WEBSITE PRIVACY POLICY
pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR)
1. Introduction
This Privacy Policy describes how Antonino De Simone S.r.l. processes the personal data of users who visit this website, use the services made available, fill in contact forms, request commercial information, subscribe to the newsletter, participate in events or trade fairs organised by the Company, or establish business relationships through digital channels.
The Company considers the protection of personal data to be a fundamental element of its corporate organisation and conducts all processing in accordance with the principles of lawfulness, fairness, transparency, data minimisation, accuracy, integrity, confidentiality and accountability set out in Regulation (EU) 2016/679.
2. Data Controller
The Data Controller is:
Antonino De Simone S.r.l.
Registered office: Via Vittorio Veneto no. 21 – 80059 Torre del Greco (NA)
Local units: NA1 and NA2 – Corso Avezzana no. 24 – 80059 Torre del Greco (NA)
E-mail: info@antoninodesimone.it
Privacy e-mail: privacy@antoninodesimone.it
Certified e-mail (PEC): antoninodesimonesrl@pec.it
Telephone: 081 8811028
The Data Controller determines the purposes and methods of processing personal data and ensures that every operation is carried out in compliance with European and national legislation on the protection of personal data.
3. Data Protection Officer (DPO)
Pursuant to Article 37 of Regulation (EU) 2016/679, the Company is not required to appoint a Data Protection Officer (DPO), as it does not fall within the categories of entities for which such appointment is mandatory under the applicable legislation.
For any request, information or clarification regarding the processing of personal data, the data subject may nevertheless contact the Data Controller at any time using the contact details provided in point 2 of this policy.
4. Types of data processed and source of data collected indirectly
While browsing the website or using the available services, personal data belonging to different categories may be collected.
These include identification data such as first and last name, contact details such as e-mail address and telephone number, data relating to the company to which the data subject belongs, professional role, tax data that may be necessary for managing contractual relationships, technical browsing data, IP addresses, identifiers of the devices used, information collected through cookies and similar technologies, data relating to consents given, data concerning the commercial preferences expressed by the data subject, as well as any photographic or audiovisual images collected after providing specific information and, where necessary, obtaining prior consent.
Where personal data is not collected directly from the data subject but is instead obtained through third parties, such as industry lists, referrals from business partners, or trade fairs and events organised by third parties, the Company informs the data subject of the source at the time of the first useful contact and, in any event, no later than one month after acquiring the data, unless this proves impossible or involves a disproportionate effort, in accordance with Article 14 of Regulation (EU) 2016/679.
5. Purposes of processing
Personal data is processed exclusively for specified, explicit and legitimate purposes.
In particular, the data may be used to respond to requests submitted through the website, prepare quotations, manage commercial and pre-contractual relationships, follow up on catalogue requests, organise business meetings, manage registrations for trade fairs and events, administer relationships with customers and suppliers, comply with legal obligations, ensure website security, prevent unlawful use of the services, send administrative or operational communications, manage newsletter subscriptions, carry out direct marketing activities, perform commercial profiling activities, statistically analyse the data collected in aggregate form and enable the data subject to exercise the rights provided for by the GDPR.
6. Nature of the provision of data
The provision of personal data necessary to manage requests for information, prepare quotations, and establish and continue commercial and contractual relationships is mandatory: failure to provide such data will make it impossible for the Company to follow up on the request or to establish or continue the relationship.
The provision of data for newsletter, direct marketing and commercial profiling purposes is optional: failure to provide consent does not in any way affect the use of the other services offered by the Company, but makes it impossible to receive promotional communications and personalised content.
7. Legal bases for processing
Personal data is processed on the basis of the conditions of lawfulness set out in Article 6 of Regulation (EU) 2016/679.
Activities connected with managing requests for information, commercial relationships, negotiations and supplies are based on the performance of pre-contractual measures taken at the request of the data subject and on the performance of the contract.
Administrative, tax and accounting obligations are based on legal obligations.
Activities aimed at protecting company assets, ensuring the security of IT systems, preventing fraud and managing relationships with customers and business partners are based on the legitimate interest of the Data Controller.
The sending of promotional newsletters, commercial profiling, personalisation of communications, and the use of images for promotional purposes are carried out exclusively on the basis of the free, specific, informed and unambiguous consent given by the data subject.
8. Automated decision-making and profiling
The commercial profiling activities carried out by the Company are intended exclusively to analyse or predict the preferences, interests and commercial behaviour of the data subject, in order to personalise the communications and offers proposed.
