PRIVACY POLICY

Privacy policy pursuant to Article 13 of EU Regulation 2016/679

The following describes the methods of managing the GIESSEGI website in relation to the processing of the personal data of users who consult it.
GIESSEGI (hereinafter GIESSEGI) is aware of the importance of protecting the confidentiality of personal data and is committed to complying with the current privacy directives and regulations that guarantee safe and confidential internet browsing.
Users of the website www.giessegi.it (the “website”) are asked to carefully read this privacy policy document which generally governs the rules that GIESSEGI observes in processing the personal data provided by users when browsing the website, as well as the use of the registration and contact forms therein.
This privacy policy is provided pursuant to Article 13 of EU Regulation 2016/679 (GDPR) regarding the protection of personal data of those who interact with the GIESSEGI website accessible via the internet at www.giessegi.it. This privacy policy is also provided for all websites and services under the domain of www.giessegi.it and not for any other websites that may be consulted via links.
This privacy policy is also based on other applicable national and European regulations, including the ePrivacy Directive (Directive 2002/58/EC) concerning the processing of personal data and the protection of privacy in the electronic communications sector, to identify the minimum requirements for collecting personal data online.

THE DATA CONTROLLER

The “Data Controller” is GIESSEGI, Via Bramante, 39, Appignano (MC), email info@giessegi.it, PEC giessegispa@pec.it, telephone +39 0733 400811.

PRIVACY REPRESENTATIVE

GIESSEGI has identified a privacy representative who can be contacted at privacy@giessegi.it for any information regarding personal data processing.

GENERAL PRINCIPLES FOR THE PROCESSING OF PERSONAL DATA

The processing of personal data is based on the principles of lawfulness, fairness, transparency and limitation as regards the purposes and period of retention, as well as data minimisation, accuracy, integrity and confidentiality.
In particular, GIESSEGI undertakes to:

• process data solely for the purposes and according to the methods described in this privacy policy.
• process data for purposes for which prior consent from the data subject is required and only when an express authorisation to that effect has been given.
• respect anonymity, allowing anonymous browsing of the website in areas that do not require authentication, except for the automatic acquisition of browsing data.
• make data available to third parties solely for purposes required to provide the requested service or in other cases, where permitted by law, only when the data subject has given his or her consent.
• respect the rights of data subjects, responding to requests for erasure, modification, integration of the data provided, objection to the processing of data for the purposes of sending commercial and advertising information.
• ensure correct and lawful management of personal data, safeguarding the data subject’s right to confidentiality, as well as applying appropriate security measures to protect the confidentiality, integrity and availability of the processed data.
• ensure maximum transparency by accompanying each data collection action with specific information.
  

CATEGORIES OF PROCESSED DATA

“Personal data” means “any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person” (Article 4 of EU Regulation 2016/679).
Therefore, personal data includes the name, contact information and addresses, payment data, computer navigation identifiers, such as the data of the device used to access the website, the IP address, cookies and any other information relating to the website user that can be directly or indirectly deduced from the browsing activity.
Some of this data may come from, or be processed by, third parties used by the website to provide its services.

DATA PROVIDED VOLUNTARILY BY THE USER

The voluntary and explicit sending of email messages to the addresses indicated in the different access channels of the GIESSEGI website and the filling in of specifically designed forms entail the subsequent acquisition of the user’s address and data, required to respond to the requests produced and/or provide the requested service.
This data is sent on an optional, explicit and voluntary basis, and entails the subsequent acquisition of the sender’s address, which is necessary in order to respond to requests, and also of any other personal data entered.
GIESSEGI will process this data assuming that it refers to the user or to third parties who have expressly authorised the user to provide it on the basis of an appropriate legal basis that legitimises its processing. In this case, the user is an independent data controller and assumes all legal obligations and responsibilities, granting the broadest indemnity with respect to any dispute, claim, request for compensation for damages resulting from processing, etc. that may be received by GIESSEGI from third parties whose personal data has been processed through the use of the website in breach of current legislation.
GIESSEGI in any case, invites users not to send personal and/or confidential data unless strictly necessary: certain categories of personal data (for example, sensitive data) may only be processed with prior consent and with specific security measures aimed at ensuring the confidentiality and integrity of the data. GIESSEGI therefore emphasises the need to provide explicit consent to the processing of special categories of personal data, should the user decide to provide such information. Otherwise, the data will be erased immediately.
Therefore, unless it is expressly required, we ask users not to use the contact forms to transmit sensitive data and, if necessary, to agree to the transmission of such data in advance.
Specific summary information, containing the appropriate legal bases for processing, will be displayed on the website pages dedicated to particular services that require the submission of personal data.

