Version of the
Data controller and contact details
The data controller is Qualore S.r.l., VAT No. 03148761202, with its registered office at Via Nazario Sauro 29, Bologna. Its operational headquarters are at Via del Lavoro 71, Casalecchio di Reno (BO). Mystery Man is the brand used by Qualore for its customer experience evaluation services.
For enquiries and requests regarding personal data: info@mysteryman.it, telephone +39 051 0566 780.
What activities does this refer to?
This privacy notice applies to the public Mystery Man website, the commercial enquiry form, correspondence initiated by its contacts and embedded external content. Applications, assignments and the viewing of results on the portal require the information provided during the relevant process. The public demonstration screenshots contain fictitious data and observations.
Data, purposes and legal bases
- Commercial enquiries. We process first name and surname, company or organisation, email address, telephone number (if provided) and the content of the message in order to reply, explore requirements in greater depth and prepare a potential project. The legal basis is the performance of pre-contractual measures requested by the data subject (Article 6(1)(b) of the GDPR); for contacts acting on behalf of an organisation, the legitimate interest in managing professional relationships (Article 6(1)(f)).
- Operation and security. The hosting systems may record IP addresses, date and time, requested resources, status and browser information. The form also uses session controls and attempt limits to prevent abuse. The legal basis is the legitimate interest in the security and continuity of the website (Article 6(1)(f)).
- Obligations and protection of rights. The relevant data may be processed to comply with applicable legal obligations (Article 6(1)(c)) and to establish, exercise or defend a legal claim (Article 6(1)(f)).
- External content. The optional loading of Soro and Google Maps takes place following a specific choice by the user. The basis for the loading of these and other non-essential tools is consent (Art. 6.1.a), which can be withdrawn via the settings.
Mandatory fields are indicated on the form; without the required details, it cannot be submitted. The telephone number is optional. The tickbox for the privacy notice confirms that you have read it: it does not constitute consent to receive advertising or newsletters. The form does not subscribe you to promotional communications. Please enter only information relevant to your enquiry, avoiding sensitive data or unnecessary third-party details.
Methods and target audience
Requests are sent via email and handled by persons authorised by Qualore. Hosting, email, maintenance and IT support providers may access the data within the scope of their respective duties; when they process data on behalf of the data controller, the arrangement requires the safeguards set out in Article 28 of the GDPR. The website uses Aruba hosting. Data may also be disclosed to professionals or authorities where necessary for the purposes indicated.
Mystery Beach enquiries submitted via this form are directed to Qualore. The partnership with certificazionispiagge.it does not trigger an automatic forwarding to the partner. Clicking on an external link will take you to another website, subject to its own privacy policy.
Statistics using Google Analytics
The website is set up to use Google Analytics 4, a service provided by Google Ireland Limited, to understand which pages are visited and to improve content. Once the service is configured, it is only activated after consent has been given for the ‘Statistics’ category (Article 6(1)(a) of the GDPR). Before consent is given or after it is refused, the website does not load the Analytics tag and does not send data to Google Analytics.
With consent, Google may process cookie identifiers, pages visited, browsing events and technical information about the device and browser. The site does not intentionally send names, email addresses or form submissions to Google Analytics. The website’s configuration denies consent to advertising and disables Google Signals and ad personalisation signals. The retention periods for data in Google’s systems depend on the Analytics property settings; you may request further information from the data controller. For details of the service and any data transfers, please refer to the Google’s privacy policy and the Information on data protection in Analytics.
You can withdraw your consent at any time via ‘Cookie Preferences’ in the footer. Withdrawal will prevent further tracking and delete Analytics cookies accessible on this domain; it does not automatically delete data already received by Google. You can still browse the site and submit enquiries even if you opt out of analytics tracking.
External services and transfers
Soro displays in-depth information via a service provided by Digimeri OÜ, Tallinn, Estonia. Once enabled, the browser contacts the service and retrieves the resources required for its content, transmitting connection data such as IP addresses and browser information. The provider describes the use of infrastructure located outside the EEA and the relevant safeguards in its Soro privacy policy.
Google Maps only displays the map once you have chosen to load it. Google may receive technical data and use cookies or identifiers in accordance with its own settings and, where applicable, your account. For users in the EEA, the designated provider is Google Ireland Limited. Data processing, storage and transfers are described in Google’s privacy policy.
External services may involve processing outside the EEA. The applicable safeguards, such as adequacy decisions or standard contractual clauses, depend on the recipient and the service; information on safeguards relating to processing on behalf of Qualore may be requested from the data controller. You may use the pages of the website and contact us without enabling this content.
Retention
Enquiries and correspondence are retained for as long as necessary to manage the contact and any subsequent developments, taking into account the subject of the enquiry, the most recent exchange and the existence of a relationship or a dispute. If a contractual relationship arises, the relevant retention obligations also apply. The form does not create a public archive of messages.
The anti-spam counter, associated with an IP fingerprint, is stored in a temporary file on the server, is valid for 10 minutes and is removed during requests following its expiry. The form token expires after 30 minutes; session data is deleted according to the hosting PHP configuration. Preferences regarding statistics and external content are retained for six months. For hosting logs and backups, the retention periods set out in the service configuration and agreements apply; the data controller can provide specific information on request.
Your rights
Where applicable, you may request access to, rectification, erasure, restriction of processing and data portability; you may object to processing based on legitimate interest and withdraw your consent, without affecting the lawfulness of processing carried out prior to such withdrawal. Please write to info@mysteryman.it. You may lodge a complaint with the Data Protection Authority. The form does not carry out automated decision-making with legal or similarly significant effects.
For details on browser tools, please see the cookie policy. Legal reference: Regulation (EU) 2016/679.