Last updated: 2026
This Privacy Policy describes how Chiara Tognetti Rights Agency ("we", "us", or "our") collects, uses, and discloses your personal data when you interact with us, purchase our B2B services, or use our website www.ctrights.com.
As a Business-to-Business (B2B) company, we primarily interact with corporate entities. However, we collect and process personal data belonging to individuals who represent, work for, or act on behalf of our corporate clients, suppliers, and partners.
1. DATA CONTROLLER
The Data Controller responsible for your personal data under the EU General Data Protection Regulation (GDPR) is:
Data Controller: Chiara Tognetti
Trading Name: Chiara Tognetti Rights Agency
VAT Number / Fiscal Code: IT 11606400965
Contact Email: chairs.tognetti@ctrights.com
2. TYPES OF PERSONAL DATA WE COLLECT
We only collect personal data necessary to establish and manage our business relationships. This includes:
Contact Information: Name, surname, professional email address, phone number, and job title.
Company Information: Business name, registered address, billing details, VAT number, and payment information (which may contain personal data in the case of sole traders or individual consultants).
Communication Data: Content of emails, chat logs, or contact forms filled out on our website.
Browsing and Technical Data: IP address, browser type, operating system, and data collected via cookies (Gmail Site Cookie Policy).
3. PURPOSES AND LEGAL BASES OF PROCESSING
We process personal data based on the following legal grounds provided by the GDPR:
Performance of a Contract (Art. 6(1)(b) GDPR): To manage quotes, process orders, deliver services, provide customer support, and fulfill contractual obligations.
Legal Obligation (Art. 6(1)(c) GDPR): To comply with Italian and EU laws, including tax, accounting, and anti-money laundering regulations.
Legitimate Interest (Art. 6(1)(f) GDPR): To manage B2B relations, improve our services, ensure network and information security, and perform direct B2B marketing (e.g., sending relevant industry updates or product news to corporate contacts, subject to your right to opt-out).
Consent (Art. 6(1)(a) GDPR): Where explicitly requested, such as for specific marketing campaigns or newsletter subscriptions.
4. DATA RETENTION
We retain personal data only for as long as necessary to fulfill the purposes for which it was collected:
Contractual and Billing Data: Retained for 10 years from the termination of the contract, in compliance with Italian statutory tax and civil laws.
B2B Marketing Data: Retained until you request to opt-out or object to the processing.
5. RECIPIENTS OF PERSONAL DATA
Your data may be shared with trusted third-party service providers acting as Data Processors (Responsabili del Trattamento), including:
IT, cloud hosting, and CRM software providers.
Banking institutions, payment processors, and shipping/logistics companies.
Professional advisors (accountants, legal counsel, auditors).
Public authorities or law enforcement agencies when required by law.
And Trusted Third-parties in one or more of the following cases:
· Fulfill a Contract (Contractual Necessity)
· To Outsource Core Business Operations (Data Processors)
· To Comply with Legal Obligations
· Based on Legitimate Interest
· When the User Gives Explicit Consent
6. INTERNATIONAL DATA TRANSFERS (EXTRA-EU)
Because our business operates within Italy and the EU, but may utilize global services, your data may be transferred to countries outside the European Economic Area (EEA), such as the United States.
When transferring data outside the EU/EEA, we ensure a high level of protection by relying on:
Adequacy Decisions adopted by the European Commission (e.g., the EU-U.S. Data Privacy Framework).
Standard Contractual Clauses (SCCs) approved by the European Commission, combined with supplementary technical and organizational security measures where necessary.
7. YOUR RIGHTS UNDER THE GDPR
As an individual, you hold the following rights regarding your personal data:
Right of Access: Request a copy of the personal data we hold about you.
Right to Rectification: Request correction of inaccurate or incomplete data.
Right to Erasure ("Right to be Forgotten"): Request deletion of your data under specific conditions.
Right to Restriction: Request that we limit the processing of your data.
Right to Data Portability: Receive your data in a structured, machine-readable format.
Right to Object: Object to the processing of your data, particularly for direct marketing purposes.
To exercise any of these rights, please contact us at chiara.tognetti@ctrights.com. You also have the right to lodge a complaint with a supervisory authority, such as the Italian Data Protection Authority (Garante per la protezione dei dati personali - www.garanteprivacy.it).
8. AMENDMENTS
We reserve the right to update this Privacy Policy at any time to reflect changes in our practices or legal obligations. The updated version will be effective as soon as it is posted on our website.