Privacy notice pursuant to Articles 13-14 of EU Regulation no. 2016/679 (GDPR)
Date of preparation: 24 June 2026
1. Data Controller
VIPA S.p.A.
Via Abetone, 20 Carpi 41012 MO
Email: info@vipaspa.it
2. Types of data collected
During browsing the following data may be collected:
- Navigation data (IP, browser, pages visited, access time)
- Voluntarily provided data (name, email, message via form)
- Technical identifiers (cookies, session ID)
- Advertising identifiers (if analytics or advertising services are active)
3. Purposes and legal basis of processing
The table summarises the main processing purposes, categories of data, legal basis and retention criteria applicable to the website.
| Purpose | Data processed | Legal basis | Indicative retention |
|---|---|---|---|
| Technical operation of the website | browsing data, technical logs, IP address, session identifiers | controller's legitimate interest in security and proper operation; technical necessity to provide the requested service | for the time necessary for operation, security and maintenance |
| Loading of external technical resources | fonts, stylesheets, libraries or technical files loaded from third-party providers; listed domains: fontawesome.com, fonts.googleapis.com | Controller's legitimate interest in the proper display and technical operation of the website interface | for the technical time necessary to load the resource |
| Replying to requests through forms or email | name, email, phone number, message content and other data voluntarily provided | pre-contractual measures or management of the data subject's request | for the time necessary to reply and manage follow-ups |
| Newsletter and commercial communications | email, name if provided, subscription preferences and consent proof | data subject's consent | until consent is withdrawn or unsubscribe |
| External content and preferences | IP, browser technical data, interactions with third-party iframes or widgets | data subject's consent, except where content is strictly necessary for the requested service | until consent withdrawal or according to providers' retention periods |
| Statistics and audience measurement | online identifiers, browsing events, visited pages and device technical data | data subject's consent, except anonymised analytics configured as technical where applicable | until consent withdrawal or according to cookies/services duration |
| Protection against spam, bots and abuse | technical data, IP address, form interactions and security parameters | legitimate interest in website security and abuse prevention | for the time necessary for security checks |
External technical resources and fonts
The website may use external technical resources, such as fonts, stylesheets or libraries loaded from third-party providers, necessary for the proper graphic display and operation of the interface. Loading these resources may involve transmitting technical data to the provider, such as IP address, browser information, requested URL and referrer. Listed domains/providers: fontawesome.com, fonts.googleapis.com. These resources are not normally cookies and are not used, by themselves, for analytics or marketing purposes.
Contact form
Legal basis: Art. 6(1)(b) GDPR — pre-contractual measures at the request of the data subject.
Form data (name, email, message) is processed to respond to the request. It is not publicly disclosed and may be processed by technical providers or authorised persons supporting the Controller in website and communication management, where necessary and under GDPR-compliant arrangements. Retention: 24 months from last contact.
Newsletter and commercial communications
Legal basis: Art. 6(1)(a) GDPR — explicit consent of the data subject.
With explicit consent, contact data is used for newsletters and commercial communications. Subscription via double opt-in. Revocable at any time.
For the technical management of subscriptions, the Controller uses MailUp / TeamSystem, which may process personal data on behalf of the Controller.
Google reCAPTCHA
Legal basis: Art. 6(1)(f) GDPR — legitimate interest in information system security.
Used to protect forms from spam and bots. Technical data is transmitted to Google Ireland Limited / Google LLC. Google Privacy Policy
4. Third-party services
The website uses the following third-party services that may process data on behalf of or independently from the Controller:
Simple Analytics — sa.vipaspa.it
Statistical visit measurement service, email clicks, outbound links and downloads. Legal basis: Art. 6(1)(a) GDPR (consent). Privacy Policy
Google Maps — Google Ireland Limited / Google LLC
Embedded geographic maps. Data: IP, map interactions. Legal basis: Art. 6(1)(a) GDPR (consent). Extra-EU transfer. Privacy Policy
YouTube — Google Ireland Limited / Google LLC
Embedded videos. Data: device identifiers, videos viewed. Legal basis: Art. 6(1)(a) GDPR (consent). Extra-EU transfer. Privacy Policy
Google reCAPTCHA
Used to protect forms from spam and bots. Technical data is transmitted to Google Ireland Limited / Google LLC. Google Privacy Policy
MailUp / TeamSystem — mailup.it
Newsletter management: subscription collection, delivery, consent proof. Legal basis: Art. 6(1)(a) GDPR. Privacy policy
5. Transfer of data outside the EU
Some providers transfer data outside the EU with the following safeguards:
- European Commission adequacy decisions (Art. 45 GDPR)
- Standard contractual clauses (Art. 46 GDPR)
- EU-US Data Privacy Framework, where applicable
6. Data retention
Personal data is retained for the following periods:
- Navigation data and technical logs: 12 months
- Contact data (form): 24 months from last contact
- Account registration data: until deletion or user request
- Tax/billing data (e-commerce): 10 years due to legal obligations
- Third-party cookies: according to the respective provider policy
7. Data security and data breach
The Controller adopts adequate technical and organisational measures (Art. 32 GDPR). In the event of a data breach with risk for data subjects, the Controller notifies the supervisory authority within 72 hours (Art. 33 GDPR) and, where necessary, the data subjects (Art. 34 GDPR).
8. Rights of the data subject
Pursuant to Arts. 15-22 GDPR, you have the right to:
- Access your personal data (Art. 15)
- Rectification of inaccurate data (Art. 16)
- Erasure — right to be forgotten (Art. 17)
- Restriction of processing (Art. 18)
- Data portability (Art. 20)
- Object to processing (Art. 21)
- Withdraw consent at any time (Art. 7)
To exercise your rights: info@vipaspa.it
9. Supervisory authority
You may lodge a complaint with the competent supervisory authority:
In Italy: Garante per la Protezione dei Dati Personali — www.garanteprivacy.it
10. Definitions
- Personal data
- Any information identifying a natural person (Art. 4 no. 1 GDPR)
- Data Controller
- Entity determining purposes and means of processing (Art. 4 no. 7 GDPR)
- Data Processor
- Entity processing data on behalf of the Controller (Art. 28 GDPR)
- Data subject
- The natural person to whom the data relates (Art. 4 no. 1 GDPR)
- Processing
- Any operation on personal data (Art. 4 no. 2 GDPR)
- Consent
- Freely given, specific, informed indication of agreement (Art. 4 no. 11 GDPR)
- Data breach
- Security breach leading to loss or unauthorised access to data (Art. 4 no. 12 GDPR)
11. Changes to this policy
This policy may be updated at any time. The date shown at the top indicates the current version.
For cookie details please refer to the Cookie Policy.