Login

Country

Language

Cart

Your cart is empty

Newsletter Privacy Policy

Form INL – Updated 02/2026

Privacy Notice on the Processing of Personal Data

Pursuant to Article 13 of EUROPEAN REGULATION NO. 679/2016

Dear Data Subject,

V.S.M. SRL, acting as Data Controller pursuant to Article 13 of European Regulation No. 679/2016, the “General Data Protection Regulation (GDPR)” (hereinafter the EU Regulation), containing provisions concerning the processing of personal data, hereby intends to inform you about the processing of your personal data.

The legislation provides that anyone who processes personal data must inform the data subject about the data processed and the essential elements of the processing, which must, in all cases, be carried out lawfully, fairly and transparently, while protecting confidentiality and safeguarding the rights of the data subject.

It should be noted that the processing of data means any operation or set of operations concerning the collection, recording, organisation, storage, consultation, processing, alteration, selection, retrieval, comparison, use, interconnection, blocking, communication, dissemination or destruction of such data.

1.Data Controller

The Data Controller is V.S.M. SRL, with registered office at Contrada Guazzetti 208/B - Montegranaro (FM), Tax Code and VAT No. 02609250440, which may be contacted at the following address: email: info@obag.it (hereinafter the “Data Controller”).

2. Nature of the Data Processed, Purposes and Legal Basis of the Processing

Nature of the data processed. In relation to the purposes of processing set out below, you are informed that only “ordinary personal data” will be processed, such as, for example:

  • personal details of the company contact person (first name, surname, company name and email address);

  • etc.

Purposes of processing. Your personal data will be processed for the following purposes:

  1. to respond to your request to subscribe to our newsletter, submitted by voluntarily completing the relevant form available in this newsletter section;

  2. to comply with legal obligations;

  3. marketing: to send you advertising material and commercial and promotional communications, conduct direct sales activities and carry out market research;

  4. profiling: to analyse your preferences and provide you with personalised information and/or commercial communications.

Legal basis of the processing. Personal data processed for the purposes referred to in points 2A and 2B will be processed lawfully in order to fulfil pre-contractual and contractual obligations between us and the user (Article 6(1)(b)) and to comply with our legal obligations (Article 6(1)(c)).

Your personal data, for the purposes referred to in points 2C-2D of this notice, may be processed lawfully only with your prior consent (Article 6(1)(a) of the EU Regulation), which must be specific, separate, explicit, documented, prior and entirely optional.

You may withdraw your consent at any time, without affecting the lawfulness of processing based on the consent given before its withdrawal (Article 7(3) of the EU Regulation).

Furthermore, pursuant to Article 21 of the EU Regulation, the data subject is informed that they have the right to object at any time to the processing of personal data concerning them for direct marketing purposes, including profiling, and that, where the data subject objects to such processing, the personal data may no longer be processed for those purposes.

Clarification: in accordance with the principle of maximum transparency towards the Data Subject, which is a distinctive feature of our Company, we wish to inform you that, should you decide to provide your consent for the purpose referred to in point 2C (marketing), you must be informed in advance and be aware that the purposes pursued are specifically commercial, advertising, promotional and marketing-related in the broadest sense, including:

1. sending advertising and informational material, such as newsletters, of a promotional nature;

2. sending commercial information in printed, automated or electronic form and, in particular, by ordinary mail or email, telephone (for example, calls, WhatsApp messages, SMS and MMS), fax and any other digital channel (for example, websites and mobile applications);

3. sending invitations to events, exhibitions and informational or promotional meetings;

4. sending updates concerning promotional initiatives or technical developments relating to services, training or assistance, and/or conducting surveys to assess satisfaction with quality.

