This Privacy Policy is provided under Articles 13 and 14 of Regulation (EU) 2016/679 (the “GDPR”). It explains how we process personal data when you visit infinithink.it, create an account, use the Infinithink platform and its tools (the “Service”), buy a plan, contact us or receive our communications. We have tried to write it in plain language. If anything is unclear, please write to info@infinithink.it.
Infinithink is the brand under which Lorenzo Locantore provides the Service. It is not a separate company. Capitalised terms that are not defined here, such as Input, Output, Customer Content and Credits, have the meaning given to them in the Terms of Service. For cookies and similar technologies, please also read the Cookie Policy. The documents referred to in this Privacy Policy, namely the Terms of Service, the Cookie Policy, the Acceptable Use Policy, the AI Transparency Notice and, for business customers, the Data Processing Agreement, are published on infinithink.it and can be reached from the footer of every page.
1. Data controller
| Controller | Lorenzo Locantore, sole proprietorship under the Italian flat-rate tax regime |
| Brand | Infinithink |
| VAT number | IT04570230989 |
| Business address | Via Marta Tana 19, 46043 Castiglione delle Stiviere (MN), Italy |
| Email for privacy requests | info@infinithink.it |
| Website | infinithink.it |
We have not appointed a data protection officer (DPO). For any matter relating to your personal data, you can contact the controller directly at info@infinithink.it.
2. When we process data on behalf of business customers
Business customers may use the Service to process personal data of their own clients, website visitors or contacts. Examples include chatbots installed on their websites or connected to messaging channels such as WhatsApp, Telegram, Messenger or Instagram, handing a conversation over to a human operator, voice assistants and content about other people.
In those cases the controller is the business customer and we act as processor under the Data Processing Agreement. To find out how your data is processed in those situations, please read the privacy notice of the business you are interacting with. If we receive a request about such data, we will forward it to that business without undue delay and assist it in responding. For the security of the Service and the prevention of abuse, we also process some of this data as an independent controller, for purpose 4 in section 4.
This Privacy Policy covers the data we process as controller, for example the account and billing data of customers, including business customers, and of the people who use their account as team members.
3. Personal data we process
| Category | Examples | Source |
|---|---|---|
| Account data | first and last name, email address, password (stored only as a hash), language, profile picture, team membership | you |
| Billing data | name or company name, address, tax code or VAT number, SDI recipient code or PEC address for Italian e-invoicing | you |
| Payment data | payment outcome and status, card type, last four digits and expiry date of the card, Stripe customer identifier. Full card details are processed directly by Stripe and we do not receive them | Stripe |
| Customer Content | prompts, instructions, uploaded files and documents, audio recordings, generated text, images, audio, video and code, chat history, chatbot settings and knowledge bases, articles and posts prepared for connected channels | you and the Service |
| Usage data | features used, Credits consumed, models selected, dates and times, settings, errors | the Service |
| Technical data | IP address, device and browser type, operating system, time zone, access and security logs, cookie identifiers | your device |
| Communications | support requests, emails, feedback, messages sent through the contact form | you |
| Connected accounts | identifiers and access credentials, such as tokens or application passwords, for third-party services you connect, for example a WordPress site, Telegram or Meta services | you and the third-party service |
| Contract and withdrawal records | version of the Terms accepted, date, time and IP address of acceptance, boxes ticked at checkout, such as the request for immediate start of the Service and, for business customers, the specific approval of clauses, order confirmations, withdrawal notices (name, email address, contract concerned, date) and their confirmations, refunds, complaints, proof that trial-end and renewal reminders were sent | you and the Service |
| Affiliate programme | affiliate code and link, affiliate code contained in the link you used to sign up, attributed sign-ups and purchases, commissions earned, details needed to pay commissions | you and the Service |
| Marketing preferences | consent status, newsletter subscriptions and unsubscriptions, refusals and objections | you |
If you join at the invitation of a team member, we receive your basic details, such as your name and email address, from the person who invited you.
