Privacy Policy

Versions 1.0 (effective from 12 July 2026), 1.1 and 1.2 (effective from 19 September 2026), 1.3 (effective from 2 October 2026), 1.4 (effective from 10 October 2026), 1.5 (effective from 18 October 2026), 1.6 (effective from 20 October 2026) and 1.7 (effective from 22 October 2026) remain retained as historical records and may be requested from the Controller.

1. Data Controller

The data controller is:

Battaglia Alessandro – sole proprietorship (impresa individuale) Registered office: Viale Paolo Onorato Vigliani 17, 20148 Milan (MI), Italy VAT number: 14248220965 Tax code and Business Register registration number: BTTLSN95E03F205E REA: MI – 2769967 Companies Register of Milan Monza Brianza Lodi Certified email (PEC): alessandro.battaglia@pec.fiscozen.it Email for privacy requests and breach notifications: a.battaglia@dentalphotovideo.it Email for orders, support and revisions: info@dentalphotovideo.it

"Dental Photo & Video" is the trade name of the website dentalphotovideo.it and its related services and does not constitute a legal entity distinct from Battaglia Alessandro.

No Data Protection Officer (DPO) has been appointed, as the conditions requiring mandatory appointment under Article 37 GDPR are not met. All requests may be addressed to the contacts indicated above.

2. Scope of this policy

This policy describes the processing of personal data carried out by the Controller in its capacity as data controller, in relation to:

• browsing of the dentalphotovideo.it website; • the creation and management of the customer account; • requests for information and quotes; • the purchase and performance of post-production services; • tax and administrative obligations; • the optional subscription to the newsletter (e-mail address, language and evidence of consent); • measurement, with prior Marketing consent, of visits and advertising campaigns through Meta Pixel.

Any personal data that may be contained in the Professional and clinical materials transmitted by the Client (photographs, videos, clinical case documentation) is processed by the Controller in its capacity as data processor on behalf of the Client: in that case, the Data Processing Agreement pursuant to Article 28 GDPR applies (see paragraph 9).

3. Browsing data and technical security

Data processed: IP address, date and time of the request, requested page, outcome of the request, browser type and operating system, technical session information, hosting infrastructure logs and security logs.

Purpose: technical delivery of the website, service stability, prevention of abuse, fraud and unauthorised access, error diagnostics.

Legal basis: the Controller's legitimate interest in the security and proper functioning of the website and services (Article 6(1)(f) GDPR); for strictly necessary cookies and technologies, the performance of the service requested by the user.

Retention: technical and security logs are retained for the time strictly necessary for the stated purposes, generally not exceeding 12 months, save for the need to retain data for legal defence or statutory obligations.

Language and localisation: to automatically suggest the website's language, the Controller uses solely the country information, if any, already present in the request headers managed by the hosting infrastructure. No external geolocation services are used and no user profile is created.

Optional tools are activated only with prior consent: Google Analytics 4 belongs to the Analytics category, which also covers the technical access notification via Telegram; Meta Pixel belongs to the Marketing category. Analytics and Marketing consent are independent and can be selected and withdrawn separately. Please refer to the Cookie Policy.

Usage statistics (Google Analytics 4) — consent only

Purpose: to measure, in aggregate form, how the website is used (pages visited, services viewed, items added to cart, checkout started, completed purchases, newsletter sign-ups and contact form submissions) in order to improve its content and operation.

Data processed: online identifiers and technical data collected by Google Analytics, such as a pseudonymous browser identifier stored in the _ga and _ga_* cookies, IP address (which Google states it does not log or store in GA4), device and browser type, language, approximate geographic area, pages visited and the interactions listed above. For purchases, only the order number, amounts and type of service are sent. The following are not sent: name, email, phone, practice details, tax data, order notes, Materials or clinical data; the User-ID feature is not used and no advertising features, Google Signals or remarketing are enabled.

Legal basis: the user's consent (Article 6(1)(a) GDPR and Article 122 of the Italian Privacy Code), given through the banner or the Cookie preferences page. Before consent, the Google Analytics script is not loaded. Consent is optional, refusal does not affect use of the website, and it can be withdrawn at any time from the Cookie preferences page.

Recipient: Google Ireland Limited, acting as processor on behalf of the Controller under Google's data processing terms; data may also be processed by Google LLC and other group companies, including in the United States (see section 12).

Retention: the _ga/_ga_* cookies last up to 2 years; event-level data is kept in Google Analytics for the period set by the Controller, not exceeding 14 months.

