REGARDING THE PROTECTION OF PERSONAL DATA PURSUANT TO ART. 13 OF EU REGULATION 679/2016 AND ITALIAN LEGISLATIVE DECREE 196/2003 AS AMENDED BY ITALIAN LEGISLATIVE DECREE 101/2018
Our Company has always been highly attentive to the protection of personal data and to respecting the principles of privacy and the dignity of individuals.
With this in mind, we kindly ask you to read the following information notice. Gambini S.p.A., with registered office at Via Carducci 16, 20123 Milan (MI), tax code and VAT no. 00456660463, in its capacity as Data Controller, through its legal representative pro tempore, pursuant to and for the purposes of EU Regulation 679/2016, hereby informs the data subject that the personal data collected concerning him/her, acquired by the Data Controller or that will be subsequently requested and/or communicated by third parties, are necessary and will be used for the purposes indicated below.
PURPOSE AND LAWFULNESS OF PROCESSING
The purpose for which the data are collected is the following:
• Pursuit of instrumental and/or complementary purposes related to activities functional to the performance of the contractual or pre-contractual relationship;
• Maintenance of general accounting, invoicing, credit management, compliance with civil and tax obligations required by law, and updating of records;
• Assessment of the data subject’s level of satisfaction regarding the quality of the products or services provided by the Controller, including statistical analysis;
• Data are processed for the purpose of sending service communications, managing requests for clarification, reports, and complaints related to the established contractual relationship, as well as for its performance;
Commercial promotion activities related to the Controller’s own services.
Any personal data relating to or collected from the data subject, upon provision of consent, may be used for marketing purposes (for example, for the promotion of advertising and commercial events, the sending of advertising campaigns, promotions, and offers) carried out by the Controller using the contact details provided by the data subject.
LEGAL BASIS OF PROCESSING
The processing is lawful under the following conditions:
– Pursuant to Article 6, paragraph 1, letter (a) of EU Regulation 679/2016, processing is lawful if the data subject has given consent to the processing of his or her personal data for one or more specific purposes.
– Pursuant to Article 6, paragraph 1, letter (b) of EU Regulation 679/2016, processing is necessary for the performance of a contract to which the data subject is party or for the implementation of precontractual measures taken at the data subject’s request.
– Pursuant to Article 6, paragraph 1, letter (c) of EU Regulation 679/2016, processing is necessary for compliance with a legal obligation to which the controller is subject.
– Pursuant to Article 6, paragraph 1, letter (f) of EU Regulation 679/2016, processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, provided that such interests are not overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, particularly where the data subject is a minor. The controller’s legitimate interest is related to the management of personal data for promotional and marketing purposes.
METHODS OF PROCESSING AND DUTY OF CONFIDENTIALITY
The processing of personal data is carried out by means of electronic and/or paper-based tools, by
persons bound by confidentiality obligations, using methods consistent with the purposes of
processing and, in any case, in such a way as to ensure the security and confidentiality of the data.
The data collected will not be disclosed or disseminated to third parties, except as required by law.
DISCLOSURE TO THIRD PARTIES
Your personal data may be disclosed to third parties known to us solely and exclusively for the
purposes described above, and in particular to the following categories of recipients:
• External companies providing services on our behalf;
• Public entities and administrations for compliance with legal obligations;
• Professionals who may assist in fulfilling legal obligations.
These entities will process personal data either as Data Processors or as independent Data Controllers.
Your data may be transferred both within and outside the EU. In the latter case, the transfer will take place, where applicable, in compliance with the adequacy decisions referred to in Article 45 of EU Regulation 679/2016, or, in any case, pursuant to Article 49(1)(b) of the same Regulation.
RETENTION PERIODS
Pursuant to Article 5 of EU Regulation 2016/679, “Principles relating to the processing of personal data,” personal data are stored in a form that allows the identification of the data subjects for no longer than what is necessary to achieve the purposes for which they are processed.
The personal data of the data subjects may also be retained for longer periods in compliance with applicable legal obligations (for example, for accounting purposes) and, in any case, applying all technical and organizational measures aimed at implementing data anonymization mechanisms.
RIGHTS OF THE DATA SUBJECT
Pursuant to the applicable legislation, the data subject may exercise his/her rights against the Data Controller, as expressed in Art. 15 et seq. of EU Regulation 679/2016.
In addition to these rights, the data subject has the right to lodge a complaint with the Supervisory Authority in cases provided by law. For further information regarding the methods of exercising these rights, please refer to the “Procedure for Data Subject Rights” on the gambini.group website.
DATA CONTROLLER AND PRIVACY COMMUNICATIONS
The Data Controller is Gambini S.p.A.. For any communication pursuant to the articles mentioned above of EU Regulation 679/2016, the Data Controller provides the following contact details: Via Carducci 16, 20123 Milan (MI). Phone +39 0583 2776; email info@gambini.group.
Lucca, 29 October 2025