Notice on the processing of personal data of customers and prospective customers, including for marketing purposes, pursuant to Articles 13 and 14 of Regulation (EU) 2016/679
With this notice, ALPI S.p.A. (“ALPI” or the “Controller”), as data controller, wishes to inform its customers, prospective customers and other parties with whom it has or intends to establish business or professional relationships about how their personal data are processed, in accordance with Italian Legislative Decree No. 196 of 30 June 2003 (Decreto Legislativo 30 giugno 2003, n. 196), as subsequently amended and supplemented (the “Privacy Code”), and with Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data (the “European Regulation”).
1. Data controller
ALPI S.p.A., with registered office at Viale della Repubblica, 34, 47015 Modigliana (FC), Italy, VAT No. 00139520407, which can be contacted at the e-mail address privacy@alpi.it, is the controller of the processing of personal data described in this notice.
2. To whom does this Notice apply?
This notice applies to the processing, by the Controller, of personal data relating to:
a) customers, prospective customers and other business or professional counterparties of the Controller, where these are natural persons, self-employed professionals or sole proprietorships;
b) legal representatives, individual shareholders, directors, attorneys-in-fact and other persons vested with powers of representation, management or control, as well as employees, collaborators and contact persons of customers, prospective customers, distributors, agents, business partners, professional firms, design studios and other organisations with which ALPI has or intends to establish business or professional relationships;
c) architects, designers, planners and other professionals who come into contact with ALPI or express interest in its products or collections, or who take part in projects, visits, meetings or other professional occasions with the Controller;
d) persons who contact ALPI through the website, e-mail, social media channels or other channels made available by the Controller, as well as persons who subscribe to the newsletter or who take part, upon registration or enrolment, in trade fairs, events and initiatives of the Controller.
(hereinafter, collectively, the “Data Subjects”). Accordingly, through this notice, the Controller provides Data Subjects with the necessary information on the processing of their personal data, as required by applicable law.
3. What Data are processed?
The Controller collects personal data relating to the Data Subject directly from the Data Subject, where the relationship is established with a natural person, a self-employed professional or a sole proprietorship, or from the company, firm, body or organisation to which the Data Subject belongs. Data may be collected through the Controller's website, by filling in online forms, by sending requests through the contact channels indicated therein, by subscribing to the newsletter or by giving consent to receive informational and promotional communications, as well as in the course of contact requests, meetings, visits, appointments, trade fairs, events and other professional occasions in which the Data Subject takes part or enrols, and during the negotiation, conclusion, performance or termination of the business relationship established with the Controller. Where Data are not collected directly from the Data Subject, they may also come from parties entitled to disclose them to ALPI in the context of the business and professional activities described in this notice.
Depending on the purposes of the processing and the way in which the Data Subject comes into contact with ALPI, the Controller may process the following types of personal data:
a) identification and contact data, such as first name, surname, e-mail address, telephone number, business address and, where necessary, identity document;
b) data relating to professional activity, such as role, function, qualification, company, firm, body or organisation of affiliation, business sector and relevant market or geographical area;
c) data relating to business and professional relationships with ALPI, such as requests made, correspondence exchanged, information relating to meetings and visits, products or collections of interest, projects, business opportunities, orders, purchases and further information collected in the course of the relationship with the Controller;
d) where the Data Subject is a natural person, a self-employed professional or a sole proprietorship, administrative, tax, banking and contractual data necessary for the negotiation, conclusion and performance of the relationship with ALPI;
e) browsing data and information collected when using the website, such as IP address, online identifiers, device and browser data, technical logs and information on interactions with the website;
f) any further personal data provided by the Data Subject or by the organisation to which the Data Subject belongs in the course of relations with the Controller.
The data indicated above are hereinafter collectively referred to as the “Data”. For each of the purposes described in this notice, the Controller processes only the Data that are relevant and necessary to achieve it. Data Subjects are advised not to provide ALPI with personal data that are not necessary for the purposes described in this notice.
