INFORMATION PURSUANT TO ARTICLE 13 EU REGULATION 2016/679 ("GDPR")

Data protection is of the utmost importance to Stockit S.r.l., which constantly endeavours to process the data of data subjects fairly, lawfully and transparently, in accordance with EU Reg. 2016/679 (hereinafter "GDPR"), Legislative Decree no. 196/2003 ("Privacy Code") and other applicable provisions on personal data protection. This document explains how the personal data collected is processed and protected.

The Data Controller

The Data Controller, pursuant to art. 4 GDPR, is Stockit S.r.l. ("Stockit"), in the person of its legal representative pro tempore, tax code and VAT number 04127140137, with registered office in Lecco (LC), Via Privata Vincenzo Monti n. 2. The interested party may contact Stockit at the e-mail address privacy@stockit.it.

Type of data processed

Personal data: shall mean any information relating to an identified or identifiable natural person ('data subject'), meaning a natural person who can be identified, directly or indirectly, by reference in particular to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to his or her physical, physiological, genetic, mental, economic, cultural or social identity (recitals 26, 27 and 30).
Browsing data: The computer systems and software procedures used to operate this website acquire, during their normal operation, some personal data whose transmission is implicit in the use of Internet communication protocols. This information is not collected in order to be associated with identified interested parties, but by its very nature could, through processing and association with data held by third parties, allow users to be identified. This category of data includes the IP addresses or domain names of the computers used by users connecting to the site, the URI (Uniform Resource Identifier) notation addresses of the resources requested, the time of the request, the method used to submit the request to the server, the size of the file obtained in response, the numerical code indicating the status of the response given by the server (successful, error, etc.) and other parameters relating to the operating system and the IT environment of the person concerned.
Location data: the Stockit website may process location data provided by the data subject's device. If the data subject has chosen to activate this functionality from their device, the website may receive an approximation of the user's geographical location.
Data communicated voluntarily: the optional, explicit and voluntary sending of messages to the contact addresses indicated on this site and/or the filling in of data collection forms entails the subsequent acquisition of the sender's address, which is necessary in order to reply to requests, as well as any other personal data entered.
Cookies: for cookies and other similar technologies, see the cookie policy in the footer of the site.

Purpose of processing, legal basis and data retention period

Purpose A): website navigation
LEGAL BASIS: legitimate interest, pursuant to Article 6(1)(f) and recital 47 GDPR. The processing is necessary for the pursuit of the legitimate interest of the data controller or a third party, provided that the interests or the fundamental rights and freedoms of the data subject requiring the protection of personal data are not overridden, having regard to the reasonable expectations of the data subject based on their relationship with the data controller. Activities strictly necessary for the operation of the site and the provision of the platform navigation service. For non-technical cookies and assimilated technologies, the legal basis is consent, ex art. 6 par. 1 lett. a) GDPR (see cookie policy in the site footer).
DATA STORAGE PERIOD: up to the duration of the browsing session (except for any need to ascertain criminal offences by the judicial authorities). For cookies and similar technologies, see the cookie policy in the site footer.
NATURE OF THE CONFERMENT: navigation data are necessary in order to allow navigation of the website. For cookies and similar technologies see the cookie policy in the footer of the site.

Purpose B): use of cookies other than technical cookies and similar technologies
LEGAL BASIS: the processing is based on the consent of the data subject, pursuant to Article 6 (1)(a) GDPR and recitals 42 and 43 GDPR.
DATA STORAGE PERIOD: see the cookie policy in the footer of the site.
NATURE OF THE CONFERENCE: See the cookie policy in the footer of the site.

Purpose C): location sharing in order to locate the nearest Stocker/Stock keeper (geolocalised navigation)
LEGAL BASIS: the processing is based on the consent of the data subject, pursuant to Article 6(1)(a) GDPR and recitals 42 and 43 GDPR.
DATA STORAGE PERIOD: Up to a maximum of 12 months from the last access to the website or, in any case, until revocation of the data subject's consent, which the latter may express freely by modifying the settings of the browser or operating system used.
NATURE OF THE CONFERMENT: the conferment is optional. Failure to provide it will make it impossible to provide the person concerned with services relating to geo-localised navigation such as, for example, association with the nearest Stocker/Stockhunter.

