Dear visitor,

pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (hereinafter the "GDPR" or the "Regulation") and Italian Legislative Decree No. 196 of June 30, 2003 (the "Italian Privacy Code"), as amended by Legislative Decree No. 101 of August 10, 2018, we hereby inform you that Xtranet Srl, with registered office at Via XX Settembre 40/9A - 16121 Genoa (GE), Italy, as Data Controller, will process the personal data concerning you that you voluntarily provide to us, in accordance with the principles of lawfulness, fairness, transparency, data minimization, accuracy, storage limitation, integrity, and confidentiality set out in Article 5 of the GDPR.
Personal data will be processed in compliance with applicable law and under the following terms.

a) Data Controller

The Data Controller is Xtranet Srl, with registered office at Via XX Settembre 40/9A - 16121 Genoa (GE) - Italy, who can be contacted by email at privacy@xtranet.it.

b) Purposes and legal basis of processing

Your personal data is processed for the following purposes and on the basis of the corresponding lawful grounds set out in Article 6 of the GDPR:

• to respond to requests for information and provide the services requested, as well as for activities prior to entering into any contracts (legal basis: performance of pre-contractual/contractual measures, Art. 6(1)(b) GDPR);
• to comply with legal, accounting, and tax obligations (legal basis: compliance with a legal obligation, Art. 6(1)(c) GDPR);
• to manage the operational and administrative relationship with the user (legal basis: legitimate interest of the Data Controller, Art. 6(1)(f) GDPR);
• to monitor access to and operation of the website www.xclaimmed.com, including for information security purposes (legal basis: legitimate interest of the Data Controller, Art. 6(1)(f) GDPR);
• to send information materials and commercial communications, and to carry out strategic and operational marketing, market research, and statistical activities (legal basis: specific consent of the data subject, Art. 6(1)(a) GDPR, which may be withdrawn at any time).

Processing for marketing purposes takes place only with your express consent, given separately from the other purposes, and does not affect the provision of the services requested, except as indicated in point d).

c) Processing methods and security measures

Processing may consist of the collection, recording, organization, structuring, storage, consultation, processing, alteration, selection, retrieval, comparison, use, combination, restriction, erasure, and destruction of data, and will be carried out both on paper and by electronic, computerized, and online means, using methods strictly related to the purposes stated.

Xtranet Srl adopts appropriate technical and organizational measures to ensure a level of security appropriate to the risk, pursuant to Article 32 of the GDPR, in order to protect data against unauthorized access, loss, destruction, or unlawful disclosure.

d) Nature of provision of data and consequences of refusal

Providing your data is:

• mandatory for purposes related to obligations under laws, regulations, or EU legislation;
• necessary to establish and continue the relationship with Xtranet Srl and to respond to your requests;
• optional for marketing and commercial communication purposes.

The fields marked as required in the forms on the website are necessary to provide the information or services requested. Failure to provide required data may make it impossible to process your request or to continue the relationship with Xtranet Srl. Failure to provide optional data has no consequences, other than not being able to receive marketing communications.

During their normal operation, the computer systems and software procedures used to run the website collect certain personal data whose transmission is implicit in the use of Internet communication protocols (browsing data). This information is not collected in order to be associated with identified data subjects, but by its very nature it could allow users to be identified through processing and association with data held by third parties.
This category includes the IP addresses or domain names of the computers used by users connecting to the website, the URI addresses of the resources requested, the time of the request, the method used to submit the request to the server, the size of the file obtained in response, the numerical code indicating the status of the server's response, and other parameters relating to the user's operating system and computer environment. This data is processed only for as long as necessary and retained for the period indicated in point f), except where needed to investigate criminal offenses.

The Data Controller retains connection logs in order to respond to any requests from the judicial authorities or other authorized public bodies.

Voluntarily sending email to the addresses shown on the website results in the collection of the sender's address and of the information contained in the message, which is processed solely to respond to the request.

e) Categories of recipients and disclosure of data

Within the limits relevant to the purposes stated above, personal data may be disclosed to parties acting as independent Data Controllers (e.g., banks, public authorities for legal compliance) or acting as Data Processors under Art. 28 GDPR, specifically appointed and bound by specific contractual confidentiality and security obligations, such as, by way of example: IT and hosting service providers, payment processing companies, law firms and tax/accounting consultants, companies responsible for quality control of logistics and sales flows, freight forwarders, and transportation service providers.

Employees, agents, and collaborators of Xtranet Srl acting within the scope of their duties may access the data as persons authorized to process data pursuant to Art. 29 GDPR.

Personal data is not disseminated. Only with your specific and express consent given online may the data be disclosed to third parties for commercial information and direct marketing of our own or third-party products and services.

Transfer of data to non-EU countries

Personal data is processed within the European Economic Area (EEA). Should a transfer to non-EEA countries become necessary for specific operational reasons, it will take place in compliance with the safeguards provided for in Articles 44 et seq. of the GDPR (e.g., adequacy decisions of the European Commission or standard contractual clauses).

f) Retention period

Personal data is retained for as long as strictly necessary to achieve the purposes for which it was collected, in compliance with legal time limits (e.g., retention of tax and accounting records for 10 years), and, for marketing purposes, until the data subject withdraws consent.

g) Rights of the data subject

As a data subject, you may exercise at any time, in relation to the processing of your personal data, the rights provided for in Articles 15-22 of the GDPR, including in particular:

• the right of access to personal data (Art. 15);
• the right to rectification of inaccurate or incomplete data (Art. 16);
• the right to erasure ("right to be forgotten"), in the cases provided for by law (Art. 17);
• the right to restriction of processing (Art. 18);
• the right to data portability (Art. 20);
• the right to object to processing, in particular for direct marketing purposes (Art. 21);
• the right to withdraw consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal.

You also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, www.garanteprivacy.it) if you believe that your data is being processed in breach of applicable law.

To exercise your rights, you can send a request:

• by regular mail to: Xtranet Srl, Via XX Settembre 40/9A - 16121 Genoa (GE), Italy;
• by email to: privacy@xtranet.it.

For any information regarding the processing of personal data, you can contact the organization's internal privacy officer at privacy@xtranet.it.

h) Changes to this notice

This notice may be amended or updated, including as a result of changes in legislation. We invite you to check this page periodically. This notice was last updated in August 2026.