Privacy policy
NOTICE ON THE PROCESSING OF PERSONAL DATA
Website www.guzzini.com and www.fratelliguzzini.com
pursuant to Article 13 of EU Regulation 2016/679 (GDPR)
This notice is provided pursuant to Article 13 of EU Regulation 2016/679 (“GDPR”) to all individuals who interact with the websites www.guzzini.com and www.fratelliguzzini.com (hereinafter, jointly, the “Site”), operated by FRATELLI GUZZINI S.p.A., acting as Data Controller.
This notice does not govern processing carried out through cookies and other tracking tools, which are covered by the specific Cookie Policy available on the Site. Nor does it apply to the processing of data relating to employees and staff, which is governed by dedicated internal notices.
1. Data Controller
FRATELLI GUZZINI S.p.A., with registered office at C.da Mattonata 60, 62019 Recanati (MC), Italy; Tax Code/VAT No.: 00082720434. E-mail address: privacy@guzzini.com; website: www.guzzini.com | www.fratelliguzzini.com.
For promotional and marketing activities, the Data Controller is likewise FRATELLI GUZZINI S.p.A., which manages such activities autonomously or, where applicable, jointly with other Group companies, on the basis of specific joint controllership agreements under Article 26 GDPR, the essential content of which may be requested by writing to privacy@guzzini.com.
2. Data subjects and data collection points
This notice is addressed to:
• visitors who browse the Site’s pages without registering (“Anonymous Users”);
• users who register on the Site by creating a personal account (“Registered Users”);
• customers who make purchases through the Site, either as registered users or as guests without registering (“Customers”);
• individuals who subscribe to the newsletter and/or have given consent to receive commercial communications (“Marketing Recipients”);
• individuals who contact the Controller through the dedicated e-mail address or customer support channels.
Personal data are collected through the following contact points: (i) browsing of the Site (automatic collection); (ii) account registration form; (iii) checkout process for the purchase of products (registered user or guest); (iv) newsletter sign-up form (on the homepage and during checkout); (v) customer support channels (e-mail, live chat, telephone); (vi) Lead Generation instant forms published on the Facebook/Instagram platform (see purpose M), through which the data subject may provide their contact details directly within the Meta application without being redirected to the Site.
3. Categories of personal data processed
3.1 Data actively provided by the data subject
Account registration: first name, last name, e-mail address, password (encrypted), date of birth (optional, collected for birthday promotion purposes — see purpose E).
Purchase (registered user and guest): first name, last name, shipping and billing address, telephone number, e-mail address, payment data (handled directly by the appointed payment provider and never stored by the Controller in unencrypted form), tax data where required for invoicing.
Newsletter and marketing: e-mail address; date of birth (optional, collected for birthday promotion purposes).
Customer support: first name, last name, e-mail address, order number, any other data provided by the data subject in the context of the request.
3.2 Data collected automatically
IP address; browser and device information (type, version, operating system, installed plug-ins); time zone and language settings; approximate geolocation data; browsing path (clickstream analysis); pages and products viewed; session duration; any loading errors.
Such technical data are processed automatically by the Site’s IT systems and are necessary for the pages to function correctly. Further browsing data for analytics and advertising purposes are processed through cookies and tracking tools described in the Cookie Policy.
3.3 Special category data
The Controller does not collect special category data pursuant to Article 9 GDPR (data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, or genetic, biometric, health-related or sex-life data). Should the data subject voluntarily disclose such data, the Controller will arrange for its immediate deletion.