4. For what purposes are the Data processed?
The Controller processes the Data Subjects' Data for the following purposes:
a) to carry out, at the Data Subject's request, negotiations and pre-contractual activities, including the analysis of the needs expressed, the exchange of the necessary information and the preparation and negotiation of offers, quotations, commercial proposals and contractual terms. This purpose also includes requests for contact, information, appointments, visits, presentations or commercial follow-up which, on the basis of their actual content, are aimed at the preparation or negotiation of offers, quotations, commercial proposals or other pre-contractual steps specifically requested by the Data Subject;
b) to establish and manage business or professional relationships and to conclude, perform, amend and terminate the related contracts, including the management of orders, deliveries, payments, related services, assistance and after-sales activities;
(the purposes set out in letters a) and b) are hereinafter collectively referred to as the “Contractual Purposes”);
c) to comply with obligations arising from applicable law, including administrative, accounting, tax and civil-law obligations, as well as to follow up on requests from public authorities or other entitled parties;
(the purpose set out in letter c) is hereinafter referred to as the “Legal Purpose”);
d) to respond, at the Data Subject's request, to requests for information or contact received through the website, online forms, e-mail, telephone, social media channels, trade fairs, events, meetings or other channels made available by the Controller, and to provide, again at the Data Subject's request, information on ALPI's products, collections and services, where such activities are of a purely informational, relational or institutional nature and are not aimed at the preparation or negotiation of offers, quotations, commercial proposals or other pre-contractual steps specifically requested by the Data Subject;
e) to manage, at the Data Subject's request, meetings, appointments and visits at showrooms or company premises, as well as the organisational activities strictly connected with such occasions of contact, where such activities have organisational, demonstrative, relational or professional networking purposes and are not linked to pre-contractual steps specifically requested by the Data Subject or to marketing activities;
f) to manage business and professional relationships with the company, firm, body or organisation to which the Data Subject belongs, to coordinate the related activities and to keep up to date the data of the contact persons necessary for the conduct of the relationship;
g) to carry out administrative, organisational, management and intra-group coordination activities, and to share strictly necessary information with the ALPI Group companies involved in managing the relationship, the project, or the relevant market or geographical area;
h) to manage the operation, maintenance and security of the website and related services, to verify and protect the security of company systems, networks and information, to prevent unlawful or fraudulent use and to protect the Controller's assets;
i) to establish, exercise or defend the rights of the Controller and, where relevant, of the Group companies involved in the relationship, in judicial, administrative, arbitration or out-of-court proceedings, and to manage any disputes, complaints or debt-recovery procedures;
j) to carry out activities relating to transfers of a business or business unit, acquisitions, mergers, demergers, reorganisations or other extraordinary transactions, and to implement them;
(the purposes set out in letters d), e), f), g), h), i) and j) are hereinafter collectively referred to as the “Legitimate Interest Purposes”);
k) subject to the Data Subject's specific consent, to send informational and promotional communications relating to ALPI's products, collections, services, projects, trade fairs, events and other initiatives, as well as invitations to take part in such initiatives, by e-mail, newsletter, SMS, messaging services, telephone calls, paper mail and other electronic communication tools, in compliance with applicable law; (the purpose set out in letter k) is hereinafter referred to as the “ALPI Marketing Purpose”);
l) subject to the Data Subject's separate and specific consent, to disclose the Data to the other companies belonging to the ALPI Group so that they, as independent controllers, may send their own informational and promotional communications relating to their respective products, services, trade fairs, events and initiatives, by e-mail, newsletter, SMS, messaging services, telephone calls, paper mail and other electronic communication tools. The updated list of companies belonging to the ALPI Group may be requested from the Controller by writing to privacy@alpi.it;
(the purpose set out in letter l) is hereinafter referred to as the “Group Marketing Purpose”);
5. On what legal basis are the Data processed?
Contractual Purposes. The processing of Data for the Contractual Purposes is carried out pursuant to Article 6(1)(b) of the European Regulation, as it is necessary for the performance of a contract to which the Data Subject is party or in order to take steps at the request of the Data Subject prior to entering into a contract. Providing the Data requested for these purposes is necessary in order to conduct negotiations, prepare offers and quotations, take the requested pre-contractual steps, and establish and manage the business or professional relationship. Failure to provide them will make it impossible for the Controller to carry out these activities or to establish and manage the business or professional relationship.
