Privacy Policy

1. Introduction

This Privacy Policy describes how Mainmast S.r.l., as data controller, collects, uses, stores and protects the personal data of users who visit the website, register on the MAINMAST platform, apply as affiliates or use the services available in the private area.

This notice is provided pursuant to Regulation (EU) 2016/679, commonly known as the GDPR, and applicable personal data protection legislation.

2. Data controller

The data controller is:

3. Personal data processed

The following categories of personal data may be processed through the MAINMAST website and platform:

4. Purposes of processing

Personal data is processed for the following purposes:

5. Legal bases for processing

The processing of personal data may rely on the following legal bases:

• taking pre-contractual steps or performing a contract, for registration, applications, account management and use of the platform;
• compliance with legal, tax, accounting or regulatory obligations;
• the controller's legitimate interests, for security, fraud prevention, technical management, protection of rights and verification of affiliate activities;
• the data subject's consent, where required, for example for marketing communications or non-essential cookies;
• the establishment, exercise or defence of legal claims in or out of court.

6. Provision of data

Providing the data needed for registration, applications and account management is necessary to use the platform.

Failure to provide essential data may prevent account creation, submission of an application, approval as an affiliate or payment of commissions.

Providing optional data, such as additional business information, estimated volumes, secondary channels or documents not immediately requested, is voluntary and helps improve assessment of the application or management of the relationship.

7. Processing methods

Personal data is processed using electronic, IT and telecommunications tools, in accordance with the principles of lawfulness, fairness, transparency, data minimisation, security, integrity and confidentiality.

The controller adopts appropriate technical and organisational measures to protect data against unauthorised access, loss, destruction, alteration or improper disclosure.

8. Data retention

Personal data is retained for as long as necessary to fulfil the purposes for which it was collected.

In particular:

• account data is retained for as long as the account remains active;
• application data is retained for the time needed to assess the application and manage the relationship;
• contractual, accounting, tax and payment data is retained for the periods required by applicable law;
• tracking, conversion and performance data is retained for operational, administrative, fraud prevention and audit purposes;
• data processed on the basis of consent is retained until consent is withdrawn, subject to any further obligations or legitimate interests.

At the end of the retention periods, data will be deleted, anonymised or aggregated, unless legal obligations or the need to protect the controller's rights require otherwise.

9. Data recipients

Personal data may be disclosed or made accessible to:

• the controller's authorised personnel;
• technical suppliers;
• hosting, database, cloud, security and authentication providers;
• tax, legal, administrative or accounting advisers;
• operators, advertisers or business partners involved in campaigns;
• tracking, analytics, CRM or automation platforms;
• payment institutions, banks or financial intermediaries;
• public authorities or parties entitled by law.

Third parties processing data on behalf of the controller are appointed, where necessary, as data processors pursuant to Article 28 of the GDPR.

10. Transfers outside the EU

Some technology providers or partners may process personal data outside the European Economic Area.

In such cases, transfers will take place only with appropriate safeguards required by applicable law, such as adequacy decisions, standard contractual clauses or other measures recognised by the GDPR.

11. Cookies and tracking tools

The website and platform may use technical cookies necessary for service operation, security, authentication, session management and storing preferences.

Any analytics, advertising or profiling cookies, or tracking tools that are not strictly necessary, will be used only to the extent permitted by applicable law and, where required, with the user's prior consent.

Users can manage their cookie preferences through the cookie banner, preference panel or browser settings.

For further details, please consult the Cookie Policy, if published separately, or the cookie section available on the website.

12. Marketing and communications

Users may receive service communications concerning their account, application, offers, security, payments or operational updates to the platform.

Promotional communications or newsletters will be sent only where permitted by law or with prior consent, where necessary.

Users may withdraw consent or object to marketing communications at any time by following the instructions in the communications received or by writing to info@mainmast.it.

13. Security and fraud prevention

To protect the platform, users, affiliates and operators, the controller may process personal and technical data for security, fraud prevention, anomaly detection, traffic verification, abuse prevention and protection of its rights.

These checks may concern, for example, IP addresses, logs, traffic patterns, conversion data, promotional sources, technical identifiers, unusual behaviour and information provided during the application process.

14. Data subject rights

Data subjects may exercise the rights provided by applicable law, including:

• the right of access to personal data;
• the right to rectification;
• the right to erasure;
• the right to restriction of processing;
• the right to object;
• the right to data portability, where applicable;
• the right to withdraw consent where processing is based on consent;
• the right to lodge a complaint with the competent supervisory authority.

To exercise these rights, data subjects may write to:

info@mainmast.it

The controller may request information needed to verify the applicant's identity before acting on the request.

15. Complaints to the supervisory authority

Data subjects have the right to lodge a complaint with the competent personal data protection supervisory authority.

For parties established in Italy, the competent authority is the Garante per la protezione dei dati personali (Italian Data Protection Authority).

16. Minors

The MAINMAST platform is intended exclusively for adults and professional or commercial operators.

Use of the platform by minors is prohibited.

17. Changes to the Privacy Policy

The controller may update this Privacy Policy for regulatory, technical, organisational or commercial reasons.

The updated version will be published on the website or made available on the platform.

Users are encouraged to consult this notice periodically.

18. Privacy contacts

For questions concerning this Privacy Policy or the processing of personal data: