Privacy policy
DRAFT NOT VALIDATED — this text is a proposal under review by the privacy consultant of CPE Italia S.p.A. and is not the final privacy notice. The parts in square brackets are still to be verified or decided.
This notice, provided under Article 13 of Regulation (EU) 2016/679 (“GDPR”), explains how CPE Italia S.p.A. processes the personal data collected through the cpe-italia.com website, in particular through the contact form and the catalogue request form. The use of cookies and similar technologies is described in the cookie policy.
Version: [DA DECIDERE #27] — Last updated: [PUBLICATION DATE]
1. Data controller
CPE Italia S.p.A. — Via Dante Chiasserini 15, 20157 Milan (Italy) — VAT no. IT06735840156 — email info@cpeitalia.it — tel. +39 02 390961. [DA VALIDARE #1: certified email (PEC) and REA number, if they are to be shown]
2. Data Protection Officer (DPO)
[DA VERIFICARE #2: state whether CPE Italia S.p.A. has designated a DPO and give the contact details. If no DPO has been designated, replace with: “CPE Italia S.p.A. has not designated a Data Protection Officer; for any question please write to info@cpeitalia.it”.]
3. What data we process
3.1 Data you enter in the forms
- first name and, in the catalogue request form only, last name;
- company;
- email address;
- telephone number (optional);
- country;
- product or product family of interest and catalogue requested;
- text of your message;
- the box you tick to confirm that you have read this notice.
Please do not include in your message any data that is not needed for your request, in particular special categories of personal data (Article 9 GDPR).
3.2 Data collected automatically when you submit a form
- website language, page from which you send the request, entry page and referring website (referrer);
- campaign parameters that may be contained in the address through which you reached the website (
utm_source,utm_medium,utm_campaign,utm_term,utm_content); - only if you have accepted marketing cookies: advertising click identifiers (
gclid,gbraid,wbraid,fbclid); - country you are connecting from, estimated from your IP address and provided by our hosting provider (Cloudflare);
- a cryptographic fingerprint (SHA-256 hash) of your IP address, calculated with a secret value that changes every day and used only to limit repeated submissions: the plain IP address is not stored in the request archive;
- the result of the Cloudflare Turnstile anti-spam check.
3.3 Technical browsing data
To show you the website and protect it, our hosting provider processes the technical data of each connection (for example IP address, browser type, requested page, date and time). We do not use this data to identify you. [DA VERIFICARE #16: logs and retention periods actually enabled on the Cloudflare account] Statistics and marketing cookies are used only with your consent: see the cookie policy.
4. Purposes and legal bases
We process your data only for the purposes listed below. We keep the reply to your request, which does not require your consent, separate from any marketing activity, which we do not carry out at present.
| Purpose | Data | Legal basis |
|---|---|---|
| a) Replying to your request for information, a quotation or a catalogue, sending you an acknowledgement of receipt and routing it to the department responsible for the product, language and country | form data; language; page; country | Article 6(1)(b) GDPR: steps taken at your request prior to entering into a contract [DA VALIDARE #4] |
| b) Subsequent B2B commercial handling of the same request: follow-up contacts, quotation, possible negotiation and recording in the customer relationship management system (CRM) | form data; status of the request | Article 6(1)(b) GDPR for the steps you requested; Article 6(1)(f) GDPR (legitimate interest of CPE in following up commercially on requests received from businesses) for the follow-up [DA VALIDARE #5] |
| c) Website security and prevention of spam, automated submissions and abuse (Turnstile check, submission limit based on the IP fingerprint, limits on automatic confirmation emails) | IP fingerprint; result of the check; technical data | Article 6(1)(f) GDPR: legitimate interest in the security of systems and forms [DA VALIDARE #6] |
| d) Understanding which page or campaign the request comes from (internal attribution) | entry page; referrer; utm parameters; detected country | Article 6(1)(f) GDPR: legitimate interest in assessing the effectiveness of our contact channels [DA VALIDARE #7] |
| e) Linking the request to the advertisement you clicked on | gclid; gbraid; wbraid; fbclid | Consent: Article 6(1)(a) GDPR and Article 122 of the Italian Privacy Code (Legislative Decree 196/2003), given by accepting marketing cookies; without consent this data is not collected [DA VALIDARE #8] |
| f) Complying with legal obligations and, where necessary, establishing, exercising or defending legal claims | data needed in the specific case | Article 6(1)(c) GDPR (legal obligation) and Article 6(1)(f) GDPR (protection of rights) |
Marketing: not active at present
We do not subscribe you to newsletters and we do not send you automated promotional communications: the emails you receive relate only to the request you sent. Should CPE Italia S.p.A. wish in future to send you commercial communications not related to your request, it will do so only on a separate legal basis (as a rule a specific, separate and optional consent, collected through an unticked box), which you may refuse without any consequence for your request. [DA DECIDERE #9]
Legitimate interest
Where we rely on legitimate interest (purposes b, c and d), we have assessed that your interests and rights do not override it, considering that the data are business contact details you provided yourself for a commercial request. You may ask for information about this assessment and object at any time (section 10). [DA VALIDARE #5: the balancing test must be documented]
5. Mandatory and optional data
Fields marked as mandatory are needed to reply: without them we cannot handle your request. The telephone number and the other optional fields only make it easier to contact you. The box in the form is used to confirm that you have read this notice: it is not a request for consent to processing. [DA VALIDARE #26]
6. How we process the data
Data are processed electronically by authorised and instructed persons, with appropriate technical and organisational measures: encrypted connection (HTTPS), request archive accessible only to the system that handles the forms and to authorised administrators, IP fingerprint instead of the plain address, automatic limits on submissions and confirmation emails.
