BLACKWOOD S.R.L. · Personal data protection
Privacy Policy
This notice explains how BLACKWOOD S.R.L. processes the personal data of people who visit blackwood.it, contact the company or take part in discussions on the website, pursuant to Articles 12 and 13 of Regulation (EU) 2016/679 (GDPR).
Last updated:
1. Controller and contact details
The data controller is BLACKWOOD S.R.L., with its registered office at Via Siegmund Freud 8, 09126 Cagliari (CA), Italy, tax code and VAT number 02683670927, Economic and Administrative Register (REA) number CA-216449.
For information about the processing of your data or to exercise your rights, you can write to info@blackwood.it, to the certified email (PEC) address blackwood@legalmail.it, or to our registered office, using “Privacy” as the subject.
2. Data, purposes and legal bases
Browsing and website security
When you visit the website, our IT systems process the data needed to receive and handle browser requests: your IP address, date and time, the resource requested, the outcome of the request and technical information about your browser, device and referring page, when transmitted. These data are used to display pages, operate the website, diagnose errors and prevent unauthorised access.
The legal basis is the controller’s legitimate interest in making the website available and protecting it and its systems, under Article 6(1)(f) GDPR.
Enquiries through the contact form or email
If you contact us, we process your name, email address, message and any other data you choose to provide. We use them to reply, provide information about our services and handle requests for quotations or collaboration.
For enquiries about a possible engagement, processing is necessary to take steps at the data subject’s request before entering into a contract (Article 6(1)(b) GDPR). For general enquiries, the legal basis is our legitimate interest in responding to communications received (point (f)). If the enquiry leads to a contractual relationship, the necessary data are also processed to perform the contract and comply with legal obligations (points (b) and (c)).
The acknowledgement of this notice in the contact form is intended to make you aware of the processing: it does not constitute consent to receive advertising. Contact details provided for an enquiry are not, on that basis alone, used to subscribe you to newsletters or promotional campaigns.
Comments on articles
On pages where comments are enabled, we process the data entered in the form, such as your name, email address, optional website and comment, together with your IP address and browser information. Your name and comment, and any website link you provide, may be published; your email address is not displayed in the comment.
The purposes are to enable and moderate discussions, prevent abuse and handle requests relating to comments. The legal basis is our legitimate interest in managing the discussion space you choose to use (Article 6(1)(f) GDPR). Before submitting a comment, please avoid including confidential information or other people’s personal data.
Legal obligations and protection of rights
Data may be processed where necessary to comply with legal obligations or lawful requests from authorities (Article 6(1)(c) GDPR), and to establish, exercise or defend legal claims (point (f)). The website does not make decisions based solely on automated processing that produce legal or similarly significant effects, or carry out its own advertising profiling.
3. Required and optional data
In the contact form, your name and email address are required to identify your enquiry and reply; the message is optional. The form cannot be submitted without the required data. You can also contact us directly by email. Technical connection data are necessary to use the website; additional information you include in your communications is optional.
We do not request data about your health, personal beliefs or other special categories of personal data: please do not include them in forms or comments. Public self-registration for user accounts is not available.
4. How long we retain data
We retain data for as long as necessary for the purposes for which they were collected, according to the following criteria:
- Enquiries and correspondence: for the time needed to handle the enquiry and any follow-up. Any subsequent retention is limited to documentation useful for the professional relationship, compliance with legal obligations or the protection of rights, taking account of applicable limitation periods.
- Contractual and administrative data: for the periods required by the legislation applicable to the specific documentation.
- Technical and security logs: according to system rotation cycles and storage limits, for the time useful for operational management and investigating anomalies; in the event of incidents or requests from authorities, only the relevant information may be retained for the necessary investigations.
- Comments: while the comment and the relevant article remain published and useful to the discussion, subject to deletion, moderation or the need to protect rights. Metadata are retained in connection with managing the comment and preventing abuse.
Backup copies follow the retention and overwriting cycles of the backup systems; any data remaining in residual copies are restricted to restoration and security needs. You can ask the controller for information about the criteria applicable to your data.
5. Who can access data and how we protect them
Data are accessible to authorised people responsible for handling enquiries, managing the website and maintaining security. Within the scope of their activities, data may also be processed by hosting, email, IT support and maintenance providers, professionals and advisers, and authorities where required by law. Providers processing data on the controller’s behalf operate within the framework of Article 28 GDPR; other recipients may act as independent controllers.
The website’s hosting infrastructure is provided by Contabo. Further information about the provider is available in its privacy policy. Contact form data are not published on the website; comments are public to the extent described above. Data are not sold.
Processing uses IT tools and technical and organisational measures appropriate to its purposes, including access controls, connection protection and separation of application environments.
6. External services and international transfers
Google Fonts
The website loads some fonts from Google’s servers. Your browser therefore communicates your IP address and the technical data needed for the request to Google, such as the requested URL and browser information. The purpose is to display the pages correctly; the legal basis for the controller’s related processing is its legitimate interest in the website’s presentation and usability (Article 6(1)(f) GDPR). Google Fonts does not set cookies to serve fonts.
For Google’s processing, see the Google Privacy Policy and the information about Google Fonts.
Comment avatars: Gravatar
The WordPress avatar feature may request an image from Automattic’s Gravatar service using an identifier derived from the commenter’s email address (a hash). A hash is pseudonymised data, not a guarantee of anonymity. When the image loads, the service also receives technical data about the visitor’s connection. The purpose is to associate an image with comments, as part of our legitimate interest in managing and presenting discussions. For details, see the Automattic privacy policy and Gravatar’s privacy information.
Links to external websites and maps
If you follow a link to an external website, including links to Google Maps, you interact with a service governed by its own privacy notice. Opening the service may involve the processing of your IP address, device data and any identifiers already stored in your browser. Please consult the provider’s information before using that service.
Processing outside the European Economic Area
The use of Google and Automattic services may involve processing in the United States and other countries. Google and Automattic state that, for the relevant transfers, they use the EU–US Data Privacy Framework, where applicable, and other mechanisms provided for by the GDPR, such as standard contractual clauses. You can consult Google’s transfer safeguards and the section on transfers in the Automattic privacy policy.
For information about recipients and safeguards applicable to data processed on behalf of BLACKWOOD S.R.L., or to request a copy of those safeguards to the extent permitted, you can contact the controller using the details above.
7. Your rights
Subject to the conditions in Articles 15–22 GDPR, you may request access to your data, rectification, erasure, restriction of processing and data portability where processing is based on consent or a contract and is carried out by automated means.
You may object, on grounds relating to your particular situation, to processing based on legitimate interests. The controller will stop processing unless there are compelling legitimate grounds that override your interests, rights and freedoms, or grounds for establishing, exercising or defending legal claims. Where processing is based on consent, you may withdraw that consent at any time without affecting the lawfulness of processing before its withdrawal.
Send requests to info@blackwood.it or to the other contact details in section 1. We normally respond within one month; for complex cases, this period may be extended by a further two months, with the reasons communicated within the first month. If necessary, we may request only the information needed to verify the requester’s identity.
You may also lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali) or the competent supervisory authority in the country of your habitual residence, place of work or the alleged infringement, and seek a judicial remedy.
8. Updates to this notice
This notice covers the website’s processing activities as of the date shown above. Changes to services and processing arrangements will be accompanied by an update to this page and, where required, a specific notice or a new request for consent.