Privacy Policy

As at the update date of this document, Digibusiness SRL has assigned to its Managing Director, Mr Gabriele Mendi, the role of Controller of the personal data processing for which the Company is responsible. The Controller takes the decisions on the purposes and methods of processing personal data and is also tasked with monitoring, including through periodic checks, the Processor's compliance with its instructions and with the applicable provisions on processing, including the security aspect.

The role of Processor for all Personal Data processing is likewise assigned to the active partner Mr Fausto Aimi, who at the same time also holds the role of System Administrator.

All employees and/or collaborators who, to varying extents and with specific authorisations, must be able to process — even occasionally — the personal data of Digibusiness and of Users, have been made accountable through a specific appointment that sets out their remit and limits their operational scope. The list of roles and the related duties to be performed are included in the Digibusiness DPIA, available on request.

The processing concerns contracts and invoicing and relates exclusively to ordinary data; no sensitive or judicial data is involved.

The identifying details of Users (customers of Digibusiness SRL) are held at the Company's premises, while administrative and accounting summaries are delegated to an external firm (Studio Vignetti, Vicolo Politi 7 – 43121 Parma, Italy), which handles them with its own resources. The purposes of the processing are to manage the supplier-customer relationship from a contractual and tax perspective and with regard to the services supplied and work developments. In some cases this data may also relate to employees and/or collaborators of these companies with whom a supply relationship is being developed, but it is in any case limited to telephone and/or postal contact details.

The privacy notice concerning the processing of User data is contained in the Service Charter, which forms an integral part of the contract signed by customers, who thereby give implicit consent to the processing of their data. Digibusiness does not carry out automated processing on the data of its customers and prospective customers and does not transfer such data to third parties, except as regards administrative and accounting matters.

Particular mention should be made of the data Digibusiness obtains from public sources in order to identify the companies to which it can offer its services (Prospective Users), with the aim of broadening its customer base. In this case, the privacy notice and the collection of consents to processing are handled at the time of first contact.

Navis.net is a management application owned by Digibusiness but it is also a services platform aimed at the businesses (Users) that sell recreational craft.

The services of the Navis.net platform comprise all the features that allow Users to manage their commercial activities optimally, and in particular: management of boats for sale, management of advertising, relations with customers and boaters, and relations with other businesses in the sector and with their own suppliers. Navis.net services are supplied to Users in ASP (Application Service Provider) mode.

3.1 Processing and purposes

User businesses (typically shipyards, dealers and brokers), as Controllers of the processing of their own customers' data, enter into the System information concerning natural or legal persons (companies) in order to maintain and develop commercial relationships. Digibusiness does not examine the merits of the data, but ensures the availability of the service and the protection of the data itself; service levels and the ability to provide a copy of the data are described in the Service Charter, which forms an integral part of every service contract. Through the Navis.net service contract, the Controller confers on Digibusiness the responsibility for data processing (external Data Processor).

The data is used to identify customers and define a profile of them in terms of nautical interests, so as to assist the seller (the Navis.net User) in promotional activities and to allow them to present proposals consistent with the profile drawn up. Navis.net allows profiling to be performed manually but also provides an automatic profiling feature (Brokerage Intelligence).

3.2 Protection and security measures

• The Controller has one or more sets of access credentials, made up of a UserID and Password, which it may make available to the persons it has authorised to process data. The access credentials restrict and confine processing solely to the data entered into the System by the Controller, or by automatic and/or bulk insertion operations authorised by it. The Password is structured so as to minimise the likelihood of it being guessed, and the system detects and blocks intrusion attempts.
• Management of access credentials is the responsibility of the Digibusiness System Administrator, while maintenance of the application and of the database is the responsibility of Digibusiness employees specifically authorised to process data and, as such, bound by confidentiality obligations.
• The servers and databases that power the Navis.net System are supplied by Microsoft AZURE and are held in data centres located in Europe with a high level of physical and logical protection. Data backup is performed daily. A detailed description of the protection and security measures can be provided on request.

3.3 GDPR compliance tools

Navis.net provides Users with what they need in order to:

• verify at any time whether all obligations have been fulfilled towards the people whose personal data is held;
• deliver or send the privacy notice to data subjects whenever the data of a new person is entered manually, and request the consent(s) to the processing of personal data, specifying the purposes;
• make the arrangements needed to fulfil the required obligations (privacy notice/consents) also for personal data acquired automatically following the processing of requests received by email, for which Navis.net can carry out an initial automatic profiling;
• automatically process and archive the delivery of privacy notices and the collection of consents;
• restrict bulk emailing solely to the people who have given their consent;
• classify people according to the consents they have given;
• respond to requests for documentation of the personal data held;
• erase personal data and/or amend consents at the request of the data subjects concerned.

Navis.net also facilitates:

• the management of privacy notice content, through customisable templates to be matched to each case;
• the presentation of GDPR compliance on the User's website.

3.4 Digibusiness guarantees

Digibusiness also implements organisational and technological measures, as well as protections to ensure the security and operational continuity of its own resources and information which are not subject to the regulations referred to as GDPR, but which are critical to the business of Digibusiness and consequently of the User businesses.

3.5 Risk assessment

Given the nature and specific characteristics of the data processed and the protection and security measures adopted, the processing of personal data with Navis.net presents a LOW level of risk. Nevertheless, Digibusiness implements monitoring measures to check that no gaps arise in the system and intends to adopt the technological measures that can further increase the level of protection.

• First and last name
• Email address
• Phone number
• Company name and professional role
• Messages sent through the contact form

• IP address
• Browser type and operating system
• Pages visited and session duration
• Navigation data collected through cookies and analytics tools (see Cookie Policy)

Legal basis: performance of a contract (art. 6.1.b GDPR). Data of user companies (shipyards, dealers, brokers) is processed to provide the Navisnet platform in ASP mode, manage billing and ensure service continuity.

Legal basis: consent of the data subject (art. 6.1.a GDPR) or legitimate interest (art. 6.1.f GDPR). Data submitted through the contact form is used solely to respond to the request.

Legal basis: legitimate interest (art. 6.1.f GDPR) and consent where required by law. The site uses web analytics tools to analyse user behaviour in aggregated and anonymous form.

Legal basis: legal obligation (art. 6.1.c GDPR).