3. Data Recipients and Processing Methods – Existence of Automated Decision-Making, Including Profiling

Your personal data will be processed in accordance with the principles of fairness, lawfulness and transparency and may be processed using paper-based and electronic tools, both by the personnel of the undersigned Company who are authorised or appointed to process personal data and by external parties called upon to perform specific tasks on behalf of the Data Controller, acting as Data Processors pursuant to Article 28 of the EU Regulation. Such parties will be appointed by means of a letter of appointment requiring them to comply with confidentiality and data-security obligations and to adopt appropriate security measures to prevent the loss of data, unlawful or improper use and unauthorised access, in accordance with the applicable personal-data protection legislation.

For the sake of brevity, a detailed list of such parties is available at the Data Controller’s registered office and may be made available to you.

Your personal data will not be disseminated or transferred to third countries or international organisations and will not be disclosed to third parties except where required by law or contract. It is specified that contractual obligations also include the disclosure of data to other companies directly connected with the undersigned Company, since their activities are essential for the completion or performance of what you have requested.

Pursuant to Article 13(2)(f) and Article 14(2)(g) of the EU Regulation, you are hereby informed that the Data Controller does not currently use any automated system or decision-making process.

4. Data Retention Periods

Your personal data will be retained for no longer than is necessary to achieve the purposes for which they are processed, in accordance with the storage-limitation principle laid down in the EU Regulation, and/or for the period required to comply with legal and contractual obligations, or until the data subject withdraws the relevant consent, and therefore:

  • with reference to the purposes indicated in points 2A-2B, the data will be retained for no longer than is necessary to achieve the purposes for which they are processed and/or for the time strictly necessary to comply with legal and contractual obligations;

  • with reference to the purpose indicated in point 2C, data processed for Marketing purposes will be retained for no longer than 24 months from the date of collection.

  • with reference to the purpose indicated in point 2D, data processed for Profiling purposes will be retained for no longer than 12 months from the date of collection.

To ensure compliance with the stated retention periods, the processed data and the possibility of erasing data that are no longer necessary for the intended purposes will be reviewed periodically on an annual basis.

5. Access to Data (Categories of Recipients to Whom Data May Be Disclosed)

We also inform you that the collected data will never be disseminated and will not be disclosed without your explicit consent, except for necessary disclosures that may involve transferring data to public bodies, consultants or other parties for compliance with tax and legal obligations or for the fulfilment of the purposes, where authorised. Such parties will be appointed by means of a letter of appointment requiring them to comply with confidentiality and personal-data security obligations.

With reference to Article 13(1)(e) of the EU Regulation, the parties or categories of parties, duly identified and instructed, who may become aware of the user’s personal data in their capacity as Data Processors or persons appointed to process data are listed below by category:

  • shareholders, employees, collaborators and suppliers of the Data Controller in Italy and abroad, acting as persons appointed/authorised to process data and/or Data Processors (for example, commercial, technical, administrative, legal and press departments; system administrators, external professionals, various service providers, etc.)

  • partner companies and/or companies directly connected with the undersigned Company, since their activities are essential for the completion or performance of what you have requested.

Your personal data may also be disclosed to external recipients involved in matters concerning you in the performance of the relevant activities, as well as to external parties interacting with the undersigned Company, always and exclusively for activities functional to the purposes described above. Such external parties may be called upon to perform specific tasks on behalf of the Data Controller in their capacity as Data Processors pursuant to Article 28 of the EU Regulation.

For the sake of brevity, a detailed list of such parties is available at our registered office and may be made available to you.

6. and 7. Disclosure and Transfer of Data

Without the need for explicit consent pursuant to Article 6(1)(b), (c) and (f) of the EU Regulation, the Data Controller may disclose your data, for the purposes referred to in points 2A to 2B, to supervisory bodies, judicial authorities and any parties to whom disclosure is required by law for the fulfilment of the purposes indicated above.

Such parties will process the data in their capacity as independent Data Controllers.

Personal data are stored on devices located at the Data Controller’s premises or at the premises of service providers within the European Union.

Your data will not be disseminated.

