Privacy Policy

Contents

1. General information
2. Data subjects and scope of application
3. Categories of Personal Data processed
4. Purposes and legal basis for the processing of Personal Data Data retention period
5. Recipients of Personal Data
6. Rights of Data Subjects

1. General information

1.1 Controller. This website (“Website”) is administered by Coesia S.p.a. (“Company” or “Controller”) with registered office at Via Battindarno 91, 40133 Bologna, VAT no. 02221441203, contactable by e-mail at privacy@coesia.com, tel. +39 051 6474111. As the Controller, Coesia explains in this Privacy Policy the purposes and methods used to process data that identifies the data subjects described in article 2.1 (“Personal Data”), in compliance with the current domestic legislation governing the protection of personal data (“Domestic Data Protection Laws”) and Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data ("GDPR").

1.2 Data Protection Officer. The DPO appointed for all companies within the Italian group may be contacted at this address dpo@coesia.com. 

1.3 Amendments. Coesia reserves the right to amend and update the Privacy Policy to take account of any new laws and domestic or European regulations on the protection of personal data, as well as any amendments made to the instructions currently in force. The Privacy Policy will be published on the Website, indicating the month of publication. Each new version of the Privacy Policy published on the Website will replace the previous version. Unless specified otherwise, the new version will be valid and effective from the date of publication. 

2. Data Subjects and scope of application

2.1 Data Subjects. The processing carried out by the Company in the context of the Website relates to all persons visiting the Website (“Visitors”). They are also known as Data Subjects, as defined in the Domestic Data Protection Laws and the GDPR.

2.2 Scope of application. This Privacy Policy applies to all Visitors, on the understanding that Coesia is responsible for the processing of Personal Data solely in the context of its own powers, duties and responsibilities. This Privacy Policy cannot be deemed valid and effective in relation to any processing carried out by third parties whose websites are reachable from this Website. In fact, this Website may well contain hyperlinks to other websites that are neither administered by nor otherwise associated with Coesia. Data Subjects are invited to read the privacy policies of the third-party websites reachable from this Website, in order to find out the methods used them to gather and process personal data.

3. Categories of Personal Data processed

3.1 Identification data. Coesia processes the ordinary Personal Data of visitors, including: 

a. Browsing data, acquired automatically on connection with the Website, including the IP addresses and domain names of the computers used by each visitor, the URI (Uniform Resource Identifier) addresses of the resources, the time of the request, the method used to query the server, the size of the file requested, the status code of the server (good, error etc.), and other parameters relating to the operating system and IT environment of each visitor. For more information about the use made of this data via cookies and other tracking tools, please read the Cookie Policy published on the Website;

b. Personal Data provided voluntarily, even during the pre-contractual and contractual phases, by Data Subjects who contact the Company, e.g. name and surname (including the name and surname of the legal representative of the company/body for which the Data Subjects work), business function, tax code and VAT number, location/domicile (including for tax purposes), contact details (mobile and land-line numbers, fax numbers and/or other identification numbers), postal and e-mail addresses (including business addresses, the e-mail addresses of employees/collaborators of the Data Subjects and, if required, certified e-mail addresses), postal codes, bank account details and/or payment details, etc. Specifically with regard to any Personal Data gathered by the Company from on-line forms available on the Website, please read the privacy policies presented at the foot of each form.

3.2 Special Data. Use of the Website does not require the provision of Special Data (being Personal Data that reveals racial or ethnic origin, political opinions, religious or philosophical convictions, or trade union membership, as well as genetic data, biometric data capable of unambiguously identifying a natural person, data relating to the health, sex life or sexual orientation of a natural person); accordingly, Data Subjects are in all cases requested not to provide and/or make Special Data available to the Company. Unless agreed otherwise in writing, any Special Data inadvertently provided by Data Subjects will be erased and/or removed or, in any case, anonymised by the Controller.

4. Purposes and legal basis for the processing of Personal Data Data retention period

4.1 Optional provision of Personal Data. Without prejudice to the above, the provision of Personal Data is entirely optional and free of charge. However, failure to provide Personal Data may make it impossible for the Company to execute or satisfy requests made by visitors to the Website.

5. Recipients of Personal Data

5.1 Authorised Persons. Employees and collaborators (regardless of their contractual relationship) of the Company may process Personal Data as Authorised Persons pursuant to the Domestic Data Protection Laws and art. 29 GDPR. Authorised Persons are duly appointed, trained and allowed to process Personal Data in the context of their specific work and assigned duties.

5.2 Processors. In the context of browsing this Website, Personal Data may be drawn to the attention of the following parties, designated as Processors pursuant to art. 28 GDPR:

• providers of e-mail and cloud storage services;

• providers of servers that host the Website;

• providers of system maintenance and Website development services;

• Coesia Group companies responsible for cyber security.

Data Subjects may e-mail the Controller for a full list of all Processors.

5.3 Independent controllers. Personal Data may be communicated to registered professionals, if necessary in order to exercise or defend a right (art. 6(1.f) GDPR), as well as to supervisory bodies, the judiciary, the police, public bodies and any other parties to which such communications must be made by law (art. 6(1.c) GDPR). The above parties will process this data in their capacity as independent controllers.

5.4. Transfer of Personal Data outside of the EEA. Personal Data is not transferred outside of the European Union. However, should this becomes necessary, it is understood that Coesia may transfer your Personal Data outside of the EEA, with the firm assurance that such transfers will comply with the applicable legal requirements: 
- in the event of international transfers of Personal Data from the European Economic Area (EEA) to a non-EEA country, the transfer may take place if the European Commission has recognised that the non-EEA country provides adequate data protection guarantees: in such cases, your Personal Data may be transferred on this basis;
- for transfers to non-EEA countries whose level of protection has not been recognised as adequate by the European Commission, we may rely on an exception applicable in the specific situation and, therefore, sign - if and to the extent necessary - specific agreements that guarantee the adequate protection of your Personal Data or, in any case, adopt the standard contractual clauses stipulated by the European Commission for the transfer of Personal Data outside of the EU.

6. Rights of Data Subjects

6.1 Rights. Data Subjects may contact the Controller directly to exercise their rights pursuant to the Domestic Data Protection Laws and the GDPR (art. 15 et seq.) and, in particular, to access their Personal Data, to update, rectify or erase it, to restrict its processing and object to any such processing that may based on a legitimate interest, and to obtain the portability of their Personal Data by sending an e-mail to privacy@coesia.com. 

6.2 Complaints. Without prejudice to the above, Data Subjects may lodge a complaint with a competent supervisory authority pursuant to art. 77(1) GDPR, this being the “Garante” in Italy (Italian Data Protection Authority). Complaints can also be lodged with a non-Italian supervisory authority, if that authority is responsible for the EU State in which the Data Subject habitually resides or works, or for the location where the alleged infringement took place.

Version: August 2026