NOTICE ON THE PROCESSING AND PROTECTION OF PERSONAL DATA

The controller of your personal data is Luxia S.r.l. (Tax Code and VAT No. 13301690015), with registered office at 10121 – Turin (TO), Corso Giacomo Matteotti 42, in the person of its pro tempore legal representative, e-mail: privacy@hiluxia.com (hereinafter "Luxia" or the "Company" or the "Controller").
Should the Controller make use of processors or sub-processors pursuant to Art. 28 GDPR, the updated list of processors and persons in charge of processing is kept at the Controller's registered office.

The types of personal data we collect depend on the purpose for which they are collected.

In general, we may collect directly from you the following types of personal data through the "Contact Us", "Chat with me" and "Request a Demo/Try Luxia" sections of the platform (hereinafter "Personal Data"):

• common personal data relating to the user (such as, by way of example and not limited to: first name, last name, e-mail address);
• personal data provided through the communication sent and/or contained in its attachments;
• usage, browsing and technical data, and profiling data, including the device identifier or the user's IP address, the time the user visits the site, the URI (Uniform Resource Identifier) addresses of the requested resources, the time of the request, the method used to submit the request to the server, the size of the file obtained in response, the numerical code indicating the status of the response given by the server (success, error, etc.) and other parameters relating to the user's operating system and computing environment.

Processing also concerns the operations or set of operations relating to data collected through the use of cookies, whose policy is referred to in full and can be viewed at the following link [.] [insert cookie policy link].

The Controller processes your Personal Data:

A) without your express consent (Art. 6(b)-(f) GDPR), for the following purposes:

• performance of the contract or of pre-contractual measures adopted at your request;
• fulfilling pre-contractual, contractual and tax obligations arising from ongoing relationships;
• fulfilling obligations imposed by law, by a regulation, by EU legislation or by an order of the Authority;
• pursuing a legitimate interest of the Controller or of third parties, provided that your interests or your fundamental rights and freedoms requiring the protection of personal data do not prevail (e.g., the Controller's right to defend itself in legal proceedings).

B) only upon your specific and separate consent (Art. 6(a) and Art. 7 GDPR), for the following marketing purposes:

• sending, via e-mail, post and/or SMS and/or telephone contact, newsletters, commercial communications and/or advertising material on products offered by the Controller, and surveying satisfaction with the quality of the services;
• sending, via e-mail, post and/or SMS and/or telephone contact, invitations to events organized by the Controller or of which the Controller is a partner.

If you have withheld your consent, it will not be possible to carry out the activities under B) above; if you have given your consent to the processing activities under B), you will in any case have the right to withdraw your consent at any time.

Your Personal Data will be processed by the Controller only for the period of time necessary to achieve the purposes of processing referred to in the preceding Article 3, after which they will be retained solely in compliance with the legal obligations in force on the matter, for administrative purposes and/or to assert or defend a right, and in any case not beyond the terms set by law for the statute of limitations on rights. In particular, for marketing purposes, your Personal Data will be retained by the Controller for a maximum of two years.

Personal Data undergo electronic and/or automated processing for the time necessary to achieve the purposes for which they are collected, by the Controller or by duly authorized persons and/or persons appointed to carry out such tasks, who are consistently identified and/or appointed, duly instructed and made aware of the constraints imposed by law, as well as through the use of security measures designed to ensure the protection of confidentiality and to avoid the risk of loss or destruction, unauthorized access, or processing not permitted or not consistent with the purposes set out above.

For the purposes indicated above, your collected data may be made accessible or disclosed to:

• employees and collaborators of the Controller, in their capacity as persons authorized to process data, within the scope of their respective duties and in accordance with the instructions received. Such individuals are nonetheless subject to confidentiality obligations;
• third parties carrying out outsourced activities on behalf of the Controller, to whom certain activities, or part of them, functional to the provision and distribution of the services offered through the site are entrusted (e.g., hosting companies, developers, system administrators and database administrators), or whose activity is connected, instrumental or supportive to that of the Controller (e.g., cloud management and/or marketing software);
• all public and/or private entities, natural and/or legal persons (legal, administrative and tax consultancy firms, debt collection agencies, Judicial Offices, Chambers of Commerce, Labour Chambers and Offices, etc.), where disclosure is necessary or functional to the proper fulfilment of contractual obligations undertaken, as well as obligations arising from law;
• all those entities (including Public Authorities) that have access to personal data by virtue of regulatory or administrative measures.

In any case, your collected personal data will not be disseminated.

The management and storage of your Personal Data will take place in Europe. It remains understood that the Controller, should it become necessary, will have the right to have your Personal Data processed outside the EU Area (EEA). In such a case, the Controller assures from now that the transfer of data outside the EU will take place in compliance with the applicable legal provisions, entering into, where necessary, agreements guaranteeing an adequate level of protection and/or adopting the standard contractual clauses provided for by the European Commission.

Pursuant to Articles 15 et seq. of the GDPR and applicable national legislation on privacy and personal data protection, you have the right to:

• obtain from the Controller confirmation as to whether or not personal data concerning you is being processed and, if so, to obtain access to the personal data and the following information:
  • the purposes of the processing;
  • the categories of personal data concerned;
  • the recipients or categories of recipients to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organizations;
  • where possible, the envisaged period for which the personal data will be retained, or, if not possible, the criteria used to determine that period;
  • the existence of the right of the data subject to request from the controller rectification or erasure of personal data or restriction of processing of personal data concerning them, or to object to such processing;
  • the right to lodge a complaint with a supervisory authority;
  • where the data are not collected from the data subject, any available information as to their source;
  • the existence of automated decision-making, including profiling.
• obtain from the Controller, without undue delay, the rectification of inaccurate personal data concerning them. Taking into account the purposes of the processing, the data subject has the right to obtain the completion of incomplete personal data, including by means of providing a supplementary statement;
• obtain from the Controller, without undue delay, the erasure of personal data concerning them, and the Controller is obliged to erase personal data without undue delay within the limits and in the cases provided for by applicable law;
• obtain from the Controller restriction of processing;
• receive the personal data concerning them that they have provided to the Controller in a structured, commonly used and machine-readable format, and to have the right to data portability, i.e. to transmit such data to another controller without hindrance from the controller to which they have been provided, where the processing is based on consent or on a contract and is carried out by automated means;
• object at any time, on grounds relating to their particular situation, to the processing of personal data concerning them where the processing is necessary for the performance of a task carried out in the public interest or connected with the exercise of official authority vested in the Controller, or where the processing is necessary for the purposes of the legitimate interests pursued by the Controller or by a third party;
• where you believe that your rights have been violated by the Controller, lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali) (Piazza Venezia 11, 00187 Rome (RM) - www.garanteprivacy.it) and/or with another competent supervisory authority under the GDPR.

Following the exercise of the rights referred to in points 2), 3) and 4), the Controller shall notify each of the recipients to whom the personal data have been disclosed of any rectification, erasure or restriction of processing, within the limits and in the manner provided for by applicable law.

To exercise the rights listed above against the Controller, you must submit a written request by sending a registered letter with return receipt to Luxia S.r.l. (VAT No. 13301690015), with registered office in Turin (TO), Corso Giacomo Matteotti 42, or by sending an e-mail to privacy@hiluxia.com

This notice may be amended and/or updated at any time. Should the Controller intend to process your Personal Data for purposes other than those set out in the preceding Article 3, it undertakes to provide you, prior to such further processing, with adequate information regarding such different purposes and to carry out such further processing in compliance with applicable law, obtaining your specific consent where necessary.

This Privacy Policy was published on 26/03/2026. Any updates will be published on this page.