Privacy Policy

Last updated: 23/07/2026

RYKEM S.r.l.
Registered office: Via G. Frua, 22 – 20146 Milan (MI) IT
Registered office: Via B. Buozzi, 22 – 20097 San Donato Milanese (MI) IT
VAT Registration Number 05435940969 – REA MI 1821615 – SDI T04ZHR3 – Share Capital € 1,000,000.00 fully paid up
Tel. +39 02 89769825 – info@labxprofessional.it – www.labxprofessional.it

Information in accordance with the General Data Protection Regulation – EU Reg. 2016/679.
Last updated: 23/07/2026

1. Principles applicable to processing activities

In accordance with Article 13 of the European Regulation, we inform you that personal data are processed in compliance with the following principles:

Lawfulness – the treatment is carried out in compliance with regulations.
Correctness – the treatment respects mutual needs as well as the rules.
Purpose limitation – the purposes of the processing are determined, explicit and legitimate; subsequent processing for purposes other than those for which the personal data were collected shall not be deemed incompatible with those initial purposes, save for further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes.
Data Minimisation – the data is adequate, relevant, and limited to what is necessary for the purposes.
Accuracy the data is accurate and, where necessary, kept up to date; all reasonable steps are taken to promptly erase or rectify inaccurate data.
Storage limitation – data are kept in a form which permits identification of the data subject for no longer than is necessary for the purposes for which the personal data were acquired.
Integrity and confidentiality The data acquired is protected by technical-organisational measures aimed at ensuring adequate security, in order to avoid or minimise the risks of unauthorised or illicit processing, loss, destruction, or accidental damage.
Responsibility – the data controller's organisation has responsibilities that are identified, assigned, and verified over time.
Re-evaluation of security policies – the policies applied to information, systems and networks are periodically reviewed and reassessed.
Oblio – after a sufficient period of time has passed, which normally coincides with the end of treatment operations, the erasure or anonymisation of data may be requested.

2. Data Controller and DPO

RYKEM S.r.l., Via G. Frua, 22 – Milan
Telephone +39 02 55607285 – E-mail info@rykem.it

Data Protection Officer (DPO) / Responsabile della protezione dei dati (RPD)

The Company has not appointed a DPO/RPD as it is not among the entities obliged to do so under and for the purposes of Article 39 of EU Regulation 2016/679.

3. Purpose and legal basis of processing. Categories of data processed

The collection and processing of personal data are carried out for the following purposes:

service provision available through the website (for example, if present, contact request via the form from the Site;
research and statistical analysis on aggregated or anonymised data, thus without the possibility of identifying the user, aimed at measuring the functioning of the Site and its operational functions, including the resolution of any technical problems;
actions aimed at preventing or averting fraudulent activities or any misuse that could damage the Controller's Site, or compromise the security of operations;
compliance with a legal obligation to which the Data Controller is subject;
ascertainment, exercise or defence of a right in judicial proceedings or whenever judicial authorities exercise their functions;
marketing treatments, advertising and commercial initiatives, including via social networks, and newsletter forwarding.

The processing involves collection, recording, storage, use, disclosure, publication, erasure, and destruction.

The personal data acquired and processed will not be subject to any automated decision-making, including profiling.

The legal basis justifying the processing of data is represented by the pre-contractual relationship between the parties, pursuant to Article 6(1)(b) of the GDPR, and for point (f) by consent, pursuant to Article 6(1)(a) of the GDPR.

For the purposes stated above, the following categories of data are processed:.

Navigation data

The computer systems and software procedures that are responsible for the proper functioning of the Site acquire, in the course of their normal operation, certain personal data whose transmission is implicit in the browsing of websites. This information is not collected to be associated with identified data subjects; however, by its very nature, it could, through processing and association with data held by third parties, allow users to be identified. These include the IP addresses or domain names of the computers used by users who connect to the Site, the URI (Uniform Resource Identifier) addresses of the resources requested, the time of the request, the method used in submitting the request to the server, the size of the file obtained in response, the numerical code indicating the status of the response given by the server, and other parameters relating to the operating system and the computer platform used by the user.

The data above is used solely for the purpose of obtaining anonymous statistical information on the use of the Site and to check its proper functioning. The data may be used to ascertain responsibility in the event of hypothetical cybercrimes against the Site.

Data provided voluntarily by the user

Through the Site, users have the option to voluntarily provide personal data, such as their name and email address, to contact the Data Controller or leave a message via the form Of the site, if present.

The Data Controller may also ask the user to provide certain information should problems arise with the services on the Website. The personal data thus provided is used solely for the purpose of satisfying or responding to the requests submitted and is communicated to third parties only if this is necessary for that purpose. In this regard, the user grants the broadest possible indemnity on this point with respect to any dispute, claim or demand for damages arising from processing that may be made against the Data Controller by third parties whose personal data has been processed through the use of the Website in violation of the applicable regulations.

Cookies

The Data Controller uses cookies through this Website. For all information regarding this, please refer to the dedicated Cookie Policy.

4. Processing methods

Data processing is carried out by natural or legal persons designated to manage or support the company's activities in compliance with logical, physical, and confidentiality security. The data in question is processed, as authorised subjects, by staff and, as data controllers, by external collaborators or appointees.

The processing of user information is carried out only when strictly necessary, including with the aid of electronic or otherwise automated means, and is performed by the Data Controller and/or by third parties that the Data Controller may use to store, manage, and transmit the data itself.