Please do not enter in the Service special categories of personal data, such as data concerning health, biometric data used to identify a person, political opinions or religious beliefs, or personal data relating to criminal convictions and offences or data of minors, unless this is necessary and you have a valid legal basis. Voice recordings and images of faces that you upload for the voice, image, video and avatar features are not used to identify people and are processed as described in section 5, under “Voice, likeness and avatars”. If you enter data about other people, for example texts, images or recordings of their voice, you must be entitled to do so and must have informed them where the law requires it.
4. Purposes, legal bases and retention periods
| Purpose | Legal basis | Retention |
|---|---|---|
| 1. Registering and managing your account and providing the Service, including sending Input to the AI models you choose, returning Output and running the integrations you enable | performance of a contract (Art. 6(1)(b) GDPR). For team members and for contact persons of business customers, who are not parties to the contract, our legitimate interest and that of the customer in providing the Service and managing the relationship (Art. 6(1)(f) GDPR) | for as long as the account exists. When the contract ends you can download your Customer Content for 30 days. We then delete the account and the content within a further 30 days, and backup copies, which are overwritten on rotation, within 35 days of deletion. If you close your account and ask for immediate deletion, we proceed without waiting for the 30 days. If you move to the Free plan, your content remains in the account. If you switch provider, the periods in Section 16.2 of the Terms of Service apply. Content you delete while the relationship is ongoing is removed from backups within 35 days. Credentials for connected services are kept until you disconnect the integration or close your account and are then deleted within 30 days. Free accounts with no log-in for 24 months are deleted, with an email notice at least 30 days in advance |
| 2. Payments, invoicing, accounting and tax compliance | performance of a contract (Art. 6(1)(b)) and compliance with a legal obligation (Art. 6(1)(c) GDPR) | invoices and other tax records for 10 years, as required by Article 2220 of the Italian Civil Code, Article 39 of Presidential Decree 633/1972 and Article 22 of Presidential Decree 600/1973, and for any further time needed if a tax audit is in progress |
| 3. Customer support and mandatory service communications, such as order and withdrawal confirmations, trial-end and renewal reminders, notices of price changes, of changes to the Service, to the Terms or of assignment of the contract, and security alerts. These communications contain no promotions and you cannot switch them off while the contract is in force | performance of a contract (Art. 6(1)(b)) and legal obligations (Art. 6(1)(c)), in particular those under the Italian Consumer Code. For optional notices about relevant aspects of the Service, our legitimate interest in informing you (Art. 6(1)(f)) | support requests for 24 months after they are closed, unless they contain a complaint, a dispute or a refund request, which we keep until the related rights become time-barred. Proof that confirmations and reminders were sent is kept with the contract records (purpose 12) |
| 4. Security, prevention of fraud and abuse, enforcement of the Terms and of the Acceptable Use Policy, including automated checks on requests and the data we process as an independent controller when acting on behalf of business customers (section 2) | our legitimate interest in protecting the Service, its users and third parties (Art. 6(1)(f)) and, where applicable, legal obligations (Art. 6(1)(c)) | technical and access logs for up to 90 days, records of incidents and abuse for up to 12 months, plus any further time needed to handle a complaint or dispute |
| 5. Improving the Service and producing usage statistics in aggregated or pseudonymised form | our legitimate interest in improving the Service (Art. 6(1)(f)) | usage data for up to 24 months, then only in aggregated and anonymous form |
| 6. Promotional emails about services similar to those you have purchased, sent only by email to the address you gave us when buying a paid plan or a Credit top-up. They do not concern people who only use the Free plan | Article 130(4) of the Italian Personal Data Protection Code and our legitimate interest (Art. 6(1)(f)). You can refuse them when you make the purchase and object at any time, free of charge, through the link in every email or by writing to info@infinithink.it | until you object, and in any case no longer than 12 months after the paid relationship ends |