4. Purposes of processing, legal bases, retention periods and nature of the data provision
The processing activities carried out by the Controller through the Site are as follows:
|
A) Registration and management of the user account |
|
|
Description |
Creation and management of the user’s personal account on the Site, including authentication, password recovery and viewing of order history. |
|
Legal basis |
Performance of the contract (services related to the account) — Article 6(1)(b) GDPR. |
|
Retention period |
For the entire duration of the contractual relationship (active account). Following account closure, data are retained for the ordinary statute-of-limitations period (Article 2946 of the Italian Civil Code, 10 years) limited to tax and accounting information only; other identifying data are deleted within 12 months of closure. |
|
Nature of the provision |
Mandatory. Failure to provide the data prevents the account from being created. |
|
B) Management of purchase orders and related obligations |
|
|
Description |
Receipt and fulfilment of purchase orders placed on the Site by registered users or guests, including shipping management, invoicing, any tax and accounting formalities, and the handling of returns, refunds and statutory warranties. |
|
Legal basis |
Performance of the sales contract — Article 6(1)(b) GDPR; compliance with legal obligations (tax and accounting regulations) — Article 6(1)(c) GDPR. |
|
Retention period |
10 years from the conclusion of the contract for tax and accounting documents (Article 2220 of the Italian Civil Code; Presidential Decree 600/1973); 2 years for statutory product warranties (Legislative Decree 206/2005); for other order-related data, 10 years from the transaction, unless longer applicable limitation periods apply. |
|
Nature of the provision |
Mandatory. Failure to provide the data makes it impossible to fulfil the order. |
|
C) Prevention of payment fraud |
|
|
Description |
Verification of the customer’s identity and the authenticity of the transaction, for the purpose of preventing fraudulent use of payment instruments. In such cases, the Controller may request, via support@guzzini.com, the transaction authorisation code and a copy of an identity document, with the middle digits of the credit/debit card masked. Data are also processed in cooperation with the payment institutions and banks involved in the transaction. |
|
Legal basis |
Performance of the contract and the Controller’s legitimate interest in preventing fraud — Article 6(1)(b) and (f) GDPR. |
|
Retention period |
12 months from collection, for evidentiary purposes and cooperation with judicial authorities. |
|
Nature of the provision |
Mandatory only for transactions subject to anti-fraud verification. |
|
D) Customer support and assistance |
|
|
Description |
Handling of customer communications relating to orders, products, returns, complaints and any other support requests, through e-mail, live chat or telephone channels. This includes fixing malfunctions and communicating changes to the services. |
|
Legal basis |
Performance of the contract — Article 6(1)(b) GDPR; the Controller’s legitimate interest in the proper functioning of the service — Article 6(1)(f) GDPR. |
|
Retention period |
For the duration of the contractual relationship and, thereafter, for the period necessary to handle any disputes and complaints (max. 5 years from the conclusion of the contract, corresponding to the limitation period for tort claims under Article 2947 of the Italian Civil Code). |
|
Nature of the provision |
Mandatory in order to receive assistance. |
|
E) Direct marketing — Newsletter and promotional communications (OPTIONAL) |
|
|
Description |
Periodic sending of newsletters, commercial updates and promotional communications relating to the products and services offered by the Controller (e.g., new collections, promotions, events, editorial content on design and lifestyle), by e-mail. This purpose is entirely autonomous and independent of purposes A), B), C) and D): failure to give consent does not in any way affect the management of the order, the account or support requests. Consent may be freely withdrawn at any time, without affecting the lawfulness of processing carried out prior to withdrawal, by sending a request to privacy@guzzini.com or by clicking the unsubscribe link included in every communication. |
|
Legal basis |
The data subject’s express and specific consent — Article 6(1)(a) GDPR. Consent is collected by ticking the relevant box in the Site sign-up form or during checkout. The consent record is retained for 10 years to demonstrate compliance with data protection obligations. |
|
Retention period |
Until consent is withdrawn; in any event, consent will be renewed after 24 months from when it was first given. Data relating to the sign-up and any withdrawal are retained for 10 years. |
|
Nature of the provision |
Optional and independent. Failure to consent does not affect any of the other processing purposes. |
|
F) Personalised birthday marketing (OPTIONAL) |
|
|
Description |
Sending a personalised promotional communication (e.g., discount code, dedicated offer) on the occasion of the user’s birthday, based on the date of birth optionally provided during registration or in the account preferences. The date of birth is not required for registration or purchase and providing it is entirely optional. Not providing it does not affect any other processing. Consent may be freely withdrawn by sending a request to privacy@guzzini.com. |
|
Legal basis |
The data subject’s express and specific consent — Article 6(1)(a) GDPR, expressed by ticking the relevant box when entering the date of birth in the account or in the newsletter form. |
|
Retention period |
Until consent is withdrawn or the account is deleted, and in any event with renewal of consent after 24 months. Data relating to consent are retained for 10 years. |
|
Nature of the provision |
Optional and entirely independent. The date of birth is not required for other processing activities. |