Such activities do not give rise to decisions based solely on automated processing that produce legal effects concerning the data subject or similarly significantly affect them, pursuant to Article 22 of Regulation (EU) 2016/679.
The data subject may object to commercial profiling or withdraw previously given consent at any time, in accordance with the procedures set out in point 18 of this policy.
9. Consent collection system and Double Opt-In
For newsletter and marketing activities, the Company adopts a consent acquisition system that complies with the accountability principles set out in the GDPR.
The data subject expresses their wishes by means of specific, non-preselected checkboxes.
They subsequently receive an electronic communication containing a unique link through which they definitively confirm their subscription.
Only after this confirmation is consent considered validly obtained and the relevant contact added to the lists that may be used for promotional purposes.
The system automatically records the date, time, IP address, device used, version of the policy accepted, text of the consent given, source of the contact and date of final confirmation.
10. CRM and contact management
The data collected through the website, QR Codes, showrooms, trade fairs, industry events, business meetings or other authorised channels is entered into a corporate CRM system.
For each contact, the source of the data, the legal basis for processing, any consents given, changes made over time and the history of privacy preferences are recorded.
The system allows full traceability of the operations carried out and ensures that the expressions of the data subject’s wishes can be reconstructed.
11. Methods of processing
Personal data is processed in compliance with the principles of lawfulness, fairness, transparency, data minimisation, accuracy, storage limitation, integrity, confidentiality and accountability, as set out in Regulation (EU) 2016/679.
Personal data is processed using paper-based, IT and electronic tools, through methods strictly related to the purposes indicated in this policy and, in any event, in such a way as to ensure an adequate level of security and confidentiality.
Processing operations may include, by way of example, the collection, recording, organisation, consultation, storage, processing, alteration, retrieval, use, disclosure in the cases permitted by law, restriction, erasure and destruction of data.
Where data is collected through the website, QR Codes, digital forms, or tablets used during trade fairs, in showrooms or at industry events, the Company adopts appropriate procedures to ensure the traceability of the operations carried out and to demonstrate that any consents required by law have been obtained.
A Double Opt-In system is adopted for subscriptions to newsletter and promotional communication services, which requires a double expression of the data subject’s wishes by confirming their e-mail address through a unique link sent automatically by the system. This procedure makes it possible to document the data subject’s wishes with certainty and constitutes an organisational measure aimed at ensuring the fairness of the processing and the quality of the information collected.
Processing activities are carried out exclusively by personnel authorised pursuant to Article 29 of the GDPR and Article 2-quaterdecies of Italian Legislative Decree 196/2003, duly trained in the protection of personal data, or by external parties formally appointed as Data Processors pursuant to Article 28 of the GDPR.
The Data Controller periodically verifies the effectiveness of the procedures adopted and updates them in line with technological, organisational and regulatory developments.
12. Data retention
Personal data is retained for no longer than is necessary to achieve the purposes for which it was collected, in compliance with the principle of storage limitation set out in Article 5 of Regulation (EU) 2016/679 and taking into account the obligations laid down by civil, tax, accounting and commercial legislation.
Data collected for pre-contractual or contractual purposes is retained for the entire duration of the relationship and, subsequently, for a maximum period of 10 years from its termination, in accordance with ordinary limitation periods and the tax and accounting obligations laid down by the applicable legislation.
Data collected through requests for commercial information, contacts acquired at showrooms, trade fairs and industry events, as well as data entered into the corporate CRM system without a subsequent commercial relationship, is retained for a maximum period of 24 months from the last relevant contact, after which it is erased or anonymised, unless a commercial relationship has been established in the meantime.
Data processed on the basis of the data subject’s consent for newsletter, commercial communication and direct marketing purposes is retained until consent is withdrawn or the right to object is exercised. If the data subject has not interacted for a period of 24 months, the Company will nevertheless update the contact list, requesting renewed confirmation of interest in receiving communications where necessary.
Data relating to commercial profiling activities is retained for a maximum period of 12 months from the last relevant interaction, subject to extension in the event of subsequent interactions, and is periodically reviewed, updated or erased.
Technical data relating to consent records, system logs, the Double Opt-In procedure, IP addresses and digital evidence collected for security purposes is retained for a maximum period of 24 months, for the time necessary to ensure that consent can be demonstrated, the security of the systems and the possible protection of the Data Controller’s rights.
Once the retention period has expired, the data is erased, anonymised or retained exclusively in the cases provided for by law or for the purpose of establishing, exercising or defending a right in legal proceedings.
13. Recipients of personal data
Personal data is not subject to indiscriminate disclosure.