| 7. Newsletters and other marketing communications, including those to Free plan users | consent (Art. 6(1)(a) GDPR) | until you withdraw your consent. If you have no contact with us for 24 months, we will ask you to confirm your subscription and, if you do not confirm, we will delete your address |
| 8. Website visit statistics, through the first-party cookie referer_session_id, Google Analytics 4 and Microsoft Clarity (heatmaps and session recordings, with masking) | consent (Art. 6(1)(a)) and Article 122 of the Italian Personal Data Protection Code | cookies for the duration set out in the Cookie Policy, Google Analytics data for 2 months, Microsoft Clarity data for 30 days (up to 13 months for items we mark to keep longer), data on where visits come from for 12 months, then only in aggregated and anonymous form |
| 9. Answering enquiries and requests for demos and quotes, including for custom terms | steps taken at your request before entering into a contract (Art. 6(1)(b)). If you write to us on behalf of a business, our legitimate interest in answering you (Art. 6(1)(f)) | 12 months if no contract follows |
| 10. Running the affiliate programme and attributing sign-ups and purchases that come through affiliate links, based on the code contained in the link | performance of the contract with the affiliate (Art. 6(1)(b)), our legitimate interest in attributing commissions correctly (Art. 6(1)(f)) and legal obligations for payments (Art. 6(1)(c)) | for as long as the affiliate takes part in the programme. Attribution data of referred people for the same period and, where it gave rise to commissions, for 10 years together with the payment records |
| 11. Establishing, exercising or defending legal claims and responding to requests from authorities | our legitimate interest (Art. 6(1)(f)) and compliance with legal obligations (Art. 6(1)(c)) | for as long as necessary, within the applicable limitation periods |
| 12. Entering into the contract, keeping proof of the acceptances and requests made at checkout, and handling withdrawals, refunds and complaints | performance of a contract (Art. 6(1)(b)), legal obligations (Art. 6(1)(c)), in particular Articles 49 to 59 of the Italian Consumer Code, and our legitimate interest in defending our rights (Art. 6(1)(f)) | 10 years after the contract ends, which is the ordinary limitation period (Article 2946 of the Italian Civil Code) |
| 13. Infinithink Assistant, the chat on our website, to answer questions about tools, plans, Credits and accounts and, if you choose to leave it, to contact you at the email address you provide in the chat | steps taken at your request before entering into a contract or performance of a contract (Art. 6(1)(b)) and, if you write on behalf of a company or are not a customer, our legitimate interest in replying (Art. 6(1)(f)). Leaving your email is optional and is not needed to use the chat | conversations and any email normally for up to 12 months from the last message, unless they are needed for an ongoing support request or contract |
| 14. Measuring the results of our advertising campaigns with the Meta pixel and the Meta Conversions API | consent (Art. 6(1)(a)) and Article 122 of the Italian Privacy Code, given through the “Marketing cookies” category | cookies for the period stated in the Cookie Policy, events sent to Meta kept by Meta under its own terms |
Account data is necessary to use the Service, and without it we cannot create an account for you. Billing data is necessary to buy a paid plan or a Credit top-up and to meet our tax obligations. Providing data for marketing purposes is optional, and declining has no effect on your use of the Service.
If you withdraw from a paid plan, your account moves to the Free plan unless you ask us to close it. In the event of withdrawal, on request we return to you free of charge the content you uploaded or created, in a commonly used and machine-readable format, and we do not use it for any purpose other than providing the Service. The “Withdraw from contract here” function collects only the data needed to identify the contract and to send you confirmation of the withdrawal.
If you object to promotional emails or withdraw your consent to the newsletter, we keep only your email address on a suppression list so that we do not write to you again. Service emails contain no tracking pixels and no links that record clicks. In promotional emails and the newsletter we measure opens and clicks only if you have given us specific consent.
When the retention periods above expire, the data is deleted or irreversibly anonymised. You can ask us for information about the assessment we carried out to balance our legitimate interests against your rights.
Your right to object
You can object at any time, on grounds relating to your particular situation, to processing based on our legitimate interests. You can always object, without giving reasons, to promotional emails and to any other processing for direct marketing, through the link in every email or by writing to info@infinithink.it.