CUSTOMER CARE

GIESSEGI processes the personal data provided by users or retailers when filing complaints or sending reports relating to purchased products. The data provided includes personal data (first name, surname, full address, telephone number, email address), the data of the retailer where the purchase was made (name and city), the product that is the subject of the complaint/report (year of purchase, type, model, finishes and colours, etc.), the nature of the problem (retailer, product, delivery, etc.), any additional information and attachments supplied by the user.
The data is necessary to satisfy the user’s request and will be retained until the request or report is closed. If it is necessary to fulfil retention obligations for contractual and/or tax purposes, the data will be retained for 10 years. It may subsequently be made anonymous and stored for statistical purposes.

BROWSING DATA

The IT systems and software procedures used to operate the website acquire some personal data items during normal operations whose transmission is implicit in the use of Internet communication protocols.
These items of information are not collected to be associated with identified data subject users but, by their very nature, they might allow users to be identified through processing procedures and associations with data held by third parties.
This data category includes IP addresses or domain names of the computer used by users visiting the website, URI (Uniform Resource Identifier) notation addresses of the requested resources, the time of the request, the method used to submit the request to the server, the size of the file obtained in response, the digital code indicating the status of the response given by the server (successful, error, etc.) the browser and operating system used and other parameters relating to the user’s operating system and IT environment, information on the clicks made and the pages shown to the user.
If a mobile device is used, the website collects data that identifies the device and other data regarding the device’s settings and characteristics, malfunctions (e.g. crashes), and other system activities.
This data is used solely to obtain statistical information not associated with any user identification data regarding the use of the website and to check that it is working properly. It is erased immediately after processing or within a few days. The data could be used to ascertain responsibility in the event of any hypothetical cyber crimes affecting the website.
This data is stored in the Data Controller’s systems or in those of the Data Processors responsible for managing the website.

PERSONAL AREA

The registration and website access options via the PERSONAL AREA features are available exclusively to distributors and agents. The information requested during registration will be used to allow access to the online “B2B” (Business To Business) services and to ensure the correct performance of all activities related or instrumental to the provision of these services.
The privacy policies for customers and suppliers apply to this kind of data processing and can be found in the relevant private areas and on the website’s privacy page

SYSTEM LOG

Accessing the website, consulting its contents, and using the services offered allows the web server to automatically record so-called “system logs” i.e. the information that the user’s browser sends while browsing the website. This information consists of the web pages requested by the user, the documents consulted, modified or created, the IP address, the browser type, the browser language, the date and time of the request.

SECURITY AND DEVELOPMENT

STATISTICAL DATA
Statistical analysis services allow the Data Controller to monitor and analyse traffic data, aimed at measuring the operation of the website for research purposes and assessments on usability and interest. This website uses Google Analytics, a service for statistical analysis of browsing activities, provided by Google Ireland Limited (EU) and Google LLC (USA).
On this website, Google Analytics is configured for the collection of anonymous and aggregate data by masking the IP address.
Google is, however, able to identify the user by using data provided when using other services, and could use personal data to contextualise and customise the ads of its advertising network.
Google Privacy policy: https://policies.google.com/privacy?hl=it and https://business.safety.google/privacy/
Google provides an add-on to disable the collection of data by Google Analytics (https://goo.gl/BdFny5).

Google Analytics uses the user’s personal data, including data provided to Google when registering for other services, for the purpose of tracking and examining the use of this website, compiling reports and sharing them with other services developed by Google.
Google may use your personal data to contextualise and customise the ads of its own advertising network.
Google provides an add-on to disable the collection of data by Google Analytics (https://goo.gl/BdFny5).
The data is processed in Europe and the United States, based on the standard contractual clauses approved by the European Commission. Google Privacy policy: https://policies.google.com/privacy?hl=it.

GOOGLE FONTS
Google Fonts is a font display service managed by Google LLC that allows fonts to be integrated into website pages. The service is used through API requests to Google servers and some data (such as IP addresses) may be collected and used for analytical purposes.
Learn more about how Google Fonts uses data: https://developers.google.com/fonts/faq/privacy?hl=it.
Google Privacy policy: https://policies.google.com/privacy?hl=it

GOOGLE TAG MANAGER
This website uses Google Tag Manager, a solution that allows us to manage web page tags through a dedicated interface. The Tag Manager tool does not collect any personal data. This tool ensures the activation of other tags that in turn acquire data under certain conditions (for example, Google Analytics services).