Purpose D): site registration and personal account management (Stocker, Stock keeper, Self Storage or Stockhunter)
LEGAL BASIS: processing is necessary for the performance of a contract to which the data subject is party or for the performance of pre-contractual measures taken at the data subject's request, pursuant to Article 6(1)(b) GDPR and recital No. 44 GDPR.
DATA STORAGE PERIOD: The retention period is until the termination of the account and the technical time to disable credentials. You have the right to delete your account at any time, subject to compliance with your contractual payment obligations. If he decides to do so, the account will cease to exist and the user will be considered inactive.
NATURE OF PROVISION: The provision of data is necessary. Failure to provide the necessary data will result in the impossibility of registering on the site.

Purpose E): management of Stocker/Stock keeper/ Self Storage subscriptions and related payments.
LEGAL BASIS: processing is necessary for the performance of a contract to which the data subject is party or for the performance of pre-contractual measures taken at the data subject's request, pursuant to Article 6(1)(b) GDPR and recital No. 44 GDPR.
DATA STORAGE PERIOD: The storage period is a maximum of 10 years.
NATURE OF PROVISION: The provision of data is necessary. Failure to provide the necessary data will make it impossible to conclude the subscription.

Purpose F): direct marketing
Stockit uses personal data, with the consent of the person concerned, to send newsletters, promotional and advertising material, commercial offers and invitations, by automated means of electronic mail, as well as by paper mail and telephone calls through an operator. In connection with communications sent by email, Stockit may also use tracking technologies, such as tracking pixels, in order to collect information regarding the receipt, opening of and interaction with the communications sent, including, where applicable, clicks on links contained therein.
LEGAL BASIS: the processing is based on the consent of the data subject, pursuant to Article 6(a) and recitals 42 and 43 GDPR.
DATA STORAGE PERIOD: until consent is revoked (opt-out).
NATURE OF THE CONFERMENT: The conferment is optional. Failure to provide the necessary data will result in the impossibility of receiving direct marketing communications.

Purpose G): non-automated profiling
Stockit uses personal data, with the consent of the data subject, to carry out analyses, evaluations and to subdivide data subjects into homogeneous groups by characteristics, also according to area and sector, for better management of services, as well as to send personalised promotional communications.
LEGAL BASIS: the processing is based on the consent of the data subject, pursuant to Article 6(1)(a) GDPR and recitals 42 and 43 GDPR.
DATA STORAGE PERIOD: until consent is revoked (opt-out) and, in any case, up to a maximum of 12 months.
NATURE OF THE CONFERMENT: The conferment is optional. Failure to provide the necessary data will result in the impossibility of carrying out analyses and/or sending targeted communications.

Purpose H): handling customer service requests
Stockit's Customer Service uses the personal data provided by the person concerned, either by e-mail or by filling in the form on the site, to fulfil their requests for information or assistance
LEGAL BASIS: legitimate interest, pursuant to Art. 6(f) and recitals 47-50 GDPR. The processing is necessary to pursue the legitimate interest of the data controller in pursuing the data subject's requests.
Performance of a contract to which the data subject is party or for the execution of pre-contractual measures taken at the data subject's request, pursuant to Art. 6(1)(b) and recital No. 44 GDPR.
DATA STORAGE PERIOD: for the time necessary to fulfil the request and for a maximum of 12 months, without prejudice to any further storage that may be necessary to protect the rights of the Data Controller.
NATURE OF PROVISION: the provision of data is optional or necessary depending on the specific purpose for which the data is processed. Failure to provide the data marked with the symbol* will make it impossible to obtain what is requested or to use the services of the data controller.