5. How we use artificial intelligence
When you use an AI feature, your Input and the context needed to respond, for example previous messages in the chat, selected documents or a chatbot's knowledge base, are sent to the provider of the model that handles the request, from among those listed in section 6. The Output is returned to you and remains in your account until you delete it or close your account. For features that search the web, such as deep research, the necessary queries are sent to the same model provider, which carries out the search, or from our servers directly to the website you ask us to analyse.
We do not use Customer Content to train AI models. We use AI providers through their paid services for businesses and developers, under which they act as our processors or sub-processors. As at the date this Privacy Policy was last updated, the terms of those services provide that the data sent is not used to train the provider's models, and we have not enabled any option that would allow it. The provider may retain the data, solely for security and abuse-prevention purposes, for a maximum of 30 days for Anthropic and OpenAI and 55 days for Google. Requests that the provider's systems flag as possible breaches of its usage policies may be kept longer, up to 2 years in the case of Anthropic, and reviewed by the provider's staff. The provider may also keep data longer where the law requires it.
Some Anthropic and Google models may be accessed through OpenRouter, which forwards the request to the model provider. We configure our OpenRouter account so that requests are forwarded only to Anthropic and Google, which do not use request data to train their models. OpenRouter does not use request data to train models, and logging of request content is switched off in our OpenRouter account.
Where your plan allows it and you use your own API keys for a provider, requests are sent to that provider through your own account with it, and the provider processes the data under the contract between you and that provider.
We do not take decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you within the meaning of Article 22 GDPR. Automated filters may block requests that appear to breach the Acceptable Use Policy. If you believe a block is unjustified, you can ask for it to be reviewed by a person by writing to info@infinithink.it.
Our website offers the Infinithink Assistant, a chat based on artificial intelligence. At the start of the conversation the chat states that you are writing to an AI system and not to a person. The messages you write, together with excerpts from our public pages used as a knowledge base and the pages of the website you visit while the chat is open, are sent to OpenAI, which processes them as our processor with the gpt-4o-mini model to generate the reply. Replies are generated automatically, may contain inaccuracies and do not replace the conditions published in the Terms of Service and the other legal pages. For payments, refunds and requests about your account, write to info@infinithink.it. The chat only uses technical tools needed for it to work, such as a session identifier, and therefore does not require cookie consent. Please do not write passwords, payment details or special categories of data in the chat. Purposes, legal bases and retention periods are set out in point 13 of section 4.
Our staff access Customer Content only when you ask us for support, to examine reports of abuse, when strictly necessary for the security or operation of the Service, or when the law requires it.
Output is generated automatically and may contain inaccurate information, including about people. Please check it before using or publishing it. To find out how we label AI-generated content and which notices our customers' chatbots must display, please read the AI Transparency Notice.
Voice, likeness and avatars
Some features process the voice or image of people, for example transcription of audio recordings, photo editing and, where available, voice cloning, avatars and videos created from a photo or a face. In these cases we process the audio samples and images you upload and, for voice cloning and avatars, the voice or avatar model generated and its identifier with the provider. We use them only to create the content you request and not to identify people.
If you use your own voice or image, the legal basis is performance of a contract (Art. 6(1)(b)). If you use the voice or image of another person, you act as controller for that data and must have that person's explicit and documented consent, as required by the Acceptable Use Policy. In that case we process that data on your behalf.
Samples, voice models and avatars remain in your account until you delete them or close your account. When you delete them, we also remove them from the provider that created them, and backup copies are overwritten within the periods set out in section 4. The person whose voice or image was used can ask for it to be deleted by writing to info@infinithink.it. Features that create a model of a person's voice or appearance are active only if their provider is listed in section 6.
