This Privacy Notice (“Notice”) applies to the processing of your personal data by Leaf Space S.r.l. (“We“, “us” or “Data Controller“) through https://leaf.space/ (“Website”) in accordance with Regulation (EU) 2016/679 – General Data Protection Regulation (“GDPR”) and the Italian Legislative Decree 196/2003 (as amended) (“Data Protection Laws“).

1. Data Controller

The Data Controller is Leaf Space S.r.l. with its registered office in Via Giacomo Leopardi, 7 Milan (MI).
For any requests regarding the processing of your personal data, please email us at info@leaf.space.

2. Categories of personal data that We collect, purposes and legal bases for our processing of your personal data

When you navigate our Website, We process the following categories of your personal data, for the purposes and on the legal bases indicated below.

Categories of processed data	Purpose	Legal Basis
Personal and contact details (e.g. name, surname, phone number, email address); Navigation data: (e.g. ID and technical information on your device, your IP address); Other information you provide us through our Website, for example, when you submit a request of information or when you submit your Resume.	To manage the relationship with you and process any requests you send to us (e.g. request for information, commercial services, and job application for the potential conclusion of an employment contract).	Processing is necessary to take steps at your request prior to entering into a contract (e.g. request for information, commercial services and/or job application for the potential conclusion of contracts) (section 6 (1) (b) of the GDPR).
	To comply with our legal obligations and any other obligations arising out of the instructions received from the authorities.	Compliance with a legal obligation to which We are subject (section 6 (1) (c) of the GDPR).
	To exercise our legal rights where it is necessary to do so, for example to detect, prevent and respond to fraud or other violations of our rights and/or of the law, for legal and dispute management purposes.	Processing is based on our legitimate interest (section 6 (1) (f) GDPR).

3. Data Retention

We retain data collected through the use of our Website for as long as necessary to carry out the purposes indicated above and in accordance with Data Protection Law.

4. Sharing Your Personal Data

We may share or disclose your personal data to the following categories of recipients:

subjects carrying out activities that are related or instrumental to our business and operational activities as outsourced data processors appointed in writing in accordance with Data Protection Laws, or acting as autonomous data controllers;
public, judicial or police authorities, within the limits established by applicable laws;
individual authorized in writing to process your personal data, under the control of the Data Controller, in accordance with Data Protection Law (e.g. our employees).

5. Transfer Your Personal Data outside the European Economic Area

We do not transfer your personal data from the European Economic Area (“EEA”) to other countries outside the EEA.

6. Your Rights

At any time and free of charge, you can exercise the following rights, as specified and subject to certain limitations and exceptions under Data Protection Laws:

Right of access. You have the right to obtain information about the processing of your personal data and to access it.
Right to rectification. You have the right to ask for the updating, rectification or integration of your personal data.
Right to erasure. You have the right to request the deletion of your personal data.
Right to restriction of processing. You have the right to request the restriction of the processing of your personal data.
Right to data portability. You have the right to obtain a portable electronic copy of your personal data.
Right to object. Where we rely on our legitimate interest to process your personal data, you have the right to object to such processing, wholly or partly, on grounds related to your specific situation.
Right to withdraw your consent. Where we rely on your consent to process your personal data, you have the right to withdraw your consent, although the processing carried out before your withdrawal of consent will remain valid.

You also have the right to lodge a complaint before the competent national Data Protection Authority, in particular before the Data Protection Authority of the Member State of your habitual residence, place of work or place of the alleged infringement.

To exercise your rights, or if you have any other questions about the processing of your personal data, you can contact us by sending an email to the contact detail provided under section 1 of this Notice.

Last update: February 2023