Who is the data controller
The data controller (titolare del trattamento) is Phoenix Crown Capital S.r.l. The Doctor Web is a division of Phoenix Crown Capital S.r.l., not a separate company.
The controller’s details are below. The email address and phone number to use for any question about your data are in the section “How to exercise your rights”.
Viale Abruzzi, 13/A, 20131 Milano MI, Italy
VAT no. & tax code 14942600967 · REA MI-2817255
PEC: [email protected]
Data we process
The website is static. It has no forms, user accounts or newsletter, and it does not use analytics, advertising, tracking pixels, or embedded maps, videos or social media widgets. Fonts are served from the site itself, so your browser sends no request to Google Fonts or to any content delivery network.
The site links to other websites (Google Maps, phoenixcrown.capital and nexustechagency.com). A link takes effect only when you click it; from that moment the third party’s own privacy policy applies, and we recommend that you read it.
The data we do process are listed below. We receive them directly from you or, in the case of server logs, from your device and browser when it requests a page.
- Server logs. The web server that hosts the site records technical data on every request: IP address, date and time, requested URL, HTTP status, referrer and user agent.
- Contact by email or phone. If you write or call us, we process what you send or tell us: your name, email address, phone number, company and the content of your message.
- Browser storage. Small technical items are kept in your own browser (cookies and local storage) to remember your cookie choice and, if you use the language switcher, your language. They are described in the Cookie policy and are not used for analytics, advertising or profiling.
Purposes and legal bases
Each purpose below has its own legal basis. Providing data is voluntary: if you do not give us your contact details or a message, we cannot reply to you. You do not need to provide anything to read the site, apart from the technical data your browser sends automatically, which the server records on every request.
- Delivering the site, keeping it secure and diagnosing faults (server logs). Legal basis: our legitimate interest in running a working and secure website, art. 6(1)(f) GDPR. The data are used only for these purposes.
- Replying to your email or call and, if you ask for it, preparing a proposal or contract (contact data). Legal basis: steps taken at your request before entering into a contract, and performance of a contract, art. 6(1)(b) GDPR.
- Keeping the records the law requires once a contract is in place, such as accounting and tax records. Legal basis: legal obligation, art. 6(1)(c) GDPR.
How long we keep data
We keep personal data only for as long as needed for the purposes for which it was collected. Cookies and local storage items last for the periods stated in the Cookie policy.
- Server logs: kept only for as long as needed for the purposes above, then deleted or anonymised.
- Requests sent to us: for as long as needed to handle the request.
- If a contract follows: for the duration of the relationship and then for the periods required by law. Accounting and tax records are kept for 10 years under art. 2220 of the Italian Civil Code.
Recipients and processors
Your data may be accessed by the categories of recipients listed below.
Processors act only on our instructions and under a contract that meets art. 28 GDPR. You can ask for the current list of processors using the contacts in the section “How to exercise your rights”.
- People who act under the controller’s authority and are authorised and instructed to process the data (art. 29 GDPR and art. 2-quaterdecies of the Codice Privacy).
- Service providers acting as data processors (responsabili del trattamento) under art. 28 GDPR: the provider that hosts the site, where one is used, which handles the server logs, and the email service provider, which handles the messages we receive and send.
- Public authorities and other bodies, only where the law requires it.
Transfers outside the EEA
The controller does not itself transfer personal data outside the European Economic Area (EEA).
If one of our processors transfers data outside the EEA, this happens only with the safeguards required by arts. 44 to 49 GDPR, for example an adequacy decision of the European Commission or standard contractual clauses. You can ask us for information on the safeguards in place (art. 15(2) GDPR).
Your rights
Under arts. 15 to 22 GDPR you have the following rights, which you can exercise at any time.
- Access (art. 15): to know whether we process your data and to receive a copy, together with the information listed in the article.
- Rectification (art. 16): to have inaccurate data corrected and incomplete data completed.
- Erasure (art. 17): to have your data erased in the cases the article provides.
- Restriction (art. 18): to have the processing limited in the cases the article provides.
- Data portability (art. 20): to receive the data you gave us, where processed by automated means on the basis of consent or a contract, in a structured, commonly used and machine-readable format, and to have it transmitted to another controller where technically feasible.
- Objection (art. 21): to object, on grounds relating to your particular situation, to processing based on legitimate interest, such as the server logs.
- Withdrawal of consent (art. 7(3)): where processing is based on consent, to withdraw it at any time, without affecting the lawfulness of processing carried out before the withdrawal. You can change your cookie choice at any time with the “Cookie settings” button in the footer.
- Automated decisions (art. 22): not to be subject to a decision based solely on automated processing, including profiling, that has legal or similarly significant effects. We do not carry out any automated decision-making or profiling.
How to exercise your rights
To exercise a right, write to the email address below or to the controller’s PEC address shown in the controller’s details above, saying which right you wish to exercise. You may also call the number below, but a written request lets us keep a record and reply properly.
We may ask for additional information to confirm your identity (art. 12(6) GDPR).
We reply without undue delay and in any case within one month of receiving your request. Where necessary, taking into account the complexity and number of requests, this period may be extended by up to two further months, and we will tell you within the first month (art. 12(3) GDPR). Exercising your rights is free of charge, unless requests are manifestly unfounded or excessive (art. 12(5) GDPR).
Email: [email protected]
Phone: +39 351 917 2815
Complaints
If you believe that the processing of your data breaches the law, you have the right to lodge a complaint with the Garante per la protezione dei dati personali (www.garanteprivacy.it) or with the supervisory authority of the EU country where you habitually live or work or where the alleged breach took place (art. 77 GDPR; arts. 140-bis and 142 of the Codice Privacy). You also have the right to a judicial remedy (art. 79 GDPR).
We would welcome the chance to address your concern first, so please contact us, but you are not obliged to.
Children
The site is not directed at children under 14, the age of digital consent in Italy (art. 2-quinquies of the Codice Privacy). We do not knowingly collect personal data from them. If you believe that a child under 14 has sent us personal data, please write to us using the contacts in this policy and we will take steps to delete it.
Changes to this policy
We may update this policy, for example if the site or the way we handle data changes. The date at the top of the page shows the latest version. Please check this page from time to time.