Privacy policy

This notice explains what happens to personal data when you use farrainbow.com. It is written under Articles 13 and 14 of the General Data Protection Regulation (EU) 2016/679 and the Italian Codice in materia di protezione dei dati personali (D.Lgs. 196/2003 as amended).

Who is responsible

The data controller is Far Rainbow S.r.l., società con socio unico, with registered office at Via Turbada 11, 23900 Lecco (LC), Italy — Registro delle Imprese di Como-Lecco n. 03894780133 · REA LC-405002 · P. IVA IT03894780133.

You can reach us about anything in this notice at contact [at] farrainbow.com, by certified email at farrainbow [at] pec.it, or by telephone on +39 328 4533411.

We have not appointed a Data Protection Officer. We are not required to: we are a small company, we do not monitor people systematically, and we do not process special categories of data as a core activity.

What we collect, and why

When you write to us through the contact form

We ask for your name, your email address and your message. The company name is optional. We use them for one thing: to answer you. The legal basis is Article 6(1)(b) — steps taken at your request before entering into a contract — or, where your message is not about working together, our legitimate interest under Article 6(1)(f) in replying to people who contact us.

The form is served from our own infrastructure. It does not use a third-party form service, and your message is not passed to one.

If you tick the box asking for occasional emails

That box is separate, unticked by default, and has no effect on your enquiry. If you tick it, we record that you did, together with the date and time, the exact wording you agreed to and its version. The legal basis is your consent, Article 6(1)(a). You can withdraw it at any time — one line to contact [at] farrainbow.comis enough, and every email we send carries an unsubscribe link. Withdrawing does not affect anything we sent before.

When you simply read the site

Our web server records the usual technical information in its log: the IP address of the request, the time, the page requested, the referring page and the browser’s user-agent string. This is how any web server works; we keep it to diagnose faults and to detect abuse, on the basis of our legitimate interest under Article 6(1)(f). Logs are rotated and deleted within 30 days.

We measure traffic at the network edge, in Cloudflare, which already carries every request to this site as our reverse proxy. There is no analytics script on any page: nothing is placed on your device, your browser is not fingerprinted, you are not followed between sites, and what we see are aggregate counts — requests, countries, pages, and whether traffic came from a browser or an automated client. No profile of you is built.

How long we keep things

• Enquiries: two years from your message, unless we end up working together — in which case the contract and tax rules below apply.
• Marketing consent and the address it covers: until you withdraw it, plus the period needed to prove the consent was given.
• Server logs: 30 days.
• Accounting and contractual records: ten years, as Italian law requires (art. 2220 c.c.).

Who else sees your data

We keep the site and its data on infrastructure we run ourselves. A small number of suppliers process data on our behalf, under Article 28 contracts:

• Cloudflare, Inc. — reverse proxy and protection in front of the site, and the aggregate traffic measurement described above. Requests pass through its network, so it processes IP addresses and request metadata. Transfers outside the EEA are covered by the European Commission’s Standard Contractual Clauses.
• Our email provider — delivery and storage of the messages you send us.
• Our accountants — only where an enquiry becomes an invoice.

We do not sell personal data, we do not share it for advertising, and we do not use it to make automated decisions or to profile you.

Your rights

Under Articles 15 to 22 you can ask us for a copy of the data we hold about you, ask us to correct it, ask us to delete it, ask us to restrict what we do with it, object to processing we base on legitimate interest, and ask for the data you gave us in a portable format. Where we rely on consent, you can withdraw it at any time.

Write to contact [at] farrainbow.com. We answer within one month, as Article 12(3) requires.

If you think we have handled your data badly, you can complain to the Italian supervisory authority, the Garante per la protezione dei dati personali (Piazza Venezia 11, 00187 Roma — garanteprivacy.it (opens in a new tab)), or to the authority in the EU country where you live or work.

Security

Data is held on systems we control, in a facility we control, with encrypted storage volumes, two-factor authentication on administrative access, and backups kept separately from the running machine. Access is limited to the people who need it to do their work. These are the measures Article 32 asks us to take in proportion to the risk; they are not a guarantee that nothing can ever go wrong, and no one can honestly offer that.

Changes

If this notice changes materially we will say so on this page and update the date at the top. The current version is always the one you are reading.