Privacy policy

Form: IS – Updated 02/2026

Privacy Notice on the Processing of Personal Data.

Articles 13 and 14 of EUROPEAN REGULATION NO. 679/2016

Italian Legislative Decree No. 196/2003, as amended by Italian Legislative Decree No. 101/2018

Dear Data Subject,

This notice describes how the website is managed with regard to the processing of the personal data of users who visit it, as well as the data-processing practices carried out through this website. In compliance with Articles 13 (for data collected from the data subject) and 14 (for data not collected from the data subject) of Regulation (EU) 2016/679 (hereinafter the GDPR), users of this Website are provided with the following information, which relates exclusively to processing carried out through this Website and not through any other websites that may be visited via links contained herein. Users are advised to review the relevant notices provided by the respective Data Controllers of those websites. This Website and any services offered through it are intended exclusively for persons who are at least eighteen years of age. The Data Controller therefore does not process personal data relating to persons under the age of 18. At the request of such Users, the Data Controller will promptly erase any personal data collected unintentionally.

1. Data Controller

The Data Controller is V.S.M. SRL, with registered office at Contrada Guazzetti 208/B, FM - Montegranaro, Tax Code and VAT No. 02609250440 (hereinafter the “Data Controller”). The Data Controller reserves the right to appoint a web agency or consultant as Data Processor for personal data managed for the purposes of technical support, maintenance, technical management and similar activities relating to this Website. The relevant contact details may be provided upon request at the addresses indicated above. The Data Controller and the Data Processor also process Users’ data through their own internal personnel, specifically appointed and provided with instructions as persons authorised to process the data.

2. Categories of data processed and sources of origin

Browsing data (during their normal operation, the IT systems and software procedures used to operate this website acquire certain personal data whose transmission is implicit in the use of Internet communication protocols. This category of data includes: IP addresses, the type of browser used, the operating system, the domain name and the addresses of websites from which access was made or to which the user exited, information about the pages visited by users within the website, access times, the time spent on each page, analysis of internal navigation paths and other parameters relating to the user’s operating system and IT environment. Such technical/IT data are collected and used exclusively in aggregate and anonymous form. These data are processed for the purpose of enabling and monitoring the proper use of this website and obtaining anonymous statistical information about its use, and are erased immediately after processing)
Cookies, regarding which we invite you to read our Cookie Policy
Data voluntarily provided by the user, including:

Ordinary data (identification, personal, billing and similar data)
Special categories of personal data only in exceptional circumstances (Article 9 GDPR)
Personal data relating to criminal convictions and offences only in exceptional circumstances (Article 10 GDPR)

Sources: browsing, other websites, cookies and similar technologies; the user; public sources.

We may primarily process browsing data and cookies.

We may also process data voluntarily provided by the user, for example through the contact form or by sending an email communication, including ordinary personal data (identification, personal, billing and similar data) and, in exceptional circumstances, special categories of personal data pursuant to Article 9 GDPR or personal data relating to criminal convictions and offences pursuant to Article 10 GDPR, strictly to the extent necessary in view of the request for information received and subject to the consent of the data subject.

Data may originate from automated or voluntary sources, as well as from public sources. For example, they may originate from the user’s browsing activity, which may include information relating to previous visits to other websites, including, in particular, cookies and other similar technologies. Data may also be voluntarily provided by the user or by persons connected with the user. Other data may originate from public sources, such as data processed during searches and obtained from official records, public databases and similar sources.

3. Purposes of processing

The personal data of Website Users, as described above, will be processed in the ways and forms prescribed by the GDPR for the performance of the Website’s functions, with particular, but not exclusive, reference to browsing its pages and the data-collection procedures described therein, contact forms, any registration process/access to reserved areas, newsletter subscription and similar activities. In particular, the personal data provided to the Data Controller will be processed for the following purposes:

to respond to specific requests submitted by the User to the Data Controller through the Website and its communication tools (contact forms, information request forms and similar tools);
to provide information concerning the services of the Data Controller following requests for information made by email, through the contact form or through other communication tools;
for any registration for events organised by the Data Controller and other related activities (for example, verification of attendance, notices concerning any updates or changes to the event, etc.);
for other purposes that are ancillary or connected to those indicated above and that, in any event, fall within the scope of the Website’s activities;

