PRIVACY NOTICE ON THE PROCESSING OF PERSONAL DATA PURSUANT TO ART. 13 OF REGULATION (EU) 2016/679

Website

Introduction

Through this notice, drafted pursuant to Art. 13 of Regulation (EU) No. 679/2016 (hereinafter, the “Regulation”), Irplast S.p.A. (hereinafter also the “Company” or the “Data Controller”), in its capacity as Data Controller, provides you with the following information regarding the processing of your personal data carried out when browsing the Company’s Website.

  1. Data Controller

The Data Controller is Irplast S.p.A., with registered office at Via Alcide De Gasperi No. 10, 50053 Empoli (FI), VAT No. IT01295310484

Contact details: a) telephone: 05719701; b) email: privacy@irplast.com

Please also note that the Company has appointed a Data Protection Officer, who can be contacted at the same email address.

  1. Types of data processed

For the purposes indicated below, the following categories of Data will be processed:

  • common or identifying data, such as, by way of example: name, surname, residential address, email and telephone contact details, tax code.
  1. Purposes and legal basis of processing
  Purpose of processing Legal basis of processing
a) Browsing the Website, obtaining anonymous statistical information on its use, checking its proper functioning and identifying any malfunctions and/or abuse. Legitimate interest of the Data Controller (Art. 6(1)(f) GDPR).
b) Commercial communications through the sending of newsletters. Consent (Art. 6(1)(a) GDPR).
c) Managing your contact request. Performance of a contract or pre-contractual measures (Art. 6(1)(b) GDPR).
d) Establishing, exercising or defending a right of the Data Controller. Legitimate interest of the Data Controller (Art. 6(1)(f) GDPR).

With reference to cookies, please see the specific Notice available in the dedicated section of this Website.

  1. Nature of data provision

The provision of personal data is optional, but necessary in order to browse the Data Controller’s website.

Failure to provide personal data makes it impossible to browse the website correctly.

With reference to the newsletter service, consent may be withdrawn at any time by sending a specific request to the Data Controller at the contact points indicated above. Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.

The provision of data to receive the newsletter is optional and does not affect the other purposes of processing.

  1. Retention period (Data Retention)

Personal data will be processed for the time necessary to pursue the purposes indicated above, in compliance with the legislation in force.

Data relating to processing carried out in connection with commercial communications through the sending of newsletters (para. 3 letter b) will be retained for the time strictly necessary to achieve the purposes indicated above, in compliance with the legislation in force and, in any case, for a period not exceeding 24 months from the provision of consent or from any renewal thereof.

If consent is subsequently withdrawn, the Data Controller will keep evidence of the relevant expression of will solely for evidentiary purposes and to protect its rights, in order to demonstrate that the data subject validly provided consent, for a period of ten years.

An additional retention period in the event of litigation is reserved. In that case, personal data will be retained until the conclusion of the proceedings and the enforcement of the relevant decision.

  1. Recipients of personal data

The following categories of subjects may have access to personal data:

  1. Within the organisational structure of the Data Controller, within the limits and according to the methods of their respective duties and exclusively if necessary to pursue the purposes indicated above, the subjects identified as persons designated to process data pursuant to Art. 2-quaterdecies of Legislative Decree 196/2003, or the persons authorised to process data pursuant to Art. 29 of Regulation (EU) 679/2016. Such subjects act on the basis of specific instructions provided by the Data Controller in order to process your personal data securely;
  2. Subjects identified as Data Processors pursuant to Art. 28 of Regulation (EU) 679/2016 who process personal data on behalf of the Data Controller in relation to specific purposes (e.g. consultants). Such subjects act on the basis of a specific contract aimed at ensuring the secure processing of your personal data.

A complete list of such subjects may be requested by contacting the Data Controller at the contact details indicated in this notice.

  1. Transfer of personal data to countries outside the EEA

The Data Controller does not transfer your personal data to countries outside the EEA.

If any third parties are based in, or use cloud services located in, States outside the European Union, please note that such States provide an adequate level of data protection, as established by specific decisions of the European Commission.

The transfer of personal data to third parties resident or located in States outside the European Union and which do not ensure adequate levels of protection will be carried out only with the data subject’s consent or after the conclusion between the Data Controller and those parties of specific agreements containing safeguard clauses and appropriate guarantees for the protection of personal data, so-called “standard contractual clauses”, also approved by the European Commission, or where the transfer is necessary for the conclusion and performance of the contract between the Data Controller and the data subject or for the management of your requests.

  1. Rights of the data subject

Please note that you may exercise the following rights in relation to the personal data covered by this notice, as provided for and guaranteed by the Regulation:

  1. Right of access and rectification (Articles 15 and 16 of the Regulation): you have the right to access your personal data and to ask that they be corrected, amended or supplemented. If you wish, we will provide a copy of your data in our possession.
  2. Right to erasure of data (Art. 17 of the Regulation): in the cases provided for by the legislation in force, you may request the erasure of your personal data. Once your request has been received and analysed, we will cease the processing and erase your personal data, where the request is found to be legitimate.
  3. Right to restriction of processing (Art. 18 of the Regulation): you have the right to request restriction of the processing of your personal data in the event of unlawful processing or where the data subject contests the accuracy of the personal data.
  4. Right to data portability (Art. 20 of the Regulation): you have the right to ask the Data Controller to obtain your personal data in order to transmit them to another Controller, in the cases provided for by the referenced article.
  5. Right to object (Art. 21 of the Regulation): you have the right to object at any time to the processing of your personal data carried out on the basis of our legitimate interest, explaining the reasons that justify your request; before accepting it, the Data Controller will assess the reasons for your request.
  6. Right to lodge a complaint (Art. 77 of the Regulation): you have the right to lodge a complaint with the competent Data Protection Supervisory Authority if you consider that a breach of your rights has occurred, or is ongoing, with regard to the processing of your personal data.
  7. Right to withdraw consent given (Art. 7 of the Regulation): you have the right to withdraw, at any time, any consent given for specific processing activities.

At any time, you may exercise your rights by writing to the Data Controller at the contact details indicated in this notice.

  1. Organisational and technical security measures pursuant to Art. 32 of Regulation (EU) 679/2016

The Data Controller adopts adequate and preventive security measures aimed at safeguarding the confidentiality, integrity, completeness and availability of the data subject’s personal data. Technical, logistical and organisational measures have been implemented to prevent damage, including accidental loss, alteration, improper and unauthorised use of the processed data.

  1. Changes to this notice

This privacy notice may be amended and supplemented over time, as necessary due to new regulatory measures concerning personal data protection, or due to the evolution/change of the Data Controller’s operations.

In that case, the Data Controller undertakes to provide you with the updated notice.

 

Last updated: March 2026