6. DATA TRANSFERS

Your personal data is not typically transferred to recipients outside the European Economic Area (EEA). If such transfers occur, the Controller ensures that your Personal Data is processed electronically by the recipients in compliance with the applicable data protection laws. Specifically, the transfers will be based on either an adequacy decision or the Standard Model Clauses approved by the European Commission. Your personal data will not be disseminated or disclosed to unauthorized third parties.

7. DATA RETENTION

The Controller will process your Personal Data for the time strictly necessary to achieve the purposes set out in Section 2. For example, Personal Data provided to request information will be processed until the request has been completed. Beyond this, the Controller will retain your Personal Data for as long as permitted under Italian law to protect its interests (Article 2947(1)(3) of the Civil Code). Further information on the retention period and the criteria used to determine it can be requested by contacting the Controller or the Data Protection Officer (DPO).

8. YOUR RIGHTS

Under the applicable law, you have the right to request from the Controller, at any time:

Access to your Personal Data

Rectification or deletion of your Personal Data

Objection to processing

Restriction of processing

The right to receive your data in a structured, commonly used, and machine-readable format

Requests should be sent via email to the Controller or the DPO.

Under applicable law, you also have the right to file a complaint with the competent supervisory authority (the Italian Data Protection Authority – Garante per la Protezione dei Dati Personali) if you believe that the processing of your Personal Data is in violation of the law.

1. Right of Access

You have the right to obtain confirmation from the Controller as to whether or not your Personal Data is being processed. If so, you can access the data and the details outlined in Article 15 of the Regulation, including the purposes of processing and the categories of Personal Data processed.

If your Personal Data is transferred to a third country or an international organization, you have the right to be informed of the appropriate safeguards in place regarding the transfer.

Upon request, the Controller can provide a copy of the processed Personal Data. If additional copies are requested, the Controller may charge a reasonable administrative fee. If the request is made electronically, and unless otherwise indicated, the information will be provided in an electronic format.

2. Right to Rectification

You have the right to obtain the correction of inaccurate Personal Data and, considering the purposes of the processing, the right to have incomplete data completed by providing a supplementary statement.

3. Right to Erasure (Right to be Forgotten)

You have the right to have your Personal Data deleted if one of the conditions outlined in Article 17 of the Regulation applies, including:

The data is no longer necessary for the purposes for which it was collected.

You withdraw your consent, and there is no other legal basis for processing.

Please note that the Controller cannot delete your Personal Data if processing is necessary, for example, for legal obligations, reasons of public interest, or for the establishment, exercise, or defense of legal claims.

4. Right to Restriction of Processing

You can request the restriction of the processing of your Personal Data under Article 18 of the Regulation, for example:

If you contest the accuracy of your Personal Data.

If the data is needed for legal claims, even though the Controller no longer requires it for processing.

5. Right to Data Portability

If the processing is based on consent or necessary for the performance of a contract and is carried out by automated means, you have the right to:

Receive your Personal Data in a structured, commonly used, and machine-readable format (e.g., computer or tablet).

Transmit your Personal Data to another Controller without interference.

You may also request the direct transfer of your Personal Data from the Controller to another Controller, if technically feasible. You must provide all necessary details of the new data controller along with written authorization.

6. Right to Object

You may object at any time to the processing of your Personal Data if processing is based on a task carried out in the public interest or for the Controller’s legitimate interests (including profiling).

If you exercise this right, the Controller will stop processing your Personal Data unless compelling legitimate reasons prevail over your interests, rights, and freedoms, or unless processing is necessary for legal claims.

7. Right to Lodge a Complaint with the Supervisory Authority

Without prejudice to any other administrative or judicial remedy, if you believe that the processing of your Personal Data violates applicable law, you can lodge a complaint with the competent Data Protection Authority (www.garanteprivacy.it).

By accepting this privacy notice, you declare without reservation that:

You have read the Privacy Notice in its entirety and accept all parts related to the processing purposes.

You have received clear and complete explanations from the Controller and/or authorized personnel about the purposes of your consent, the processing methods, and your rights regarding data processing.

This Privacy Policy was last updated on March 20, 2025.