To ensure the security of such transfers, we use only parties that provide the necessary guarantees that appropriate technical and organisational measures will be implemented to ensure that processing complies with the provisions of EU Regulation 679/2016.

With regard both to data stored on its own devices and to any data stored by service providers, the Data Controller has implemented appropriate technical and organisational measures to ensure a suitable level of security, in full compliance with the provisions of the EU Regulation.

8. Consequences of Failure to Provide Data

The personal data referred to in points 2A-2B of this notice are necessary. Without such data, it would be impossible for us to proceed and comply with contractual and legal obligations.

The personal data referred to in point 2C, however, are optional. Refusal to provide them will have no consequences and will not affect your request to proceed with registration or our ability to fulfil contractual and legal obligations. You may therefore decide not to provide any data or subsequently deny, at any time, permission to process data already provided.

9. Rights of the Data Subject

As a data subject, you have the rights set out in Articles 15 to 22 of the EU Regulation, as specified below. In particular, you have the right to:

  • obtain confirmation as to whether personal data concerning you exist and are being processed and, where that is the case, obtain access to your data (the so-called right of access);

  • obtain information concerning the purposes of the processing, the categories of data concerned, the recipients or categories of recipients to whom the data have been or will be disclosed, particularly recipients in third countries or international organisations, the envisaged data-retention period or the criteria used to determine that period; and, where the data have not been collected from the data subject, obtain any available information as to their source;

  • obtain the rectification of data concerning you (the so-called right to rectification)

  • obtain the erasure of data concerning you (the so-called right to be forgotten);

  • obtain the restriction of processing (the so-called right to restriction of processing);

  • obtain data portability, namely receive the data from a Data Controller in a structured, commonly used and machine-readable format and transmit them to another Data Controller without hindrance (the so-called right to data portability);

  • object to processing at any time (the so-called right to object). As specifically required by Article 21 of the EU Regulation, you are informed that, where personal data are processed for direct marketing purposes, including profiling, the data subject has the right to object at any time to the processing of personal data concerning them for such purposes and that, where the data subject objects to processing for direct marketing purposes, the personal data may no longer be processed for those purposes;

  • be informed of, and have the opportunity to object to, the existence of automated decision-making concerning natural persons, including profiling;

  • withdraw consent at any time, without affecting the lawfulness of processing based on consent given before its withdrawal;

  • lodge a complaint with a supervisory authority, namely the Italian Data Protection Authority.

It should be noted that the rights of the data subject may be subject to conditions or limitations. It is therefore not certain, for example, that the right to data portability will apply in all cases, as this depends on the specific circumstances of the processing activity.

By way of another example, should you decide to object to the processing of your data, the Data Controller has the right to assess your request, which may not be accepted where there are compelling legitimate grounds for continuing the processing that override your interests, rights and freedoms.

10. Methods for Exercising Your Rights

Without any formalities, you may exercise your rights clearly and explicitly at any time by sending:

- a registered letter with acknowledgement of receipt to the undersigned Company (see the address indicated on the letterhead);

- an email to info@obag.it

11. Minors

The services offered by the Data Controller and the relationship currently in place with you do not involve the intentional collection of personal information relating to minors. If information concerning minors is recorded unintentionally, the Data Controller will erase it promptly upon request or notification by the data subject.

12. DPO – Persons Appointed/Authorised to Process Data – Data Processors

Below we provide certain information that must be brought to your attention, not only in order to comply with legal obligations, but also because transparency and fairness towards Data Subjects are fundamental principles of our activities.

Data Controller. The Data Controller of your personal data is V.S.M. SRL, which is responsible towards you for the lawful and proper use of your personal data and which you may contact for any information or request at the following address: email: info@obag.it

Data Processors.

The updated list of Data Processors is available from the Data Controller upon request.

Persons Appointed/Authorised to Process Data. The updated list of persons appointed/authorised to process personal data is kept at the registered office of the Data Controller.