Regulation (EU) 2016/679 on the protection of personal data, which safeguards the rights and freedoms of natural persons, requires, under Articles 13 and 14, that information be provided to data subjects, whose personal data are concerned. As data controller, we are responsible for collecting and processing your personal data in connection with our activities.

Through this Privacy Policy, we wish to provide detailed information about the protection of your personal data processed through our website. In particular, we explain:

• which personal data we process;
• the purposes for which we process them;
• how long we retain your data;
• what rights you have and how you can exercise them.

Data Controller

The data controller is CORBO GROUP S.P.A.
You can contact the data controller at info@corbogroup.it.

What Personal Data We Process and Why

We may collect the following categories of data:

• identification and personal details (e.g. first name, surname, place and date of birth, sex, photographs);
• contact details (e.g. address, email address);
• browsing data (e.g. cookies).

Data collected through the website are processed using IT and electronic means and are protected by appropriate security measures designed to ensure their confidentiality, integrity and availability. The data will be recorded in dedicated databases and used strictly and exclusively in connection with browsing the website.

Personal data are provided by you voluntarily or, in the case of usage data, collected automatically as you browse this website.

Unless otherwise specified, all data requested by this website are mandatory.

If you refuse to provide them, this website may be unable to provide the services offered. Where this website indicates that certain data are optional, you are free not to provide them without any consequences for the availability or operation of the service.

If you have any questions about which data are mandatory, you can contact the data controller.

Unless otherwise stated, any use of cookies or other tracking tools by this website, or by the providers of third-party services used by this website, is intended to provide the requested service, as well as for the additional purposes described in this document and in the Cookie Policy.

When using certain features of this website, you may obtain, publish or share personal data relating to third parties. Accordingly, by using this website, you assume responsibility for your use of third-party data and warrant that you are entitled to disclose, use or disseminate them, holding the data controller harmless from any liability towards third parties.

We never request personal data concerning your racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data or sexual orientation unless required by a legal obligation. If we process such data in other circumstances, we will provide you with a specific privacy notice and obtain your explicit consent.

Details of Personal Data Processing

Personal data may be collected and processed in connection with one or more of the following services provided through this website:

Contacting the User (Contact Form)
By completing the contact form with their data, users consent to the use of those data to respond, for example, to requests for information, quotations or other enquiries, as indicated in the form heading.

Personal data collected: first name, surname, email address, address, telephone number, etc.

Mailing List or Newsletter
By subscribing to the mailing list or newsletter, the user’s email address is added to a contact list to which email messages containing information relating to this website may be sent. The user’s email address may also be added to this list following registration.
Personal data collected: first name, surname, email address, address, telephone number, etc.

Analytics
This website uses Google Analytics, a web analytics service provided by Google Inc.

This service uses cookies to collect and analyse information about your use of the website anonymously.

This website does not use, and does not permit third parties to use, Google’s analytics tool to monitor or collect personally identifiable information.

Google does not associate your IP address with any other data held by Google, nor does it attempt to link an IP address with the identity of a computer user. Google may also transfer this information to third parties where required by law or where such third parties process the information on Google’s behalf.

You may refuse cookies by selecting the appropriate settings in your browser, although this may prevent you from using all the features of this website.

Google Analytics collects and processes data in accordance with Google’s policy, “How Google uses information from sites or apps that use our services”.

By using the website, you consent to Google’s processing of your data in the manner and for the purposes described above.

Analytics data are stored on Google Analytics systems in a fully anonymised form and therefore cannot be traced back to the end user.

Spam Protection Service
This is a spam protection service implemented on the website.

Cookie

A cookie is a small file containing a string of characters that is sent to your computer when you visit a website. When you return to the website, the cookie allows the site to recognise your browser, storing user preferences and other information. Through cookies, the company may obtain information about use of the website, monitor sessions and enable authenticated access to certain areas.
You can configure your browser to refuse all cookies or to notify you when a cookie is sent. To accept or refuse cookies by changing your browser settings, we recommend consulting the browser’s help documentation (e.g. Chrome, Firefox, Internet Explorer, Opera, Safari, etc.). You should, however, be aware that without cookies, certain services or features of the website may not function correctly.
The cookies used on this website do not allow the collection of personal information, do not link a user’s IP address to their identity and are not used for advertising or marketing purposes, even when managed by external websites. In particular, this website uses cookies to collect and analyse information about users’ browsing behaviour anonymously and in aggregate form.
For further details about the use of cookies on this website, please refer to the Cookie Policy.

