Notice on the processing of personal data – Yellow Tech newsletter service

The data controller is Yellow Tech S.r.l., with registered office at Via Carlo Boncompagni 3B, 20139 Milan, email: info@yellowtech.it, PEC: yellowtech@pec.it.

The Data Protection Officer (DPO) appointed by the controller can be contacted at: lorusso@legalelorusso.it.

For the subscription to and management of the newsletter service, Yellow Tech S.r.l. processes the following personal data:

• first and last name, where requested;
• email address;
• any further personal data voluntarily entered by the user in the subscription form;
• data on the opening of newsletters sent through the Substack platform, collected by means of tracking pixels or equivalent technical tools and linked to the individual recipient;
• aggregate statistical data on interaction with the communications, including clicks on the hyperlinks (links) contained in the messages, to the extent that such information is made available to and consulted by Yellow Tech S.r.l. exclusively in aggregate form.

Personal data is processed for the following purposes:

a) managing newsletter subscription requests and the related subscriber records;

b) sending, by email, informational, commercial and promotional communications about the activities, content, products, services, events and initiatives of Yellow Tech S.r.l.;

c) detecting the opening of newsletters sent through the Substack platform;

d) processing and analysing aggregate statistical data on the performance of the communications and the clicks on the links in the newsletters.

The processing of personal data for sending the newsletter and commercial and promotional communications by email is based on the free, specific and informed consent of the data subject (Article 6(1)(a) of Regulation (EU) 2016/679 and Article 130 of Italian Legislative Decree 196/2003).

Under the technical setup currently adopted, the processing related to detecting the opening of messages is also brought to the attention of the data subject and included in the consent given at the time of subscription, it being understood that, based on the checks carried out to date, the Substack platform does not allow Yellow Tech S.r.l. to selectively disable such tracking or to send newsletters without tracking pixels only to subscribers who do not wish to accept it.

The newsletter management and sending service is provided through the Substack technology platform. In view of the technical features of this platform, Yellow Tech S.r.l. informs data subjects that, based on the checks carried out to date:

• communications sent by email include tracking pixels or equivalent technical markers;
• the platform records the opening of messages, linking it to the individual recipient;
• information on clicks on the links contained in the newsletters is visible to and can be consulted by Yellow Tech S.r.l. only in aggregate statistical form, not linked to the individual subscriber;
• no technical feature is currently available, among the settings granted by the provider to Yellow Tech S.r.l., that would allow receiving the newsletter to be separated from the tracking of its opening.

Providing personal data and giving the related consent is optional, but is a necessary requirement to complete the subscription and receive the newsletter and promotional communications of Yellow Tech S.r.l.

Data subjects have the right to withdraw their consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal, and to unsubscribe from the newsletter service using the unsubscribe link ("Unsubscribe" / "Disiscriviti") at the bottom of each communication received, or by sending a written request to Yellow Tech S.r.l. at the contact details given in section 1.

Please note that, due to the current technical features of the Substack platform, it is not possible to handle separately the withdrawal of consent to, or objection to, the tracking of openings alone while continuing to receive the newsletter.

Personal data may be processed:

• by internal staff of Yellow Tech S.r.l. expressly authorised to process it and duly instructed;
• by third-party providers of technology and telematic services used to manage and send the newsletters, including the Substack platform, acting as data processors for the activities carried out on behalf of Yellow Tech S.r.l. or as independent controllers for any further processing carried out for their own purposes, as governed by their respective contractual documentation and privacy notices.

As a result of the use of the Substack platform (a provider established in the United States) and its related services, personal data may be transferred to the United States of America. In this regard, Yellow Tech S.r.l. informs data subjects that the provider declares that it adheres to the EU-U.S. Data Privacy Framework, without prejudice to the further safeguards provided for by applicable law and by the provider's contractual documentation.

Personal data is kept and processed for the purposes set out in this notice until consent is withdrawn or the data subject unsubscribes, or until the controller discontinues the newsletter service, without prejudice to any further retention periods required by law or necessary to protect the controller's rights in administrative or judicial proceedings.

Data subjects may at any time exercise the rights granted by Articles 15-22 of Regulation (EU) 2016/679 (including the right to request access to their personal data, rectification, erasure, restriction of processing, objection to processing and data portability, where applicable) by contacting the data controller or the Data Protection Officer (DPO) at the contact details given in section 1. Data subjects who believe that the processing of their personal data infringes the applicable law also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, www.garanteprivacy.it), pursuant to Article 77 of the GDPR, or to bring proceedings before the competent courts.