Website privacy policy

1Who the data controller is

The data controller is UTurn (progetto in fase di costituzione). For any privacy question or to exercise your rights, write to privacy@uturn.day.

2What this policy covers

This policy only covers the uturn.day website. The UTurn app and the partner shop programme have their own policy, which you can find here: app privacy policy.

3What data we process

• Browsing data. When you open a page, your browser automatically sends some technical information: IP address, date and time, requested page, browser and device type. It is processed by our hosting provider to show you the website and protect it from abuse. We don't use it to identify or profile you.
• Data you send us. If you email us (for example at ciao@uturn.day), we process your email address, your name if you give it, and the content of your message.
• Preferences saved in your browser. The website remembers in your browser the language you picked and your cookie preferences. This data stays on your device: see the cookie policy.

The website has no sign-up forms, analytics tools, advertising or social buttons that track visits. Fonts are hosted on our own servers, with no calls to external services.

4Why we process it and on what legal basis

• Showing you the website and keeping it secure (browsing data): legitimate interest in offering a working, protected website, Art. 6(1)(f) GDPR.
• Replying to your messages: taking steps at your request, Art. 6(1)(b) GDPR, or our legitimate interest in replying to people who contact us, Art. 6(1)(f) GDPR.

Providing browsing data is necessary to visit the website. Writing to us is optional: without your data we simply couldn't reply.

5How long we keep it

• Browsing data: for the technical time the hosting provider needs for security purposes, usually a few days, unless it is needed to establish an offence.
• Emails: for as long as needed to handle your request and then for no more than 24 months, unless the law requires otherwise or we need it to defend a right.
• Browser preferences: until you delete them; you'll be asked for your cookie choice again after 6 months or if we change this policy.

6Who receives the data

The data is processed by us and by the providers that help us run the website, appointed as processors under Art. 28 GDPR:

• Cloudflare, Inc.: website hosting, content delivery network, attack protection and forwarding of emails sent to @uturn.day addresses.
• Google LLC / Google Ireland Ltd: the Gmail mailbox where we receive forwarded emails.

We don't sell or pass on your data to anyone and we don't use it for advertising.

7Transfers outside the European Union

Cloudflare and Google may also process some data in the United States. Both companies participate in the EU-U.S. Data Privacy Framework (European Commission adequacy decision of 10 July 2023) and also use the standard contractual clauses approved by the Commission.

8Your rights

You can ask us at any time to access your data, correct it, erase it, restrict its processing, object to processing based on legitimate interest and receive your data in a portable format (Arts. 15–22 GDPR). Write to privacy@uturn.day: we'll reply within one month.

If you believe the processing breaches the GDPR, you can lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali) or the authority of the EU country where you live.

9Changes to this policy

If we change the way we process data, we'll update this page and the date at the top. If the changes are significant, we'll point them out clearly on the website.