It may be disclosed exclusively to parties whose knowledge of it is necessary to pursue the purposes indicated in this policy or where disclosure is required by legal obligations.
Within the corporate organisation, data may be processed by employees and collaborators specifically authorised by the Data Controller, within the limits of their respective responsibilities and in accordance with the instructions given.
Where necessary, data may be disclosed to professionals, consultants, credit institutions, insurance companies, transport companies, couriers, tax advisers, lawyers, auditors, IT service providers, companies responsible for managing the website, CRM platforms, e-mail marketing platforms, cloud services, and companies providing technical support and maintenance for IT systems, all duly appointed as Data Processors pursuant to Article 28 of the GDPR, where required.
Data may also be disclosed to public authorities, supervisory bodies, law enforcement agencies or judicial authorities where disclosure is required by law, regulation or an order of the competent authority.
An up-to-date list of Data Processors may be requested from the Data Controller at any time using the contact details provided in this Privacy Policy.
14. Transfer of data to non-EU countries
As a rule, personal data is processed and stored within the European Economic Area.
Where, for technical or organisational reasons, it becomes necessary to use providers that carry out processing in third countries or IT services based on cloud infrastructures located outside the European Economic Area, the Data Controller ensures that such transfers take place exclusively in compliance with Articles 44 et seq. of Regulation (EU) 2016/679.
In particular, transfers may take place only to countries covered by an adequacy decision of the European Commission or through the adoption of Standard Contractual Clauses (SCCs), supplemented, where necessary, by additional technical and organisational measures suitable for ensuring a level of protection substantially equivalent to that provided for by European legislation.
Where services provided by international operators are used for the management of e-mail, CRM, newsletters, cloud services or other digital tools, the Data Controller verifies in advance that the relevant processing complies with European legislation on the protection of personal data.
15. Security of processing
The Data Controller adopts appropriate technical and organisational measures pursuant to Article 32 of Regulation (EU) 2016/679, aimed at ensuring a level of security appropriate to the risks arising from the processing of personal data, taking into account the state of the art, the costs of implementation, and the nature, scope, context and purposes of the processing.
Security measures include, among other things, authentication and access control systems, credential management, protection of IT networks, encryption where applicable, firewalls, antivirus software, periodic backup systems, disaster recovery procedures, access monitoring, recording of relevant operations, physical protection of premises and equipment, as well as organisational procedures aimed at preventing unauthorised access to, loss, destruction, disclosure or alteration of personal data.
Particular attention is paid to processing carried out through the corporate website, the CRM system, the collection of contacts through QR Codes, tablets and digital forms, as well as newsletter subscription systems using the Double Opt-In procedure, in order to ensure the traceability of operations and demonstrate that consent has been obtained.
The Data Controller periodically reviews the security measures adopted, updating them in line with technological developments, risk analysis and the possible introduction of new processing operations or IT tools.
Should a personal data breach (Data Breach) occur, the Data Controller activates the procedures provided for by its data protection management system, adopting the measures necessary to contain the effects of the event and, where the conditions set out in Articles 33 and 34 of Regulation (EU) 2016/679 are met, notifying the Italian Data Protection Authority and the data subjects.
16. Cookies and similar technologies
With regard to the cookies used by the website, please refer to the relevant Cookie Policy, accessible from the website footer.
Cookie preferences may be changed at any time using the dedicated consent management panel.
17. Rights of the data subject
The data subject may exercise at any time the rights provided for in Articles 15–22 of Regulation (EU) 2016/679, obtaining access to their data, rectification of inaccurate information, erasure of data in the cases provided for by law, restriction of processing, data portability, objection to processing based on legitimate interest and withdrawal of consents previously given.
The withdrawal of consent does not affect the lawfulness of processing carried out prior to its withdrawal.
18. Methods for exercising rights
The data subject may exercise their rights by sending a request to the Data Controller by e-mail, certified e-mail (PEC) or written communication using the contact details indicated above.
Users subscribed to the newsletter also have access to a dedicated restricted area through a link included in the communications received, where they can update their data, change their preferences, withdraw consent, object to promotional communications or request the erasure of their data.
19. Complaint to the Supervisory Authority
Where the data subject considers that personal data is being processed in breach of the applicable legislation, they have the right to lodge a complaint with the Italian Data Protection Authority, as well as to bring proceedings before the competent judicial authorities.
20. Updates to this policy
This Privacy Policy may be amended or updated as a result of regulatory, organisational or technological changes.
The updated version will always be published on the website, together with the relevant update date.
Torre del Greco, 20 March 2026