|
G) Profiling for personalised marketing purposes (OPTIONAL) |
|
|
Description |
Analysis of the user’s purchasing behaviour on the Site (products viewed, added to the cart, purchased, preferred categories, frequency and value of purchases) in order to build an individual profile of commercial interest and to provide the data subject with personalised communications, offers and content in line with their preferences (through the communication channels provided). The profiling mechanism works as follows: the system automatically collects data on the authenticated user’s interactions with the product catalogue (clicks on product pages, additions to the cart, completion or abandonment of the order); such data are aggregated and classified by product category, price range and frequency; based on this classification, recommendation algorithms build an individual profile that drives the sending of personalised communications and offers by e-mail and/or the display of dedicated content in the Controller’s communications. Profiling is carried out only on users who have given their specific consent. The data subject may object to profiling and withdraw consent at any time by sending a request to privacy@guzzini.com, without affecting the lawfulness of processing carried out prior to withdrawal. No automated decision is made that produces legal effects or similarly significantly affects the data subject: the profiles generated are used exclusively for commercial personalisation purposes. |
|
Legal basis |
The data subject’s express and specific consent — Article 6(1)(a) GDPR, expressed by ticking the relevant box in the account preferences or when consent is collected for the newsletter. |
|
Retention period |
Until consent is withdrawn; in any event, profiling data are updated at intervals of no more than 24 months, and consent is renewed within that period. Data relating to consent are retained for 10 years. |
|
Nature of the provision |
Optional and entirely independent. Failure to consent does not affect any of the other processing purposes. |
|
H) Personalised advertising through Facebook/Meta Custom Audiences (OPTIONAL) |
|
|
Description |
The Controller uses the “Custom Audiences” feature offered by Meta Platforms Ireland Limited (hereinafter “Meta”) to display personalised advertisements on the Facebook/Instagram platform to users who are already customers or newsletter subscribers of the Controller. The mechanism consists of uploading to Meta a list of the data subjects’ contact details (e-mail address and/or telephone number) in a format processed through a cryptographic hash function (SHA-256), in order to allow Meta to match such data with the accounts of users registered on the platform and to show them the Controller’s advertisements. The original data are never transmitted to Meta in plain form; once the matching process is complete, the hashed data are deleted from Meta’s servers in accordance with the applicable contractual terms. Pursuant to EDPB Guidelines 8/2020 on the targeting of social media users (Section 5.2.2, Examples 2-3), the Controller acts as the sole controller for the initial collection of data subjects’ e-mail addresses and telephone numbers. From the transmission of such data to Meta onward, and for all subsequent operations (upload of hashed identifiers, matching, selection of the custom audience, display of the advertisement, campaign reporting), the Controller and Meta Platforms Ireland Limited act as joint controllers pursuant to Article 26 GDPR: each jointly determines the purposes and means of such operations, albeit with differing degrees of responsibility. Meta has greater technical control over the matching and display infrastructure. The essence of the joint controllership arrangement between the Controller and Meta for the Custom Audiences service is reflected in the Customer List Custom Audiences Terms, available at: https://www.facebook.com/legal/terms/customaudience. The transfer of data to Meta (with servers in the United States) takes place under the EU-US Data Privacy Framework (EU Implementing Decision 2023/1795) and, additionally, by means of Standard Contractual Clauses pursuant to Article 46(2)(c) GDPR. Meta Platforms Ireland Limited also acts as an independent controller in relation to its own platform purposes (e.g., security, fraud prevention, service improvement); for such processing, please refer to Meta’s privacy notice: https://www.facebook.com/privacy/policy/. The data subject may exercise their rights against the Controller by writing to privacy@guzzini.com, or directly against Meta through their Facebook/Instagram account settings (including the “Why am I seeing this ad?” feature). Consent may be freely withdrawn at any time by sending a request to privacy@guzzini.com. |
|
Legal basis |
The data subject’s express and specific consent — Article 6(1)(a) GDPR, expressed by ticking the relevant box in the account marketing preferences or when consent is collected for the newsletter. |
|
Retention period |
Until consent is withdrawn. Data relating to consent are retained for 10 years. |
|
Nature of the provision |
Optional and entirely independent. Failure to consent does not affect any of the other processing purposes. |
|
I) Security and maintenance of IT systems |
|
|
Description |
Technical support, monitoring and maintenance of the IT infrastructure and the Site, in order to ensure its proper functioning and security. In carrying out these activities, the personnel responsible for maintenance may access, including for mere viewing purposes, the data subjects’ data held in the systems. |
|
Legal basis |
The Controller’s legitimate interest in the security and proper functioning of its IT systems — Article 6(1)(f) GDPR. |
|
Retention period |
For the duration of the technical intervention; security logs are retained for a maximum of 12 months. |
|
Nature of the provision |
The data have already been collected on the basis of the preceding purposes. |
