Privacy notice

1. Data controller

The controller of personal data collected through www.prisma-magazine.com is:

Prisma-Cultura S.r.l. Società Benefit Registered office: Viale Europa, 135 – 50126 Firenze (FI), Italy VAT no.: 07191420483 Privacy contact: privacy@prisma-magazine.com

2. Categories of data collected

a) Browsing data. In the ordinary course of their operation, the systems and software running this site acquire personal data whose transmission is implicit in the use of internet communication protocols. This includes: IP addresses, browser type, operating system, domain name and addresses of the sites from which entry or exit occurred, information on the pages visited, time of access, time spent on each page, analysis of the path through the site, and other parameters relating to the user's operating system and computing environment.

b) Data provided voluntarily — account registration. Registering requires an email address and a password. The password is stored only in hashed form and is not accessible in clear text, either to the controller or to any third party.

c) Data provided voluntarily — newsletter subscription. Subscribing requires an email address and explicit, freely given consent, which can be withdrawn at any time.

d) Cookies and similar technologies. The site uses technical cookies and, subject to your consent, analytics and third-party cookies. Details are in the Cookie Policy.

3. Purposes and legal bases

• Providing the service and managing your account. Legal basis: performance of a contract or pre-contractual measures to which the data subject is party (Art. 6(1)(b) GDPR).
• Site security, prevention of fraud, abuse and attacks. Legal basis: the controller's legitimate interest (Art. 6(1)(f) GDPR) in the security, integrity and availability of the site and its services.
• Compliance with legal obligations. Legal basis: compliance with a legal obligation to which the controller is subject (Art. 6(1)(c) GDPR), including accounting and tax obligations and responses to requests from the judicial authority or the Italian data protection authority.
• Sending the newsletter and information about our editorial activity. Legal basis: free, specific, informed and withdrawable consent (Art. 6(1)(a) GDPR).
• Aggregate statistical analysis of site usage. Legal basis: the user's consent for non-technical cookies (Art. 6(1)(a) GDPR and Art. 122 of Italian Legislative Decree 196/2003).

4. How data is processed, and security measures

Personal data is processed by electronic means, with logic strictly related to the stated purposes, applying technical and organisational measures appropriate to the risk under Art. 32 GDPR. Specifically:

• data encrypted in transit using TLS 1.3;
• data encrypted at rest using AES-256;
• access managed through individual credentials and the principle of least privilege;
• logging and monitoring of system access;
• perimeter protection (firewall, DDoS mitigation, anomalous traffic filtering).

5. Where data is processed

Personal data is processed principally on servers located within the European Union (Ireland and Germany). Some perimeter security, content delivery (CDN) and infrastructure analytics components may involve data transiting or being temporarily processed in data centres located outside the European Union.

In those cases the transfer takes place solely on the basis of one of the safeguards under Chapter V GDPR, including: an adequacy decision of the European Commission (e.g. the EU-U.S. Data Privacy Framework, Decision (EU) 2023/1795); standard contractual clauses approved by the Commission (Implementing Decision (EU) 2021/914); or other appropriate safeguards under Art. 46 GDPR.

6. Retention periods

Personal data is kept only as long as necessary for the purposes for which it was collected, specifically:

• browsing data and system logs: up to 12 months, save where needed to establish criminal offences or where requested by the authorities;
• account data: for the life of the account and for 12 months after its deletion, for security purposes and legal defence;
• newsletter data: until consent is withdrawn or deletion is requested;
• data subject to legal obligations: for the period required by the applicable rules (generally 10 years for accounting and tax records).

7. Categories of recipients

Personal data may be disclosed, for the purposes described above, to the following categories of recipients, each duly appointed as a processor or acting as an independent controller where applicable:

• providers of cloud hosting and IT infrastructure;
• providers of perimeter security, CDN, DDoS mitigation and infrastructure analytics;
• providers of email marketing and newsletter services;
• providers of editorial automation and content management technology;
• legal, tax and accounting advisers, where needed to protect the controller's rights or to comply with the law;
• public authorities, where they so request under the law.

Users' personal data is never disseminated or sold to third parties for their own marketing purposes.

8. Artificial intelligence and users' data

The controller expressly declares that users' personal data collected through this site is not used to train artificial intelligence models, either by the controller or by any third-party provider.

Where the site hosts editorial content produced wholly or partly with the assistance of artificial intelligence systems, that content is identified accordingly, in compliance with the transparency obligations of Art. 50 of Regulation (EU) 2024/1689 (the AI Act). How we work is set out in full on our Editorial standards page.

9. Your rights

In relation to the processing described here, you may exercise at any time the rights under Arts. 15-22 GDPR, and in particular:

• the right of access to your personal data (Art. 15);
• the right to rectification of inaccurate or incomplete data (Art. 16);
• the right to erasure (Art. 17, the "right to be forgotten");
• the right to restriction of processing (Art. 18);
• the right to data portability (Art. 20);
• the right to object to processing (Art. 21);
• the right not to be subject to automated decision-making, including profiling, producing legal effects or similarly significantly affecting you (Art. 22);
• the right to withdraw consent at any time, without affecting the lawfulness of processing carried out on the basis of consent before the withdrawal.

To exercise these rights, write to the controller at privacy@prisma-magazine.com. The controller will respond within 30 days of receiving the request, extendable by a further 60 days where the request is particularly complex.

10. Right to lodge a complaint

You have the right to lodge a complaint with the Garante per la protezione dei dati personali, the Italian supervisory authority, at Piazza Venezia 11 – 00187 Rome, Italy (www.garanteprivacy.it), if you believe your data is being processed in breach of the applicable rules.

11. Whether providing data is mandatory

Providing the data needed for the technical operation of the site is necessary for the site to work.

Providing data to register an account or subscribe to the newsletter is optional. Not providing it means only that you cannot use those services.

12. Cookies

For detailed information on the cookies this site uses, their purposes, their retention periods and how to manage your consent, see the Cookie Policy.

13. Changes to this notice

The controller may amend, supplement or update this notice at any time, including in response to changes in the law or in how data is processed. Changes are published on the site with the date of the latest update and, where substantial, notified to registered users by email.

---

This English version is provided for convenience. The controller is an Italian company and the supervisory authority is the Italian one: in the event of any divergence, the Italian text governs.