Privacy Policy

1. Data Controller

The Data Controller for your personal data is:
Gabbianelli Srl
Largo Schuster 1, 20122 – Milan (MI) – IT
VAT / Tax Code: IT14599590966
Privacy contact email: info@gabbianelli.com

2. Types of Data Collected

During the navigation and use of this website, the Data Controller collects the following categories of personal data:

  • Data provided voluntarily by the user:
    • Contact form: first name, last name, email address, message content, and—if provided optionally—company name, country, and phone number.
    • Download unlock forms: email address and any other details required to access informative materials.
    • Newsletter subscription form: email address.
  • Navigation data: the computer systems and software procedures used to operate this website acquire, during their normal operation, certain personal data whose transmission is implicit in the use of Internet communication protocols (e.g., IP addresses, domain names of computers used by users, time of the request, method used to submit the request to the server, numerical code indicating the status of the server response). This data is used solely to obtain anonymous statistical information on site usage, verify its proper functioning, and ensure infrastructure security. For details on the cookies used on this website, please refer to our Cookie Policy.

3. Purposes, Legal Basis, and Nature of Data Provision

Personal data is processed for the following purposes:

A. Managing contact and information requests

To respond to inquiries sent via the contact form.

  • Legal basis: performance of pre-contractual measures taken at the data subject’s request (Art. 6, par. 1, let. b GDPR).
  • Nature of provision: providing data marked as mandatory is necessary to receive a reply; failure to provide it makes it impossible to process the request. Providing optional data (company, country, phone) is voluntary and serves solely to facilitate handling your inquiry.

B. Providing restricted content (download unlock)

To allow users to download catalogs, technical sheets, or other informative materials available on the website.

  • Legal basis: performance of pre-contractual measures or a service requested by the data subject (Art. 6, par. 1, let. b GDPR).
  • Nature of provision: providing an email address is necessary to unlock access to the files; without it, downloading the materials will not be possible.

C. Sending newsletters and informational/promotional communications

To send product updates, company news, and marketing communications via email, strictly subject to the user’s explicit consent given via a dedicated optional checkbox.

  • Legal basis: consent of the data subject (Art. 6, par. 1, let. a GDPR).
  • Nature of provision: completely optional. Refusing consent does not affect browsing the website, submitting contact inquiries, or unlocking downloads in any way.

D. Website security and technical operation

To prevent fraud, abuse, or cyberattacks and ensure platform stability.

  • Legal basis: legitimate interest of the Data Controller (Art. 6, par. 1, let. f GDPR).

4. Processing Methods and Data Recipients

Processing is carried out using IT and telematic tools, implementing appropriate technical and organizational security measures to prevent data loss, unlawful or improper use, and unauthorized access.

Personal data will never be disseminated, but may be shared with third parties providing services instrumental to the Controller’s activities, duly appointed as Data Processors pursuant to Art. 28 of the GDPR, including:

  • MailerLite (UAB “MailerLite” / MailerLite Limited), for managing data collection forms, contact storage, and newsletter delivery;
  • Epta Tech S.r.l., for web hosting and server infrastructure maintenance;
  • external IT and technical website maintenance providers, where applicable.

An updated list of Data Processors is available upon request by writing to info@gabbianelli.com.

5. Data Transfers Outside the EEA

Personal data is stored on servers located within the European Economic Area (EEA). Should technical requirements linked to the service providers listed above necessitate transferring data to third countries outside the EEA, the Data Controller ensures that such transfers occur strictly in compliance with Art. 44 et seq. of the GDPR—namely to countries covered by an Adequacy Decision of the European Commission (including the EU-US Data Privacy Framework for the United States) or subject to Standard Contractual Clauses (SCCs) approved by the European Commission.

6. Data Retention Period

  • Purpose A (Contact requests) and Purpose B (Download unlock): data will be retained for a maximum period of 24 months from collection, unless a commercial or contractual relationship is established; in such case, data will be retained for the entire duration of the relationship and for the subsequent 10 years in compliance with civil and tax obligations.
  • Purpose C (Newsletter): data will be retained until the user withdraws consent (unsubscribes), which can be done at any time by clicking the unsubscribe link at the bottom of every email or by contacting the Data Controller.
  • Purpose D (Navigation data): technical navigation logs are retained strictly for the time necessary for security and technical maintenance purposes (typically no longer than 7–30 days, unless required for investigating cybercrimes by judicial authorities).

7. Absence of Automated Decision-Making

The Data Controller does not use any automated decision-making processes, nor does it carry out profiling activities pursuant to Art. 22 of the GDPR.

8. Data Subject’s Rights

Pursuant to Articles 15–22 of the GDPR, users have the right to obtain from the Data Controller, where applicable:

  • access to their personal data and confirmation as to whether or not personal data concerning them is being processed (Art. 15);
  • rectification of inaccurate data or completion of incomplete data (Art. 16);
  • erasure of personal data (“right to be forgotten”, Art. 17);
  • restriction of processing (Art. 18);
  • data portability in a structured, commonly used, and machine-readable format (Art. 20);
  • objection to processing based on legitimate interest (Art. 21);
  • withdrawal of consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal (Art. 7).

Requests should be sent via email to: info@gabbianelli.com.

Users who believe that the processing of their personal data infringes the GDPR also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali – www.garanteprivacy.it) or with the supervisory authority of the EU Member State of their habitual residence or place of work.

Last updated: November 2026