Legal Purpose. The processing of Data for the Legal Purpose is carried out pursuant to Article 6(1)(c) of the European Regulation, as it is necessary to enable the Controller to comply with the legal obligations to which it is subject. Providing the Data requested for this purpose is mandatory in the cases provided for by applicable law. The processing is not based on the Data Subject's consent. Failure to provide them will make it impossible for the Controller to comply with the applicable obligations and, consequently, to establish or continue the business or professional relationship where such Data are necessary for that purpose.
Legitimate Interest Purposes. The processing of Data for the Legitimate Interest Purposes is carried out pursuant to Article 6(1)(f) of the European Regulation, for the pursuit of the Controller's legitimate interests indicated in this notice, with due respect for the fundamental rights and freedoms of Data Subjects and only to the extent strictly necessary to pursue the relevant purposes. In particular, the processing is necessary to enable the Controller to: (i) respond to requests for information or contact of a purely informational, relational or institutional nature, manage meetings, appointments and visits and maintain business and professional relationships with the organisation to which the Data Subject belongs; (ii) carry out the necessary administrative, organisational, management and intra-group coordination activities, ensure the operation, maintenance and security of the website, company systems, networks and information, and protect its assets; and (iii) protect and defend its rights and, where relevant, those of the Group companies involved in the relationship, and assess, organise and implement any extraordinary transactions.
The Data Subject may object at any time, on grounds relating to his or her particular situation, to processing based on legitimate interest, in the manner indicated in the section “What are the rights of Data Subjects?”. In the event of an objection, the Controller shall no longer process the Data unless it demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the Data Subject, or the processing is necessary for the establishment, exercise or defence of legal claims.
ALPI Marketing Purpose and Group Marketing Purpose. The processing of Data for the ALPI Marketing Purpose is carried out pursuant to Article 6(1)(a) of the European Regulation, on the basis of the Data Subject's specific consent.
The disclosure of Data to the companies belonging to the ALPI Group for the Group Marketing Purpose is carried out pursuant to Article 6(1)(a) of the European Regulation, on the basis of a specific consent, separate from the consent requested for marketing activities carried out directly by ALPI.
Giving consent for the ALPI Marketing Purpose and for the Group Marketing Purpose is optional. Failure to give consent for the ALPI Marketing Purpose will only result in the Data Subject not receiving ALPI's informational and promotional communications; failure to give consent for the Group Marketing Purpose will only result in the Data not being disclosed to the other ALPI Group companies and, therefore, in the Data Subject not receiving their informational and promotional communications. Failure to give one or both consents will have no consequence on the possibility of establishing or continuing business or professional relationships with ALPI.
Each consent may be withdrawn at any time and separately, without affecting the lawfulness of processing carried out before its withdrawal, by using the unsubscribe link contained in the communications received or by writing to privacy@alpi.it. Withdrawal will result in the cessation of the processing carried out for the relevant marketing purpose, without prejudice to any further retention and use of the Data for the other purposes and on the other legal bases described in this notice.
Following the disclosure of Data for the Group Marketing Purpose, each recipient company will act as an independent controller and will provide the Data Subject with its own privacy notice. The Data Subject may withdraw consent and exercise his or her rights against the company concerned using the contact details indicated in the relevant notice. The Data Subject may in any case contact ALPI to find out to which Group companies the Data have been disclosed.
6. How are the Data processed?
In relation to the purposes indicated above, the Data are processed both with the aid of IT or otherwise automated tools and on paper, using methods strictly related to the purposes described in this notice. The Controller adopts appropriate organisational and technical measures to protect the Data in its possession against loss, theft and unauthorised use, disclosure or modification, as well as to ensure their confidentiality, integrity and availability. In the context of managing business and professional relationships and of the direct marketing activities described in this notice, ALPI does not carry out profiling of the Data Subject and does not use automated decision-making that produces legal effects concerning him or her or similarly significantly affects him or her.