Purposes of Processing

Processing consists of the operations or sets of operations referred to in Article 4(2) of Regulation (EU) 2016/679, namely any operation or set of operations performed on personal data or sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

In particular, processing of your data when you use this website may be carried out for the following purposes:

• use of the website and its features;
• use of the services provided through the website;
• provision of services requested while browsing the website, including the collection, storage and processing of data for operational and technical management;
• provision of services requested through registration on the website and the creation of an account and profile, including the collection, storage and processing of data for the operational, technical and administrative management of the relationship (and of the account and profile created), for service delivery and communications relating to such delivery;
• management of relationships with public authorities and other public bodies in connection with specific requests and compliance with legal obligations.

Personal Data Retention Period

The retention period for personal data processed exclusively for the purposes set out above depends on the service for which you provided the data. For example:

• personal data collected for purposes connected with the performance of a contract will be retained until the contract has been fully performed;
• personal data collected for purposes relating to the legitimate interests of the data controller will be retained until those interests have been fulfilled.

You may obtain further information about the legitimate interests pursued by the data controller by emailing info@corbogroup.it.

The retention period is determined taking into account limitation periods applicable to rights in respect of which we may need to defend ourselves, or data retention requirements imposed by law. Your personal data may be recorded on protected electronic media, and paper forms will be properly stored and protected. Your personal data will not be publicly disseminated.

Where processing is based on consent, the data controller may retain personal data until consent is withdrawn. The data controller may also be required to retain personal data for longer than is otherwise necessary for processing in order to comply with a legal obligation or an order issued by an authority.

At the end of the retention period, personal data will be erased. Accordingly, once that period has expired, the rights provided for under Regulation (EU) 2016/679 can no longer be exercised.

Your Rights in Relation to Your Data

To provide data subjects with greater safeguards in relation to the processing of their data, the General Data Protection Regulation (GDPR) contains a section dedicated to the rights that data subjects may exercise against the data controller. These rights are:

• right of access by the data subject (Article 15);
• right to rectification (Article 16);
• right to erasure (“right to be forgotten”) (Article 17);
• right to restriction of processing (Article 18);
• right to data portability (Article 20);
• right to object (Article 21).

Data subjects may exercise their rights by submitting a request to the data controller, including by using the Data Subject Rights Request Form.

The data controller must provide information on action taken in response to a request to exercise rights without undue delay and, in any event, no later than one month after receiving the request. This period may be extended by a further two months where necessary, taking into account the complexity and number of requests. The data controller will inform the data subject of the extension and the reasons for the delay within one month of receiving the request. Where requests are manifestly unfounded or excessive (in particular because they are repetitive), the data controller may charge a reasonable fee or refuse to act on the request.

Right of Access by the Data Subject (Article 15)
The data subject has the right to obtain confirmation from the data controller as to whether or not personal data concerning them are being processed and, where that is the case, access to those personal data and the following information:

a) the purposes of the processing;

b) the categories of personal data concerned;

c) the recipients or categories of recipients to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organisations;

d) the envisaged period for which the personal data will be stored or, if that is not possible, the criteria used to determine that period;

e) the existence of the right to request from the data controller rectification or erasure of personal data, or restriction of processing of personal data concerning the data subject, or to object to such processing;

f) the right to lodge a complaint with a supervisory authority;

h) the existence of automated decision-making, including profiling, and, at least in such cases, meaningful information about the logic involved, as well as the significance and envisaged consequences of such processing for the data subject.

Right to Rectification (Article 16)
The data subject has the right to obtain from the data controller, without undue delay, the rectification of inaccurate personal data concerning them. Taking into account the purposes of processing, the data subject has the right to have incomplete personal data completed, including by means of a supplementary statement. The data controller must communicate any rectification to each recipient to whom the personal data have been disclosed, unless this proves impossible or involves disproportionate effort. The data controller must inform the data subject about those recipients if the data subject so requests.

Right to Erasure (“Right to Be Forgotten”) (Article 17)
The data subject has the right to obtain from the data controller the erasure of personal data concerning them without undue delay, and the data controller is obliged to erase personal data without undue delay where one of the following grounds applies:

a) the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;

b) the data subject withdraws the consent on which the processing is based, and there is no other legal ground for the processing;

c) the data subject objects to the processing pursuant to Article 21(1) and there are no overriding legitimate grounds for the processing, or the data subject objects to the processing pursuant to Article 21(2);

d) the personal data have been unlawfully processed;

e) the personal data must be erased to comply with a legal obligation under Union or Member State law to which the data controller is subject;

f) the personal data have been collected in relation to the offer of information society services referred to in Article 8(1) of Regulation (EU) 2016/679.

Right to Restriction of Processing (Article 18)
The data subject has the right to obtain from the data controller restriction of processing where one of the following applies:

a) the data subject contests the accuracy of the personal data, for a period enabling the data controller to verify their accuracy;

b) the processing is unlawful and the data subject opposes erasure of the personal data and requests restriction of their use instead;

c) the data controller no longer needs the personal data for the purposes of processing, but the data subject requires them for the establishment, exercise or defence of legal claims;

d) the data subject has objected to processing pursuant to Article 21(1) of Regulation (EU) 2016/679, pending verification of whether the legitimate grounds of the data controller override those of the data subject.

