How data submitted through the website is handled.

Data processed

The forms process name, company, contact details, message content and, in the technical pathways, the project information the user chooses to provide. Fields identified as required in the form are necessary to submit the enquiry.

Purposes and legal bases

The data is used to respond and, where requested, to take pre-contractual steps at the data subject’s request (Article 6(1)(b) GDPR). Website security and abuse prevention rely on the controller’s legitimate interests (Article 6(1)(f) GDPR).

Recipients and technical services

Requests are sent through turboSMTP to authorised Vetroresina Padana contacts and managed in corporate Microsoft 365 mailboxes. Hosting services, Cloudflare Turnstile and iubenda provide infrastructure, form protection and preference management respectively. Data is not sold or publicly disclosed.

Retention

Vetroresina Padana receives enquiries, responds and, where relevant, prepares a quotation. Enquiries, replies and correspondence remain in corporate mailboxes; quotations are also stored in the relevant database. Currently there is no set deletion deadline and no periodic deletion is planned. This description of current practice does not establish GDPR-compliant unlimited retention: specific periods or criteria still need to be defined and applied separately for enquiries without follow-up, customer relationships and legal obligations. Technical data retention by providers also remains to be verified.

Data subject rights

You may request access, rectification, erasure, restriction, portability where applicable, or object to processing. You may also lodge a complaint with the Italian Data Protection Authority. Use the contact details above to exercise your rights.

Transfers and automated processing

Vetroresina Padana does not sell or publicly disclose the data received. However, data is processed by the technical providers used for the services described above: internal handling of enquiries does not demonstrate that all processing takes place within the European Economic Area. Providers’ contractual roles, processing locations and possible transfers remain to be verified. For transfers outside the European Economic Area, the applicable conditions and safeguards under the GDPR must be identified. No profiling or automated decision-making is planned.

Cookies and preferences

iubenda manages the banner and stores explicit acceptance or rejection. No optional analytics or marketing technologies have been added; both choices leave necessary protections active. See the Cookie policy for verified technologies and known lifetimes. No newsletter or marketing consent is added to contact forms.

Cookies

NODO IA private area

Access to the NODO IA private area is reserved for customers after the contract has been signed and for the duration of the service relationship. Access is intended to be deactivated when the service ends; this notice does not verify an automated process. Deactivation is separate from the retention of customer data and relationship records: retention requires its own purposes, legal bases and periods or criteria, to be specified as explained in the Retention section. Customer status alone does not justify unlimited retention. The area manages accounts, permissions and sessions on the website infrastructure. A session cookie is set after successful login and does not contain the password; its lifetimes and protections are described in the Cookie policy.