SmartPuzzle

Documents

Privacy and cookie policy

This notice is provided under Articles 13 and 14 of Regulation (EU) 2016/679, under Article 122 of Italian Legislative Decree 196/2003 and in accordance with the guidelines on cookies and other tracking tools issued by the Italian Data Protection Authority, decision no. 231 of 10 June 2021.

In force since 15 September 2026. The Italian version is the binding one, the English translation is provided for convenience.

Data controller

The data controller is SmartPuzzle S.r.l. Impresa Culturale e Creativa, registered office at via Divisione Julia 5, 24121 Bergamo, Italy, registered with the Bergamo Companies Register under no. 04862740166, which is also its tax code and VAT number, REA BG-494819, share capital euro 10,000.00 fully paid up.

For any matter concerning data protection you may write to info@smartpuzzle.eu or, by certified email, to smartpuzzle@pec.it.

The controller has not appointed a data protection officer, as the conditions set out in Article 37 of the Regulation do not apply.

Scope of this notice

This notice covers the website available at www.smartpuzzle.eu and its internal pages. The site is an institutional presentation, so it does not sell online, does not manage user accounts, does not collect sign-ups and contains no forms to fill in.

It does not cover the ARTcheck platform, available at artcheck.smartpuzzle.eu, which is a restricted-access application. Processing carried out there is governed separately, in the relationship between the controller, the commissioning body and the authorised users.

Browsing data and server logs

Like any website reachable on the internet, the infrastructure hosting smartpuzzle.eu automatically records certain technical information about the requests it receives, in particular the IP address of the calling device, the date and time of the request, the address of the requested resource, the method and outcome of the request, the browser and operating system declared and, where present, the referring page.

This data is not used to identify visitors or to analyse their behaviour, and it is not combined with other information. It serves to keep the service running and to detect abuse, intrusion attempts and malfunctions.

The legal basis is the controller’s legitimate interest in the security and continuity of the service, Article 6(1)(f) of the Regulation. Retention by the hosting provider is twelve months, save for any longer period needed to establish liability in the event of computer-related offences.

Data provided voluntarily

The site contains no contact forms. The addresses published in the contact section and in the page footer allow you to write to us, and in doing so you send us your email address together with whatever you choose to include in the message, typically your name, the organisation or company you belong to, your role, a telephone number and a description of your request.

The legal basis is the performance of pre-contractual steps requested by the data subject or the performance of a contract, Article 6(1)(b) of the Regulation, as far as necessary to reply and to prepare any quotation. For correspondence that leads to no relationship, residual retention rests on the controller’s legitimate interest in keeping a record of the professional contacts received.

Providing this data is voluntary, although without contact details we are simply unable to reply.

What this site does not do

For the sake of clarity we also state what we do not do.

  • We use no statistics or traffic analysis tools.
  • We embed no social platform buttons or widgets.
  • We load no fonts, stylesheets, scripts or images from third-party content delivery networks, because every resource the page needs is hosted on our own domain.
  • We provide no newsletter, user registration or online payments.
  • We process no special categories of data within the meaning of Article 9 of the Regulation.
  • We carry out no automated decision-making and no profiling within the meaning of Article 22 of the Regulation.

Third-party 3D content

The project page devoted to the Cangrande equestrian statue features a 3D model hosted on Sketchfab, a platform operated by Sketchfab Inc., a company of the Epic Games group based in New York. The content is not loaded when the page opens, where only a static preview image hosted on our own servers is shown, and it is requested only if the visitor activates it by pressing the dedicated button.

From the moment of activation the platform receives the device IP address, the technical data of the browser and the address of the page from which the request originates, and it may set its own cookies or equivalent tools. The controller of this site has no control over such processing, and Sketchfab and its group companies act as independent controllers. Until activation no data is transmitted to third parties.

Activating the content is the act by which the visitor gives consent, having been informed by the wording shown next to the button. Anyone who prefers not to activate external content can simply refrain from pressing the button and carry on reading the site, which remains fully legible and complete.

The terms applied by the provider are described in its own notice, available at sketchfab.com/privacy and, for the group it belongs to, at legal.epicgames.com.

Links to external sites

Some pages contain links to third-party sites, including RaiPlay, ISREC Bergamo, the Val Divedro project site, the Accademia di Belle Arti di Verona and the personal sites of some team members. A link, in itself, transmits no data. It is the visitor’s own decision to follow it that leads to a site governed by a different privacy notice, over which the controller has no control and for which it bears no responsibility.

Recipients of the data

The data may be processed, solely for the purposes stated above, by the controller’s authorised staff and by the following categories of external parties, acting as processors under Article 28 of the Regulation on the basis of written agreements.

  • The provider of the website hosting services, which also manages the access logs.
  • The provider of the domain email service, which stores the messages received and sent.
  • The controller’s professional advisers in accounting, tax and legal matters, where disclosure is necessary to comply with legal obligations or to protect a right.