Advertising measurement (Meta Pixel) — Marketing consent only

Purpose: to measure visits from advertising campaigns and campaign performance on the website's public commercial pages and on /assessment.

Possible Pixel data: pseudonymous online identifiers, the _fbp cookie and, where present, _fbc, technical browser and device data, IP address, referrer and visited page, as part of the normal technical request to Meta.

Configuration and minimisation: the website sends the standard PageView and Lead events, both without custom parameters. PageView measures views of allowlisted public commercial pages, including /assessment. Lead is sent only after completion of the Assessment and successful server acceptance of the request/report form: it indicates completion/successful submission only. Lead contains no name, email, telephone, profession, answers, results, fit, callback request, newsletter checkbox, clinical photographs, patient data or health data. Advanced Matching, automatic form tracking, automatic event setup and automatic Meta events are not used. No form or Assessment data is intentionally sent to Meta. The assessment does not place answers or results in the URL.

Separate consent choices: the Assessment form's marketing/newsletter checkbox is separate from Marketing cookie consent and does not control the Meta Pixel; PageView and Lead depend exclusively on Marketing cookie consent.

Legal basis: the user's Marketing consent (Article 6(1)(a) GDPR and Article 122 of the Italian Privacy Code), given through the banner or Cookie preferences page. The Pixel is not loaded before Marketing consent. Consent is optional and refusal does not prevent use of the website.

Recipient: Meta Platforms Ireland Limited; see section 12 for possible international transfers.

Withdrawal: consent may be withdrawn at any time from the Cookie preferences page. Withdrawal stops events, attempts to delete first-party Meta cookies where technically possible and, if the Pixel has already loaded, reloads the page without the Pixel.

Technology duration: please refer to the Cookie Policy.

Technical access notification via Telegram — consent only

Purpose: to inform the Controller, technically, that the website has been accessed, without profiling or marketing purposes.

Data processed: the message sent by the website server contains only the public path of the landing page (without query parameters or fragments). The application does not send IP address, user-agent, referrer, email or user identifiers to Telegram and creates no internal database for this feature. The sessionStorage key telegram_notified is set in the browser, only after consent and until the tab/session is closed, to avoid duplicate notifications. The website infrastructure may still process the ordinary technical connection data described in this section.

Legal basis: the user's consent (Article 6(1)(a) GDPR), given through the same analytics consent and withdrawable at any time from the Cookie preferences page.

Recipient: Telegram, limited to receiving and delivering to the Controller the technical message described above.

4. Account and customer profile data

Data processed: email address, credentials managed in encrypted form by the authentication service, first and last name of the contact person, name of the company, practice or professional name, country, telephone number (optional), preferred language, technical account identifiers, profile creation and update date, application role (customer or administrator).

In case of registration or sign-in via Google, the Controller receives from the provider the account identifier, email address, email verification status and, if available, the profile name and picture (requested scopes: openid, email, profile). The Controller does not access other contents of the Google account.

Purpose: creation and authentication of the account, management of the reserved area, verification of the professional nature of the purchase, performance of the contract, support, access security.

Legal basis: performance of pre-contractual measures and of the contract (Article 6(1)(b) GDPR); legitimate interest in access security (Article 6(1)(f) GDPR).

Nature of provision: data marked as necessary are indispensable to create the account and conclude the purchase; failure to provide them prevents the delivery of the service. The telephone number is optional.

Tax and billing data: as the service is strictly B2B, tax and billing data (company name, address, VAT number or tax code, province, SDI recipient code or PEC) may be requested already at registration or when completing the profile, so that the invoice can subsequently be issued. The related processing is described in paragraph 8.

Service communications (transactional emails): for email address confirmation, sign-in, account recovery, address change and order confirmation, the Controller sends transactional communications through the email infrastructure of the application platform (Lovable) and its sending sub-providers, using the technical domain notify.dentalphotovideo.it and the sender noreply@dentalphotovideo.it. The data processed are the email address, minimal account data and, for the order confirmation, the order number, the summary of services and any add-ons with quantities and amounts, and the total. No clinical Materials and no health data are included in the emails. Legal basis: performance of the contract and of pre-contractual measures (Article 6(1)(b) GDPR) and legitimate interest in access security (Article 6(1)(f) GDPR).

Retention: for the duration of the relationship and, thereafter, for the time necessary to manage obligations, disputes and liabilities, generally not exceeding 10 years from the end of the relationship for the relevant documentary part. The account may be deleted upon request, except for data that must be retained for statutory obligations or for the defence of rights.

