PRIVACY POLICY - WEBSITE

Information notice pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR)

WHY THIS INFORMATION?

Pursuant to Regulation (EU) 2016/679 (hereinafter, the "GDPR"), this page describes how personal data are processed. This notice is provided pursuant to Articles 13 and 14 of the GDPR. This notice does not apply to any third-party websites that may be accessed through links on this website, for which no responsibility is assumed.

PERSONAL DATA THAT MAY BE PROCESSED

  1. *Browsing data* The computer systems and software procedures used to operate this website acquire, during their normal operation, certain personal data whose transmission is implicit in the use of Internet communication protocols. This category includes the IP addresses or domain names of the computers and devices used by users, the URI/URL addresses of the requested resources, the time of the request, the method used to submit the request to the server, the size of the file obtained in response, the numerical code indicating the status of the response, such as success or error, and other parameters relating to the user's operating system and IT environment.
  2. *Data provided by the user* The optional, explicit and voluntary sending of messages to the Data Controller's contact addresses, private messages sent by users to institutional social media profiles or pages, and the completion and submission of forms available on the Data Controller's websites, entail the acquisition of the sender's contact details necessary to respond, as well as all personal data included in the communications.
  3. Personal data
    Any information relating to an identified or identifiable natural person (the data subject); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, identification number, location data, online identifier or one or more factors specific to their physical, physiological, genetic, mental, economic, cultural or social identity (Recitals 26, 27 and 30 GDPR).
  4. Data relating to contractors/users.

COOKIES AND OTHER TRACKING SYSTEMS. WHAT ARE THEY? WHAT ARE THEY USED FOR?

COOKIES

Cookies are text files that websites visited by users send to their devices and that are transmitted back to the same websites on a subsequent visit. For cookies and other tracking systems, please refer to the cookie policy available in the website footer and at

the following link. For non-technical cookies and similar technologies, processing is based on consent to the processing of personal data pursuant to Article 6(1)(a) and Recitals 42 and 43 GDPR. Consent is given through the banner and the cookie policy in the website footer.

EMAIL PIXEL TRACKING

Tracking tools that collect information on users' behaviour and how they use services, especially online. Tracking pixels in email messages are images, often transparent and very small, equal to one pixel, which are not directly embedded in the email but hosted on remote servers. As a rule, whenever the recipient opens the email, whether for the first time or subsequently, HTML code included in the message automatically triggers a request to the sender's server. In response, the image is downloaded by the recipient's email client, such as dedicated software or a browser, and stored in the data subject's device memory to be displayed in the body of the email. To compare and possibly improve the results of automated communications, the Data Controller uses reporting systems (pixel tracking). Through pixel tracking, the Data Controller may know, for example, the number of readers, openings, unique clickers and clicks; the devices and operating systems used to read the communication; details of individual users' activity; and details of emails sent, delivered and undelivered, and forwarded emails. All such data are used to compare and possibly improve the results of communications. Processing is based on consent to the processing of personal data pursuant to Article 6(1)(a) and Recitals 42 and 43 GDPR.

Information on personal data processed through social media platforms

With regard to personal data processing carried out by the operators of the social media platforms used by the Data Controller, please refer to the information provided by them in their respective privacy policies. The Data Controller processes personal data provided by users through the dedicated social media platform pages to manage interactions with users, such as comments and public posts, in compliance with applicable law.

WHO IS THE DATA CONTROLLER? HOW CAN THEY BE CONTACTED?

The DATA CONTROLLER is BOFFI|DE PADOVA SPA, with registered office at Via Oberdan no. 70, 20823 Lentate sul Seveso (MB), Italy, represented by its legal representative pro tempore. The Data Controller's contact email address is privacy@boffi.com.

HAS A DATA PROTECTION OFFICER BEEN APPOINTED? WHAT ARE THE CONTACT DETAILS?

The DATA PROTECTION OFFICER (DPO - Data Protection Officer) has been appointed pursuant to Articles 37 to 39 of Regulation (EU) 2016/679. The DPO's contact email address is dpo.boffi@dpoprofessionalservice.it.

PURPOSES OF PROCESSING
Browsing this website and using web services. Data are also processed in order to:

  • obtain statistical information on the use of services, such as the most visited pages, the number of visitors by time slot or day, and geographical areas of origin;
  • monitor the proper operation of the services provided;
  • establish liability in the event of alleged cybercrimes against the website.

