Privacy

We wish to inform you that, pursuant to Article 13 of Regulation (EU) 2016/679 (General Data Protection Regulation – “GDPR”), your personal data will be processed by our Company in accordance with the applicable data protection legislation. The processing of personal data by the Company will be carried out in compliance with the aforementioned regulation and, in particular, in accordance with the principles of lawfulness, fairness, transparency, integrity and confidentiality, as well as with full respect for the rights and freedoms of data subjects.

1. Data Protection Controller

Data Controller: Monguzzi S.r.l.
Registered office: Via Valsugana n. 7 – 20814, Varedo (MB)
E-mail address to contact the Data Controller: info@monguzzibordi.com

2. Type of data processed

The data provided to and processed by Monguzzi S.r.l. consist of ordinary personal identification data provided directly by the data subject.

“Personal data means any information relating to an identified or identifiable natural person. An identifiable natural person is a person who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or to one or more factors specific to their physical, physiological, genetic, mental, economic, cultural or social identity”.

The personal data collected include the following categories:

• personal data submitted through the “Request information” page;
• contact details submitted through the “Request information” page;
• data relating to newsletter subscription (e-mail address), where the User subscribes by ticking the relevant box to receive periodic updates and communications;
• any additional data voluntarily entered in the “Messages” field;
• cookies and browsing data.

3. Purpose of data processing

The User’s Data are collected to enable the Data Controller to provide its services and, in particular, to contact the User following a request for information. More specifically:
– CONTACT: by voluntarily filling in the contact form, the User provides personal data to the Data Controller and authorises their use in order to be contacted and receive the requested information.
Types of personal data: name, surname, e-mail address, telephone number and any information freely provided in the request;
– NEWSLETTER: by voluntarily subscribing to the newsletter service, the User provides his/her Data to the Data Controller in order to receive periodic updates, including, where applicable, profiled communications, concerning products, services, events, promotions and other information of interest relating to the Data Controller’s activities.
Types of personal data: e-mail address;
– COOKIES AND BROWSING DATA: cookies are small text strings that a website may send, during browsing, to the User’s device (PC, Notebook, smartphone or tablet). The same website that sent them may read and record the cookies stored on the device in order to obtain various types of information. This information is not collected for the purpose of being associated with identified data subjects, however, by its nature, it may allow Users to be identified through processing and association with data held by third parties.
Types of personal data: please refer to the Cookie Policy.

4. Data processing and storage methods

The processing of personal data will be carried out by electronic and/or manual means, in compliance with the Article 32 of the GDPR 2016/679 regarding security measures, by subjects specifically authorised to process personal data pursuant to Article 29 of the GDPR. The Data Controller adopts appropriate technical and organisational security measures to prevent unauthorised access, disclosure, alteration or destruction of personal data and to ensure the confidentiality of the data subjects to whom the data relate.

5. Legal basis of the processing

The personal data referred to in this Privacy Policy are processed, where necessary, for the performance of pre-contractual and/or contractual measures requested by the data subject, in order to allow the provision of the services offered by the Company.
For processing activities that are not strictly necessary for the performance of such measures, the legal basis is the User’s explicit consent. In particular, the User’s consent is requested in the following cases:

• voluntary submission of requests through the “Request Information” section;
• voluntary subscription to the newsletter, by filling in the appropriate form on the “Request information” page, to receive informational, promotional and/or update communications relating to the Company’s services;
• configuration and management of cookie preferences through the dedicated banner or the “Advanced Cookie Settings” section, by enabling or disabling specific categories of cookies.

6. Place of processing

Personal data are processed at the Data Controller’s operational offices. For further information, the User may contact the Data Controller using the address provided above. Any transfer of personal data to countries outside the European Economic Area shall take place in compliance with the GDPR and with appropriate safeguards to ensure the confidentiality and security of the data.

7. Storing

In compliance with the principles of lawfulness, purpose limitation and data minimisation pursuant to Article 5 of the GDPR, personal data will be retained for no longer than is necessary to achieve the purposes for which they are collected and processed, without prejudice to any retention periods required by law. In particular:

• data submitted through the “Request Information” page: retained until the request has been fully processed and, generally, for up to 12 months from the end of the communication;
• data relating to the newsletter: retained until the User unsubscribes or withdraws consent, without prejudice to any longer retention period required by law;
• cookies and browsing data: retained as indicated in the Cookie Policy.

When the processing is based on the User’s consent, personal data may be processed until such consent is withdrawn. In addition, the Data Controller may be required to retain personal data for a longer period in order to comply with a legal obligation or an order issued by a competent authority.

At the end of the applicable retention period, personal data will be deleted or anonymised. As a result, once the data have been deleted, the rights of access, erasure, rectification and data portability can no longer be exercised.

8. Scope of communication and disclosure

The personal data collected will not be publicly disclosed and may only be communicated to persons or entities whose activities are necessary or functional to the pursuit of the purposes indicated above, including:

• public bodies or competent authorities, where required by law;
• consultants, collaborators and professionals appointed by the Data Controller for administrative, legal, tax or technical purposes;
• providers of IT and technological services related to the management of the website, IT systems, e-mail services, hosting, technical maintenance, IT security and data storage;
• parties providing services functional to the management of communications and requests submitted through the website.

The above-mentioned persons or entities will process personal data, as the case may be, as Data Processors pursuant to Article 28 of the GDPR or as independent Data Controllers. Personal data will be processed exclusively within the limits necessary for the performance of the respective activities and in compliance with the security measures required by applicable law.

9. Transfer of data to non-EU countries

The Data Controller does not transfer personal data to non-EU countries. However, where the use of cloud services or other technological providers involves the transfer of personal data outside the European Economic Area, the Data Controller shall ensure that such transfer takes place in compliance with the GDPR and, in particular, on the basis of appropriate safeguards pursuant to Article 46 of the GDPR.

10. Rights of the data subject

At any time, the data subject may exercise the rights provided for under Articles 15 to 22 of the GDPR by contacting the Data Controller at the contact details indicated above. In particular, the data subject has the right to:

• obtain confirmation as to whether or not personal data concerning him or her are being processed;
• obtain information on the origin of the data, the purposes of processing, the categories of personal data processed, the recipients or categories of recipients to whom the personal data have been or will be disclosed, and the applicable retention period;
• obtain the rectification of inaccurate personal data, the erasure of personal data, the restriction of processing, or data portability, namely the right to receive personal data in a structured, commonly used and machine-readable format and to transmit those data to another data controller without hindrance;
• object to the processing of personal data at any time, including where the processing is carried out for direct marketing purposes or involves automated decision-making, including profiling;
• lodge a complaint with the competent Supervisory Authority.

11. Information not contained in this Privacy policy

Further information regarding the processing of personal data may be requested at any time from the Data Controller using the contact details provided above.

12. Changes to the Privacy Policy

The Data Controller reserves the right to amend, update, add to or remove parts of this Privacy Policy at its discretion and at any time. Users are therefore invited to check this page periodically for any changes. In order to facilitate such verification, this Privacy Policy indicates the date on which it was last updated.

Continued use of the website after the publication of any changes shall constitute acceptance of the updated Privacy Policy.

Updated March 2026