PERSONAL DATA PROCESSING NOTICE — CUSTOMERS

CATEGORIES OF DATA PROCESSED

The data controller processes the identification data of the customer and of its contact persons, contact details, tax and invoicing data, bank details, as well as data connected with the performance of the logistics and transport service (data relating to orders, shipments, deliveries, stock levels and customs and excise documentation). As a rule, no special categories of data within the meaning of Art. 9 GDPR are processed.

​

METHODS OF PROCESSING

The data is processed both in paper form and with the aid of electronic and/or automated tools. In compliance with the applicable legislation on the matter, the data controller adopts technical and organisational measures appropriate to ensure the confidentiality, integrity, availability and accuracy of the data, as well as to prevent unauthorised access and accidental loss or destruction.

​

AUTOMATED DECISION-MAKING AND PROFILING

The data controller does not take decisions based solely on automated processing, including profiling, which produce legal effects concerning the data subject or similarly significantly affect them. Any artificial intelligence applications are used exclusively to support the internal organisation of work, under the supervision of designated staff and in full compliance with the applicable legislation, including Regulation (EU) 2024/1689 (the AI Act).

​

RECIPIENTS AND CATEGORIES OF RECIPIENTS OF PERSONAL DATA

The data is processed by employees and other persons authorised to process it engaged by the data controller in carrying out its business activities, as well as by third parties designated as data processors pursuant to Art. 28 GDPR, in particular providers of IT and software development services, tax and legal advisors, credit institutions and debt collection agencies.

For the performance of the service, the data may also be disclosed to carriers, sub-carriers, warehouse keepers, freight forwarders and customs representatives, acting as data processors or as independent controllers depending on the role assumed, as well as to the competent authorities in compliance with legal obligations. The data is not disseminated.

​

PLACE OF PROCESSING

Personal data will generally be processed within the European Union. Certain applications of the services used by the data controller may, however, entail the transfer of personal data to the United States. Such transfer is lawful pursuant to Art. 45 of Regulation (EU) 2016/679, by virtue of the adequacy decision adopted by the European Commission on 10 July 2023 concerning the EU-U.S. Data Privacy Framework, and concerns exclusively providers certified under that Framework. Should it become necessary, the data controller reserves the right to relocate its electronic archives to other non-EU countries, ensuring that any transfer of data outside the EU will be carried out only to States capable of offering a level of protection adequate to the standards laid down by the applicable legislation, in compliance with Arts. 45, 46 and 49 of Regulation (EU) 2016/679.

​

NATURE OF THE PROVISION OF DATA

The provision of data is optional; however, failure to provide the data necessary for the performance of the contract or of the requested service will make it impossible to deliver the service.

​

RETENTION PERIOD

The data is processed for the period necessary to fulfil the purposes set out above and, in particular:

• contractual data and data relating to the performance of the service: for the duration of the relationship and, thereafter, for ten years, in line with the ordinary limitation period;

• accounting and tax data: ten years from the last entry, as provided for by specific statutory provisions;

• customs and excise documentation: for the periods laid down by the applicable sector legislation;

• data used for sending newsletters: until consent is withdrawn or erasure is requested (opt-out);

• data collected through customer satisfaction surveys: 24 months from collection;

• data necessary for the defence of a right in legal proceedings: for the time strictly necessary and within the limits of the applicable limitation periods.

​

DATA SUBJECT'S RIGHTS REGARDING THE PROCESSING OF DATA

Pursuant to Arts. 15, 16, 17, 18, 19, 20, 21 and 77 of the EU Regulation, the data subject is hereby informed that:

• they have the right to request access to their personal data, its rectification or erasure, or the restriction of the processing concerning them, to object to such processing, and to have their data transferred to another controller in the cases provided for;

• where the processing is based on consent, they have the right to withdraw that consent at any time, without affecting the lawfulness of the processing carried out prior to the withdrawal;

• any rectification, erasure or restriction of processing carried out at the data subject's request — unless this proves impossible or involves disproportionate effort — will be communicated by the data controller to each of the processors to whom the personal data has been transmitted;

• they have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali), following the procedures and instructions published on the Authority's official website at www.garanteprivacy.it.

To exercise the rights set out above, the data subject must contact the data controller at the addresses indicated above. The exercise of these rights is not subject to any formal requirement and is free of charge.

​

Notice updated on 16 June 2026.