LEGAL BASIS

Processing is necessary for the purposes of the legitimate interests pursued by the Data Controller or by a third party, provided that such interests are not overridden by the interests or fundamental rights and freedoms of the data subject that require protection of personal data, taking into account the data subject's reasonable expectations and the activities strictly necessary for operation of the website and browsing (Article 6(1)(f) and Recital 47 GDPR).

DATA RETENTION PERIOD

Browsing data are retained for the duration of the browsing session and, in any event, do not persist for more than seven days (except where necessary for the investigation of offences by the judicial authority).

NATURE OF DATA PROVISION

Providing such data is necessary to browse this website.

In addition to browsing, personal data will be processed for:

A.1) CONTACTS

PURPOSE OF PROCESSING
Sending contact and information requests.

LEGAL BASIS

Processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the data subject's request prior to entering into a contract, pursuant to Article 6(1)(b) GDPR.

DATA RETENTION PERIOD

No more than two years from the time data are collected. At the end of the retention period, personal data will be anonymised.

NATURE OF DATA PROVISION

Provision is necessary. Failure to provide the necessary data will make it impossible to contact the user and provide information.

A.2) SOURCE OF DATA

For this purpose, data may be obtained from another source, for example EDILPORTALE.com S.p.A. through the Archiproducts website.

A.3) RESTRICTED AREA

PURPOSE OF PROCESSING

Registering and managing the account, including account verification and credential recovery, to access restricted areas of the website through authentication credentials and use account-related functions.

These functions include downloading project models. If the user downloads a project, they will be contacted for the pre-contractual purposes of the service.

LEGAL BASIS

Processing is necessary for the performance of a contract or service to which the data subject is party or in order to take steps at the data subject's request prior to entering into a contract, pursuant to Article 6(1)(b) and Recital 44 GDPR.

DATA RETENTION PERIOD

No more than twelve months from deactivation of the credentials, or until termination of the contract or service and for the technical time required to disable the credentials. At the end of the retention period, personal data will be anonymised.

NATURE OF DATA PROVISION

Provision is necessary. Failure to provide the data makes it impossible to register for or access the restricted area.

SOURCE OF DATA

For this purpose, data may be obtained from another source, for example EDILPORTALE.com S.p.A. through the Archiproducts website.

B) DIRECT MARKETING


PURPOSE OF PROCESSING

Sending advertising or direct sales material, carrying out market research, satisfaction surveys or commercial communications and newsletters through automated means, such as email including pixel tracking, social networks and sponsored content, and through traditional means, such as postal mail and telephone calls made by an operator.

LEGAL BASIS

Processing is based on consent to the processing of personal data pursuant to Article 6(1)(a) and Recitals 42 and 43 GDPR.

DATA RETENTION PERIOD

Until consent is withdrawn, or through opt-out from email communications only.

NATURE OF DATA PROVISION

Provision is optional. Failure to provide the necessary data will make it impossible to receive direct marketing communications.

C) NON-AUTOMATED PROFILING

PURPOSE OF PROCESSING

Personal data will be entered into databases or web platforms in order to carry out analyses and divide data subjects into homogeneous groups based on specific characteristics, applying assessments for better service management and to send targeted promotional communications.

LEGAL BASIS

Processing is based on consent to the processing of personal data pursuant to Article 6(1)(a) and Recitals 42 and 43 GDPR.

DATA RETENTION PERIOD

No more than twenty-four months from the time data are collected, unless consent is withdrawn. At the end of the retention period, personal data will be anonymised.

NATURE OF DATA PROVISION

Provision is optional. Failure to provide the necessary data will make it impossible to carry out analyses and send targeted communications.

D) DATA SUBJECT RIGHTS

PURPOSE OF PROCESSING

Handling data subject requests, pursuant to Articles 15 et seq. GDPR.

LEGAL BASIS

Processing is necessary for compliance with a legal obligation to which the Data Controller is subject following a request to exercise rights, pursuant to Article 6(1)(c) and Recital 45 GDPR.

DATA RETENTION PERIOD

Five years from closure of the request, unless litigation is ongoing.

NATURE OF DATA PROVISION

Provision of personal data is mandatory, as it is essential to comply with legal obligations.

