◆ Last updated: 9 July 2026
Privacy & Cookie Policy
This policy describes how the personal data of users who visit the website www.guug.it (the showcase site of the GUUG copy shop in Rome, Prati district) is processed, pursuant to EU Regulation 2016/679 (GDPR) and Italian Legislative Decree 196/2003 and subsequent amendments.
Privacy policy
If you have placed an order on shop.guug.it (e-commerce), the processing of order-related data is governed by the privacy policy published on that domain.
1. Data Controller
The Data Controller is GUUG SRL.
- Registered office: Via Città della Pieve 76, 00191 Rome (RM)
- Operational office: Via di Porta Castello 29, 00193 Rome (RM)
- VAT / Tax code: IT14172541006
- Email: stampa@guug.it
- Phone: +39 06 4424 0707
The Controller has not appointed a Data Protection Officer (DPO) as there is no such obligation under Art. 37 GDPR.
2. Types of Data Collected
The showcase site www.guug.it collects the following data:
a) Data provided voluntarily via the contact form Name, email address, phone number (optional) and the content of the message. Submission is handled by the Web3Forms service (see §4).
b) Files uploaded to the free PDF/A checker The PDF uploaded to /en/pdf-a-checker (which may contain personal data, for instance on a thesis title page) is analysed in memory on GUUG systems for the sole purpose of checking its PDF/A compliance, and is discarded as soon as the analysis ends, within seconds. It is not stored, its content is not read, and it is not used for any other purpose.
c) Browsing data Statistics collected with self-hosted Plausible Analytics (plausible.guug.it, on servers owned by GUUG SRL in Italy): fully anonymous, aggregated data, with no cookies and no tracking of the full IP address. Plausible does not identify individual users.
d) Technical logs Like any website, our systems record technical logs (IP address, user agent, requested page) needed for the security and proper operation of the service.
3. Purposes and Legal Basis of Processing
| Purpose | Legal basis |
|---|---|
| Responding to requests sent via the contact form | Consent of the data subject (Art. 6.1.a GDPR) and pre-contractual measures (Art. 6.1.b GDPR) |
| PDF/A check of the file uploaded by the user | Performance of the service requested by the data subject (Art. 6.1.b GDPR) |
| Anonymous and aggregated statistical analysis via Plausible | Legitimate interest of the Controller in improving the site (Art. 6.1.f GDPR); non-invasive processing that does not identify users |
| Site security and abuse prevention (technical logs) | Legitimate interest of the Controller (Art. 6.1.f GDPR) |
| Compliance with legal obligations (requests from authorities, if any) | Legal obligation (Art. 6.1.c GDPR) |
4. Data Recipients and Processors
Data is not disclosed, sold or used for marketing or profiling. It may be shared exclusively with providers acting as data processors under Art. 28 GDPR:
- Web3Forms (contact form delivery): receives the data entered in the form and forwards it to our email inbox. The provider declares GDPR compliance and automatically deletes submissions after a limited period (about 30 days).
- Cloudflare Inc. (content delivery and site protection network): processes visitors’ IP addresses in transit while providing the service.
- Competent authorities, exclusively upon a legitimate request under the law.
The site and its analytics are hosted on infrastructure owned by GUUG SRL in Italy.
5. Data Transfers outside the EU
Submitting the contact form via Web3Forms may involve transferring data to third countries (the service runs on US cloud infrastructure). The transfer relies on the safeguards provided by Arts. 45-46 GDPR: the EU-US Data Privacy Framework adequacy decision for certified providers, or the standard contractual clauses included in the provider’s data processing agreement.
Cloudflare Inc. is certified under the EU-US Data Privacy Framework (European Commission adequacy decision of 10 July 2023). Plausible Analytics is self-hosted on servers owned by GUUG SRL in Italy: no data leaves the EU.
6. Processing Methods and Retention Periods
- Contact form data: for the time needed to reply and, unless the data subject indicates otherwise, for a maximum of 24 months from the last interaction. On the Web3Forms platform, submissions are automatically deleted after about 30 days.
- PDF/A checker files: no retention — the file is discarded as soon as the analysis ends.
- Plausible statistics: in aggregated, anonymous form, for a maximum of 24 months.
- Technical logs: for the time strictly necessary for security purposes, normally no longer than 90 days.
Data is processed with IT tools, adopting technical and organisational measures adequate to ensure its security and confidentiality (HTTPS connection, restricted access, regularly updated infrastructure).
7. Rights of the Data Subject
Pursuant to Articles 15–22 GDPR, the data subject has the right to:
- Access their personal data and obtain a copy (Art. 15)
- Rectify inaccurate data or update incomplete data (Art. 16)
- Erase data (the "right to be forgotten"), in the cases provided for by law (Art. 17)
- Restrict processing (Art. 18)
- Data portability in a structured, commonly used and machine-readable format (Art. 20)
- Object to processing based on legitimate interest (Art. 21)
- Withdraw consent at any time, without affecting the lawfulness of processing based on consent given previously (Art. 7.3)
To exercise these rights, simply send a written request to stampa@guug.it.
The data subject also has the right to lodge a complaint with the Italian Data Protection Authority (Garante per la Protezione dei Dati Personali, www.garanteprivacy.it) if they believe that the processing of their data violates applicable law.
8. Changes to this Policy
The Controller reserves the right to amend this policy at any time. Any changes will be published on this page, indicating the date of the last update. We recommend consulting this section periodically.
Cookies: this site uses none
www.guug.it uses no cookies at all — no technical, statistical or profiling cookies — and no other form of on-device storage (localStorage) or fingerprinting. That is why there is no banner: there is nothing to ask consent for.
Browsing statistics are collected without cookies using self-hosted Plausible Analytics, in anonymous and aggregated form, as described above.
The online store shop.guug.it, where orders are placed, has its own privacy and cookie policy published on that domain.
◆ Keep exploring
Questions about your data?
To exercise your rights or for any clarification, write to us at stampa@guug.it or drop by the shop.