Automated decision-making
We do not take decisions based solely on automated processing which produce legal effects concerning you or similarly significantly affect you. The anti-spam check is a technical control: if it detects an automated submission, the form is not accepted and you can write to us at info@cpeitalia.it; if the check cannot be performed (for example because your browser blocks the script), the request still reaches CPE but without the automatic confirmation email. [DA VALIDARE #28]
7. Who receives the data
The data are processed by authorised staff of CPE Italia S.p.A., in particular the sales department that receives the notification of the request, and by the following parties, acting as processors under Article 28 GDPR on the basis of a data processing contract or agreement:
| Recipient | Activity | Location and safeguards |
|---|---|---|
| Rockslam S.r.l. | agency managing the website and campaigns on behalf of CPE; receives a copy of the notification of each request for technical support and to check correct operation | Italy — appointment as processor [DA FORMALIZZARE #14] |
| Cloudflare, Inc. | website hosting (Cloudflare Pages), form processing (Functions and Workers), request archive (D1 database, Western Europe region), anti-spam check (Turnstile) | USA — see section 8 [DA VERIFICARE #16] |
| Sendinblue SAS (Brevo) | sending of internal notification emails and of the confirmation email to the requester [DA DECIDERE #18: open tracking is currently enabled in the Brevo account; if it is not disabled it must be disclosed here] | France (EU) [DA VERIFICARE #17] |
| Microsoft (Microsoft 365 service used by CPE Italia) | corporate email on which notifications are received | [DA VERIFICARE #21] |
| HubSpot — planned, not yet active | customer relationship management system (CRM): recording of the contact and of the deal | EU data centre requested; see section 8 [DA VERIFICARE #19] |
Google (Google Tag Manager, Google Analytics 4, Google Ads) receives browsing data only if you accept the related cookies: see the cookie policy. [DA VALIDARE #20]
Other recipients: [DA DECIDERE #15: CPE group companies, distributors or agents who will handle requests for specific countries or languages; if any, they must be listed here with their role]. Data may be disclosed to public authorities where required by law. Data are not made public.
8. Transfers outside the European Economic Area
Some providers belong to groups based in the United States and may process data outside the European Economic Area (EEA), even if only for support or security. In such cases the transfer is based on the European Commission adequacy decision of 10 July 2023 (EU-U.S. Data Privacy Framework), where the provider is certified under it, or on the standard contractual clauses adopted by the Commission (Implementing Decision (EU) 2021/914), with supplementary measures where needed.
| Provider | Proposed safeguard |
|---|---|
| Cloudflare, Inc. | Data Privacy Framework and/or standard contractual clauses [DA VERIFICARE #16] |
| Google Ireland Ltd / Google LLC | Data Privacy Framework and/or standard contractual clauses [DA VERIFICARE #20] |
| HubSpot | Data Privacy Framework and/or standard contractual clauses; storage in the EU data centre [DA VERIFICARE #19] |
| Sendinblue SAS (Brevo) | established in the EU; any sub-processors outside the EEA to be verified [DA VERIFICARE #17] |
| Microsoft | [DA VERIFICARE #21] |
You can ask for information about the safeguards in place by writing to info@cpeitalia.it.
9. How long we keep the data
We keep data only for as long as necessary for the purposes described. The following periods are proposals still to be approved:
| Data | Proposed period |
|---|---|
| Requests that did not lead to a quotation or business relationship (website archive, CRM, notification emails) | 24 months from the request [DA DECIDERE #10] |
| Requests that led to a quotation or a contract | for the duration of the relationship and, after it ends, for the period required by law for contractual and accounting records (as a rule 10 years) [DA DECIDERE #11] |
| IP fingerprint used for the submission limit | 48 hours [DA DECIDERE #12] |
| Copy of the notification received by Rockslam S.r.l. | [DA DECIDERE #13] |
| Email sending logs at Brevo | according to the Brevo account settings [DA VERIFICARE #13] |
| Advertising click identifiers collected with consent | until consent is withdrawn and in any case no longer than the retention period of the request they relate to [DA DECIDERE #10] |
At the end of the period data are deleted or anonymised. They may be kept longer only where necessary to comply with a legal obligation or to defend a legal claim.
10. Your rights
At any time you may ask CPE Italia S.p.A. for:
- access to your data and a copy of it (Article 15 GDPR);
- rectification of inaccurate data or completion of incomplete data (Article 16);
- erasure (Article 17);
- restriction of processing (Article 18);
- portability of the data you provided to us, where applicable (Article 20);
- to object at any time, on grounds relating to your particular situation, to processing based on legitimate interest (Article 21);
- to withdraw your consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal (Article 7(3)).
To exercise your rights write to info@cpeitalia.it [DA DECIDERE #3]. We reply within one month, which may be extended by two further months for complex requests (Article 12 GDPR); we may ask you for information to verify your identity.
To withdraw or change your cookie consent use the “Cookie preferences” link at the bottom of every page of the website.
Complaint to a supervisory authority
If you consider that the processing of your data infringes the GDPR, you may lodge a complaint with the supervisory authority of the Member State of your habitual residence, place of work or place of the alleged infringement (Article 77 GDPR), or seek a judicial remedy. For example:
- in Italy: Garante per la protezione dei dati personali — www.garanteprivacy.it.
11. Changes to this notice
We may update this notice, for example if providers or purposes change. The version in force is always published on this page with the date of the update, and each request sent from the website records the version of the notice in force at the time of submission. [DA DECIDERE #27] This notice is available in Italian, English, French and Spanish; in case of discrepancies the Italian version prevails. [DA DECIDERE #30]