5. Contact data, requests for information and quotes

Data processed: identification and contact data spontaneously provided (name, email, telephone, company or practice, country) and the content of the communication, including any technical information about the project.

Purpose: responding to requests, preparing quotes, managing the pre-contractual phase.

Legal basis: performance of pre-contractual measures requested by the data subject (Article 6(1)(b) GDPR) and, for communications not aimed at a purchase, legitimate interest in responding to received requests (Article 6(1)(f) GDPR).

Retention: 24 months from the last relevant contact, unless the request develops into a contractual relationship, in which case the terms of paragraph 7 apply.

The Controller invites users not to include patients' personal data, clinical images or health data in requests for information and in quotes. Such content must only be transmitted within the scope of an active project and through the secure channels indicated by the Provider.

5-bis. Online assessment (/assessment)

Purpose: letting professionals and organisations complete an indicative questionnaire on clinical photography, post-production, video, events and training and receive recommendations generated deterministically from their answers. The report can be viewed and printed without providing personal data.

Data processed if you request the report by email: first name, email, optional practice/company and professional website or social profile, questionnaire answers (predefined options), language, optional callback request, optional marketing consent, date/time and privacy notice version. Clinical images or patient data are neither requested nor accepted; please do not include them.

Legal basis: pre-contractual steps at your request (Art. 6(1)(b) GDPR) for sending the report and any callback you request; separate, optional consent (Art. 6(1)(a)) for the newsletter. Requesting the report is not marketing consent.

How: the report is emailed via Brevo from info@dentalphotovideo.it; the Controller receives a summary of the request at info@dentalphotovideo.it for any follow-up you requested. Contact data and professional assessment answers, together with the indicative profile, are also stored in Brevo CRM to follow up on the request, for up to 24 months from the last interaction. This storage is not marketing authorisation or newsletter subscription, which requires separate consent; it does not change existing unsubscribes. Recommendations are indicative and produce no decisions with legal or similarly significant effects.

Retention: up to 24 months from the last interaction, as for contact requests, unless a contractual relationship follows. Usage statistics (GA4) are collected only with cookie consent and never include answers or email addresses.

6. Data required for checkout and payment

Data processed by the Controller: order data (services purchased, quantities, prices, any options), Client's email and name, country, currency, language, payment status, technical identifiers of the payment session and of the transaction, transaction outcome, any refund.

Payment data: card and payment instrument data are collected and processed directly by Stripe, which acts as an independent controller for the purposes of fraud prevention and compliance with its own obligations, and as the provider of the payment service on behalf of the Controller. The Controller does not receive and does not store the full card number, the security code or the payment credentials: the payment form is hosted by Stripe and is loaded only when the user starts the checkout process.

Purpose: conclusion and performance of the contract, collection of payment, management of refunds and disputes, fraud prevention.

Legal basis: performance of the contract (Article 6(1)(b) GDPR); statutory obligations (Article 6(1)(c) GDPR); legitimate interest in fraud prevention and in the protection of its own rights (Article 6(1)(f) GDPR).

Retention: order and transaction data are retained for 10 years, consistent with tax obligations and ordinary limitation periods.

7. Data relating to orders, contractual acceptances and proof of consent

Data processed: order number and status, project event history, type of acceptance given (general B2B acceptance, specific approval of clauses pursuant to Articles 1341 and 1342 of the Italian Civil Code, any marketing consent), version of the document and of the accepted text, copy of the text shown at the time of acceptance, language, date and time, reference to the account and to the order and, where technically collected in compliance with applicable law, IP address and user agent.

Purpose: demonstrating the conclusion of the contract and the content accepted, fulfilling the burden of proof of acceptances and consents, managing disputes.

Legal basis: performance of the contract (Article 6(1)(b) GDPR); statutory obligation and the accountability principle, including pursuant to Article 7(1) GDPR for proof of consent (Article 6(1)(c) GDPR); legitimate interest in the defence of its own rights (Article 6(1)(f) GDPR).

Retention: 10 years from the conclusion of the order. Acceptance records are protected by access controls, operation traceability and measures against unauthorised modification, and are not deleted upon simple request, as they are necessary to demonstrate compliance with statutory obligations and the defence of rights.

8. Tax and administrative data

Data processed: company name, billing address, VAT number, tax code, SDI recipient code or PEC, invoice data, payments, credit notes, administrative correspondence.