The processing will be carried out using organisational and processing logic for personal data, also relating to log arising from access to and use of the services made available online, related to the purposes indicated above and, in any case, in such a way as to guarantee the security and confidentiality of the data.

Safety

The Data Controller undertakes to protect the security of personal data during its transmission, using selected suppliers who guarantee to adopt the most appropriate security measures.

In any event, the Data Controller recommends taking appropriate precautions against unauthorised access to passwords and personal computers. It is always advisable to ensure you have logged out when using a computer shared with other users.

5. Data recipients

With reference to the purposes for processing for which they are acquired, the data may and must be communicated, by express legal obligation, regulation, and consequently contract, to third parties identified as individuals or legal entities and public authorities authorised to receive them (by way of example and not exhaustively: accountants and company consultants, inspection and supervisory bodies).

The Data Controller shall appoint processors and persons authorised to process data, namely all employees and collaborators, including occasional ones, and shall designate external parties who carry out tasks connected to personal data processing on behalf of the Data Controller as data controllers. Such parties shall act in accordance with the GDPR, upon specific instruction from the Data Controller.

Personal data may be shared, for the purposes indicated, with:

employees and authorised consultants to manage the Site and provide related services (e.g. customer service, IT system management) as data processors, system administrators or internal data controllers;
employees and consultants from other business areas, as internal data processors.

The Data Controller may also request its service providers to carry out certain data processing operations on its behalf, acting as external data processors, in accordance with the instructions provided by the Data Controller and in line with this privacy policy.

6. Data retention period

The personal data held by the Data Controller will be retained solely for the time necessary to fulfil the purposes outlined above, and in any case to comply with legal retention obligations under civil, fiscal, and tax law, in accordance with the principle of storage limitation set out in Article 5(1)(e) of the GDPR.

7. Transfer of personal data to a third country or international organisation

Should RYKEM transfer personal data to countries outside the EU, it hereby undertakes as follows:

ensure an adequate level of protection by establishing appropriate safeguards and complying with the provisions of Regulation (EU) 2016/679;
manage the transfer of personal data on the basis of: a) adequacy decisions of the European Union; or b) standard contractual clauses or binding corporate rules; or c) a code of conduct approved by the relevant supervisory authority or official security certifications;
manage the transfer of personal data on the basis of the consent of the data subject whose data are to be transferred, or on the basis of the derogations under Article 49 of Regulation (EU) 2016/679 if the transfer cannot be carried out on the basis of the aforementioned points a), b), c).

8. Profiling activities and use of automated monitoring systems

Personal data will be acquired and processed without carrying out analyses aimed at profiling, understood as any form of automated processing of personal data consisting of the use of such data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning professional performance, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements of the said natural person.

The data controller will not use automated decision-making or monitoring systems for the purpose of providing relevant indications for the staff selection procedure. Should they be used in the future, the data controller will fulfil the further legally established information obligations.

9. Recognised rights and methods of exercise

In addition to the right to lodge a complaint with a supervisory authority, data subjects may exercise the following rights.

Art. 15 - Right of access. The data subject has the right to obtain from the data controller confirmation as to whether or not personal data concerning them is being processed, and, where that is the case, to obtain access to the personal data and information regarding the processing.
Art. 16 – Right of rectification. The data subject shall have the right to obtain, without undue delay, the rectification of inaccurate personal data concerning him or her. Taking into account the purposes of the processing, the data subject shall have the right to have incomplete personal data completed, including by means of providing a supplementary statement.
Article 17 – Right to erasure (right to be forgotten). The data subject has the right to obtain the erasure of personal data concerning him or her without undue delay, and the controller shall have the obligation to erase it without undue delay.
Art. 18 – Right to restriction of processing. The data subject has the right to obtain restriction of processing in any of the following cases: a) the accuracy of the personal data is contested by the data subject, for a period enabling the controller to verify the accuracy of the personal data; b) the processing is unlawful and the data subject opposes the erasure of the personal data and requests instead the restriction of their use; c) the controller no longer needs the personal data for the purposes of processing, but they are required by the data subject for the establishment, exercise or defence of legal claims; or d) the data subject has objected to processing pursuant to Article 21(1) of the Regulation pending the verification whether the legitimate grounds of the controller override those of the data subject.
Article 20 – Right to data portability. The data subject shall have the right to receive the personal data concerning him or her, which he or she has provided to a controller, in a structured, commonly used and machine-readable format and has the right to transmit such data to another controller without hindrance. Where feasible technically, the data subject shall have the right to have the personal data transmitted directly from one controller to another.
Art. 21 – Right to object. The data subject shall have the right to object, on grounds relating to his or her particular situation, at any time to the processing of personal data concerning him or her, including profiling based on those provisions.
Article 22 – Right not to be subject to automated decision-making, including profiling. The data subject has the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning them or similarly significantly affects them.

The rights may be exercised by making a request directly to the Data Controller, who can be contacted at the addresses given in point 2.

If the data subject should encounter any anomalies or violations regarding the processing of personal data, they have the right to contact the Italian Data Protection Authority (Garante per la protezione dei dati personali)garanteprivacy.it) or to the European Data Protection Supervisor (edps.europa.eu).

10. Legal and contractual obligations or requirements necessary for the conclusion of a contract

Failure to provide the personal data requested for the purposes indicated above in points a), b), c), d) and e) may prevent users from using the Site and the services listed, whereas for point f) free and optional prior consent is requested from the data subject.

Milan, 23/07/2026
RYKEM S.r.l.