Privacy policy

1. Data Controller 

A.P.G. Srl Via Marco Biagi, 1 - 37060 - Bonferraro di Sorgà - Verona - (Italy) 

• Personal and contact data: name, surname, physical shipping and billing address, email, phone number. 

• Tax and transactional data: tax code, billing data, purchase history, payment details, and information related to the fulfillment of e-commerce orders. 

• Browsing data and system logs: IP addresses, request times, method used to submit the request to the server, online identifiers, and other parameters relating to the operating system and the user's IT environment. 

• Data provided voluntarily: information sent via the contact form, communications to customer support, contents of curricula vitae submitted for job applications, or audiovisual and photographic material provided for specific initiatives. 

• Methods: Processing is carried out using both automated tools (IT and telematics) and manual/paper tools, with logics strictly related to the purposes and for the time strictly necessary to achieve them. 

• Minimization and Security: The Controller applies the principle of "data minimization", collecting only the information necessary for the execution of activities. Electronic and paper archives are protected by adequate technical and organizational security measures (Art. 32 GDPR) designed to prevent loss of information, unlawful, unauthorized use, and improper access. 

• Location: Data are processed at the operational headquarters of the company, in remote storage/cloud systems, and at the servers of external suppliers appointed as Data Processors. 

• Performance of the contract and E-commerce (Art. 6, point b GDPR): Browsing the website, managing online purchase orders, processing payments, shipping and delivering products, managing returns and customer support. For B2B (business) sales, processing may also concern the contact details (email, phone) of directors, employees, or collaborators who manage the contract. 

• Compliance with legal obligations and administrative-accounting purposes (Art. 6, point c GDPR): Compliance with tax, accounting, civil law, and regulatory obligations related to business activity. 

• Management of contact and support requests (Art. 6, point b GDPR): Responding to requests for commercial, technical, or assistance information sent via contact forms or email. 

• Soft-Spam and Direct Commercial Communications (Art. 6, point f GDPR & Art. 130 para. 4 Legislative Decree 196/2003): Sending promotional communications via email for products or services similar to those already purchased. The user has the right to object at any time (opt-out) through the designated link at the bottom of the emails or by contacting the Controller. 

• Subscription to the Newsletter and General Marketing (Art. 6, point a GDPR): Subject to the explicit consent of the user, sending newsletters and commercial communications related to A.P.G. S.r.l. products. 

• Profiling of consumer habits (Art. 6, point a GDPR): Subject to explicit and specific consent, analysis of preferences and purchasing habits to send personalized communications. 

• Participation in events, contests, and surveys (Art. 6, point a GDPR): Involvement of users in promotional initiatives, events, prize contests, or customer satisfaction analysis. 

• Management of photographic and audiovisual material (Art. 6, point a GDPR): Publication of images or videos on the website or company social channels, governed by specific release forms and information notices with express consent. 

• Personnel selection (Art. 6, point b/a GDPR): Evaluation of Curricula Vitae sent spontaneously or in response to job postings. 

• Protection of rights and defense in court (Art. 6, point f GDPR): Use of data to establish liability in case of computer crimes or to prevent abuses and violations of the Website's Terms of Use. 

• Internal personnel authorized and instructed in processing (administrative, commercial, logistics, IT). 

• IT companies, hosting providers, platforms for sending newsletters (e.g., Mailchimp/Klaviyo), and e-commerce system managers. 

• Banking institutions, payment gateways, and financial services for managing payments. 

• Couriers, freight forwarders, and logistics companies for product delivery. 

• Legal, tax, accounting consultants, and professional firms. 

• Judicial or administrative authorities for compliance with legal obligations. 

• To third countries subject to an adequacy decision by the European Commission. 

• On the basis of Standard Contractual Clauses approved by the European Commission. 

• To US organizations adhering to the EU-U.S. Data Privacy Framework. 

• Browsing data: for the duration of the session. 

• Contact requests and quotes: maximum 12 months from the management of the request. 

• Contractual, accounting, and tax data (E-commerce): stored for 10 years in compliance with civil law and tax obligations. 

• Newsletter and Marketing data: until consent is revoked or opposition (opt-out) is exercised by the user. 

• Profiling data: up to a maximum of 24 months from registration or revocation of consent. 

• Curricula Vitae: stored for a maximum of 12 months from receipt, after which they will be deleted. 

• Access (Art. 15): Obtain confirmation as to whether or not personal data concerning them are being processed and receive a copy. 

• Rectification (Art. 16): Obtain the updating or correction of inaccurate data. 

• Erasure / Right to be forgotten (Art. 17): Request the erasure of their information in cases provided for by law. 

• Restriction of processing (Art. 18): Request the restriction of processing under certain conditions. 

• Data portability (Art. 20): Receive the information in a structured, commonly used, and machine-readable format. 

• Objection (Art. 21): Object at any time to the processing (e.g., for direct marketing or profiling). 

• Revocation of consent: Revoke authorization at any time without affecting the lawfulness of processing based on consent given before its revocation. 

• Complaint: Lodge a complaint with the Data Protection Authority (www.garanteprivacy.it) or bring an action before the appropriate judicial venues. 

• Information Notice for Customers 

• Information Notice for Sending CVs and Applications 

• Video Surveillance Information Notice