Purpose: issuance and retention of invoices, electronic invoicing, accounting, tax and anti-money-laundering compliance where applicable.

Legal basis: statutory obligation (Article 6(1)(c) GDPR) and performance of the contract (Article 6(1)(b) GDPR).

Retention: 10 years pursuant to civil and tax law, save for longer periods in the event of audits or disputes.

For invoicing and administrative compliance, the Controller uses the FattureWeb di Sistemi service, which acts as a data processor.

9. Professional and clinical materials

When the Client transmits Materials (photographs, videos, audio, radiographs, clinical case documentation, texts) for the performance of the Service, such Materials may contain personal data and health data relating to patients or other data subjects.

In relation to such data:

• the Client generally remains the data controller and is responsible for the lawfulness of the collection, for the legal bases, for the notices and for any authorisations or consents required; • the Controller of this policy acts as data processor on behalf of the Client, exclusively on the basis of the documented instructions received; • the processing is governed by the Data Processing Agreement pursuant to Article 28 GDPR published on the website, which defines its subject matter, nature, purposes, security measures, sub-processors, duration and deletion obligations; • the Materials are not used for the Provider's own purposes, nor for training artificial intelligence systems, nor for marketing purposes, save for a separate written agreement for portfolio use with content rendered non-identifiable or expressly authorised; • the transfer and delivery of files takes place via SwissTransfer (a service of Infomaniak Network SA, Switzerland) or another secure channel expressly indicated in writing. SwissTransfer is a temporary transfer service and does not constitute an archive: the six-month retention of Materials and Final files from final delivery is carried out by the Controller on its own systems, not by the transfer service; • processing is carried out using professional software installed locally (for example Adobe and DaVinci Resolve), as provided for in the Agreement under Article 28.

Retention: Materials, Final files and Project files are generally retained for six months from final delivery. An extended retention service for a further 12 months per project may be purchased, either at the time of the order or also at a later time provided the files have not already been deleted, at the price published on the website and renewable for successive 12-month periods. Before the expiry of the active period the Controller endeavours to send a warning email regarding the forthcoming expiry and the subsequent deletion of the files; sending is not automated and is not guaranteed. The Customer may in any case purchase a further 12-month period before expiry, provided that the files have not already been deleted. There is no automatic renewal, and the warning email is a courtesy communication: failure to receive it for reasons not attributable to the Controller does not extend retention. For projects archived due to inactivity, the specific rules set out in the B2B General Terms and Conditions of Sale apply. Once the applicable period has expired, files may be irreversibly deleted; after deletion, recovery is not guaranteed and extended retention can no longer be purchased for that material. The Customer remains responsible for its own backup.

Minors: the website and services are intended exclusively for professional subjects and are not directed at minors. The Controller does not knowingly collect data of minors through the website. Any images or data relating to minor patients contained in the Materials are the Client's data, processed exclusively within the scope of the Agreement under Article 28 GDPR and under the Client's responsibility as regards notices and authorisations.

10. Newsletter and commercial communications

Data processed: e-mail address, language and subscription source (homepage or website footer); date, time and version of the consent text; any withdrawal date; technical unsubscribe identifier. No other data is requested.

Purposes: sending the Dental Photo & Video newsletter, with informational and educational content on photography, video and post-production in dentistry, service news and promotional communications of the Controller, including occasional sponsored communications relating to products, services, software, training and events aimed at dental professionals.

Status of the service as at the date of this version: the newsletter service is active. Subscription is optional and takes place through the form available on the website, with a separate, non-pre-ticked consent checkbox.

Sponsored content: any sponsored communications are sent exclusively by the Controller, who remains the sender and the data controller. Subscribers' e-mail addresses and other data are not disclosed, transferred or made accessible to sponsors or to any other third party for their own marketing purposes.

Legal basis: free, specific, optional and revocable consent (Article 6.1.a GDPR and Article 130 of the Italian Data Protection Code), collected through a separate, non-pre-ticked checkbox, distinct from contractual acceptances. Refusal does not prevent account registration, the purchase of the services or any other use of the website.

Sending provider: communications are sent through Brevo (Sendinblue SAS, France), appointed as data processor, to which only the data necessary for sending is disclosed (e-mail address, language and subscription status). Subscription takes place through a first-party form on the website: no third-party scripts, cookies or trackers are installed for the newsletter.