COMMERCIAL COMMUNICATIONS NEWSLETTER
The personal data collected when signing up to the newsletter is processed for the purpose of promoting and advertising our products and services, by means of sending commercial communications and informational and advertising materials via email.
This type of service allows GIESSEGI to manage a database of email contacts, telephone contacts or contacts of any other type, used to communicate with the user.
These services may also allow data to be collected relating to the date and time the messages were viewed by the user, as well as the user’s interaction with them, such as information on clicks on links included in the messages.
The user may at any time stop receiving commercial communications by using the cancellation tools available in the communications themselves or update their communication preferences, restricting or refusing them altogether.

INTERACTIONS WITH SOCIAL NETWORKS
GIESSEGI processes personal data provided by users through social media pages as part of its activities and for the purpose of managing interactions with users (comments, public posts, etc.) and in compliance with applicable legislation. As regards the processing of personal data by social media platform operators, one should refer to the information provided by them in their respective privacy policies.

DATA RELATING TO MINORS
The activities and services on this website are intended for adults. GIESSEGI does not accept registrations or orders placed by minors under 18 (eighteen) years of age nor will it intentionally collect or use their personal data. Minors are therefore advised not to transmit personal data via the website.

PROFILING THROUGH AUTOMATED PROCESSING OF PERSONAL DATA
Automated user profiling systems are active for the purpose of analysing or predicting aspects regarding the user’s browsing preferences.
These systems are provided by third parties and are based on the use of cookies or pixels and can be deactivated via cookie banners and the tracking tool management features on the website.
Third-party traffic analysis systems (Google Analytics) are also active and may use the user’s personal data to optimise and contextualise the advertising network’s advertisements.

COOKIE
This website uses cookies to offer its users the best possible experience on the website and to optimise their visit. Some types of cookies fall within the categories of tracking tools. For further details one should refer to the specific cookie policy https://www.giessegi.it/en/cookie-policy/

PURPOSE AND LEGAL BASIS OF THE DATA PROCESSING

Personal data voluntarily provided by website users is processed for various purposes, specified below, and for which consent may be required:

One or more consents given may be withdrawn at any time by contacting the Data Controller in the manner indicated for exercising one’s rights, at the end of this privacy policy.

PURPOSE OF THE PROCESSING OF BROWSING DATA AND SYSTEM LOGS

Personal data, the transmission of which is implicit in the use of Internet communication protocols, and the system logs are processed solely to obtain statistical information on the use of the website, to check its correct functioning, and to protect the IT systems that enable its operation.
This data, such as the user’s IP address, could also be used to ascertain responsibility in the event of any hypothetical cyber crimes affecting the website.

OBLIGATION OR OPTION TO PROVIDE DATA

Aside from what is specified above regarding browsing data, the user is free to provide personal data in the online contact forms or during the registration procedures. Failure to provide such data may make it impossible to obtain what is requested or to perform certain services, as specified below with reference to the aforementioned purposes:

1. MANAGEMENT OF REQUESTS AND PROVISION OF SERVICES, the provision of data (which may be marked as required in the online contact forms) is necessary to achieve the purposes referred to in point 1 and any refusal to provide such data will make it impossible for GIESSEGI to satisfy user requests and for users to use the services available on the website. Furthermore, data processing for these purposes is necessary to fulfil any legal obligations: personal data must be processed in accordance with applicable legislation, including their retention and disclosure to the Authorities for accounting, tax, or other purposes.
2. MARKETING AND COMMERCIAL PROMOTION ACTIVITIES, the provision of data is optional for the purposes referred to in point 2, and failure to provide it, or objection to its processing, will prevent us from sending you commercial and promotional communications. Failure to provide the data will not affect the provision of services.
3. PROFILING THROUGH AUTOMATED PROCESSING OF PERSONAL DATA, the provision of data, based on the user’s consent, is optional for the purposes referred to in point 3 and failure to indicate it or the withdrawal of consent will prevent us from carrying out profiling activities, i.e. sending commercial and promotional communications in line with the user’s displayed interests, or showing customised ads. Failure to provide the data will not affect the provision of services.

PROCESSING METHODS

Personal data is processed using automated tools, methods, and procedures for the time strictly necessary to achieve the purposes for which it was collected and to pursue the purposes set out in this privacy policy.
In particular, data will be processed by specially appointed personnel, mainly with the aid of electronic, computerised or otherwise automated means, through the use of emails or other remote communication techniques.

