Privacy Policy

Version 1.0

This policy applies to personal data collected through ritmotype.com during the Beta Phase of Ritmo Type. It will be updated at full launch to reflect any additional data flows.

This policy is issued pursuant to Art. 13 of Regulation (EU) 2016/679 (GDPR) and the Italian Personal Data Protection Code (Legislative Decree 196/2003, as amended by Legislative Decree 101/2018).

1. Data Controller

Identity. Ritmo Type c/o Archivio Tipografico, via Brindisi 13, 10152 Torino, Italy.

Contact. studio@ritmotype.com

DPO. For any data protection enquiry, contact studio@ritmotype.com.

2. Personal Data Collected

What we collect. Ritmo Type collects only the following personal data: name and email address, provided voluntarily by the user when requesting trial fonts or contacting Ritmo Type; IP address, logged automatically by the download system for the purposes described in Section 3.

Source. All data is collected directly from the data subject. No data is obtained from third parties.

Decision-making. No automated decision-making or profiling, within the meaning of Art. 22 GDPR, is carried out.

3. Purposes and Legal Bases

Beta management. Purpose: to allow download of trial font files and to send technical communications strictly related to their use during the Beta Phase (e.g. bug reports, updated versions, Beta Phase closure notice). Legal basis: Art. 6(1)(b) GDPR (performance of pre-contractual measures at the request of the data subject).

IP protection and IT security. Purpose: IP address logs are retained to allow Ritmo Type to ascertain, exercise, or defend its intellectual property rights and to ensure the IT security of the download infrastructure. Legal basis: Art. 6(1)(f) GDPR (legitimate interest of the controller). The processing is limited to what is strictly necessary for the stated purpose and does not override the interests or fundamental rights of the data subject.

4. Processing Methods and Security

Personal data is processed using computerised tools. Ritmo Type adopts appropriate technical and organisational measures to ensure a level of security appropriate to the risk, in accordance with Art. 32 GDPR.

Data is accessible only to persons within the organisation who need it to perform the purposes described in Section 3.

5. Data Transfers

Service providers. For the management of email communications and font downloads, Ritmo Type may use service providers acting as data processors under Art. 28 GDPR. Where such providers are located in third countries outside the European Economic Area (for example, Mailchimp / Intuit Inc., based in the United States), data transfers are carried out on the basis of Standard Contractual Clauses adopted by the European Commission pursuant to Art. 46(2)(c) GDPR.

A list of data processors is available upon request at studio@ritmotype.com.

No sale of data. Personal data is not sold, rented, or otherwise disclosed to third parties for their own commercial purposes.

6. Data Retention

Beta management data. Name and email address collected for Beta Phase management will be retained for the duration of the Beta Phase and for a period of twelve (12) months following its conclusion. This retention is carried out on the basis of Ritmo Type's legitimate interest to: (i) verify compliance with the Trial EULA; (ii) manage the transition of Beta users to commercial licensing; and (iii) conduct audits regarding any unauthorised use of Beta versions once the commercial Phase has commenced. Data will be deleted at the end of this period unless the user has separately consented to newsletter communications or an active legal proceeding requires further retention.

Newsletter data. Where consent has been given for marketing communications, name and email address will be retained until the user withdraws consent or requests erasure, whichever occurs first.

IP address logs. IP address logs retained for IP protection and IT security purposes will be stored for a maximum of 5 years from the date of the download, corresponding to the applicable limitation period for intellectual property claims under Italian law. Logs will be deleted at the end of this period unless an active legal proceeding requires their continued retention.

7. Rights of the Data Subject

Your rights. In accordance with Articles 15 to 22 GDPR, you have the right to:

• Access your personal data (Art. 15);
• Rectification of inaccurate or incomplete data (Art. 16);
• Erasure of your data where the processing is no longer necessary or lawful (Art. 17);
• Restriction of processing in the circumstances specified in Art. 18;
• Data portability in relation to data processed on the basis of consent or contract (Art. 20);
• Object to processing based on legitimate interest (Art. 21);
• Withdraw consent at any time, without affecting the lawfulness of processing before withdrawal (Art. 7(3)).

Exercising your rights. Send a written request to studio@ritmotype.com. We will respond within 30 days in accordance with Art. 12 GDPR.

Right to lodge a complaint. If you believe your rights under the GDPR have been infringed, you may lodge a complaint with the Italian supervisory authority:

Garante per la protezione dei dati personali Piazza Venezia 11, 00187 Roma, Italy garante@gpdp.it — www.garanteprivacy.it

You may also lodge a complaint with the supervisory authority of the EU Member State where you are habitually resident or where the alleged infringement occurred.

8. Changes to This Policy

This policy reflects the Beta Phase data flows only. Ritmo Type will publish an updated Privacy Policy prior to the full launch of ritmotype.com, covering any additional data collected through the purchase flow, website analytics, and other services. The updated policy will be made available on the website before any new processing begins.

Material changes to this policy will be communicated to existing Beta Phase users by email where feasible.