The processing of data provided in a general manner, including data collected automatically during browsing, will be carried out solely for the purposes of verifying and monitoring access to the Website. This also applies to technical cookies, meaning session, functionality or analytics cookies that meet the requirements specified by the Italian Data Protection Authority. With particular regard to analytics cookies, it is clarified that they may be treated in the same way as technical cookies where they are created and used directly by the Website. In any event, for such analytics cookies, the Website, also in accordance with the clarifications issued by the Italian Data Protection Authority, has implemented the anonymisation of IP addresses and limitations on data processing; the collection and use of the aforementioned browsing data, without prejudice to the anonymisation of IP addresses, make it possible to monitor the Website’s performance and improve the service offered, providing the User with a better browsing experience. Please refer to the specific Cookie Notice for further information.

4. Legal basis for processing

The processing of personal data is based on the performance of contractual or pre-contractual obligations relating to the request made by the User (for example, requests for information about the services provided by the Data Controller, requests for quotations, etc.), as well as, where necessary, on consent given by freely and knowingly completing the relevant information fields in the form used to collect and provide data and by selecting the appropriate checkbox, where applicable.

It should be noted that completing the relevant fields in forms used to request information is inherent in the request itself and therefore entails the performance of a pre-contractual or contractual obligation, depending on the context. Consent may subsequently be requested for the processing of additional data.

A specific privacy notice will be provided wherever necessary, separate from this notice.

In any event, processing is also based on legitimate interests, including the right to information, as further described in the following section.

5. Legitimate interests of the Data Controller

The processing of personal data is also based on the legitimate interests of the Data Controller, such as exercising its rights in the context of the information society, performing contractual services and carrying out direct marketing activities in the manner, by the means and within the time limits provided for by applicable legislation.

6. Mandatory nature of providing data

The provision of browsing data by Users for the purposes referred to above depends on the level of privacy that the User has enabled or disabled through their browser. In some cases, disabling certain functions may impair browsing on this Website. For certain forms on this Website, the provision of browsing data and/or the use of technical cookies is mandatory for the proper functioning of the Website.

The provision of certain personal data is, in any event, necessary due to the structure of the Website and its procedures. Any request for other optional data will instead be preceded by an appropriate approval checkbox. The provision of all other data is optional, depending on the type of information that the User wishes to provide to the Website.

Without prejudice to the above, for example, providing an email account is necessary in order to respond to a request submitted through the contact form, as is providing the other mandatory data identified therein with an asterisk. All other data are optional.

Failure to provide the data necessary for the requested action, such as an email account through the form used to request information by this means, will make it impossible for the Data Controller to process the request.

PROVISIONS APPLICABLE TO ALL PROCESSING ACTIVITIES

In any event, even where the data subject has given consent authorising the Data Controller to pursue all the purposes referred to in the points above, the data subject will remain free to withdraw such consent at any time.

As specifically and separately required by Article 21 of the Regulation, the data subject is hereby informed that they have the right to object at any time to the processing of personal data concerning them for the purposes referred to above and that, where the data subject objects to the processing, the personal data may no longer be processed for such purposes.

7. Possible recipients of personal data

The data may be disclosed to companies connected with, affiliated with or controlled by the Data Controller, as well as to consultants or third parties that operate, including in the name and on behalf of the Data Controller, for the performance of services connected with the purposes indicated in this notice, both within and outside the EU. In the latter case, the data will be disclosed exclusively to entities that comply with applicable legislation.

Browsing and similar data, as referred to above, as well as profiling cookies, including third-party cookies, regarding which reference is made to the Cookie Notice of this Website, will be disclosed to the respective third parties concerned where such parties do not manage them directly in their capacity as Data Controllers.

In any event, the data may be disclosed to Data Processors, as well as to persons authorised to process the data and duly instructed, always within the scope of the purposes of processing.

For the sake of brevity, a detailed list of such parties is available at our registered office.

8. Retention period

Data voluntarily provided by the Data Subject will be retained until expressly withdrawn by the Data Subject, including through an action performed in their browser, the deletion of cookies, an express request or any other form of withdrawal. Browsing data will be retained, in accordance with the principle of proportionality, in a form that permits the identification of the Data Subject for no longer than is necessary for the purposes for which they were collected or subsequently processed.

