Privacy Policy.

1. Data Controller

The Controller is responsible for the processing of personal data collected through this website and its related services.

2. Categories of data processed and purposes

2.1 Browsing data

IT systems automatically acquire certain technical data during browsing: IP addresses, browser type, operating system, pages visited, date and time of the visit. This data is used solely for anonymous statistical purposes and to ensure the correct operation of the site. It is not associated with identified users.

2.2 Data provided voluntarily — contact form

Submitting the contact form involves the collection of the following data:

• Full name
• Email address
• Telephone number (if provided)
• Company / organisation (if provided)
• Content of the message

Purpose: to respond to the enquiry and manage the business relationship.
Legal basis: performance of pre-contractual measures (Art. 6(1)(b) GDPR).
Retention: 24 months from receipt, unless a longer retention obligation is imposed by law.

2.3 Client area data (MyPhaenomena)

Registration for the client area involves the collection of:

• Full name
• Email address (used as the login identifier)
• Company and professional role
• Access data (password hash, login timestamps)
• Record of downloads made

Purpose: to provide access to restricted technical documents (datasheets, photometric files, CAD files), manage the relationship with industry professionals and prevent unauthorised access.
Legal basis: express consent given at the time of registration (Art. 6(1)(a) GDPR) and legitimate interest in the security of the service (point (f)).
Retention: for the entire duration of the relationship and up to 36 months from deactivation of the account or withdrawal of consent.

2.4 Job applications

CVs sent speculatively or in response to job advertisements are processed solely for the purpose of assessing the application.
Retention: 12 months from receipt, after which the data is deleted unless explicit consent to extended retention has been given.

2.5 Cookies and tracking technologies

For the use of cookies, please refer to the Cookie Policy.

3. Method of processing

Personal data is processed using IT and electronic tools, with organisational and logical arrangements strictly related to the stated purposes. Processing complies with the principles of lawfulness, fairness, transparency, data minimisation, accuracy, storage limitation, integrity and confidentiality (Art. 5 GDPR).

Appropriate technical and organisational measures are in place to ensure a level of security appropriate to the risk, including encryption of communications (HTTPS/TLS), password hashing and role-based access control.

4. Recipients of the data

Personal data is not transferred, sold or disclosed to third parties for their own commercial purposes. It may be disclosed to:

• Technical service providers (hosting, email, analytics) acting as processors under Art. 28 GDPR
• Competent authorities in the cases provided for by law
• Professionals and collaborators involved in handling enquiries, bound by confidentiality obligations

An up-to-date list of processors is available on request by writing to info@phaenomena.it.

5. Transfers to third countries

Some services used (Google LLC, Meta Platforms, LinkedIn Corporation) involve the transfer of data to the United States. Such transfers take place in compliance with Arts. 44-49 GDPR, by means of Standard Contractual Clauses approved by the European Commission and, where applicable, under the EU-US Data Privacy Framework.

6. Rights of the data subject

Under Arts. 15-22 GDPR, the data subject has the right to:

• Access — obtain confirmation of processing and a copy of the data (Art. 15)
• Rectification — correct inaccurate or incomplete data (Art. 16)
• Erasure — obtain erasure (the «right to be forgotten») in the cases provided for (Art. 17)
• Restriction — request restriction of processing (Art. 18)
• Portability — receive the data in a structured, machine-readable format (Art. 20)
• Objection — object to processing for marketing purposes or based on legitimate interest (Art. 21)
• Withdrawal of consent — at any time, without affecting the lawfulness of prior processing (Art. 7)

Requests should be sent to info@phaenomena.it. The Controller responds within 30 days of receipt (extendable by a further 60 days in complex cases).

7. Minors

The website and services of Phaenomena S.p.A. are intended for adult professionals. We do not knowingly collect personal data of children under 14. Should we become aware of such collection, we will delete the data immediately.

8. Changes to this notice

Phaenomena S.p.A. reserves the right to amend this Privacy Policy at any time. Changes are published on this page together with an updated date. We recommend consulting this page periodically. For processing substantially different from the consent originally given, fresh consent will be requested.