|
L) Establishment, exercise or defence of a legal claim, in or out of court |
|
|
Description |
Processing strictly necessary to protect the Controller’s rights in any disputes arising from the contractual or pre-contractual relationship, in court (including higher-instance courts) or out of court (mediation, arbitration, ADR procedures). |
|
Legal basis |
The Controller’s legitimate interest — Article 6(1)(f) GDPR; compliance with legal obligations — Article 6(1)(c) GDPR. |
|
Retention period |
Five years from the conclusion of the contract, corresponding to the ordinary limitation period for tort claims (Article 2947 of the Italian Civil Code), unless the law provides for different time limits. |
|
Nature of the provision |
The data have already been collected on the basis of the preceding purposes. |
|
M) Collection of contacts through Facebook/Meta Lead Generation Ads (OPTIONAL) |
|
|
Description |
The Controller uses the “Lead Ads” service (contact acquisition advertisements) offered by Meta Platforms Ireland Limited (“Meta”) to collect, directly within the Facebook/Instagram platform, the contact details of users interested in the Controller’s products and services. The mechanism works as follows: the user sees one of the Controller’s advertisements on the platform; by clicking the call-to-action button, an “Instant Form” opens, pre-filled with the user’s Meta profile data (first name, last name, e-mail address, telephone number, where available); the user checks the data, gives the required consents and submits the form; the data are transmitted to the Controller via Meta’s APIs and stored in the Controller’s CRM for the purposes for which consent was given. The consents collected through the Meta form are the same as those requested on the Site (newsletter, birthday promotion, profiling) and have the same legal effect. The form must include a link to this notice, in accordance with Meta’s terms of use for Lead Ads. In relation to this activity, the Controller and Meta Platforms Ireland Limited act as joint controllers pursuant to Article 26 GDPR for the stage of data collection through the form: the Controller determines the purposes and types of data to be collected; Meta provides the form’s technical infrastructure and processes the data for its own platform purposes. The Controller is the sole controller for the subsequent marketing activities carried out with the data thus collected. For processing carried out by Meta as an independent controller, please refer to Meta’s privacy notice: https://www.facebook.com/privacy/policy/. Meta’s terms of use for contact acquisition advertisements are available at: https://www.facebook.com/legal/lead_ads_terms. The transfer of data to Meta (with servers in the United States) takes place under the EU-US Data Privacy Framework (EU Implementing Decision 2023/1795) and, additionally, by means of Standard Contractual Clauses pursuant to Article 46(2)(c) GDPR. Consent may be freely withdrawn at any time by sending a request to privacy@guzzini.com. |
|
Legal basis |
The data subject’s express and specific consent — Article 6(1)(a) GDPR, expressed by completing and submitting the Meta instant form with the relevant consent boxes ticked. Records of consents collected through Meta are retained for 10 years to demonstrate compliance with data protection obligations. |
|
Retention period |
Until the specific consent given is withdrawn (newsletter, birthday promotion, profiling). Data relating to the collection and any withdrawal of consent are retained for 10 years. |
|
Nature of the provision |
Optional and entirely independent. Failure to consent does not affect any of the other processing purposes. |
5. Recipients of the data
The personal data collected through the Site may be disclosed, to the extent strictly necessary to pursue the purposes set out above, to the following categories of recipients:
• Data processors pursuant to Article 28 GDPR: hosting and IT infrastructure service providers; e-commerce platform providers; e-mail service providers; newsletter delivery platforms; web analytics service providers (where not acting as independent controllers); payment service providers; couriers and logistics companies; customer support service providers (live chat, CRM).
• Meta Platforms Ireland Limited: (i) as joint controller pursuant to Article 26 GDPR for the upload, matching, custom audience selection, ad display and reporting operations relating to the Custom Audiences service (see purpose H) — with the Controller as sole controller only for the initial collection of e-mail addresses and telephone numbers; (ii) as joint controller pursuant to Article 26 GDPR for the stage of data collection through the Lead Ads instant forms (see purpose M); (iii) as independent controller for its own platform purposes (e.g., security, fraud prevention, service improvement). The essence of the joint controllership arrangements is available, respectively, at: https://www.facebook.com/legal/terms/customaudience (Custom Audiences) and https://www.facebook.com/legal/lead_ads_terms (Lead Ads). In accordance with Article 26(3) GDPR, the data subject may exercise their rights against each joint controller regardless of the arrangements agreed between them.
• Employees and staff of the Controller, authorised to process data within the scope of their respective duties.
• Banks and payment providers, to the extent necessary to manage transactions and prevent fraud.
• Law firms and consultancy firms, limited to purpose L) (defence of a legal claim).
• Public and judicial authorities, where disclosure is required by law or requested by the competent authority.
The data will not be disseminated to an indefinite number of persons, nor disclosed to third parties for purposes of their own, except as set out in purposes H) and M) with regard to processing carried out by Meta as an independent controller. The up-to-date list of data processors may be requested by writing to privacy@guzzini.com.
