How we process your data

Data controller

Alessandro Pette – Forensis Lab, Palermo · forensislab@pec.it. You can send any request about the processing of your data to this address.

Data collected

From the site, only the data you enter in its forms. Contact form: full name, email, telephone if given, organisation, subject and message. Trusted Seller application: the business's details (trading name, legal name, VAT number, address, website and marketplace profiles) and the contact person's (full name, role, email, telephone). Photographs and messages about a case are covered in the next section.

Case photographs and correspondence

If you send us a request for an expert report or engage us on a case, we also process the photographs and the messages we exchange about it, by email or PEC (Italian registered email), in order to examine the case and prepare the result or the report. Photographs and technical data may feed the laboratory's comparative database only in a form that cannot be traced back to you or to the client, unless consent is given or the law requires otherwise; the database is not transferred to third parties (Code of Ethics 4.3). Reports and expert reports, with their supporting documentation, are kept for ten years, or longer if the law or the proceedings require it (Code of Ethics 3.4 f). If you tell us about your health, for example a reaction to the product, that information belongs to the special categories of personal data (art. 9 GDPR): we process it only for that case, including any report to the competent authorities in the cases provided for by law (Code of Ethics 3.8 e), and it does not go into the comparative database.

Purposes and legal bases

To answer requests and to manage applications to the Trusted Seller pilot programme, on the basis of the pre-contractual and contractual measures requested by the data subject (art. 6(1)(b) GDPR); to comply with legal obligations, for example tax and accounting obligations (art. 6(1)(c) GDPR). For these purposes processing is not based on consent: the privacy-notice checkbox in the forms only confirms that you have read it.

Health information (art. 9 GDPR): in assignments, we process it because it is necessary for the establishment, exercise or defence of legal claims or whenever courts are acting in their judicial capacity (art. 9(2)(f) GDPR); in what private individuals tell us on their own initiative, such as what they write in a request for an expert report, only with your explicit consent, which you give in the form through a separate checkbox (art. 9(2)(a) GDPR) and can withdraw at any time, without affecting processing already carried out. If the box is not ticked, the form asks you not to describe any health information; if any reaches us nonetheless, we use it only to advise you to see a doctor and, in the cases provided for by law, to report to the competent authorities; we do not keep it in the case file or in the comparative database.

Data relating to criminal offences (art. 10 GDPR), for example those concerning a seizure: we process them only in the context of assignments from the authorities or for the exercise or defence of a right in legal proceedings (art. 2-⁠octies d.lgs. 196/2003, Italian Personal Data Protection Code).

Retention

For as long as needed to handle the request or the application and, beyond that, for as long as legal obligations require. For reports and expert reports, the period stated in the section ‘Case photographs and correspondence’ applies.

Recipients

The data are processed by the controller and by Vercel Inc., hosting provider, appointed as processor (art. 28 GDPR). Emails arrive in the laboratory's PEC mailbox, managed by the PEC service provider (processor, art. 28 GDPR). The data are not passed on to third parties. They may be disclosed to the competent authorities only where the law requires it, where the judicial authorities order it, or where there is a risk to health (Code of Ethics 3.8 e).

Transfers outside the EU

Some of the providers named above, including the hosting provider, are based in the United States. For these providers, transfers of data outside the European Union rely on the EU-US Data Privacy Framework, for providers that participate in it, or on the standard contractual clauses approved by the European Commission (arts. 45 and 46 GDPR).

Your rights

You can request access to your data, rectification, erasure, restriction of processing and portability, and you can object to processing (arts. 15–⁠22 GDPR), by writing to forensislab@pec.it. You also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali).

Cookies

The site does not use profiling cookies.