Use of Brevo for the contact form: as of the date of this version, Brevo is also used to forward to the Controller (info@dentalphotovideo.it) the messages sent through the website contact form and to send the automatic confirmation reply to the requester. The form data transmitted via Brevo is: name, practice or company name if provided, country if provided, e-mail address, requested service if provided, message text if present and language. The automatic reply contains only the name, e-mail address and a standard confirmation text. This processing is separate from the application infrastructure (Lovable) used for authentication and orders. The invitation not to include patient data, clinical images or health data in the contact form remains unchanged.

Withdrawal: consent may be withdrawn at any time through the unsubscribe link included in every communication or by writing to a.battaglia@dentalphotovideo.it. Withdrawal does not affect the lawfulness of processing carried out before it. Unsubscribes and sending suppressions are also managed through the sending provider's own functions.

Retention: contact data is processed until consent is withdrawn or the service ceases; evidence of consent and of its withdrawal is retained for as long as necessary to demonstrate the lawfulness of the processing, as a rule 10 years.

No profiling of subscribers and no automated decision-making take place.

11. Recipients and providers

Data may be processed by authorised persons and by providers appointed as data processors pursuant to Article 28 GDPR, limited to what is necessary:

Data may also be disclosed to tax, legal and administrative consultants, to public authorities in the cases provided for by law, and to parties involved in any proceedings for the defence of rights.

Data is not sold, transferred for third-party marketing purposes, nor disseminated.

12. Transfers to third countries

The Controller gives preference to providers processing data within the European Union or the European Economic Area.

Some of the providers indicated above may involve processing or access from third countries, in particular from the United States. In such cases, the transfer takes place exclusively on the basis of the safeguards provided for by Chapter V of the GDPR, including:

• adequacy decisions of the European Commission, where applicable; • standard contractual clauses adopted by the European Commission; • for Google Analytics, Google LLC's participation in the EU-U.S. Data Privacy Framework, where applicable, and the standard contractual clauses included in Google's terms; • for Meta Pixel, the safeguards provided for in Meta's terms, including, where applicable, adequacy decisions and the Data Privacy Framework and/or standard contractual clauses (SCC); exclusive data localisation within the European Union is not guaranteed; • supplementary technical and organisational measures, such as encryption and minimisation.

A copy of, or information on, the applicable safeguards may be requested by writing to a.battaglia@dentalphotovideo.it.

For clinical Materials, sub-processors and the related localisation constraints are governed by the Agreement under Article 28 GDPR.

13. Security

The Controller adopts technical and organisational measures appropriate to the risk, including access authentication, encryption of transmission channels, database access control through row-level security rules, minimisation of the data collected, acceptance records protected by access controls, traceability and measures against unauthorised modification, system updates and incident management procedures. The measures applicable to clinical Materials are detailed in the Agreement under Article 28 GDPR.

14. Absence of automated decision-making

The Controller does not use website data for automated decisions under Article 22 GDPR. Any advertising measurement through Meta Pixel takes place only with prior Marketing consent and is not used by the Controller for decisions producing legal effects or similarly significantly affecting data subjects.

15. Data subjects' rights

The data subject may exercise at any time the rights provided for in Articles 15-22 GDPR:

• access to data and information on the processing; • rectification of inaccurate or incomplete data; • erasure, within the limits provided for by law; • restriction of processing; • portability of data processed on the basis of the contract or of consent, by automated means; • objection to processing based on legitimate interest; • withdrawal of consent at any time, without prejudice to the lawfulness of processing carried out before the withdrawal.

Requests may be sent to a.battaglia@dentalphotovideo.it or to the certified email address alessandro.battaglia@pec.fiscozen.it. The Controller shall respond without undue delay and in any case within one month, extendable in the cases provided for.

Some data cannot be deleted upon request when retention is necessary to comply with statutory obligations, in particular tax obligations, or for proof of contractual acceptances and the defence of rights.

When the Controller processes data contained in the Materials on behalf of the Client, data subjects' requests must be addressed to the Client as data controller; the Controller provides its assistance in accordance with the Agreement under Article 28 GDPR.

Complaint: the data subject may lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, www.garanteprivacy.it) or with the supervisory authority of their State of residence, as well as bring proceedings before a judicial authority.

16. Updates to this policy

This policy may be updated for regulatory, organisational or technical reasons. The current version is always published on the website with an indication of the version and effective date.

Should new purposes or technologies requiring consent be introduced, the policy will be updated and the relevant consent collection mechanism will be put in place before such technologies are activated.

This English version is a courtesy translation provided for convenience only. In the event of any discrepancy or inconsistency between this English version and the Italian original, the Italian version shall prevail.