6. Transfer of data outside the European Economic Area (EEA)
Personal data are processed predominantly within the European Union. Some service providers (including Meta Platforms, Inc. and Google LLC, for e-mail and analytics services) are based in the United States. Transfers to such entities take place on the basis of a European Commission adequacy decision (EU-US Data Privacy Framework, adopted by EU Implementing Decision 2023/1795) and, additionally, by means of Standard Contractual Clauses approved by the European Commission pursuant to Article 46(2)(c) GDPR. For any transfers to third countries not covered by an adequacy decision, the Controller will adopt the appropriate safeguards provided for under Articles 46-47 GDPR. The data subject may request further information on the transfer mechanisms adopted by writing to privacy@guzzini.com.
7. Automated processing and profiling
Except for the profiling for personalised marketing purposes described in purpose G), the Controller does not carry out automated profiling that produces legal effects or similarly significantly affects the data subject within the meaning of Article 22 GDPR. In any event, no decision based solely on automated processing is made in respect of data subjects. The analyses of aggregated data referred to in the section on profiling (purpose G) do not result in legally binding decisions.
8. Security measures
The Controller adopts technical and organisational measures appropriate to the risks of the processing, pursuant to Article 32 GDPR, in order to ensure an adequate level of security, including measures suitable to prevent unauthorised access, loss, destruction or disclosure of personal data. Data are transmitted using encryption protocols (TLS/HTTPS). Should the data subject believe that their personal data have been subject to a breach, they are invited to contact the Controller immediately at privacy@guzzini.com. The list of security measures is available from the Controller upon request.
9. Rights of the data subject
The data subject has the right, at any time, to exercise the following rights against the Controller, as provided for under Articles 15-22 GDPR:
• Access (Article 15 GDPR): to obtain confirmation of processing and access to the data as well as to information on the purposes, categories of data, recipients and retention period.
• Rectification (Article 16 GDPR): to obtain the correction of inaccurate data or the completion of incomplete data.
• Erasure (Article 17 GDPR): to obtain the deletion of data (“right to be forgotten”) where the statutory conditions are met.
• Restriction (Article 18 GDPR): to obtain the restriction of processing in the cases provided for by law.
• Portability (Article 20 GDPR): to receive, in a structured, machine-readable format, the data processed on the basis of consent or the performance of a contract.
• Objection (Article 21 GDPR): to object to processing based on the Controller’s legitimate interest, unless the Controller demonstrates compelling legitimate grounds that override the interests of the data subject.
• Withdrawal of consent (Article 7(3) GDPR): to withdraw, at any time, the consent given for purposes E), F), G), H) and M), without affecting the lawfulness of processing carried out prior to the withdrawal.
• Objection to direct marketing (Article 21(2) GDPR): to object at any time to the processing of data for direct marketing purposes, including profiling related to such marketing.
The above rights may be exercised by writing to: FRATELLI GUZZINI S.p.A. — C.da Mattonata 60, 62019 Recanati (MC), Italy — e-mail: privacy@guzzini.com.
The Controller will respond to requests within 30 days of receipt, which may be extended by a further 60 days in cases of particular complexity, notifying the data subject of any extension within the initial time limit (Article 12 GDPR).
The data subject also has the right to lodge a complaint with the competent supervisory authority. For residents of Italy: the Garante per la protezione dei dati personali (Italian Data Protection Authority) (www.garanteprivacy.it). The data subject may also contact the supervisory authority of the EU Member State in which they habitually reside or work.
With regard to processing carried out under joint controllership with Meta Platforms Ireland Limited (purposes H and M), the data subject may exercise their rights either against the Controller (at privacy@guzzini.com) or directly against Meta, in accordance with the methods set out in Meta’s privacy notice (https://www.facebook.com/privacy/policy/) and through the tools made available by the platform, including the “Why am I seeing this ad?” feature and the Facebook/Instagram account privacy settings. Pursuant to Article 26(3) GDPR, the data subject may exercise their rights against each of the joint controllers, regardless of the arrangements agreed between them. The essence of the joint controllership arrangements with Meta is available at the following addresses: https://www.facebook.com/legal/terms/customaudience (Custom Audiences — purpose H) and https://www.facebook.com/legal/lead_ads_terms (Lead Ads — purpose M).
10. Updates to this notice
This notice may be amended to reflect regulatory, case-law or technological developments. The Controller undertakes to notify data subjects who are newsletter subscribers of any material changes by e-mail. The updated version will always be available on the Site, indicating the date of the last update.
Ver. dated 24.03.2026 — Rev. 2
The Data Controller — FRATELLI GUZZINI S.p.A.