6. Recipients of personal data
We share personal data only to the extent necessary for the purposes described above. The providers that process data on our behalf or receive it in order to provide the Service are listed in the table below, together with the place of processing and the safeguard used for transfers outside the European Economic Area (EEA).
| Provider | Service | Role | Place of processing and transfer safeguard |
|---|---|---|---|
| Hostinger International Ltd (Cyprus) | servers on which the Service and its backups run, including the files you upload or generate | processor | Germany (Frankfurt), no transfer outside the EEA |
| Cloudflare, Inc. (United States) | content delivery network, DNS, protection of the website against abusive traffic and automated programs | processor | global network, including the United States. EU-U.S. Data Privacy Framework (Cloudflare, Inc. is certified) and standard contractual clauses |
| Anthropic Ireland, Limited (Ireland), which uses Anthropic, PBC (United States) | Claude AI models | processor | United States. Standard contractual clauses included in Anthropic's data processing agreement |
| OpenAI Ireland Ltd (Ireland), which uses OpenAI OpCo, LLC (United States) | GPT AI models, image creation and editing, text to speech and transcription | processor | United States. Standard contractual clauses included in OpenAI's data processing agreement |
| Google (paid Gemini API services) | Gemini AI models | processor | United States and other countries where Google has data centres. EU-U.S. Data Privacy Framework (Google LLC is certified) and standard contractual clauses |
| OpenRouter, Inc. (United States) | forwarding of requests to the Anthropic and Google models accessed through OpenRouter | processor | United States. Standard contractual clauses |
| Stripe Payments Europe, Limited (Ireland), with Stripe, LLC (United States) | payments | processor and, for fraud prevention and compliance with legal obligations, independent controller under its own privacy policy | Ireland and the United States. EU-U.S. Data Privacy Framework (Stripe, LLC is certified) and standard contractual clauses |
| Google Ireland Limited (Ireland), with Google LLC (United States) | Google Analytics 4, only if you consent to analytics cookies. It is loaded only after consent and works with Google's consent mode (Consent Mode), which passes the choices made in the banner to Google | processor | Ireland, the United States and other countries where Google has data centres. EU-U.S. Data Privacy Framework (Google LLC is certified) and standard contractual clauses |
| Microsoft Corporation (United States) | Microsoft Clarity (heatmaps and session recordings, with masking), only if you consent to analytics cookies | processor | The United States and other countries where Microsoft has data centres. EU-U.S. Data Privacy Framework (for certified recipients) and standard contractual clauses |
| Google (Google Fonts) | fonts that some pages load from Google's servers, which receive your device's IP address | independent controller | United States and other countries where Google has data centres. EU-U.S. Data Privacy Framework (Google LLC is certified) |
| ElevenLabs (Eleven Labs, Inc., United States) | text to speech, voice cloning and voice assistants, if you use these features | processor | United States. Standard contractual clauses in the ElevenLabs data processing agreement |
| Features and Labels, Inc. (fal.ai, United States) | image and video generation with some models, if you use these features | processor | United States. Standard contractual clauses |
| Together Computer, Inc. (Together AI, United States) | real-time image generation, if you use this feature | processor | United States. Standard contractual clauses |
| Pusher Ltd (United Kingdom) | real-time notifications in the dashboard, for example the progress of running tasks, with technical identifiers and the content of the notifications | processor | European Union (EU cluster) and United Kingdom. European Commission adequacy decision for the United Kingdom |
| Meta Platforms Ireland Limited (Ireland), with Meta Platforms, Inc. (United States) | Meta pixel and Conversions API, only if you accept marketing cookies | joint controller with us for the collection and transmission of the data, independent controller for subsequent processing, under Meta's terms | Ireland and United States. EU-U.S. Data Privacy Framework (Meta Platforms, Inc. is certified) and standard contractual clauses |
The following categories of recipients also receive personal data.
- Email service providers, with servers in the EEA, including our own dedicated mail server, from which service emails are sent without tracking pixels, to send service emails and, where applicable, promotional emails and the newsletter, and to run our mailbox.
- The provider of our e-invoicing software and the Italian Revenue Agency's Interchange System (Sistema di Interscambio), to issue, transmit and store invoices.
- Providers of management tools, such as project and customer relationship management software, which we use to organise our work with business customers and which receive only their contact and relationship details, not Customer Content.