Right to Data Portability (Article 20)
As provided for in Article 20 of Regulation (EU) 2016/679, in certain circumstances (e.g. processing carried out by automated means), the data subject has the right to receive the personal data concerning them that they have provided to a data controller and the right to transmit those data to another data controller. The data subject has the right to have the personal data transmitted directly from one data controller to another where technically feasible and where this does not adversely affect the rights and freedoms of others.

Right to Object (Article 21)
The data subject has the right to object at any time to the processing of personal data concerning them, including profiling. The data controller will cease processing the personal data, except in certain circumstances. Where personal data are processed for direct marketing purposes, the data subject has the right to object at any time to processing of personal data concerning them for such marketing, including profiling to the extent that it is related to such direct marketing.

Where the data subject objects to processing for direct marketing purposes, the personal data will no longer be processed for those purposes.

Legal Basis for Processing

The data controller processes your personal data where one of the following conditions applies:

• you have given consent for one or more specific purposes. (Note that in some jurisdictions, the data controller may be permitted to process personal data without the data subject’s consent or another of the legal bases listed below until the data subject objects to the processing (opts out). This does not apply where the processing of personal data is governed by European data protection legislation);
• processing is necessary for the performance of a contract with you and/or in order to take steps at your request prior to entering into a contract;
• processing is necessary for compliance with a legal obligation to which the data controller is subject;
• processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the data controller;
• processing is necessary for the purposes of the legitimate interests pursued by the data controller or a third party.
You may always request that the data controller clarify the specific legal basis for each processing activity and, in particular, specify whether processing is based on a legal requirement, provided for by a contract or necessary to enter into a contract.

To Whom We May Disclose Your Data

The data controller processes users’ personal data using appropriate security measures designed to prevent unauthorised access, disclosure, modification or destruction of personal data.

Processing is carried out using IT and/or electronic tools, with organisational methods and procedures strictly related to the purposes indicated.

In addition to the data controller, certain categories of persons within the company (e.g. administrative, sales and marketing staff, legal personnel, system administrators, etc.) or external parties (e.g. third-party technical service providers, postal couriers, hosting providers, IT companies, communications agencies, etc.) may have access to the data. Where necessary, the data controller may appoint such external parties as data processors. An up-to-date list of data processors may be requested from the data controller.

Where it becomes necessary to disclose your data to third parties, processing will be permitted only by persons or organisations with appropriate expertise, using electronic and non-electronic tools configured to ensure the confidentiality and protection of your personal data.

Hosting and Backend Infrastructure

This type of service hosts the data and files required for the website to operate, enables the website to be published and provides ready-to-use infrastructure for the delivery of specific services. Some of these services operate through servers located in different geographical areas, making it difficult to determine the precise location where personal data are stored.

The hosting service is provided by an external company, and the place of processing is Paris.

Your personal data may be disclosed to external collaborators for the purposes described above.

Information on Transfers of Data to a Third Country

No transfers of data to third countries or international organisations are envisaged.

The company reserves the right to use cloud services. In that event, service providers will be selected from among those offering appropriate safeguards as provided for under Article 46 of the EU Regulation.

Automated Decision-Making

The company does not currently use automated decision-making processes.

The cookies used on this website do not enable the collection of personal information, do not link users’ IP addresses to their identities and are not used for advertising or marketing purposes, even when managed by external websites.

Processing for Other Purposes

Should the company process your personal data for purposes other than those listed in this Privacy Policy, you will receive appropriate information before such processing takes place and, where necessary, will be asked to provide consent again.

Complaints

Without prejudice to any administrative or judicial remedies, you may lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali), unless you reside or work in another EU Member State. In the latter case, or where the infringement of personal data protection legislation occurs in another EU country, the supervisory authorities of the country in which the processing takes place will have jurisdiction to receive and examine the complaint.

Response to “Do Not Track” Requests

This website does not support “Do Not Track” requests.
To find out whether any third-party services used by the website support such requests, please consult their respective Privacy Policies.

To find out whether any third-party services used by the website support such requests, please consult their respective Privacy Policies.

Updates to This Privacy Policy

The data controller reserves the right to update this Privacy Policy at any time by posting information on this page and, where technically and legally possible, sending a notification using one of the contact details held by the data controller. We therefore encourage you to consult this page regularly, referring to the date of the most recent update indicated below.

Where changes concern processing based on consent, the data controller will obtain consent again where necessary.

Contact Us

If you have any questions about this Privacy Policy, the practices of this website or your interactions with it, you can contact us using the contact details on www.corbogroup.it, on the “Contact Us” page, or by emailing info@corbogroup.it.

Last updated: 29 September 2025