7. To whom are the Data disclosed?
For the purposes indicated in this notice, the Controller may disclose, in whole or in part, the Data Subjects' Data to the following categories of recipients:
a) employees and collaborators of the Controller, expressly authorised to process the Data within the scope of their respective duties and to the extent necessary to perform the activities entrusted to them;
b) companies belonging to the ALPI Group, in Italy and abroad, to the extent that disclosure is necessary for administrative, organisational, management or intra-group coordination purposes connected with managing the relationship, the project, or the relevant market or geographical area, which will act as independent controllers or, where they process the Data on behalf of ALPI, as duly appointed processors;
c) agents, distributors, Business Developers, consultants and business partners involved in managing the relationship, the project, or the relevant market or geographical area, who will act, as the case may be, as independent controllers or processors;
d) providers of services that are instrumental to or supporting the activities carried out by the Controller, such as providers of IT, technology, communication, contact management, event organisation and newsletter services, as well as legal, tax and administrative consultants, banks, auditors and other professionals, who will act, according to the role actually assumed, as processors on behalf of ALPI or as independent controllers;
e) ALPI Group companies to which the Data are disclosed, subject to the Data Subject's specific consent, for the Group Marketing Purpose, which will act as independent controllers;
f) public authorities, judicial and supervisory authorities and other parties whose right of access to the Data is provided for by applicable law, which will act as independent controllers in the exercise of their respective institutional functions;
g) purchasers, successors, potential purchasers and their advisors or other parties involved in mergers, acquisitions, disposals, restructurings, reorganisations or transfers, including partial ones, of the Controller's business or assets, to the extent necessary for the assessment and execution of the transaction, who will act, as the case may be, as independent controllers or as processors on behalf of the party that engaged them.
The Data will not be disseminated. The updated list of processors and recipients of the Data is available at the Controller's registered office and may be requested by writing to privacy@alpi.it. Some of the recipients indicated above may be located in countries outside the European Union or the European Economic Area. In that case, the disclosure of the Data will take place in accordance with the following section.
8. Are the Data transferred abroad?
In compliance with applicable law, the Data may be transferred abroad, including to countries outside the European Economic Area, in particular to countries where ALPI Group companies, agents, distributors, Business Developers, consultants, business partners or technology service providers involved in the processing described in this notice are based or operate. An updated list of the countries and parties concerned may be requested from the Controller by writing to privacy@alpi.it.
Any transfer of Data to countries outside the European Economic Area will in any case take place in compliance with Articles 44 et seq. of the European Regulation and on the basis of an adequacy decision of the European Commission or through the adoption of the appropriate safeguards provided for by applicable law, including, where necessary, the standard contractual clauses approved by the European Commission and any supplementary measures deemed appropriate. The Data Subject may obtain further information on the transfers carried out and on the applicable safeguards, and request a copy of them within the limits provided for by law, by writing to privacy@alpi.it.
9. How long are the Data retained?
The Data are retained by the Controller in compliance with the principles of necessity and storage limitation and, in particular:
a) the Data processed for the Contractual Purposes relating to pre-contractual activities that do not lead to the conclusion of a contract will be retained, for the management of the opportunity and for any follow-up contacts connected with the request or the negotiation initiated, for a maximum of 24 months from the last significant interaction, without prejudice to the retention of the related documentation for a maximum of 5 years from the end of negotiations, where necessary to protect the Controller's rights;
b) the Data processed for the Contractual Purposes, where a contractual relationship is established, will be retained for the entire duration of the relationship and for 10 years after its termination;
c) the Data processed for the Legal Purpose will be retained for the period required by applicable law or otherwise necessary to comply with the related obligations. In particular, administrative, accounting, tax and contractual documentation will, as a rule, be retained for 10 years from the end of the financial year to which the documentation relates or, for contractual documentation, from the termination of the relationship, unless applicable law provides for a different period;