- Third-party platforms you connect, such as your WordPress site, Telegram, Meta services (WhatsApp, Messenger, Instagram and Facebook) or other social networks, which receive the data you choose to send or publish through the integration. When you publish on your social profiles or your website, the platform processes the data as an independent controller under its own terms and privacy policies. When a chatbot or another feature sends or receives messages through a channel connected to your account, such as your WhatsApp Business number, your Telegram bot or your account with a messaging service provider, the channel provider processes the data under the contract between you and that provider. For the WhatsApp Business Platform, for example, Meta generally acts as processor for the holder of the WhatsApp Business account. Messaging channels are connected only through your own accounts with these platforms.
- Whoever manages your team, if you belong to a customer's team, who may see your basic details, the use of shared Credits and, depending on the settings, content shared with the team.
- Affiliates, if you sign up through an affiliate's link, who see in their own account the sign-ups and purchases attributed to them and the commissions earned, but not your Customer Content or your payment data.
- Professional advisers, such as our accountant, lawyers and IT consultants, who are bound by confidentiality.
- Public authorities, where required by law or by an order.
- Alternative dispute resolution bodies and courts, if you start or take part in proceedings.
- Any party to which the business is transferred, in the event of a sale or contribution of the business, for example to a company set up to continue the Service under the Infinithink brand, which would become the new controller. We will inform you at least 30 days in advance and tell you who the new controller is. The new controller will be bound by the commitments in this Privacy Policy, and you will be able to withdraw from the contract as provided in Section 21 of the Terms of Service.
The table and the list in this section are complete and up to date as at the date shown at the top, and they form part of this Privacy Policy. Email, invoicing and management tool providers are listed by category, and you can ask us for their names by writing to info@infinithink.it. We only make available features whose providers are listed in this section. Before entrusting personal data to a new provider, we add it to this Privacy Policy with the notice period set out in section 11. We do not sell personal data and we do not disclose it to third parties for their own marketing purposes.
7. Where we process data and transfers outside the European Economic Area
The servers on which we store Service data, including the files you upload or generate, and its backups are located in Frankfurt, Germany. Some providers listed in section 6, such as Anthropic, OpenAI, Google, OpenRouter, Cloudflare and Stripe, process data in the United States or may access it from there. For Google and Cloudflare, processing may also take place in other countries where they have data centres. The country and the safeguard used for each provider are shown in the table in section 6. The safeguards are those provided for in Chapter V GDPR, namely
- the European Commission's adequacy decision on the EU-U.S. Data Privacy Framework (Commission Implementing Decision (EU) 2023/1795), for certified recipients, whose certification we checked on dataprivacyframework.gov as at the date of the latest update;
- the standard contractual clauses adopted by the European Commission in Implementing Decision (EU) 2021/914, included in the providers' data processing agreements, together with any supplementary measures that may be needed.
The providers listed by category in section 6 process data in the EEA or, if they process it outside the EEA, on the basis of the same safeguards. When you ask us to send or publish content on a third-party platform you connect, such as Telegram, Meta services or your website, the platform may be located outside the EEA. In those cases the transfer is necessary to carry out your request (Art. 49(1)(b) GDPR) and the platform processes the data under its own terms.
We only make available models from the providers listed in section 6, including when they are accessed through OpenRouter, and for each of them the transfer is covered by one of the safeguards described in this section. If a safeguard ceases to apply, we will put in place another safeguard provided for by the GDPR or stop using that provider. You can request information about the safeguards in place and a copy of the clauses by writing to info@infinithink.it.
8. Security
We apply technical and organisational measures appropriate to the risk to protect personal data, including encrypted connections (HTTPS), storage of passwords only as hashes, protection of the website against abusive traffic, server access restricted to authorised persons using personal credentials, daily backups with restricted access, and regular software updates.
No system is completely secure and we cannot rule out every incident. This does not limit our liability under the GDPR or consumer protection law. If a personal data breach occurs, we assess the risk and, where required by Articles 33 and 34 GDPR, notify the Italian Data Protection Authority and inform the people concerned. We record every breach in our breach register, even where it does not have to be notified, as required by Article 33(5) GDPR.