WHO WILL RECEIVE PERSONAL DATA? DATA RECIPIENTS

Personal data will be disclosed to parties that process data as independent Data Controllers or Data Processors pursuant to Article 28 GDPR, and will be processed by natural persons pursuant to Article 29 GDPR who act under the authority of the Data Controller and the Data Processors on the basis of specific instructions regarding the purposes and methods of processing. Data will be disclosed to recipients belonging to the following categories:

  • Parties providing services for the website and communication networks, including email, hosting and website management;
  • Parties managing the IT system and telecommunications networks, including email, web platforms, cloud services and CRM;
  • social network platforms;
  • parties managing marketing activities, subject to consent;
  • competent authorities for compliance with legal obligations or provisions of public bodies, upon request.

The list of Data Processors pursuant to Article 28 GDPR is available by writing to privacy@boffi.com or to the other contacts indicated above.

WILL DATA BE TRANSFERRED TO NON-EEA COUNTRIES?

Personal data may be transferred to countries outside the EEA in order to pursue the purposes indicated above. In particular, for interactions on social networks, the transfer of personal data outside EEA countries will be managed as set out in the terms and conditions and privacy policies of the relevant social networks. Data will be transferred to entities participating in the Data Privacy Framework (DPF) Program or through the European Commission's Standard Contractual Clauses (SCCs). For information on the safeguards applicable to transfers of data outside the EEA, please write to privacy@boffi.com.

IS THERE ANY AUTOMATED DECISION-MAKING?

Personal data will be processed manually, electronically and through automated means. No fully automated decision-making processes are carried out. With regard to profiling activities, where carried out with the data subject's explicit consent as indicated among the purposes, these activities will be performed with the involvement of an operator who will develop the data subject's profile and analyse their habits and consumer choices in order to improve the Data Controller's commercial offering and services (non-automated profiling).

WHAT ARE YOUR RIGHTS? HOW CAN YOU EXERCISE THEM?

Data subjects may exercise their rights as set out in Articles 15 et seq. GDPR by contacting the DPO at dpo.boffi@dpoprofessionalservice.it or the Data Controller at privacy@boffi.com.

The Data Controller guarantees data subjects the right to request, at any time, access to their personal data (Article 15), rectification (Article 16), erasure (Article 17), and restriction of processing (Article 18). The Data Controller shall notify each recipient to whom personal data have been disclosed of any rectification, erasure or restriction of processing carried out (Article 19). The Data Controller shall inform data subjects, upon request, of such recipients. The Data Controller guarantees the right to data portability (Article 20) and, in the event of requests pursuant to Article 20, will provide the data in a structured, commonly used and machine-readable format. Data subjects have the right to object (Article 21), at any time, to processing based on the Data Controller's legitimate interest, by writing to dpo.boffi@dpoprofessionalservice.it with the subject line "objection". Data subjects have the right to withdraw consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal. To stop receiving automated direct marketing communications, including email, social networks and sponsored content, it is sufficient to write to dpo.boffi@dpoprofessionalservice.it with the subject line "unsubscribe from automated communications", or to use the automatic unsubscribe systems provided for email only (opt-out). To stop receiving traditional direct marketing communications, such as telephone calls made by an operator and postal mail, write to dpo.boffi@dpoprofessionalservice.it with the subject line "unsubscribe from traditional communications". To stop receiving all marketing communications, write to dpo.boffi@dpoprofessionalservice.it with the subject line "unsubscribe from marketing". To withdraw consent to non-automated profiling, write at any time to dpo.boffi@dpoprofessionalservice.it with the subject line "no profiling". Consent for pixel tracking is managed through the footer of email communications, in the preferences section. If data subjects believe that the processing of their personal data by the Data Controller infringes Regulation (EU) 2016/679, they may lodge a complaint with the national supervisory authority, in particular in the Member State of their habitual residence or place of work, or in the place where the alleged infringement occurred (Italian Data Protection Authority https://www.garanteprivacy.it/), or seek a judicial remedy.

CHANGES TO THIS NOTICE

The Data Controller may change, amend, add to or remove any part of this Privacy Notice. To facilitate the verification of any changes, the notice will indicate the date on which it was updated.

Last updated: 11 August 2026

BOFFI|DE PADOVA SPA