Data Controller
Imprese Bagnone snc di Bagnone Michele & C.
VAT No. and Tax Code 01605040110
Via Alta Vecchia, 5 19038 Sarzana, La Spezia – Italy
info@bagnone.com
+39 0187 761856
The Data Controller informs you that your data will be processed in the manner and for the purposes indicated below. Furthermore, the Data Controller commits to protecting the privacy and confidentiality of Personal Data in compliance with the principles of fairness, lawfulness, transparency, and protection of your rights.
Types of data processed
We will process personal data communicated by you during requests sent spontaneously, as well as data collected autonomously by the website.
- Data provided by you: common and identifying personal data, such as first name, last name, email address, phone number, company name, and the content of your request, communicated to make requests via email, through the contact form, or by phone regarding our products/services.
- Data we collect automatically: data collected using cookies or similar technologies. For more information, view the Cookie Policy.
N.B. Users under the age of 14 cannot provide any personal data without the consent of their parents or guardians (Art. 8 GDPR and Art. 2-quinquies of the Italian Privacy Code).
Purposes, legal bases and retention periods of processing
We will process your personal data for the purposes, according to the legal bases, and for the retention periods indicated below:
- Purpose: to fulfill our contractual obligations; provide a response to your information requests; calculate a quote you requested; execute purchase contracts for products or service engagement contracts; provide you with the necessary assistance for purchased products and services.
Legal basis: performance of a contract to which you are party or pre-contractual measures taken at your request (Art. 6(1)(b) GDPR).
Retention period: for the entire duration of the contractual relationship and, after its termination, for the time necessary to comply with legal obligations and to defend legal claims. - Purpose: to perform aggregate statistical analysis to improve our services.
Legal basis: the Controller’s legitimate interest in improving its products and services (Art. 6(1)(f) GDPR).
Retention period: no more than 14 months from the collection of the data. - Purpose: administrative purposes and compliance with legal obligations such as those of an accounting or tax nature, or to act upon requests from judicial authorities.
Legal basis: compliance with a legal obligation to which the Controller is subject (Art. 6(1)(c) GDPR).
Retention period: no more than 10 years from the end of the relationship, in accordance with applicable legal obligations. - Purpose: in the case of sending a curriculum vitae, exclusively for recruitment purposes.
Legal basis: pre-contractual measures taken at your request (Art. 6(1)(b) GDPR).
Retention period: no more than 24 months from receipt, unless you request otherwise.
Where processing is based on your consent (for example, to send promotional communications or to use certain cookies), you have the right to withdraw it at any time, without affecting the lawfulness of processing carried out before the withdrawal.
Is providing data mandatory?
Providing your data is always optional, but failure to provide it could make it impossible to proceed with some processing, such as that strictly connected to fulfilling a contract or providing the services you requested.
Location and methods of processing
The processing of your personal data is carried out through the operations indicated in Art. 4 no. 2) of the GDPR, specifically: collection, registration, organization, storage, consultation, processing, modification, selection, extraction, comparison, use, interconnection, communication, deletion, and destruction of data.
Your personal data are stored at the Controller’s premises and are processed both in paper and electronic and/or automated formats, with logic strictly related to the purposes indicated and in any case in a way that guarantees the security and confidentiality of the data.
The retention periods for each purpose are indicated in point 2 above.
Access to data
Your data may be made accessible for the purposes indicated in point 2:
- to employees and collaborators of the Controller, in their capacity as persons in charge and/or internal data processors and/or system administrators;
- to third-party companies or other entities (website providers, cloud providers, e-payment service providers, suppliers, hardware and software assistance technicians, shippers and carriers, credit institutions, professional firms, etc.) that perform outsourced activities on behalf of the Controller, in their capacity as data processors.
Disclosure and transfer of data
Data will not be disseminated, sold, or exchanged with entities other than the Controller, the processors, and the appointed personnel without your express and explicit consent.
Your data are generally processed within the European Union. Should some providers (for example cloud or email service providers) involve a transfer of data to third countries outside the European Economic Area, the Controller ensures that such transfer takes place in compliance with Art. 44 et seq. of the GDPR, on the basis of an adequacy decision by the European Commission or appropriate safeguards (for example the Standard Contractual Clauses adopted by the European Commission). You may request a copy of the safeguards adopted by contacting the Controller.
Your rights
You have the right to know what personal data are being processed. In particular, you are entitled to the right of access, rectification, and erasure, as well as the right to data portability, the right to restriction of processing, and the right to object to the processing, where the conditions are met.
Below is a brief explanation of the rights granted to you with regard to the processing of your personal data.
- The right of access allows you to obtain confirmation as to whether or not personal data concerning you are being processed by the Controller and, if so, to access such data and the related information;
- The right to rectification allows you to obtain the correction of inaccurate personal data concerning you without undue delay and, considering the purposes of the processing, to obtain the completion of incomplete personal data;
- The right to erasure allows you to obtain the deletion of data concerning you without undue delay (e.g., when your personal data are no longer necessary in relation to the purposes for which they were collected), subject to the exceptions provided by applicable law (e.g., when the retention of your data is necessary to comply with legal obligations applicable to the data controller). Deletion will be carried out within the technical times provided;
- The right to data portability allows you, in certain circumstances provided by applicable law, to receive in a structured, commonly used, and machine-readable format the personal data concerning you that you have provided. You may transmit these data to another data controller, provided that this right can be recognized under applicable law and except where this may result in harm to the rights and freedoms of others;
- The right to restriction of processing allows you, in certain circumstances provided by applicable law, to obtain the restriction of the processing of your personal data. In such cases, the Controller may continue to process your data only in certain cases, such as for the exercise of the right of defense or to protect the rights of another natural or legal person;
- The right to object to processing allows you, in certain circumstances provided by applicable law, to object to the processing of your personal data unless there are legitimate prevailing reasons, rights, or freedoms that allow the Controller to continue the processing;
- The right to withdraw consent allows you, where processing is based on your consent, to withdraw it at any time, without affecting the lawfulness of processing carried out before the withdrawal;
- The right to lodge a complaint allows you, if you believe that the processing of your data infringes applicable law, to lodge a complaint with the competent supervisory authority. In Italy this is the Italian Data Protection Authority (Garante per la protezione dei dati personali) (www.garanteprivacy.it), without prejudice to any other administrative or judicial remedy.
To obtain more information on the processing of your personal data or to exercise your rights, we invite you to contact us.
Changes to this information notice
This Information Notice may be subject to changes. We therefore recommend that you check this Notice regularly and refer to the most updated version.
Last updated: 15th September 2026