Personal data collected through the customer service system, such as support requests, complaints and communications submitted through contact forms or email, will be retained for a maximum period of 3 years from the date on which a final response is provided to the request, for the purpose of managing any disputes, protecting the Data Controller in the event of litigation and demonstrating proper compliance with contractual and pre-contractual obligations. Such retention is based on the legitimate interests of the Data Controller pursuant to Article 6(1)(f) GDPR.

The retention periods indicated above do not apply where it is necessary to retain data for a longer period in order to defend or enforce a right or comply with any legal obligations or orders issued by the Authorities.

9. Rights of the data subject

Each Data Subject has the right of access, rectification, erasure (the right to be forgotten), restriction, receipt of notification in the event of rectification, erasure or restriction, data portability, objection and not to be subject to a decision based solely on automated processing, including profiling, pursuant to Articles 15 to 22 of the GDPR. These rights may be exercised in the manner and within the time limits set out in Article 12 GDPR by means of a written communication sent to the Data Controller (see point 10).

The Data Controller will provide an appropriate response as soon as possible and, in any event, within 1 month of receiving the request.

10. Right to withdraw consent (Methods for exercising rights)

Where applicable, consent may be withdrawn at any time and/or rights may be exercised by sending:

- a registered letter with acknowledgement of receipt to the undersigned, containing an express request (see the address indicated on the letterhead);

- an email to info@obag.it.

11. Complaints

Each Data Subject has the right to lodge a complaint pursuant to Article 77 et seq. of the GDPR with a supervisory authority, which, for Italy, is the Italian Data Protection Authority. The forms, procedures and time limits for lodging complaints are provided for and governed by the applicable national legislation. The right to lodge a complaint is without prejudice to administrative and judicial remedies, which, in Italy, may alternatively be brought before the same Data Protection Authority or the competent Court.

12. Profiling

Personal data provided through browsing this website and through the possible completion of the forms published on it may be subject to profiling by third-party providers through third-party cookies.

Profiling enables such third-party providers, acting as independent Data Controllers for their respective processing of personal data for profiling purposes and separate from the Data Controller of this website, to evaluate certain personal aspects relating to the Data Subject, particularly their preferences, interests and tastes, with reference to the pages viewed and activities carried out, in order to enable those separate and independent Data Controllers to offer the Data Subject a service that is more specific and targeted to their needs.

For further information, Users are invited to read the Cookie Notice.

13. Data Controller, DPO, Persons Appointed/Authorised to Process Data and Data Processors

Below we provide certain information that must be brought to your attention, not only in order to comply with legal obligations, but also because transparency and fairness towards data subjects are fundamental principles of our activities.

Data Controller. The Data Controller of your personal data is V.S.M. SRL, which is responsible towards you for the lawful and proper use of your personal data and which you may contact for any information or request at the following address: email: info@obag.it

Data Processors.

For the sake of brevity, a detailed list of such parties is available at our registered office.

Persons Appointed/Authorised to Process Data. The updated list of persons appointed/authorised to process personal data is kept at the registered office of the Data Controller.

14. Social media plug-ins

This website may contain plug-ins from certain social media platforms, such as Facebook. Social media plug-ins are special tools that make it possible to embed social network functions directly within the website, such as Facebook’s “Like” function, and are identified by the logo of the relevant social media platform. When a page of this website is visited and the user interacts with the plug-in, for example by clicking the “Like” button, or chooses to leave a comment, the relevant information is transmitted directly by the browser to the social media platform, in this case Facebook, and stored by that platform. For information about the purposes, nature and methods of the collection, processing, use and retention of personal data by the social media platform, as well as the methods through which users may exercise their rights, please refer to the privacy policy of the relevant social network.

15. Links to third-party websites

This website contains links through which users may access other third-party websites. The Data Controller accepts no responsibility for any processing of personal data by third-party websites or for the management of authentication credentials provided by third parties.

16. Cookies

Cookies are packets of information sent by a web server, such as the website, to the user’s Internet browser, automatically stored by the browser on the user’s computer and automatically sent back to the server whenever the website is subsequently accessed. For all information regarding the characteristics and types of cookies, how they are used and the available options for removing, deleting or disabling the cookies used on the website, please refer to the specific Cookie Policy.

The Data Controller

V.S.M. SRL

V.S.M. SRL welcomes comments regarding this Privacy Notice.

Please contact us at the following address: info@obag.it