d) the Data processed for the Legitimate Interest Purposes will be retained: (i) with regard to purely informational or relational requests and the management of meetings, appointments and visits, for a maximum of 3 months from the closure of the request or from the occasion of contact, unless the relationship develops into a pre-contractual or contractual activity; (ii) with regard to the management of relationships with the organisation to which the Data Subject belongs and intra-group coordination, for the duration of the relevant relationship and, as regards the Data Subject's contact details, for as long as the Data Subject acts as a contact person within that relationship; (iii) with regard to technical data and security logs, for the time strictly necessary to ensure the security of the website, company systems, networks and information and to prevent or detect any unlawful or fraudulent use. The relevant retention period is determined taking into account the type and purpose of the log, the technical characteristics of the system concerned, the level of security risk and any need to analyse or document anomalies, security incidents or unlawful or fraudulent use. In such cases, the Data may be retained for the time necessary to manage and document the event and the related verification activities. For data collected through cookies and other tracking tools, please refer to the Cookie Policy; (iv) with regard to disputes, complaints, debt-recovery procedures or the protection of the Controller's rights, for the entire duration of their handling and, thereafter, until the expiry of the applicable limitation period, generally 10 years from the closure of the dispute or the termination of the relationship, unless different periods are provided for by applicable law. In the event of judicial, administrative, arbitration or out-of-court proceedings, the Data may be retained until their final conclusion; (v) with regard to extraordinary transactions, for the period necessary to assess, organise and execute the transaction and, if it is completed, for the further period necessary to comply with the applicable obligations and to document the transaction, within the limits of the relevant limitation periods. If the transaction is not completed, the Data will be erased or anonymised once the purposes for which they were collected no longer apply, unless their further retention is necessary to protect the Controller's rights;
e) the Data processed for the ALPI Marketing Purpose will be retained until the relevant consent is withdrawn and, in any case, for no longer than 24 months from the last significant interaction with the Data Subject;
f) the Data processed for the Group Marketing Purpose will be retained by ALPI until they are disclosed to the Group companies concerned. Proof of the consent given and of the related disclosure will be retained as indicated in the following point. The recipient companies will retain the Data as indicated in their own privacy notices, until consent is withdrawn and in any case no longer than the retention periods indicated therein;
g) proof of the consents given, of any withdrawals and, where applicable, of the disclosures made will be retained for the entire duration of the processing based on the relevant consent and, after withdrawal of consent or termination of the processing, for 10 years, solely for the purpose of demonstrating compliance with applicable law and protecting the Controller's rights;
In any case, further retention of the Data remains possible where necessary to comply with legal obligations, to follow up on requests from the competent authorities or to establish, exercise or defend a right of the Controller or of third parties. Upon expiry of the applicable retention periods, the Data will be erased, anonymised or aggregated.
10. Cookies and other tracking tools
ALPI's website uses cookies and other tracking tools. For detailed information on the processing of Data carried out through such tools, including their types, purposes and legal bases, the parties involved, any transfers to third countries, retention periods and how to manage preferences and withdraw consent, where applicable, the Data Subject is invited to consult the Cookie Policy available on the website.
11. What are the rights of Data Subjects?
Without prejudice to the above regarding the nature of the provision of Data and the legal bases of the processing, the Data Subject may, at any time, exercise the rights provided for by applicable law and, in particular:
a) obtain confirmation as to whether or not Data concerning him or her are being processed and, where that is the case, obtain access to the Data and to information relating to the processing;
b) obtain information on the purposes of the processing, the categories of Data processed, the recipients or categories of recipients to whom the Data have been or will be disclosed, and the retention period or the criteria used to determine it;
c) request the updating, rectification or, where he or she has an interest, the completion of the Data concerning him or her;
d) request the erasure of the Data concerning him or her in the cases provided for by applicable law;
e) request the restriction of processing in the cases provided for by Article 18 of the European Regulation;
f) obtain the portability of the Data concerning him or her, where applicable;
g) object, on grounds relating to his or her particular situation, to processing based on the Controller's legitimate interest, unless the Controller demonstrates compelling legitimate grounds for continuing the processing or that the processing is necessary for the establishment, exercise or defence of legal claims;
h) withdraw at any time, separately and without affecting the lawfulness of processing carried out before withdrawal, the consents given for the ALPI Marketing Purpose and for the Group Marketing Purpose.
The Data Subject also has the right to lodge a complaint with the Garante per la Protezione dei Dati Personali (Italian Data Protection Authority) or with another competent supervisory authority pursuant to Article 77 of the European Regulation, where the relevant conditions are met. Requests to exercise these rights may be sent in writing to the Controller at the e-mail address privacy@alpi.it or by letter sent to the registered office indicated in this notice.
12. Changes and updates
This notice is valid from the date of the version indicated below. The Controller may make changes or additions to this notice, including as a result of regulatory or organisational changes or changes relating to the processing described. The updated version will be made available through the channels used by the Controller to communicate with Data Subjects.
Version dated 7 October 2026
Type here |
en