PRIVACY POLICY – GDPR UE 2016/679
This Data Processing Agreement is dated: 05/06/2025

DEFINITIONS
Controller means a person who, alone or jointly with others, determines the purposes and means of the Processing of Personal Data;
Data Protection Laws means all laws and regulations relating to the Processing of Personal Data, as the same may be in force from time to time;
Data Subject means the individual to whom the Personal Data relates;
Personal Data Breach means the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Personal Data;
Personal Data means any information relating to an identified or identifiable living individual;
Processing means any operation or set of operations which is performed on Personal Data or sets of Personal Data, whether or not by automated means, and Process, Processes and Processed shall be construed accordingly;
Processor means a person who processes Personal Data on behalf of a Controller.

WHO I AM
This privacy policy (hereinafter, "Privacy Policy") describes how I, Marta Riva, collect, use and share your personal data. I am the Data controller under the EU General Data Protection Regulation (GDPR). If you have any questions or would like to receive more information in this regard, please write to intotheforest.illustrations@gmail.com
My contact details: 
Name: Marta Riva
Email: intotheforest.illustrations@gmail.com
Website: https://intotheforestillustrations.com

PERSONAL DATA I COLLECT
When you engage my services, I may collect the following personal data:
Full Name;
Address;
Email Address;
Social Security Number. 
The form indicates the data that is mandatory with an asterisk. Data that is not marked as mandatory by an asterisk is optional. Only the Data necessary for each purpose is collected. Please note that if you do not provide the mandatory information, then I may not be able to deal with your query or request or manage the processing. 
It is your responsibility to provide accurate data and keep them updated, so I reserve the right to exclude Data Subjects who provide false, incorrect or unauthorised information from purchasing my services and/or register, without prejudice to the right of the Responsible Parties to take the corresponding legal action.

PURPOSES AND LEGAL BASES FOR PROCESSING
Your Data will be processed for the following purposes:
Executing and managing contracts (legal obligation Art. 6 (1)(c));
Issuing invoices and fulfilling tax duties (legal obligation Art. 6 (1)(c));
Communicating about projects (Legitimate interest Art. 6 (1)(f);
Sending newsletters (if consent given) (Consent Art. 6 (1)(a)).
The legal basis for sending newsletters and commercial communications, in case you consent, is the consent you have given by registering on the corresponding forms. Keep you informed about the Controllers' initiatives and compliance with their legal obligations.
Remember that you can revoke your consent at any time. You may also object to continuing to receive commercial communications in the manner indicated in the footer of each communication.

HOW LONG WILL YOUR DATA BE KEPT?
Your Data will be kept for the period of time necessary for the purpose for which they were collected, and specifically: 
Accounting and Tax Records: 10 years (under Italian tax law).
Contract Administration: for the duration of the contract plus an additional 2 years for potential claims. 
In relation to the delivery of newsletters and communications, the Data will be processed until you revoke your consent or object to the processing and/or for a maximum of two years. 

Once the Data are no longer necessary for the purpose for which they are processed, they will remain blocked for the sole purpose of meeting any liability or obligations that may arise from the processing thereof. After these periods, your data will be securely deleted or anonymised.

WHO ARE THE DATA RECIPIENTS?
Your Data may be communicated to service providers that assist the Controller in carrying out their business, for example, IT tools, technical support services, payment providers, financial services, etc. 
When your Data may leave the European Economic Area (EEA), it will maintain the same level of protection based on compliance with the provisions of European data protection law. In this regard, international transfers of Data will be made (i) to countries with an adequate level of protection declared by the European Commission (ii) based on the provision of adequate safeguards (standard contractual clauses or binding corporate, or (iii) by virtue of authorisation by the competent supervisory authority or under other conditions provided for in the regulations. 

To receive more information about international transfers of Data or to obtain confirmation or a copy of the safeguards used, you may contact intotheforest.illustrations@gmail.com.
In cases where it is necessary to comply with the Controller’s legal obligations, the Data may be communicated to the Public Administration and the State Security Forces and Corps.

SECURITY MEASURES
The Controller is committed to keeping your personal data secure, taking all reasonable measures to do so. The Controller will implement all necessary organisational and technical measures in accordance with the regulations in force against any unauthorised access and modification, disclosure, loss or destruction. 
The Controller stores your personal data using Google Drive, Notion.com and Aruba. Data is hosted on servers located within the EU. Notion stores data within the US. Please refer to the following Terms of Use: 
https://policies.google.com/privacy
https://www.notion.so/notion/Data-Processing-Addendum-361b540101274b1fa7e16b90402b0d99
https://www.aruba.it/documents/tc-files/it/11_it_privacy_policy_aruba_spa.aspx
Appropriate technical and organisational measures to secure your data are implemented.

DATA SHARING
I share your personal data only with:
My Accountant for bookkeeping and tax reporting;
The Italian Revenue Agency issues invoices and complies with tax obligations.
I don’t sell or rent your data to third parties.
COOKIES AND TRACKING
If you visit my website, I may use cookies and similar tracking technologies. For details, please refer to the Cookie Policy: 

WHAT ARE YOUR RIGHTS
As the owner of your Data, you may request confirmation from the Controller regarding whether your Data are being processed and, if so, access to it. You can also request the rectification of inaccurate Data or, where appropriate, request its deletion when, among other reasons, the Data is no longer necessary for the purposes for which it was collected. 
In certain circumstances, you may request the limitation of the processing of your Data, in which case the Controller will only retain them for the purpose of legal proceedings or the defence of claims. 
You may revoke your consent at any time, but please note that it will not be retroactive unless otherwise required by law, and your data may be kept blocked for the prescription periods established by the applicable regulations.
You may also oppose the processing of your data, in which case I will not process your data, except for compelling legitimate reasons or for processing possible complaints.

To exercise any of the aforementioned rights, please contact me at intotheforest.illustrations@gmail.com. To help me process your request, please indicate "Data Protection" in the subject line. 

CONTACT INFORMATION AND SUPERVISORY AUTHORITY
If you have any questions or concerns regarding the exercise of your rights, please contact me at intotheforest.illustrations@gmail.com. 
In the event that you become aware of or consider that an event may involve a breach of the applicable data protection regulations, you also have the right to file a complaint to the Italian Data Protection Authority (Garante per la protezione dei dati personali):
Website: https://www.garanteprivacy.it/
Email: protocollo@gpdp.it

CHANGES TO THIS PRIVACY POLICY
This privacy policy may be updated to reflect changes in my practices or legal requirements. The “Last Updated” date at the top will indicate when changes were made. I encourage you to review this page periodically.