The identity of each individual provider is disclosed on request, by writing to the addresses given above. The data may also be disclosed to public authorities in the cases provided for by law. It is not disseminated and it is not disclosed to third parties for their own commercial purposes.

Transfers to third countries

The hosting and email infrastructure is located in Italy.

A transfer to the United States occurs only where the visitor voluntarily activates the 3D model described above. Since in that case the connection is established directly between the visitor’s device and the third-party platform, which acts as an independent controller, the transfer relies on the explicit consent of the data subject under Article 49(1)(a) of the Regulation, given by activating the content after the specific notice. In its own notice the provider states that it relies on the standard contractual clauses approved by the European Commission and, where applicable, on adequacy decisions.

Retention periods

  • Server access logs are kept for the period indicated in the section on browsing data.
  • Correspondence that does not lead to a contractual relationship is kept for twenty-four months from the last meaningful contact.
  • Correspondence and documents relating to contractual relationships are kept for ten years from the end of the relationship, in view of the obligation to retain accounting records and business correspondence under Article 2220 of the Italian Civil Code and of the ordinary limitation period under Article 2946 of the same Code.
  • Data processed by third parties after external content has been activated follows the periods set independently by the provider and stated in its own notice.

Once these periods expire the data is deleted or anonymised, unless retention is required by a legal obligation or necessary to exercise or defend a right in legal proceedings.

Rights of the data subject

Within the limits and under the conditions set out in Articles 15 to 22 of the Regulation, every data subject has the right to obtain access to their personal data, its rectification, its erasure, restriction of processing, portability where processing is based on consent or on a contract and is carried out by automated means, and the right to object to processing based on the controller’s legitimate interest.

Requests should be sent to info@smartpuzzle.eu or to smartpuzzle@pec.it. The controller replies without undue delay and in any event within one month of receipt, a period that may be extended by two months where requests are complex or numerous, with a reasoned notice to the data subject.

The right to lodge a complaint with the supervisory authority under Article 77 of the Regulation remains unaffected. In Italy the competent authority is the Garante per la protezione dei dati personali, piazza Venezia 11, 00187 Rome, email protocollo@gpdp.it, certified email protocollo@pec.gpdp.it, switchboard +39 06 696771. It is also possible to bring proceedings before the courts under Article 79 of the Regulation.

Minors

The site is professional in nature and is not directed at minors, from whom it does not knowingly collect personal data. Where SmartPuzzle’s work involves schools or class groups, the processing of pupils’ data is governed by separate arrangements between the controller and the school, and does not pass through this site.

Security measures

The site is served exclusively over encrypted HTTPS. The controller applies appropriate technical and organisational measures under Article 32 of the Regulation, including restricted and authenticated access to the publishing systems, keeping the software components in use up to date, maintaining backups and not collecting unnecessary data, which remains the most effective measure available.

What cookies are

Cookies are small text files that a site may store on the device of the person visiting it, and that are then sent back to the site on later visits. Alongside cookies there are technically different but functionally equivalent tools, such as browser local storage and device identifiers, which the Italian Data Protection Authority treats as subject to the same rules.

The distinction that matters legally is not technological but functional. Tools strictly necessary to deliver a service requested by the user may be employed without consent, whereas all others, including non-anonymised statistical measurement and profiling tools, require prior consent that is freely given, specific, informed and revocable.

The choice made for this site

This site was built to work without tracking the people who visit it. It sets no profiling cookies, uses no audience measurement tools, embeds no social platform buttons and loads no resources from external domains during ordinary browsing. That is why no consent banner appears on arrival, because a banner is the means of collecting consent when consent is needed, and in ordinary browsing here it is not.

Our own technical tools

The site sets no cookies of its own and uses no browser storage. The reading language depends solely on the page address, with the Italian version at the root of the site and the English version under the /en/ path, so no preference is recorded on the visitor’s device.

The site does not store the preference expressed about activating third-party 3D content, so every fresh page load returns that content to its non-activated state. This is a deliberate choice, which keeps consent confined to the individual activation.

Third-party tools activated on request

Before the activation described in the section on 3D content, no third-party cookie is set and no data leaves our servers. After activation, Sketchfab may set its own cookies, over which the controller of this site has no control, and whose names and durations can be found only in the provider’s own notice. Any cookies already set remain on the device until they naturally expire and can be removed through the browser settings.

How to act from your browser

Every browser lets you view the cookies that have been set, delete them wholesale or selectively and block third-party ones. These functions sit in the settings for privacy and site data, under names that vary between programs and change with updates, so the most reliable reference remains the official documentation of the program in use. Bear in mind the caveat the Italian Data Protection Authority raises in its guidelines, since blocking cookies indiscriminately can impair the operation of other sites, including those that use them purely for technical purposes.

Changes to this notice

This notice may be updated to reflect changes to the site, to the providers used or to the legal framework. The version in force is the one published at this address, with the date shown at the top. Substantive changes are flagged on the page.