Some files, such as the images you generate, can be reached through a unique web address that is hard to guess. Anyone who knows the address can open the file, so share it only with people you choose.
We recommend that you choose a strong password, do not share it, and tell us immediately at info@infinithink.it if you suspect unauthorised access to your account.
9. Your rights
Under Articles 15 to 22 GDPR you have the right, in the cases and within the limits provided by law,
- to access your personal data and obtain a copy of it (Art. 15);
- to have inaccurate data rectified and incomplete data completed (Art. 16);
- to have your data erased where the conditions are met (Art. 17);
- to obtain restriction of processing (Art. 18);
- to be informed of the recipients to whom we have communicated any rectification, erasure or restriction (Art. 19);
- to receive the data you provided to us in a structured, commonly used and machine-readable format and to transmit it to another controller, where processing is based on contract or consent and is carried out by automated means (Art. 20);
- to object at any time, on grounds relating to your particular situation, to processing based on legitimate interests, and to object at any time, without giving reasons, to processing for direct marketing (Art. 21);
- not to be subject to a decision based solely on automated processing that produces legal effects concerning you or similarly significantly affects you (Art. 22);
- to withdraw your consent at any time, without affecting the lawfulness of processing carried out before its withdrawal (Art. 7(3)).
Some actions can be carried out directly in your account, such as editing your profile, deleting content and, where the feature is available in the settings, downloading your content and closing your account. You can also close your account at any time by writing to info@infinithink.it, without giving reasons. For any other request, including obtaining a copy of your data, write to the same address, preferably from the email address linked to your account. We will respond without undue delay and in any event within one month of receiving your request. This period may be extended by two further months where necessary, taking into account the complexity and number of requests, in which case we will tell you within the first month. We may ask you for information to verify your identity. Exercising your rights is free of charge, unless a request is manifestly unfounded or excessive (Art. 12(5) GDPR).
For data we process on behalf of business customers, described in section 2, please contact the business that acts as controller. Any request we receive about that data will be forwarded to it.
You also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, Piazza Venezia 11, 00187 Rome, Italy, www.garanteprivacy.it) or with the supervisory authority of the EU Member State where you habitually reside, where you work or where the alleged infringement took place. You can also bring proceedings before a court (Art. 79 GDPR).
Rights relating to the data of a deceased person may be exercised by anyone who has an interest of their own, acts to protect the data subject, for example as their agent, or acts for family reasons deserving protection (Article 2-terdecies of the Italian Personal Data Protection Code).
10. Minors
The Service is only available to people aged 18 or over. We do not knowingly collect data of minors. If you believe a minor has provided us with personal data, please write to info@infinithink.it and we will delete it.
11. Changes to this Privacy Policy
We may update this Privacy Policy, for example when we add features or providers or when the law changes. The date of the latest update is shown at the top. For significant changes, such as new purposes, new providers that process your data or transfers to new countries, we will notify you by email or in your account at least 30 days before they apply. If you do not agree, you can withdraw from the contract as provided in Section 20.2 of the Terms of Service. If we have to replace a provider urgently because it has become unavailable, for example for security reasons, the notice period may be shorter and we will tell you as soon as possible. For new purposes that require it, we will ask for your consent before the processing starts.
12. Applicable law and language
This Privacy Policy is provided in accordance with the GDPR and Italian data protection law, in particular Legislative Decree No. 196 of 30 June 2003 (the Italian Personal Data Protection Code). It is available in Italian and English with the same content. In the event of any conflict between the two versions the Italian version prevails, unless the English version is more favourable to you as a data subject or consumer.
13. Contact
For any question about this Privacy Policy or to exercise your rights, write to info@infinithink.it or to Lorenzo Locantore, Via Marta Tana 19, 46043 Castiglione delle Stiviere (MN), Italy.
Questions about this document? Write to info@infinithink.it.