PRIVACY POLICY

1. Data controller

ESTRO Games
VAT no.: 02719740207
REA: MN - 274834
Email: estrocardgame@gmail.com

2. Personal data collected

The website collects personal data in the following ways:

• >Contact form: name, email address, message content. The email delivery service is provided by Resend Inc. (resend.com), which acts as a data processor.
• >Newsletter: email address. The management of the mailing list is entrusted to Brevo (Sendinblue) (brevo.com), based in the EU, which acts as a data processor.
• >Technical cookies: cookies strictly necessary for the operation of the website and for storing cookie preferences.
• >Analytics cookies (subject to consent): Google Analytics (Google LLC), Microsoft Clarity (Microsoft Corp).
• >Marketing cookies (subject to consent): Facebook Pixel (Meta Platforms Inc.).
• >Browsing data: Vercel Analytics collects anonymous, aggregated data on visits (first-party, cookieless, no personal data).

3. Purposes and legal basis

• >Responding to requests: the contact form data is processed in order to respond to the user's request (legal basis: legitimate interest, art. 6.1.f GDPR).
• >Sending the newsletter: the email address is processed for the sending of informational communications about ESTRO (legal basis: consent of the data subject, art. 6.1.a GDPR). The user may withdraw consent at any time via the unsubscribe link included in every email.
• >Analytics and marketing: non-necessary cookies are installed only upon the user's explicit consent (art. 6.1.a GDPR).

4. Cookies

The website uses the following categories of cookies:

The user may manage their preferences at any time via the Cookie Preferences button located in the bottom-left corner of every page.

5. Third-party services and data transfer

• >Resend Inc. (USA) — email delivery from the contact form. The transfer to the USA takes place on the basis of the Standard Contractual Clauses (SCC) approved by the European Commission.
• >Brevo (Sendinblue) (France, EU) — newsletter management. The data remains within the EU.
• >Google LLC (USA) — Google Analytics. Transfer based on SCC + supplementary measures. Activated only upon consent.
• >Microsoft Corp. (USA) — Clarity. Transfer based on SCC. Activated only upon consent.
• >Meta Platforms Inc. (USA) — Facebook Pixel. Transfer based on SCC. Activated only upon consent.
• >Vercel Inc. (USA) — website hosting and anonymous aggregated analytics (no personal data processed).

6. Retention period

• >Contact form data: retained for as long as necessary to handle the request, then deleted.
• >Newsletter data: retained until the user unsubscribes.
• >Cookies: according to the duration indicated in the table at point 4.

7. Rights of the data subject

Pursuant to arts. 15-22 of the GDPR, the user has the right to:

• >Access their personal data
• >Rectification of inaccurate data
• >Erasure of data ("right to be forgotten")
• >Restriction of processing
• >Data portability
• >Objection to processing
• >Withdrawal of consent at any time, without prejudice to the processing based on consent prior to the withdrawal

To exercise their rights, contact the data controller at estrocardgame@gmail.com or via the contact page.

8. Right to lodge a complaint

The user has the right to lodge a complaint with the competent supervisory authority: the Italian Data Protection Authority (Garante per la protezione dei dati personali) (garanteprivacy.it).

9. Changes to this policy

The data controller reserves the right to modify this policy at any time, giving notice thereof via the website. The updated version will always be available on this page.