GDPR PRIVACY NOTICE (UPDATED)

Dear Data Subject,

If you provide your personal data to M&M Servizi Srls, we inform you that Regulation (EU) 2016/679 (GDPR) on the protection of natural persons with regard to the processing of personal data provides for the protection of individuals and other subjects in relation to such processing.

M&M Servizi Srls, as the Data Controller, pursuant to Article 13 of the GDPR, hereby provides you with the following information:

1. Purpose of Processing

Your personal data, including photos and documents, will be processed for the purpose of handling patient requests. This includes the management of bookings, communication with clinics, and related administrative processes.

2. Methods of Processing

The personal data provided will be processed in compliance with applicable legislation and the principles of lawfulness, fairness, transparency and confidentiality.
Processing may be carried out using both manual and electronic tools, ensuring appropriate security measures.

• Patient requests and data are transmitted to clinics via API synchronization of systems or by email.
• Payments are processed securely through REVOLUT BANK.
• Invoices for services are issued directly to the patient by the clinic.

The platform used for processing is encrypted, and the technical service provider is:
Squid Studio Srl – Oradea, Romania

3. Communication and Dissemination of Data

Within the limits of the purposes indicated above, personal data (including images and audiovisual content) may be:

• communicated to the relevant clinic to process the patient request
• published in promotional materials only if consent is granted
• disclosed through press releases, local newspapers or media channels only for promotional content

4. Data Controller and Data Processor (DPO)

The Data Controller is:
M&M Servizi Srls
Via G. Marconi 2178/2
45030 Pontecchio Polesine (RO) – Italy
VAT No. 01663570297

The Data Protection Responsible (Data Processor / DPO) is:
Squid Solutions Srl

5. Rights of the Data Subject

You may exercise your rights at any time, pursuant to Articles 15–22 and Article 34 of the GDPR, including:

• right of access
• right to rectification
• right to erasure (“right to be forgotten”)
• right to restriction of processing
• right to data portability
• right to object to processing

Requests may be addressed to the Data Controller.

6. Data Retention Period

Personal data will be retained only for the time necessary to achieve the purposes for which they are collected, in accordance with the principle of storage limitation (Article 5 GDPR), and/or for the time required by applicable legal obligations.

Data will be periodically reviewed to ensure they are not retained longer than necessary.

This notice may be updated periodically in accordance with regulatory changes.