Purpose I): Fulfilment of legal obligations
Stockit uses personal data to fulfil the legal obligations to which it is subject.
LEGAL BASIS: legal obligation, pursuant to Art. 6(c) GDPR. The processing is necessary to fulfil a legal obligation to which the Data Controller is subject.
DATA STORAGE PERIOD: 10 years
NATURE OF PROVISION: the data subject is free to decide whether to conclude a contract with Stockit, but if he does so his data will necessarily be processed

Purpose L): prevention and conduct of disputes and other legal matters and for the defence in the event of legal proceedings
LEGAL BASIS: legitimate interest, pursuant to Article 6(f) and recital 47 GDPR. The processing is necessary for the pursuit of the legitimate interest of the data controller or a third party, provided that the interests or the fundamental rights and freedoms of the data subject requiring the protection of personal data are not overridden, having regard to the reasonable expectations of the data subject based on his or her relationship with the data controller.
DATA STORAGE PERIOD: 10 years, except for the time required for defence in court.
NATURE OF THE CONFERMENT: the conferment of data is necessary. Refusal shall be balanced against the legitimate interest of the data controller in this purpose.

Treatment modes

Your data will be subject to traditional manual, electronic and automated processing.

Place of data storage

Personal data collected for the purposes described in this notice will not be communicated and/or transferred to companies and/or entities located in countries outside the E.E.U., with the exception of the following purpose B) - use of cookies other than technical cookies and similar technologies, for which there will be a transfer to the United States, on the basis of an adequacy decision of the European Commission, ex art. 45 GDPR. Any further transfers of personal data to third countries, if any, will be carried out in compliance with the conditions set forth in Articles 44 et seq. of the GDPR.

Parties with access to data

Your personal data will be processed by: Stockit's internal subjects, in their capacity as Authorised Data Processors (art. 29 GDPR), who act under the authority of the Data Controller on the basis of specific instructions received; autonomous Data Controllers; third parties who carry out activities on behalf of the Data Controller and who are therefore classified as Data Processors (art. 28 GDPR), who will process the data, for the purposes indicated above, in compliance with the provisions of the GDPR and the instructions received. The data will be communicated to recipients belonging to the following categories, who act as Data Processors or operate in total autonomy as separate Data Controllers: subjects in charge of managing the information system used by Stockit and the telecommunications networks, including e-mail and website management; companies that provide services for geolocalised navigation; freelancers, studies or companies in the context of assistance and consultancy relationships; subjects, entities or authorities to which the Data Controller is obliged to communicate your personal data by virtue of legal provisions or legitimate orders.
The list of data processors can be obtained by writing to privacy@stockit.it or to Stockit's registered office.

Rights of the data subject

The data subject may exercise, at any time, the following rights, as provided for in Articles 15 et seq. GDPR, by contacting the Data Controller at the e-mail address privacy@stockit.it: right of access to personal data (Art. 15), right of rectification (Art. 16), if the data are incorrect or incomplete, right of deletion (Art. 17), right to restriction of processing (Art. 18). The Data Controller shall inform each of the recipients to whom the personal data have been transmitted of any rectification, erasure or restriction of processing carried out (Art. 19). The Data Controller shall inform the data subject of these recipients if the data subject so requests. In the cases provided for, the data subject has the right to the portability of his data (Art. 20), which in that case will be provided in a structured, commonly used and machine-readable format. He/she has the right to object (Art. 21), at any time, to the processing of data based on legitimate interest, and in cases where the legal basis is consent, he/she has the right to revoke the consent given without prejudice to the lawfulness of the processing based on the consent before revocation.
To stop receiving automated direct marketing communications (e.g. e-mails), simply write an e-mail at any time to privacy@stockit.it with the subject line 'unsubscribe from automated' or use the automatic unsubscription systems provided for e-mails.
To stop receiving traditional direct marketing communications (telephone calls, paper mail), simply write an e-mail to privacy@stockit.it with the subject line 'unsubscribe from traditional' at any time.
To revoke consent to profiling, simply write an e-mail to privacy@stockit.it with the subject 'no profiling'.
If the data subject considers that Stockit is processing personal data incorrectly, he or she may contact the Data Controller at privacy@stockit.it. In addition, the data subject has the right to lodge a complaint with the Data Protection Authority, using the form and procedure indicated on the Authority's website.

Privacy Policy Updates

Updates to Stockit's Privacy Policy may be necessary, also as a consequence of possible subsequent regulatory changes and/or additions. The latest version of the Policy is always available on Stockit's website.

Last updated: October 2026