DATA STORAGE

The data is stored for the time strictly necessary to provide the requested service or for the time established by applicable regulations, including legal obligations regarding tax and fiscal matters.
In general, personal data provided by users that is no longer necessary for the purposes for which it was collected is immediately erased or made anonymous, except for the retention obligations indicated herein, prescribed by law, or unless otherwise indicated by the data subject.
Contact details, if relevant for the performance of a contract to which the user is a party or for the performance of pre-contractual measures taken at the user’s request (Article 6(1)(b) of the GDPR), will be retained until the performance of such relationship is completed, and in any case for a maximum period of 10 years in relation to any contractual or tax obligations.
For marketing, commercial promotion and profiling purposes, data will be retained until consent, where required, is withdrawn, after which GIESSEGI will no longer make use of the user’s personal data for such purposes, reserving the right to retain it for as long as necessary to protect its interests from potential complaints based on such processing.
GIESSEGI may process personal data for a further period, i.e. for as long as may be necessary to protect its interests from potential litigation or complaints relating to the services provided.

DATA SECURITY

GIESSEGI adopts specific, appropriate and preventative security measures to safeguard the confidentiality, integrity, completeness and availability of the data subject’s personal data, as well as to prevent data loss, illicit or improper use and unauthorised access.
In particular, to protect the personal data of the data subject, the website uses an encryption system with https encrypted protocol with SSL (Secure Sockets Layer) technology, which guarantees protection through the encryption of transmitted and exchanged information.
In any case, GIESSEGI will not be held responsible for any untruthful or incomplete information sent directly by the user (for example: correctness of their email address, personal details or postal contact details), as well as information concerning the user that has been provided by a third party, even on a fraudulent basis.

PERSONAL DATA RECIPIENTS

Personal data may be disclosed to parties who may have access to the data pursuant to legal, regulatory or EU legislative provisions, within the limits set by such provisions.
As regards the provision and management of the services requested by the user, the user’s personal data may be disclosed to other parties, acting as data processors (such as, for example, parties providing assistance and consultancy in the creation and development of the website, in accounting, administrative, legal, fiscal, financial and debt collection matters relating to the provision of services) and independent data controllers (such as, for example, providers of web services, email or technical services that provide services necessary for the operation of the website and the provision of services), internal and external personnel authorised to process data and bound by confidentiality obligations to the extent necessary to carry out their duties within our organisation.
Data may also be disclosed to individuals, entities or authorities as required by law, by a need to protect against abuse or fraud or by order of the authorities.
The full list of the aforementioned parties, in addition to what is indicated in the various sections of this privacy policy, can be requested directly from the Data Controller. The personal data collected will not be disseminated unless specifically authorised.

LOCATION OF DATA PROCESSING

The data processing activities linked to the web services of this website are performed at the offices of GIESSEGI, which uses external providers for the website hosting service, and are handled by technical personnel authorised to process data and, occasionally, by external and internal personnel assigned to maintenance operations.
Personal data will be stored on servers located within the European Union. Except as further indicated, the data will not be transferred outside the European Union.

TRANSFER TO THIRD COUNTRIES

Some of the user’s personal data may be transferred to recipients located outside the European Union, as indicated in the various processing purposes (e.g. statistical service providers). GIESSSEGI undertakes to constantly verify that the processing of personal data by these recipients occurs in compliance with the requirements of current legislation, i.e. by basing the transfer on an adequacy decision or, alternatively, on the standard contractual clauses approved by the European Commission.
Further information on the transfer and the agreements that provide the legal basis can be found in the various sections of this privacy policy or from us, by contacting us using the contact details provided in this privacy policy.

RIGHTS OF DATA SUBJECTS

Users of the website – to whom the personal data refers as data subjects and within the limits of current legislation – are granted the rights set forth in Articles 15 to 22 of EU Regulation 2016/679, that is, in brief, the right at any time to ask GIESSEGI for:

• access to his or her personal data, as well as additional information on its processing
• the rectification or updating of the data
• the erasure of the data
  

The user may also:

• object to the processing
• ask for the restriction of processing
• if applicable in relation to the processing, receive the data concerning the user in a structured, commonly used and machine-readable format
• withdraw consent for the processing purposes that require it

Pursuant to and within the limits of applicable legislation, the user has the right to lodge a complaint with the competent supervisory authority (for Italy: Italian Data Protection Authority, email urp@gpdp.it) if he or she believes that the processing of his or her personal data violates the law or his or her rights.
The rights listed above can be exercised at any time by the data subject, by contacting GIESSEGI, Via Bramante, 39, Appignano (MC), email info@giessegi.it, telephone +39 0733 400811 and/or the privacy representative at privacy@giessegi.it.

CHANGES AND UPDATES

This privacy policy came into force on 02 December 2025. GIESSEGI reserves the right to modify or update its content also in relation to changes in the applicable legislation. All changes and updates will be binding as soon as they are published on the website.